Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 11:17
Behavioral task
behavioral1
Sample
f283068a04b298b744d75b833d08fe90_NeikiAnalytics.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target f283068a04b298b744d75b833d08fe90_NeikiAnalytics.exe
- Size 456KB
- Sample240520-nd61baha76
- SHA256 386492e395bf4ad04b7d692694992cc22e1ca28d2ab869a7ebbf2d037252ac72
- MD5 f283068a04b298b744d75b833d08fe90
- SHA1 b5db3416cbe75cbcb97c05b66f80233a7c0f14d4
- SHA512 c17ccc46fc2860c90c0aed33722efd602728151f80c33c77f08229b7b3a848315ab14ef135159952835e1e05f29ff2ab00e6ff6fa8cfd506963e76f047728a6e
- SSDEEP 12288:04wFHoSyd0V3eFp3IDvSbh5nPYERM8mXzplo4Ms:rd0gFp3lz1/uzploU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1580-6-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2868-7-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2556-23-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3968-24-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1908-39-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1004-18-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3944-44-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3932-52-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1280-47-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/444-68-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1544-71-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4656-77-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4840-81-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1380-92-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3700-98-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2444-104-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/116-110-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3924-113-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1212-119-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4388-128-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1012-138-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2392-154-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3268-158-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3384-164-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/364-182-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4548-187-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3712-195-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2772-199-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3968-204-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3308-209-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4604-213-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/972-218-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1524-220-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2228-223-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1280-230-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1252-231-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5080-235-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1672-239-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4836-255-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4140-262-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1864-278-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4216-304-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2956-312-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4928-320-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3496-322-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4720-328-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/364-339-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2924-365-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/228-381-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/864-391-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3420-404-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4480-411-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/316-