Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 11:55
Behavioral task
behavioral1
Sample
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe
-
Size
352KB
-
MD5
1382b1da38a9b96dbf4de51472b03f50
-
SHA1
840c3e04324f408acc54ef5ebea0c4ab3ebd161d
-
SHA256
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6
-
SHA512
854d6a0e41723980dfd0255a5a5b1a6bd555c50fe7471651d00181f8bdbff656721eae772693398428999fb29a78c89b30e672d84612a9769d2f48af5e565b09
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF23e:h4wFHoSgWj168w1VjsyvhNFF2u
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4484-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/804-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3416-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1620-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/680-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-619-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\vpvdd.exe family_berbew C:\xxrlffx.exe family_berbew \??\c:\3rxrxxx.exe family_berbew \??\c:\3bbbtt.exe family_berbew \??\c:\pjvpp.exe family_berbew \??\c:\5ffxrll.exe family_berbew \??\c:\xxlfxxr.exe family_berbew \??\c:\5nttnn.exe family_berbew \??\c:\7vjdp.exe family_berbew \??\c:\lxfxfxf.exe family_berbew \??\c:\pvdvp.exe family_berbew \??\c:\fffxxrl.exe family_berbew \??\c:\nbnbnh.exe family_berbew \??\c:\hntnnn.exe family_berbew \??\c:\lxlfxrr.exe family_berbew \??\c:\flxxxff.exe family_berbew \??\c:\pjjdd.exe family_berbew \??\c:\hnttnn.exe family_berbew \??\c:\bbbttn.exe family_berbew \??\c:\9rxxrrr.exe family_berbew \??\c:\jdjdv.exe family_berbew \??\c:\nbhhbb.exe family_berbew \??\c:\xrrlfxr.exe family_berbew \??\c:\pjvjd.exe family_berbew \??\c:\lllfllf.exe family_berbew \??\c:\rfllffl.exe family_berbew \??\c:\7dpjj.exe family_berbew \??\c:\3jpjd.exe family_berbew \??\c:\bnhbtt.exe family_berbew \??\c:\ttntth.exe family_berbew \??\c:\bbhhnn.exe family_berbew \??\c:\dpdvv.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
vpvdd.exedpdvv.exexxrlffx.exe3rxrxxx.exebbhhnn.exe3bbbtt.exepjvpp.exe5ffxrll.exexxlfxxr.exettntth.exebnhbtt.exe3jpjd.exe7dpjj.exerfllffl.exelllfllf.exe5nttnn.exepjvjd.exe7vjdp.exexrrlfxr.exelxfxfxf.exenbhhbb.exepvdvp.exejdjdv.exe9rxxrrr.exefffxxrl.exebbbttn.exehnttnn.exepjjdd.exeflxxxff.exelxlfxrr.exehntnnn.exenbnbnh.exevdddd.exe1djjv.exefrxffxx.exelxflffx.exe1bhbbt.exethbbtb.exevpdvv.exelffxxrl.exerlxrrrl.exebnttnn.exehhttbb.exedvpjd.exe7pdvp.exexrrlfff.exe7ffxllf.exe7bnbnn.exebnttnn.exe1vpjd.exerlrrllf.exexlrlfff.exe9bhbbb.exethhbbt.exe5jpjd.exedjvvd.exerflllll.exerrxxxxx.exe3bhhhn.exejddvv.exejddvv.exedddpj.exerrfxxrr.exe7tbbtt.exepid process 4484 vpvdd.exe 4816 dpdvv.exe 4292 xxrlffx.exe 1620 3rxrxxx.exe 3416 bbhhnn.exe 2592 