Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 13:26
Behavioral task
behavioral1
Sample
55233345c4166d0d340d8070a494990945c8a3a40ecf3d9c4a21e74ea2c348e5_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
55233345c4166d0d340d8070a494990945c8a3a40ecf3d9c4a21e74ea2c348e5_NeikiAnalytics.exe
-
Size
464KB
-
MD5
a5e048590ae0b3dadad860f2c26384f0
-
SHA1
95173bf1fc5567a7c718e9dc4a50ba7ba2b7322e
-
SHA256
55233345c4166d0d340d8070a494990945c8a3a40ecf3d9c4a21e74ea2c348e5
-
SHA512
a22f0ba0bbf3e25603d178eb7c154987b510c9a42d79d1de14b744675f998e04e3dc305bc2f286a4cca511d5c541c74c3afe948540c6ed047e8ac1d7b340ce4a
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1V/:VeR0oykayRFp3lztP+OKaf1V/
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1860-5-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1596-11-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3548-18-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4128-19-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3908-33-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4568-40-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3924-46-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3416-52-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4280-60-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2000-70-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4924-83-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2456-100-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3336-108-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1388-114-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2200-125-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4560-128-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3496-137-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2304-143-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4160-152-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3492-158-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4504-164-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1708-177-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1132-195-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4912-199-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3448-207-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3232-216-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/912-221-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3648-228-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4276-232-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4968-237-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4444-239-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1596-245-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2876-247-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4972-256-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4168-261-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4388-267-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4680-274-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5088-278-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/512-300-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3316-310-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1444-314-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1680-316-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2152-328-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2176-338-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4668-345-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4632-358-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1148-371-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2888-397-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3108-408-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3976-429-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2576-436-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4816-451-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4816-455-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3784-502-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2744-509-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3132-513-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1568-529-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4636-543-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4996-548-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2264-561-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3764-646-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2936-695-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1552-714-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2056-826-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/1860-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rfrrxrf.exe family_berbew behavioral2/memory/1860-5-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tbhtnn.exe