461-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/856-474-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1672-508-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/864-512-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3804-525-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4652-547-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2852-567-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/724-589-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2848-611-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2764-704-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4052-838-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/936-1204-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/1580-0-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000800000002343a-3.dat family_berbew behavioral2/memory/1580-6-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/2868-7-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0008000000023440-10.dat family_berbew behavioral2/files/0x0007000000023441-13.dat family_berbew behavioral2/memory/2556-23-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023443-21.dat family_berbew behavioral2/memory/3968-24-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023444-28.dat family_berbew behavioral2/files/0x0007000000023445-33.dat family_berbew behavioral2/files/0x0007000000023446-37.dat family_berbew behavioral2/memory/1908-39-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/1004-18-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023447-43.dat family_berbew behavioral2/memory/3944-44-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023448-49.dat family_berbew behavioral2/memory/3932-52-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023449-55.dat family_berbew behavioral2/memory/1280-47-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002344a-61.dat family_berbew behavioral2/memory/444-63-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002344b-66.dat family_berbew behavioral2/memory/444-68-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/1544-71-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002344c-74.dat family_berbew behavioral2/memory/4656-77-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000800000002343e-79.dat family_berbew behavioral2/memory/4840-81-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002344d-85.dat family_berbew behavioral2/files/0x000700000002344e-90.dat family_berbew behavioral2/memory/1380-92-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002344f-96.dat family_berbew behavioral2/memory/3700-98-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023450-105.dat family_berbew behavioral2/memory/2444-104-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/116-110-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023452-116.dat family_berbew behavioral2/memory/3924-113-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/1212-119-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023451-111.dat family_berbew behavioral2/files/0x0007000000023453-121.dat family_berbew behavioral2/files/0x0007000000023454-129.dat family_berbew behavioral2/memory/4388-128-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023455-132.dat family_berbew behavioral2/memory/1012-138-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023456-139.dat family_berbew behavioral2/files/0x0007000000023458-143.dat family_berbew behavioral2/files/0x0007000000023459-149.dat family_berbew behavioral2/files/0x000700000002345a-155.dat family_berbew behavioral2/memory/2392-154-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/3268-158-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002345b-161.dat family_berbew behavioral2/memory/3384-164-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002345c-168.dat family_berbew behavioral2/files/0x000700000002345d-172.dat family_berbew behavioral2/files/0x000700000002345e-177.dat family_berbew behavioral2/files/0x000700000002345f-181.dat family_berbew behavioral2/memory/364-182-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/4548-187-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/724-188-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/3712-195-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/2772-199-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/3968-200-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew - Executes dropped EXE 64 IoCs