3bbbtt.exe 1920 pjvpp.exe 3432 5ffxrll.exe 2784 xxlfxxr.exe 4428 ttntth.exe 560 bnhbtt.exe 804 3jpjd.exe 2068 7dpjj.exe 1576 rfllffl.exe 4892 lllfllf.exe 1596 5nttnn.exe 1516 pjvjd.exe 1656 7vjdp.exe 4812 xrrlfxr.exe 3596 lxfxfxf.exe 4876 nbhhbb.exe 3696 pvdvp.exe 3484 jdjdv.exe 4660 9rxxrrr.exe 5104 fffxxrl.exe 880 bbbttn.exe 4968 hnttnn.exe 2460 pjjdd.exe 3884 flxxxff.exe 4124 lxlfxrr.exe 4656 hntnnn.exe 2600 nbnbnh.exe 4900 vdddd.exe 3700 1djjv.exe 4032 frxffxx.exe 2376 lxflffx.exe 3152 1bhbbt.exe 404 thbbtb.exe 4844 vpdvv.exe 612 lffxxrl.exe 4676 rlxrrrl.exe 3572 bnttnn.exe 3776 hhttbb.exe 1056 dvpjd.exe 2740 7pdvp.exe 1892 xrrlfff.exe 3920 7ffxllf.exe 4860 7bnbnn.exe 1908 bnttnn.exe 5000 1vpjd.exe 1592 rlrrllf.exe 220 xlrlfff.exe 1976 9bhbbb.exe 5036 thhbbt.exe 4388 5jpjd.exe 4352 djvvd.exe 1956 rflllll.exe 8 rrxxxxx.exe 5076 3bhhhn.exe 4424 jddvv.exe 1192 jddvv.exe 3232 dddpj.exe 4624 rrfxxrr.exe 944 7tbbtt.exe -
Processes:
resource yara_rule behavioral2/memory/1912-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvdd.exe upx behavioral2/memory/4484-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1912-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrlffx.exe upx \??\c:\3rxrxxx.exe upx \??\c:\3bbbtt.exe upx \??\c:\pjvpp.exe upx \??\c:\5ffxrll.exe upx \??\c:\xxlfxxr.exe upx behavioral2/memory/4428-56-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5nttnn.exe upx \??\c:\7vjdp.exe upx \??\c:\lxfxfxf.exe upx \??\c:\pvdvp.exe upx \??\c:\fffxxrl.exe upx behavioral2/memory/5000-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1192-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4624-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4424-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/8-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1976-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4860-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3152-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4032-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3700-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4900-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4656-158-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbnbnh.exe upx behavioral2/memory/4124-153-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hntnnn.exe upx \??