family_berbew behavioral2/memory/1596-11-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lrxrffr.exe family_berbew behavioral2/memory/3548-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4128-19-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nnbbth.exe family_berbew C:\xrxrrlx.exe family_berbew C:\1fxrllf.exe family_berbew behavioral2/memory/3908-33-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4568-35-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vjdpj.exe family_berbew behavioral2/memory/4568-40-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vpvpj.exe family_berbew behavioral2/memory/3924-46-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rffrxfr.exe family_berbew behavioral2/memory/3416-52-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vdjdv.exe family_berbew behavioral2/memory/1100-58-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4280-60-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\ttnhhh.exe family_berbew \??\c:\1lffrrf.exe family_berbew behavioral2/memory/2000-70-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nhhbnn.exe family_berbew C:\rlxrfrf.exe family_berbew behavioral2/memory/4924-83-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\xflfxxr.exe family_berbew behavioral2/memory/2328-88-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bhbnhb.exe family_berbew C:\ffrxlfx.exe family_berbew behavioral2/memory/2456-100-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nhnbtn.exe family_berbew behavioral2/memory/3336-108-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\fxrlfxr.exe family_berbew behavioral2/memory/1388-114-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\jdvpp.exe family_berbew \??\c:\1djdv.exe family_berbew behavioral2/memory/2200-125-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4560-128-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\thnhhh.exe family_berbew C:\ddjdd.exe family_berbew C:\rlrlrxx.exe family_berbew behavioral2/memory/3496-137-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\rfxlfxf.exe family_berbew behavioral2/memory/2304-143-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\1bbthb.exe family_berbew behavioral2/memory/4160-152-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rrlfrlf.exe family_berbew behavioral2/memory/3492-158-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tbbnht.exe family_berbew behavioral2/memory/4504-164-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pppdp.exe family_berbew C:\vjddp.exe family_berbew behavioral2/memory/1708-177-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xxrlffx.exe family_berbew behavioral2/memory/3868-180-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\djdpp.exe family_berbew behavioral2/memory/1132-195-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4912-199-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3448-207-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3232-216-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/912-221-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
rfrrxrf.exetbhtnn.exelrxrffr.exennbbth.exexrxrrlx.exe1fxrllf.exevjdpj.exevpvpj.exerffrxfr.exevdjdv.exettnhhh.exe1lffrrf.exenhhbnn.exerlxrfrf.exexflfxxr.exebhbnhb.exeffrxlfx.exenhnbtn.exefxrlfxr.exejdvpp.exe1djdv.exethnhhh.exeddjdd.exerlrlrxx.exerfxlfxf.exe1bbthb.exerrlfrlf.exetbbnht.exepppdp.exevjddp.exexxrlffx.exedjdpp.exe9hhbnh.exe5jdjd.exerffrfxr.exebnnbbt.exe7ddpd.exe1vjvj.exe5ffffxr.exebttnbb.exetbhbtn.exevppjp.exefrxlfxl.exebtthbh.exenhthbh.exe5dvpd.exe3xlxfxr.exenttnhb.exejddvd.exepjjvp.exefxrlfxx.exebnnthb.exevjpjv.exejddpd.exefxxrlfx.exettbnhb.exe9bhbhh.exeppvvj.exerllfxxr.exethhnbt.exe9jpjv.exedppvj.exe3frrffr.exenhnhbt.exepid process 1596 rfrrxrf.exe 3548 tbhtnn.exe 4128 lrxrffr.exe 2596 nnbbth.exe 3908 xrxrrlx.exe 4568 1fxrllf.exe 3924 vjdpj.exe 3416 vpvpj.exe 4280 rffrxfr.exe 1100 vdjdv.exe 2000 ttnhhh.exe 2100 1lffrrf.exe 1444 nhhbnn.exe 4924 rlxrfrf.exe 2328 xflfxxr.exe 4060 bhbnhb.exe 2456 ffrxlfx.exe 3336 nhnbtn.exe 1388 fxrlfxr.exe 1372 jdvpp.exe 2200 1djdv.exe 4560 thnhhh.exe 3496 ddjdd.exe 2304 rlrlrxx.exe 1560 rfxlfxf.exe 4160 1bbthb.exe 3492 rrlfrlf.exe 4504 tbbnht.exe 940 pppdp.exe 1708 vjddp.exe 3868 xxrlffx.exe 2920 djdpp.exe 4936 9hhbnh.exe 1132 5jdjd.exe 4664 rffrfxr.exe 4912 bnnbbt.exe 4220 7ddpd.exe 3448 1vjvj.exe 4384 5ffffxr.exe 5040 bttnbb.exe 3232 tbhbtn.exe 912 vppjp.exe 3976 frxlfxl.exe 3648 btthbh.exe 4276 nhthbh.exe 4968 5dvpd.exe 4444 3xlxfxr.exe 1596 nttnhb.exe 2876 jddvd.exe 4984 pjjvp.exe 4972 fxrlfxx.exe 4272 bnnthb.exe 4168 vjpjv.exe 4388 jddpd.exe 2852 fxxrlfx.exe 4680 ttbnhb.exe 5088 9bhbhh.exe 3924 ppvvj.exe 2208 rllfxxr.exe 2372 thhnbt.exe 1220 9jpjv.exe 3024 dppvj.exe 4976 3frrffr.exe 512 nhnhbt.exe -
Processes:
resource yara_rule behavioral2/memory/1860-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rfrrxrf.exe upx behavioral2/memory/1860-5-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tbhtnn.exe upx behavioral2/memory/1596-11-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lrxrffr.exe upx behavioral2/memory/3548-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4128-19-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nnbbth.exe upx C:\xrxrrlx.exe upx C:\1fxrllf.exe upx behavioral2/memory/3908-33-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4568-35-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vjdpj.exe upx behavioral2/memory/4568-40-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vpvpj.exe upx behavioral2/memory/3924-46-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rffrxfr.exe upx behavioral2/memory/3416-52-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vdjdv.exe upx behavioral2/memory/1100-58-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4280-60-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\ttnhhh.exe upx \??\c:\1lffrrf.exe upx behavioral2/memory/2000-70-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nhhbnn.exe upx C:\rlxrfrf.exe upx behavioral2/memory/4924-83-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\xflfxxr.exe upx behavioral2/memory/2328-88-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bhbnhb.exe upx C:\ffrxlfx.exe upx behavioral2/memory/2456-100-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nhnbtn.exe upx behavioral2/memory/3336-108-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\fxrlfxr.exe upx behavioral2/memory/1388-114-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\jdvpp.exe upx \??\c:\1djdv.exe upx behavioral2/memory/2200-125-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4560-128-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\thnhhh.exe upx C:\ddjdd.exe upx C:\rlrlrxx.exe upx behavioral2/memory/3496-137-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\rfxlfxf.exe upx behavioral2/memory/2304-143-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\1bbthb.exe upx behavioral2/memory/4160-152-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rrlfrlf.exe upx behavioral2/memory/3492-158-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tbbnht.exe upx behavioral2/memory/4504-164-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pppdp.exe upx C:\vjddp.exe upx behavioral2/memory/1708-177-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xxrlffx.exe upx behavioral2/memory/3868-180-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\djdpp.exe upx behavioral2/memory/1132-195-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4912-199-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3448-207-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3232-216-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/912-221-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
55233345c4166d0d340d8070a494990945c8a3a40ecf3d9c4a21e74ea2c348e5_NeikiAnalytics.exerfrrxrf.exetbhtnn.exelrxrffr.exennbbth.exexrxrrlx.exe1fxrllf.exevjdpj.exevpvpj.exerffrxfr.exevdjdv.exettnhhh.exe1lffrrf.exenhhbnn.exerlxrfrf.exexflfxxr.exebhbnhb.exeffrxlfx.exenhnbtn.exefxrlfxr.exejdvpp.exe1djdv.exedescription pid process target process PID 1860 wrote to memory of 1596 1860 55233345c4166d0d340d8070a494990945c8a3a40ecf3d9c4a21e74ea2c348e5_NeikiAnalytics.exe rfrrxrf.exe PID 1860 wrote to memory of 1596 1860 55233345c4166d0d340d8070a494990945c8a3a40ecf3d9c4a21e74ea2c348e5_NeikiAnalytics.exe rfrrxrf.exe PID 1860 wrote to memory of 1596 1860 55233345c4166d0d340d8070a494990945c8a3a40ecf3d9c4a21e74ea2c348e5_NeikiAnalytics.exe rfrrxrf.exe PID 1596 wrote to memory of 3548 1596 rfrrxrf.exe tbhtnn.exe PID 1596 wrote to memory of 3548 1596 rfrrxrf.exe tbhtnn.exe PID 1596 wrote to memory of 3548 1596 rfrrxrf.exe tbhtnn.exe PID 3548 wrote to memory of 4128 3548 tbhtnn.exe lrxrffr.exe PID 3548 wrote to memory of 4128 3548 tbhtnn.exe lrxrffr.exe PID 3548 wrote to memory of 4128 3548 tbhtnn.exe lrxrffr.exe PID 4128 wrote to memory of 2596 4128 lrxrffr.exe nnbbth.exe PID 4128 wrote to memory of 2596 4128 lrxrffr.exe nnbbth.exe PID 4128 wrote to memory of 2596 4128 lrxrffr.exe nnbbth.exe PID 2596 wrote to memory of 3908 2596 nnbbth.exe xrxrrlx.exe PID 2596 wrote to memory of 3908 2596 nnbbth.exe xrxrrlx.exe PID 2596 wrote to memory of 3908 2596 nnbbth.exe xrxrrlx.exe PID 3908 wrote to memory of 4568 3908 xrxrrlx.exe 1fxrllf.exe PID 3908 wrote to memory of 4568 3908 xrxrrlx.exe 1fxrllf.exe PID 3908 wrote to memory of 4568 3908 xrxrrlx.exe 1fxrllf.exe PID 4568 wrote to memory of 3924 4568 1fxrllf.exe vjdpj.exe PID 4568 wrote to memory of 3924 4568 1fxrllf.exe vjdpj.exe PID 4568 wrote to memory of 3924 4568 1fxrllf.exe vjdpj.exe PID 3924 wrote to memory of 3416 3924 vjdpj.exe vpvpj.exe PID 3924 wrote to memory of 3416 3924 vjdpj.exe vpvpj.exe PID 3924 wrote to memory of 