pid Process 2868 bttnhh.exe 1004 jdddd.exe 2556 fxfrlfr.exe 3968 ttbtht.exe 3308 lrllflf.exe 1908 hhbthb.exe 3944 xlfxrlf.exe 1280 nbhbtn.exe 3932 9lrfrfr.exe 3256 lrllfrl.exe 444 rllxrff.exe 1544 pjdvj.exe 4656 ddvjv.exe 4840 thnnhh.exe 1380 dvvvp.exe 3700 dvvpj.exe 2444 rfflflf.exe 116 5nnnhn.exe 3924 9lrrxxl.exe 1212 ththhh.exe 4388 thtnht.exe 2564 fxfxxxx.exe 1012 3nbtnn.exe 4672 fxxfffx.exe 4808 9tbbhh.exe 2392 7ddpj.exe 3268 xxxrlfx.exe 3384 bnnnnn.exe 4120 jvdvj.exe 1104 5dvvv.exe 364 5lrllfx.exe 4548 9vpjj.exe 724 bnnnbb.exe 3712 ppvdv.exe 2772 rflxlfr.exe 3968 7tbtnn.exe 3308 dpvdv.exe 4604 rrxrllf.exe 972 7ntnnn.exe 1524 jdvpp.exe 2228 xrxrlll.exe 1280 bnhbnb.exe 1252 hbhbnn.exe 5080 pjpjj.exe 1672 lfflxll.exe 3052 hnnbbb.exe 2308 jddvv.exe 2332 xxfllxx.exe 3756 xfrrxfr.exe 4836 1thhbb.exe 4140 jdvjv.exe 2784 xlllrfr.exe 3180 nhnhtt.exe 232 hntnnh.exe 4780 pjppj.exe 1864 ffxlrlf.exe 3488 ttbtth.exe 1928 9bbtnn.exe 1212 ddvvp.exe 1352 lrfxxxr.exe 3872 thhbbb.exe 2468 nhnhbt.exe 4076 jpjjj.exe 4216 xrffxff.exe -
resource yara_rule behavioral2/memory/1580-0-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000800000002343a-3.dat upx behavioral2/memory/1580-6-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2868-7-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0008000000023440-10.dat upx behavioral2/files/0x0007000000023441-13.dat upx behavioral2/memory/2556-23-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023443-21.dat upx behavioral2/memory/3968-24-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023444-28.dat upx behavioral2/files/0x0007000000023445-33.dat upx behavioral2/files/0x0007000000023446-37.dat upx behavioral2/memory/1908-39-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1004-18-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023447-43.dat upx behavioral2/memory/3944-44-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023448-49.dat upx behavioral2/memory/3932-52-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023449-55.dat upx behavioral2/memory/1280-47-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002344a-61.dat upx behavioral2/memory/444-63-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002344b-66.dat upx behavioral2/memory/444-68-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1544-71-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002344c-74.dat upx behavioral2/memory/4656-77-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000800000002343e-79.dat upx behavioral2/memory/4840-81-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002344d-85.dat upx behavioral2/files/0x000700000002344e-90.dat upx behavioral2/memory/1380-92-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002344f-96.dat upx behavioral2/memory/3700-98-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023450-105.dat upx behavioral2/memory/2444-104-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/116-110-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023452-116.dat upx behavioral2/memory/3924-113-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1212-119-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023451-111.dat upx behavioral2/files/0x0007000000023453-121.dat upx behavioral2/files/0x0007000000023454-129.dat upx behavioral2/memory/4388-128-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023455-132.dat upx behavioral2/memory/1012-138-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023456-139.dat