\c:\lxlfxrr.exe upx behavioral2/memory/2460-144-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\flxxxff.exe upx behavioral2/memory/4968-139-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjjdd.exe upx behavioral2/memory/880-134-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hnttnn.exe upx behavioral2/memory/5104-129-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bbbttn.exe upx behavioral2/memory/3484-119-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9rxxrrr.exe upx behavioral2/memory/3696-115-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdjdv.exe upx behavioral2/memory/3596-106-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nbhhbb.exe upx behavioral2/memory/1656-96-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xrrlfxr.exe upx behavioral2/memory/1516-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1596-87-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjvjd.exe upx behavioral2/memory/4892-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1576-77-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lllfllf.exe upx behavioral2/memory/2068-71-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfllffl.exe upx behavioral2/memory/804-67-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7dpjj.exe upx behavioral2/memory/560-62-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3jpjd.exe upx behavioral2/memory/2784-54-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bnhbtt.exe upx \??\c:\ttntth.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exevpvdd.exedpdvv.exexxrlffx.exe3rxrxxx.exebbhhnn.exe3bbbtt.exepjvpp.exe5ffxrll.exexxlfxxr.exettntth.exebnhbtt.exe3jpjd.exe7dpjj.exerfllffl.exelllfllf.exe5nttnn.exepjvjd.exe7vjdp.exexrrlfxr.exelxfxfxf.exenbhhbb.exedescription pid process target process PID 1912 wrote to memory of 4484 1912 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe vpvdd.exe PID 1912 wrote to memory of 4484 1912 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe vpvdd.exe PID 1912 wrote to memory of 4484 1912 44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe vpvdd.exe PID 4484 wrote to memory of 4816 4484 vpvdd.exe dpdvv.exe PID 4484 wrote to memory of 4816 4484 vpvdd.exe dpdvv.exe PID 4484 wrote to memory of 4816 4484 vpvdd.exe dpdvv.exe PID 4816 wrote to memory of 4292 4816 dpdvv.exe xxrlffx.exe PID 4816 wrote to memory of 4292 4816 dpdvv.exe xxrlffx.exe PID 4816 wrote to memory of 4292 4816 dpdvv.exe xxrlffx.exe PID 4292 wrote to memory of 1620 4292 xxrlffx.exe 3rxrxxx.exe PID 4292 wrote to memory of 1620 4292 xxrlffx.exe 3rxrxxx.exe PID 4292 wrote to memory of 1620 4292 xxrlffx.exe 3rxrxxx.exe PID 1620 wrote to memory of 3416 1620 3rxrxxx.exe bbhhnn.exe PID 1620 wrote to memory of 3416 1620 3rxrxxx.exe bbhhnn.exe PID 1620 wrote to memory of 3416 1620 3rxrxxx.exe bbhhnn.exe PID 3416 wrote to memory of 2592 3416 bbhhnn.exe 3bbbtt.exe PID 3416 wrote to memory of 2592 3416 bbhhnn.exe 3bbbtt.exe PID 3416 wrote to memory of 2592 3416 bbhhnn.exe 3bbbtt.exe PID 2592 wrote to memory of 1920 2592 3bbbtt.exe pjvpp.exe PID 2592 wrote to memory of 1920 2592 3bbbtt.exe pjvpp.exe PID 2592 wrote to memory of 1920 2592 3bbbtt.exe pjvpp.exe PID 1920 wrote to memory of 3432 1920 pjvpp.exe 5ffxrll.exe PID 1920 wrote to memory of 3432 1920 pjvpp.exe 5ffxrll.exe PID 1920 wrote to memory of 3432 1920 pjvpp.exe 5ffxrll.exe PID 3432 wrote to memory of 2784 3432 5ffxrll.exe xxlfxxr.exe PID 3432 wrote to memory of 2784 3432 5ffxrll.exe xxlfxxr.exe PID 3432 wrote to memory of 2784 3432 5ffxrll.exe xxlfxxr.exe PID 2784 wrote to memory of 4428 2784 xxlfxxr.exe ttntth.exe PID 2784 wrote to memory of 4428 2784 xxlfxxr.exe ttntth.exe PID 2784 wrote to memory of 4428 2784 xxlfxxr.exe ttntth.exe PID 4428 wrote to memory of 560 4428 ttntth.exe bnhbtt.exe PID 4428 wrote to memory of 560 4428 ttntth.exe bnhbtt.exe PID 4428 wrote to memory of 560 4428 ttntth.exe bnhbtt.exe PID 560 wrote to memory of 804 560 bnhbtt.exe 3jpjd.exe PID 560 wrote to memory of 804 560 bnhbtt.exe 3jpjd.exe PID 560 wrote to memory of 804 560 bnhbtt.exe 3jpjd.exe PID 804 wrote to memory of 2068 804 3jpjd.exe 7dpjj.exe PID 804 wrote to memory of 2068 804 3jpjd.exe 7dpjj.exe PID 804 wrote to memory of 2068 804 3jpjd.exe 7dpjj.exe PID 2068 wrote to memory of 1576 2068 7dpjj.exe rfllffl.exe PID 2068 wrote to memory of 1576 2068 7dpjj.exe rfllffl.exe PID 2068 wrote to memory of 1576 2068 7dpjj.exe rfllffl.exe PID 1576 wrote to memory of 4892 1576 rfllffl.exe lllfllf.exe PID 1576 wrote to memory of 4892 1576 rfllffl.exe lllfllf.exe PID 1576 wrote to memory of 4892 1576 rfllffl.exe lllfllf.exe PID 4892 wrote to memory of 1596 4892 lllfllf.exe 5nttnn.exe PID 4892 wrote to memory of 1596 4892 lllfllf.exe 5nttnn.exe PID 4892 wrote to memory of 1596 4892 lllfllf.exe 5nttnn.exe PID 1596 wrote to memory of 1516 1596 5nttnn.exe pjvjd.exe PID 1596 wrote to memory of 1516 1596 5nttnn.exe pjvjd.exe PID 1596 wrote to memory of 1516 1596 5nttnn.exe pjvjd.exe PID 1516 wrote to memory of 1656 1516 pjvjd.exe rrlxfxf.exe PID 1516 wrote to memory of 1656 1516 pjvjd.exe rrlxfxf.exe PID 1516 wrote to memory of 1656 1516 pjvjd.exe rrlxfxf.exe PID 1656 wrote to memory of 4812 1656 7vjdp.exe xrrlfxr.exe PID 1656 wrote to memory of 4812 1656 7vjdp.exe xrrlfxr.exe PID 1656 wrote to memory of 4812 1656 7vjdp.exe xrrlfxr.exe PID 4812 wrote to memory of 3596 4812 xrrlfxr.exe lxfxfxf.exe PID 4812 wrote to memory of 3596 4812 xrrlfxr.exe lxfxfxf.exe PID 4812 wrote to memory of 3596 4812 xrrlfxr.exe lxfxfxf.exe PID 3596 wrote to memory of 4876 3596 lxfxfxf.exe nbhhbb.exe PID 3596 wrote to memory of 4876 3596 lxfxfxf.exe nbhhbb.exe PID 3596 wrote to memory of 4876 3596 lxfxfxf.exe nbhhbb.exe PID 4876 wrote to memory of 3696 4876 nbhhbb.exe pvdvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44b7f19132ddbad4f0b564c6cf0a32e9c18cbf95fad02ab69bcc440b8bb4c9a6_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvdd.exec:\vpvdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpdvv.exec:\dpdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrlffx.exec:\xxrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3rxrxxx.exec:\3rxrxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhhnn.exec:\bbhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bbbtt.exec:\3bbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvpp.exec:\pjvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5ffxrll.exec:\5ffxrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttntth.exec:\ttntth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhbtt.exec:\bnhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3jpjd.exec:\3jpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7dpjj.exec:\7dpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfllffl.exec:\rfllffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lllfllf.exec:\lllfllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nttnn.exec:\5nttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjvjd.exec:\pjvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7vjdp.exec:\7vjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhhbb.exec:\nbhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdvp.exec:\pvdvp.exe23⤵
- Executes dropped EXE
-
\??\c:\jdjdv.exec:\jdjdv.exe24⤵
- Executes dropped EXE
-
\??\c:\9rxxrrr.exec:\9rxxrrr.exe25⤵
- Executes dropped EXE
-
\??\c:\fffxxrl.exec:\fffxxrl.exe26⤵
- Executes dropped EXE
-
\??\c:\bbbttn.exec:\bbbttn.exe27⤵
- Executes dropped EXE
-
\??\c:\hnttnn.exec:\hnttnn.exe28⤵
- Executes dropped EXE
-
\??\c:\pjjdd.exec:\pjjdd.exe29⤵
- Executes dropped EXE
-
\??\c:\flxxxff.exec:\flxxxff.exe30⤵
- Executes dropped EXE
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe31⤵
- Executes dropped EXE
-
\??\c:\hntnnn.exec:\hntnnn.exe32⤵
- Executes dropped EXE
-
\??\c:\nbnbnh.exec:\nbnbnh.exe33⤵
- Executes dropped EXE
-
\??\c:\vdddd.exec:\vdddd.exe34⤵
- Executes dropped EXE
-
\??\c:\1djjv.exec:\1djjv.exe35⤵
- Executes dropped EXE
-
\??\c:\frxffxx.exec:\frxffxx.exe36⤵
- Executes dropped EXE
-
\??\c:\lxflffx.exec:\lxflffx.exe37⤵
- Executes dropped EXE
-
\??\c:\1bhbbt.exec:\1bhbbt.exe38⤵
- Executes dropped EXE
-
\??\c:\thbbtb.exec:\thbbtb.exe39⤵
- Executes dropped EXE
-
\??\c:\vpdvv.exec:\vpdvv.exe40⤵
- Executes dropped EXE
-
\??\c:\lffxxrl.exec:\lffxxrl.exe41⤵
- Executes dropped EXE
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe42⤵
- Executes dropped EXE
-
\??\c:\bnttnn.exec:\bnttnn.exe43⤵
- Executes dropped EXE
-
\??\c:\hhttbb.exec:\hhttbb.exe44⤵
- Executes dropped EXE
-
\??\c:\dvpjd.exec:\dvpjd.exe45⤵
- Executes dropped EXE
-
\??\c:\7pdvp.exec:\7pdvp.exe46⤵