upx behavioral2/files/0x0007000000023458-143.dat upx behavioral2/files/0x0007000000023459-149.dat upx behavioral2/files/0x000700000002345a-155.dat upx behavioral2/memory/2392-154-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3268-158-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002345b-161.dat upx behavioral2/memory/3384-164-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002345c-168.dat upx behavioral2/files/0x000700000002345d-172.dat upx behavioral2/files/0x000700000002345e-177.dat upx behavioral2/files/0x000700000002345f-181.dat upx behavioral2/memory/364-182-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4548-187-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/724-188-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3712-195-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2772-199-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3968-200-0x0000000000400000-0x0000000000438000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2868 1580 f283068a04b298b744d75b833d08fe90_NeikiAnalytics.exe 85 PID 1580 wrote to memory of 2868 1580 f283068a04b298b744d75b833d08fe90_NeikiAnalytics.exe 85 PID 1580 wrote to memory of 2868 1580 f283068a04b298b744d75b833d08fe90_NeikiAnalytics.exe 85 PID 2868 wrote to memory of 1004 2868 bttnhh.exe 86 PID 2868 wrote to memory of 1004 2868 bttnhh.exe 86 PID 2868 wrote to memory of 1004 2868 bttnhh.exe 86 PID 1004 wrote to memory of 2556 1004 jdddd.exe 87 PID 1004 wrote to memory of 2556 1004 jdddd.exe 87 PID 1004 wrote to memory of 2556 1004 jdddd.exe 87 PID 2556 wrote to memory of 3968 2556 fxfrlfr.exe 88 PID 2556 wrote to memory of 3968 2556 fxfrlfr.exe 88 PID 2556 wrote to memory of 3968 2556 fxfrlfr.exe 88 PID 3968 wrote to memory of 3308 3968 ttbtht.exe 91 PID 3968 wrote to memory of 3308 3968 ttbtht.exe 91 PID 3968 wrote to memory of 3308 3968 ttbtht.exe 91 PID 3308 wrote to memory of 1908 3308 lrllflf.exe 92 PID 3308 wrote to memory of 1908 3308 lrllflf.exe 92 PID 3308 wrote to memory of 1908 3308 lrllflf.exe 92 PID 1908 wrote to memory of 3944 1908 hhbthb.exe 93 PID 1908 wrote to memory of 3944 1908 hhbthb.exe 93 PID 1908 wrote to memory of 3944 1908 hhbthb.exe 93 PID 3944 wrote to memory of 1280 3944 xlfxrlf.exe 94 PID 3944 wrote to memory of 1280 3944 xlfxrlf.exe 94 PID 3944 wrote to memory of 1280 3944 xlfxrlf.exe 94 PID 1280 wrote to memory of 3932 1280 nbhbtn.exe 95 PID 1280 wrote to memory of 3932 1280 nbhbtn.exe 95 PID 1280 wrote to memory of 3932 1280 nbhbtn.exe 95 PID 3932 wrote to memory of 3256 3932 9lrfrfr.exe 96 PID 3932 wrote to memory of 3256 3932 9lrfrfr.exe 96 PID 3932 wrote to memory of 3256 3932 9lrfrfr.exe 96 PID 3256 wrote to memory of 444 3256 lrllfrl.exe 97 PID 3256 wrote to memory of 444 3256 lrllfrl.exe 97 PID 3256 wrote to memory of 444 3256 lrllfrl.exe 97 PID 444 wrote to memory of 1544 444 rllxrff.exe 98 PID 444 wrote to memory of 1544 444 rllxrff.exe 98 PID 444 wrote to memory of 1544 444 rllxrff.exe 98 PID 1544 wrote to memory of 4656 1544 pjdvj.exe 99 PID 1544 wrote to memory of 4656 1544 pjdvj.exe 99 PID 1544 wrote to memory of 4656 1544 pjdvj.exe 99 PID 4656 wrote to memory of 4840 4656 ddvjv.exe 100 PID 4656 wrote to memory of 4840 4656 ddvjv.exe 100 PID 4656 wrote to memory of 4840 4656 ddvjv.exe 100 PID 4840 wrote to memory of 1380 4840 thnnhh.exe 101 PID 4840 wrote to memory of 1380 4840 thnnhh.exe 101 PID 4840 wrote to memory of 1380 4840 thnnhh.exe 101 PID 1380 wrote to memory of 3700 1380 dvvvp.exe 102 PID 1380 wrote to memory of 3700 1380 dvvvp.exe 102 PID 1380 wrote to memory of 3700 1380 dvvvp.exe 102 PID 3700 wrote to memory of 2444 3700 dvvpj.exe 103 PID 3700 wrote to memory of 2444 3700 dvvpj.exe 103 PID 3700 wrote to memory of 2444 3700 dvvpj.exe 103 PID 2444 wrote to memory of 116 2444 rfflflf.exe 104 PID 2444 wrote to memory of 116 2444 rfflflf.exe 104 PID 2444 wrote to memory of 116 2444 rfflflf.exe 104 PID 116 wrote to memory of 3924 116 5nnnhn.exe 105 PID 116 wrote to memory of 3924 116 5nnnhn.exe 105 PID 116 wrote to memory of 3924 116 5nnnhn.exe 105 PID 3924 wrote to memory of 1212 3924 9lrrxxl.exe 107 PID 3924 wrote to memory of 1212 3924 9lrrxxl.exe 107 PID 3924 wrote to memory of 1212 3924 9lrrxxl.exe 107 PID 1212 wrote to memory of 4388 1212 ththhh.exe 108 PID 1212 wrote to memory of 4388 1212 ththhh.exe 108 PID 1212 wrote to memory of 4388 1212 ththhh.exe 108 PID 4388 wrote to memory of 2564 4388 thtnht.