- Executes dropped EXE
-
\??\c:\xrrlfff.exec:\xrrlfff.exe47⤵
- Executes dropped EXE
-
\??\c:\7ffxllf.exec:\7ffxllf.exe48⤵
- Executes dropped EXE
-
\??\c:\7bnbnn.exec:\7bnbnn.exe49⤵
- Executes dropped EXE
-
\??\c:\bnttnn.exec:\bnttnn.exe50⤵
- Executes dropped EXE
-
\??\c:\1vpjd.exec:\1vpjd.exe51⤵
- Executes dropped EXE
-
\??\c:\rlrrllf.exec:\rlrrllf.exe52⤵
- Executes dropped EXE
-
\??\c:\xlrlfff.exec:\xlrlfff.exe53⤵
- Executes dropped EXE
-
\??\c:\9bhbbb.exec:\9bhbbb.exe54⤵
- Executes dropped EXE
-
\??\c:\thhbbt.exec:\thhbbt.exe55⤵
- Executes dropped EXE
-
\??\c:\5jpjd.exec:\5jpjd.exe56⤵
- Executes dropped EXE
-
\??\c:\djvvd.exec:\djvvd.exe57⤵
- Executes dropped EXE
-
\??\c:\rflllll.exec:\rflllll.exe58⤵
- Executes dropped EXE
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe59⤵
- Executes dropped EXE
-
\??\c:\3bhhhn.exec:\3bhhhn.exe60⤵
- Executes dropped EXE
-
\??\c:\jddvv.exec:\jddvv.exe61⤵
- Executes dropped EXE
-
\??\c:\jddvv.exec:\jddvv.exe62⤵
- Executes dropped EXE
-
\??\c:\dddpj.exec:\dddpj.exe63⤵
- Executes dropped EXE
-
\??\c:\rrfxxrr.exec:\rrfxxrr.exe64⤵
- Executes dropped EXE
-
\??\c:\7tbbtt.exec:\7tbbtt.exe65⤵
- Executes dropped EXE
-
\??\c:\hbbtnt.exec:\hbbtnt.exe66⤵
-
\??\c:\dddvp.exec:\dddvp.exe67⤵
-
\??\c:\ddppj.exec:\ddppj.exe68⤵
-
\??\c:\1flfxrr.exec:\1flfxrr.exe69⤵
-
\??\c:\nhbtnn.exec:\nhbtnn.exe70⤵
-
\??\c:\xxrrllf.exec:\xxrrllf.exe71⤵
-
\??\c:\9xxrlfx.exec:\9xxrlfx.exe72⤵
-
\??\c:\tbbbbh.exec:\tbbbbh.exe73⤵
-
\??\c:\ppdvv.exec:\ppdvv.exe74⤵
-
\??\c:\dvdvd.exec:\dvdvd.exe75⤵
-
\??\c:\rrlxfxf.exec:\rrlxfxf.exe76⤵
-
\??\c:\7nbbtb.exec:\7nbbtb.exe77⤵
-
\??\c:\bbtnth.exec:\bbtnth.exe78⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe79⤵
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe80⤵
-
\??\c:\5rxrrxx.exec:\5rxrrxx.exe81⤵
-
\??\c:\1nhhbb.exec:\1nhhbb.exe82⤵
-
\??\c:\dpppp.exec:\dpppp.exe83⤵
-
\??\c:\djdvj.exec:\djdvj.exe84⤵
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe85⤵
-
\??\c:\hbhbtt.exec:\hbhbtt.exe86⤵
-
\??\c:\pdvpp.exec:\pdvpp.exe87⤵
-
\??\c:\dvvvd.exec:\dvvvd.exe88⤵
-
\??\c:\7lfxllf.exec:\7lfxllf.exe89⤵
-
\??\c:\tbhbbb.exec:\tbhbbb.exe90⤵
-
\??\c:\vjvpv.exec:\vjvpv.exe91⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe92⤵
-
\??\c:\rllxrll.exec:\rllxrll.exe93⤵
-
\??\c:\htbhbt.exec:\htbhbt.exe94⤵
-
\??\c:\jjpvp.exec:\jjpvp.exe95⤵
-
\??\c:\rffrffx.exec:\rffrffx.exe96⤵
-
\??\c:\5fllfll.exec:\5fllfll.exe97⤵
-
\??\c:\ntnhbt.exec:\ntnhbt.exe98⤵
-
\??\c:\jdddv.exec:\jdddv.exe99⤵
-
\??\c:\7vvjv.exec:\7vvjv.exe100⤵
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe101⤵
-
\??\c:\3xfxrxr.exec:\3xfxrxr.exe102⤵
-
\??\c:\bntnnh.exec:\bntnnh.exe103⤵
-
\??\c:\3pppj.exec:\3pppj.exe104⤵
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe105⤵