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\f283068a04b298b744d75b833d08fe90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f283068a04b298b744d75b833d08fe90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\bttnhh.exec:\bttnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\jdddd.exec:\jdddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\fxfrlfr.exec:\fxfrlfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\ttbtht.exec:\ttbtht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\lrllflf.exec:\lrllflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\hhbthb.exec:\hhbthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\nbhbtn.exec:\nbhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\9lrfrfr.exec:\9lrfrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\lrllfrl.exec:\lrllfrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\rllxrff.exec:\rllxrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\pjdvj.exec:\pjdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\ddvjv.exec:\ddvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\thnnhh.exec:\thnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\dvvvp.exec:\dvvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\dvvpj.exec:\dvvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\rfflflf.exec:\rfflflf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\5nnnhn.exec:\5nnnhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\9lrrxxl.exec:\9lrrxxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\ththhh.exec:\ththhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\thtnht.exec:\thtnht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe23⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3nbtnn.exec:\3nbtnn.exe24⤵
- Executes dropped EXE
PID:1012 -
\??\c:\fxxfffx.exec:\fxxfffx.exe25⤵
- Executes dropped EXE
PID:4672 -
\??\c:\9tbbhh.exec:\9tbbhh.exe26⤵
- Executes dropped EXE
PID:4808 -
\??\c:\7ddpj.exec:\7ddpj.exe27⤵
- Executes dropped EXE
PID:2392 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe28⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bnnnnn.exec:\bnnnnn.exe29⤵
- Executes dropped EXE
PID:3384 -
\??\c:\jvdvj.exec:\jvdvj.exe30⤵
- Executes dropped EXE
PID:4120 -
\??\c:\5dvvv.exec:\5dvvv.exe31⤵
- Executes dropped EXE
PID:1104 -
\??\c:\5lrllfx.exec:\5lrllfx.exe32⤵
- Executes dropped EXE
PID:364 -
\??\c:\9vpjj.exec:\9vpjj.exe33⤵
- Executes dropped EXE
PID:4548 -
\??\c:\bnnnbb.exec:\bnnnbb.exe34⤵
- Executes dropped EXE
PID:724 -
\??\c:\ppvdv.exec:\ppvdv.exe35⤵
- Executes dropped EXE
PID:3712 -
\??\c:\rflxlfr.exec:\rflxlfr.exe36⤵
- Executes dropped EXE
PID:2772 -
\??\c:\7tbtnn.exec:\7tbtnn.exe37⤵
- Executes dropped EXE
PID:3968 -
\??\c:\dpvdv.exec:\dpvdv.exe38⤵
- Executes dropped EXE
PID:3308 -
\??\c:\rrxrllf.exec:\rrxrllf.exe39⤵
- Executes dropped EXE
PID:4604 -
\??\c:\7ntnnn.exec:\7ntnnn.exe40⤵
- Executes dropped EXE
PID:972 -
\??\c:\jdvpp.exec:\jdvpp.exe41⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xrxrlll.exec:\xrxrlll.exe42⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bnhbnb.exec:\bnhbnb.exe43⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hbhbnn.exec:\hbhbnn.exe44⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pjpjj.exec:\pjpjj.exe45⤵
- Executes dropped EXE
PID:5080 -