-
\??\c:\7bhnhh.exec:\7bhnhh.exe106⤵
-
\??\c:\pvdjd.exec:\pvdjd.exe107⤵
-
\??\c:\9jjdv.exec:\9jjdv.exe108⤵
-
\??\c:\lllfrrl.exec:\lllfrrl.exe109⤵
-
\??\c:\9tnhnn.exec:\9tnhnn.exe110⤵
-
\??\c:\bhbtnh.exec:\bhbtnh.exe111⤵
-
\??\c:\dpvvp.exec:\dpvvp.exe112⤵
-
\??\c:\lrxrffx.exec:\lrxrffx.exe113⤵
-
\??\c:\xrfxllr.exec:\xrfxllr.exe114⤵
-
\??\c:\bbbtnn.exec:\bbbtnn.exe115⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe116⤵
-
\??\c:\frxxrrr.exec:\frxxrrr.exe117⤵
-
\??\c:\nhhbtn.exec:\nhhbtn.exe118⤵
-
\??\c:\nhtnnt.exec:\nhtnnt.exe119⤵
-
\??\c:\ddddj.exec:\ddddj.exe120⤵
-
\??\c:\3rrllrl.exec:\3rrllrl.exe121⤵
-
\??\c:\5ttbbh.exec:\5ttbbh.exe122⤵
-
\??\c:\nbnnnn.exec:\nbnnnn.exe123⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe124⤵
-
\??\c:\dvvpd.exec:\dvvpd.exe125⤵
-
\??\c:\rxlfrrr.exec:\rxlfrrr.exe126⤵
-
\??\c:\frrlfxx.exec:\frrlfxx.exe127⤵
-
\??\c:\bthhnn.exec:\bthhnn.exe128⤵
-
\??\c:\9vjdv.exec:\9vjdv.exe129⤵
-
\??\c:\xxfrllf.exec:\xxfrllf.exe130⤵
-
\??\c:\lxlffxr.exec:\lxlffxr.exe131⤵
-
\??\c:\nbbthh.exec:\nbbthh.exe132⤵
-
\??\c:\7jpjd.exec:\7jpjd.exe133⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe134⤵
-
\??\c:\frxxxxx.exec:\frxxxxx.exe135⤵
-
\??\c:\7bbbtn.exec:\7bbbtn.exe136⤵
-
\??\c:\ntbbbb.exec:\ntbbbb.exe137⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe138⤵
-
\??\c:\dvvjj.exec:\dvvjj.exe139⤵
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe140⤵
-
\??\c:\bttnhb.exec:\bttnhb.exe141⤵
-
\??\c:\nnttnn.exec:\nnttnn.exe142⤵
-
\??\c:\jvdvj.exec:\jvdvj.exe143⤵
-
\??\c:\7jpdv.exec:\7jpdv.exe144⤵
-
\??\c:\9lrlllr.exec:\9lrlllr.exe145⤵
-
\??\c:\9flflfl.exec:\9flflfl.exe146⤵
-
\??\c:\7tttnt.exec:\7tttnt.exe147⤵
-
\??\c:\dvdvp.exec:\dvdvp.exe148⤵
-
\??\c:\dvdvj.exec:\dvdvj.exe149⤵
-
\??\c:\lflflll.exec:\lflflll.exe150⤵
-
\??\c:\hhnnnn.exec:\hhnnnn.exe151⤵
-
\??\c:\7htnhb.exec:\7htnhb.exe152⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe153⤵
-
\??\c:\5jddd.exec:\5jddd.exe154⤵
-
\??\c:\5frllll.exec:\5frllll.exe155⤵
-
\??\c:\3nnhbb.exec:\3nnhbb.exe156⤵
-
\??\c:\tntntn.exec:\tntntn.exe157⤵
-
\??\c:\jjjpj.exec:\jjjpj.exe158⤵
-
\??\c:\djppj.exec:\djppj.exe159⤵
-
\??\c:\llxxrrl.exec:\llxxrrl.exe160⤵
-
\??\c:\9xfllrr.exec:\9xfllrr.exe161⤵
-
\??\c:\tttnhb.exec:\tttnhb.exe162⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe163⤵
-
\??\c:\9dpjj.exec:\9dpjj.exe164⤵
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe165⤵
-
\??\c:\bntnhh.exec:\bntnhh.exe166⤵
-
\??\c:\bhnhhh.exec:\bhnhhh.exe167⤵
-
\??\c:\vppjj.exec:\vppjj.exe168⤵
-
\??\c:\9pvjd.exec:\9pvjd.exe169⤵
-
\??\c:\fxfffff.exec:\fxfffff.exe170⤵
-
\??\c:\bhhtnn.exec:\bhhtnn.exe171⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe172⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe173⤵