\??\c:\lfflxll.exec:\lfflxll.exe46⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hnnbbb.exec:\hnnbbb.exe47⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jddvv.exec:\jddvv.exe48⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xxfllxx.exec:\xxfllxx.exe49⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xfrrxfr.exec:\xfrrxfr.exe50⤵
- Executes dropped EXE
PID:3756 -
\??\c:\1thhbb.exec:\1thhbb.exe51⤵
- Executes dropped EXE
PID:4836 -
\??\c:\jdvjv.exec:\jdvjv.exe52⤵
- Executes dropped EXE
PID:4140 -
\??\c:\xlllrfr.exec:\xlllrfr.exe53⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nhnhtt.exec:\nhnhtt.exe54⤵
- Executes dropped EXE
PID:3180 -
\??\c:\hntnnh.exec:\hntnnh.exe55⤵
- Executes dropped EXE
PID:232 -
\??\c:\pjppj.exec:\pjppj.exe56⤵
- Executes dropped EXE
PID:4780 -
\??\c:\ffxlrlf.exec:\ffxlrlf.exe57⤵
- Executes dropped EXE
PID:1864 -
\??\c:\ttbtth.exec:\ttbtth.exe58⤵
- Executes dropped EXE
PID:3488 -
\??\c:\9bbtnn.exec:\9bbtnn.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ddvvp.exec:\ddvvp.exe60⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lrfxxxr.exec:\lrfxxxr.exe61⤵
- Executes dropped EXE
PID:1352 -
\??\c:\thhbbb.exec:\thhbbb.exe62⤵
- Executes dropped EXE
PID:3872 -
\??\c:\nhnhbt.exec:\nhnhbt.exe63⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jpjjj.exec:\jpjjj.exe64⤵
- Executes dropped EXE
PID:4076 -
\??\c:\xrffxff.exec:\xrffxff.exe65⤵
- Executes dropped EXE
PID:4216 -
\??\c:\frxrllr.exec:\frxrllr.exe66⤵PID:2392
-
\??\c:\thbntn.exec:\thbntn.exe67⤵PID:4348
-
\??\c:\jdpjj.exec:\jdpjj.exe68⤵PID:2956
-
\??\c:\dvvpp.exec:\dvvpp.exe69⤵PID:4928
-
\??\c:\rfxrfxl.exec:\rfxrfxl.exe70⤵PID:3496
-
\??\c:\dddpv.exec:\dddpv.exe71⤵PID:4720
-
\??\c:\flfxrfx.exec:\flfxrfx.exe72⤵PID:4848
-
\??\c:\5fllxxl.exec:\5fllxxl.exe73⤵PID:4404
-
\??\c:\bhhnbt.exec:\bhhnbt.exe74⤵PID:364
-
\??\c:\dpjvp.exec:\dpjvp.exe75⤵PID:3164
-
\??\c:\3rrfrfr.exec:\3rrfrfr.exe76⤵PID:4320
-
\??\c:\hbhbhb.exec:\hbhbhb.exe77⤵PID:3564
-
\??\c:\1jjjd.exec:\1jjjd.exe78⤵PID:4956
-
\??\c:\dpjvj.exec:\dpjvj.exe79⤵PID:3556
-
\??\c:\rxlrxlx.exec:\rxlrxlx.exe80⤵PID:2256
-
\??\c:\bbnnnt.exec:\bbnnnt.exe81⤵PID:3308
-
\??\c:\3djvv.exec:\3djvv.exe82⤵PID:4184
-
\??\c:\jjppp.exec:\jjppp.exe83⤵PID:2924
-
\??\c:\1xxrffx.exec:\1xxrffx.exe84⤵PID:3944
-
\??\c:\bntbnh.exec:\bntbnh.exe85⤵PID:2228
-
\??\c:\htbnnh.exec:\htbnnh.exe86⤵PID:1280
-
\??\c:\jdvpp.exec:\jdvpp.exe87⤵PID:3256
-
\??\c:\rlrrlll.exec:\rlrrlll.exe88⤵PID:228
-
\??\c:\9bnthb.exec:\9bnthb.exe89⤵PID:384
-
\??\c:\pvjvj.exec:\pvjvj.exe90⤵PID:864
-
\??\c:\pjvdp.exec:\pjvdp.exe91⤵PID:1716
-
\??\c:\7xfrlll.exec:\7xfrlll.exe92⤵PID:1516
-
\??\c:\tbbnhb.exec:\tbbnhb.exe93⤵PID:4460
-
\??\c:\9nnhht.exec:\9nnhht.exe94⤵PID:3420
-
\??\c:\jjvdj.exec:\jjvdj.exe95⤵PID:2444
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe96⤵PID:116
-
\??\c:\ttntnt.exec:\ttntnt.exe97⤵PID:4480
-
\??\c:\3nnbnn.exec:\3nnbnn.exe98⤵PID:784
-
\??\c:\1jvpv.exec:\1jvpv.exe99⤵PID:1352
-
\??\c:\xlrlffx.exec:\xlrlffx.exe100⤵PID:5028
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe101⤵PID:2676
-
\??\c:\hbhbbt.exec:\hbhbbt.exe102⤵PID:3248
-
\??\c:\dvdpv.exec:\dvdpv.exe103⤵PID:5056
-
\??\c:\flxfxlr.exec:\flxfxlr.exe104⤵PID:1904
-
\??\c:\tnhtnn.exec:\tnhtnn.exe105⤵PID:4744
-
\??\c:\dvjdp.exec:\dvjdp.exe106⤵PID:3780
-
\??\c:\fxllrrx.exec:\fxllrrx.exe107⤵PID:4088
-
\??\c:\lllfrlf.exec:\lllfrlf.exe108⤵PID:2788
-
\??\c:\hhnbtn.exec:\hhnbtn.exe109⤵PID:4784
-
\??\c:\djdjj.exec:\djdjj.exe110⤵PID:3876
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe111⤵PID:4772
-
\??\c:\lflxlfx.exec:\lflxlfx.exe112⤵PID:316
-
\??\c:\tbnhnh.exec:\tbnhnh.exe113⤵PID:4488
-
\??\c:\ddpjv.exec:\ddpjv.exe114⤵PID:4000
-
\??\c:\llrflxl.exec:\llrflxl.exe115⤵PID:2556
-
\??\c:\frxrlfx.exec:\frxrlfx.exe116⤵PID:1500
-
\??\c:\9hthhb.exec:\9hthhb.exe117⤵PID:856
-
\??\c:\pvvjd.exec:\pvvjd.exe118⤵PID:3968
-
\??\c:\xxrfxxr.exec:\xxrfxxr.exe119⤵PID:2068
-
\??\c:\lxxlfrf.exec:\lxxlfrf.exe120⤵PID:2848
-
\??\c:\bhhhtn.exec:\bhhhtn.exe121⤵PID:972
-
\??\c:\jjpdj.exec:\jjpdj.exe122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-