-
\??\c:\frrfllr.exec:\frrfllr.exe174⤵
-
\??\c:\jjjjp.exec:\jjjjp.exe175⤵
-
\??\c:\3pjdv.exec:\3pjdv.exe176⤵
-
\??\c:\xrfxrll.exec:\xrfxrll.exe177⤵
-
\??\c:\nbbtnn.exec:\nbbtnn.exe178⤵
-
\??\c:\ttnnbb.exec:\ttnnbb.exe179⤵
-
\??\c:\9jpjj.exec:\9jpjj.exe180⤵
-
\??\c:\xxfxlrl.exec:\xxfxlrl.exe181⤵
-
\??\c:\7thbtb.exec:\7thbtb.exe182⤵
-
\??\c:\pjvjd.exec:\pjvjd.exe183⤵
-
\??\c:\ddvvp.exec:\ddvvp.exe184⤵
-
\??\c:\5fxrrrl.exec:\5fxrrrl.exe185⤵
-
\??\c:\ntbbtt.exec:\ntbbtt.exe186⤵
-
\??\c:\7ttnhb.exec:\7ttnhb.exe187⤵
-
\??\c:\vjdjp.exec:\vjdjp.exe188⤵
-
\??\c:\3rrllll.exec:\3rrllll.exe189⤵
-
\??\c:\5lrlrrr.exec:\5lrlrrr.exe190⤵
-
\??\c:\bhnnhh.exec:\bhnnhh.exe191⤵
-
\??\c:\5dpjd.exec:\5dpjd.exe192⤵
-
\??\c:\vdjjd.exec:\vdjjd.exe193⤵
-
\??\c:\lrrlllf.exec:\lrrlllf.exe194⤵
-
\??\c:\xfxlfff.exec:\xfxlfff.exe195⤵
-
\??\c:\1ttnhn.exec:\1ttnhn.exe196⤵
-
\??\c:\ntbtnh.exec:\ntbtnh.exe197⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe198⤵
-
\??\c:\rflllfx.exec:\rflllfx.exe199⤵
-
\??\c:\xxflxrr.exec:\xxflxrr.exe200⤵
-
\??\c:\7btnhh.exec:\7btnhh.exe201⤵
-
\??\c:\3ppjd.exec:\3ppjd.exe202⤵
-
\??\c:\9pvjj.exec:\9pvjj.exe203⤵
-
\??\c:\xrrrllf.exec:\xrrrllf.exe204⤵
-
\??\c:\3lrlfff.exec:\3lrlfff.exe205⤵
-
\??\c:\bnthbt.exec:\bnthbt.exe206⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe207⤵
-
\??\c:\pdvpv.exec:\pdvpv.exe208⤵
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe209⤵
-
\??\c:\xlrfxxl.exec:\xlrfxxl.exe210⤵
-
\??\c:\5ttnnn.exec:\5ttnnn.exe211⤵
-
\??\c:\ppppv.exec:\ppppv.exe212⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe213⤵
-
\??\c:\ffrlffx.exec:\ffrlffx.exe214⤵
-
\??\c:\thhbtn.exec:\thhbtn.exe215⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe216⤵
-
\??\c:\1flfrrl.exec:\1flfrrl.exe217⤵
-
\??\c:\bhntbh.exec:\bhntbh.exe218⤵
-
\??\c:\pjppv.exec:\pjppv.exe219⤵
-
\??\c:\9pjdd.exec:\9pjdd.exe220⤵
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe221⤵
-
\??\c:\bthbhh.exec:\bthbhh.exe222⤵
-
\??\c:\vvvdv.exec:\vvvdv.exe223⤵
-
\??\c:\1pdvp.exec:\1pdvp.exe224⤵
-
\??\c:\fxfxrlr.exec:\fxfxrlr.exe225⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe226⤵
-
\??\c:\nnbtnt.exec:\nnbtnt.exe227⤵
-
\??\c:\vppjj.exec:\vppjj.exe228⤵
-
\??\c:\ppdvv.exec:\ppdvv.exe229⤵
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe230⤵
-
\??\c:\5xxrffl.exec:\5xxrffl.exe231⤵
-
\??\c:\9tnnhh.exec:\9tnnhh.exe232⤵
-
\??\c:\jjpjj.exec:\jjpjj.exe233⤵
-
\??\c:\nbtbtt.exec:\nbtbtt.exe234⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe235⤵
-
\??\c:\pjddv.exec:\pjddv.exe236⤵
-
\??\c:\nhtntt.exec:\nhtntt.exe237⤵
-
\??\c:\5vvvp.exec:\5vvvp.exe238⤵
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe239⤵
-
\??\c:\pvdjj.exec:\pvdjj.exe240⤵
-
\??\c:\xxrrllf.exec:\xxrrllf.exe241⤵