3416 3924 vjdpj.exe vpvpj.exe PID 3416 wrote to memory of 4280 3416 vpvpj.exe rffrxfr.exe PID 3416 wrote to memory of 4280 3416 vpvpj.exe rffrxfr.exe PID 3416 wrote to memory of 4280 3416 vpvpj.exe rffrxfr.exe PID 4280 wrote to memory of 1100 4280 rffrxfr.exe vdjdv.exe PID 4280 wrote to memory of 1100 4280 rffrxfr.exe vdjdv.exe PID 4280 wrote to memory of 1100 4280 rffrxfr.exe vdjdv.exe PID 1100 wrote to memory of 2000 1100 vdjdv.exe ttnhhh.exe PID 1100 wrote to memory of 2000 1100 vdjdv.exe ttnhhh.exe PID 1100 wrote to memory of 2000 1100 vdjdv.exe ttnhhh.exe PID 2000 wrote to memory of 2100 2000 ttnhhh.exe 1lffrrf.exe PID 2000 wrote to memory of 2100 2000 ttnhhh.exe 1lffrrf.exe PID 2000 wrote to memory of 2100 2000 ttnhhh.exe 1lffrrf.exe PID 2100 wrote to memory of 1444 2100 1lffrrf.exe nhhbnn.exe PID 2100 wrote to memory of 1444 2100 1lffrrf.exe nhhbnn.exe PID 2100 wrote to memory of 1444 2100 1lffrrf.exe nhhbnn.exe PID 1444 wrote to memory of 4924 1444 nhhbnn.exe rlxrfrf.exe PID 1444 wrote to memory of 4924 1444 nhhbnn.exe rlxrfrf.exe PID 1444 wrote to memory of 4924 1444 nhhbnn.exe rlxrfrf.exe PID 4924 wrote to memory of 2328 4924 rlxrfrf.exe xflfxxr.exe PID 4924 wrote to memory of 2328 4924 rlxrfrf.exe xflfxxr.exe PID 4924 wrote to memory of 2328 4924 rlxrfrf.exe xflfxxr.exe PID 2328 wrote to memory of 4060 2328 xflfxxr.exe bhbnhb.exe PID 2328 wrote to memory of 4060 2328 xflfxxr.exe bhbnhb.exe PID 2328 wrote to memory of 4060 2328 xflfxxr.exe bhbnhb.exe PID 4060 wrote to memory of 2456 4060 bhbnhb.exe ffrxlfx.exe PID 4060 wrote to memory of 2456 4060 bhbnhb.exe ffrxlfx.exe PID 4060 wrote to memory of 2456 4060 bhbnhb.exe ffrxlfx.exe PID 2456 wrote to memory of 3336 2456 ffrxlfx.exe nhnbtn.exe PID 2456 wrote to memory of 3336 2456 ffrxlfx.exe nhnbtn.exe PID 2456 wrote to memory of 3336 2456 ffrxlfx.exe nhnbtn.exe PID 3336 wrote to memory of 1388 3336 nhnbtn.exe fxrlfxr.exe PID 3336 wrote to memory of 1388 3336 nhnbtn.exe fxrlfxr.exe PID 3336 wrote to memory of 1388 3336 nhnbtn.exe fxrlfxr.exe PID 1388 wrote to memory of 1372 1388 fxrlfxr.exe jdvpp.exe PID 1388 wrote to memory of 1372 1388 fxrlfxr.exe jdvpp.exe PID 1388 wrote to memory of 1372 1388 fxrlfxr.exe jdvpp.exe PID 1372 wrote to memory of 2200 1372 jdvpp.exe 1djdv.exe PID 1372 wrote to memory of 2200 1372 jdvpp.exe 1djdv.exe PID 1372 wrote to memory of 2200 1372 jdvpp.exe 1djdv.exe PID 2200 wrote to memory of 4560 2200 1djdv.exe thnhhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55233345c4166d0d340d8070a494990945c8a3a40ecf3d9c4a21e74ea2c348e5_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\55233345c4166d0d340d8070a494990945c8a3a40ecf3d9c4a21e74ea2c348e5_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rfrrxrf.exec:\rfrrxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbhtnn.exec:\tbhtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxrffr.exec:\lrxrffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nnbbth.exec:\nnbbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrxrrlx.exec:\xrxrrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1fxrllf.exec:\1fxrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjdpj.exec:\vjdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpvpj.exec:\vpvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rffrxfr.exec:\rffrxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjdv.exec:\vdjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnhhh.exec:\ttnhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1lffrrf.exec:\1lffrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhbnn.exec:\nhhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrfrf.exec:\rlxrfrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xflfxxr.exec:\xflfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbnhb.exec:\bhbnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrxlfx.exec:\ffrxlfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnbtn.exec:\nhnbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvpp.exec:\jdvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1djdv.exec:\1djdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thnhhh.exec:\thnhhh.exe23⤵
- Executes dropped EXE
-
\??\c:\ddjdd.exec:\ddjdd.exe24⤵
- Executes dropped EXE
-
\??\c:\rlrlrxx.exec:\rlrlrxx.exe25⤵
- Executes dropped EXE
-
\??\c:\rfxlfxf.exec:\rfxlfxf.exe26⤵
- Executes dropped EXE
-
\??\c:\1bbthb.exec:\1bbthb.exe27⤵
- Executes dropped EXE
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe28⤵
- Executes dropped EXE
-
\??\c:\tbbnht.exec:\tbbnht.exe29⤵
- Executes dropped EXE
-
\??\c:\pppdp.exec:\pppdp.exe30⤵
- Executes dropped EXE
-
\??\c:\vjddp.exec:\vjddp.exe31⤵
- Executes dropped EXE
-
\??\c:\xxrlffx.exec:\xxrlffx.exe32⤵
- Executes dropped EXE
-
\??\c:\djdpp.exec:\djdpp.exe33⤵
- Executes dropped EXE
-
\??\c:\9hhbnh.exec:\9hhbnh.exe34⤵
- Executes dropped EXE
-
\??\c:\5jdjd.exec:\5jdjd.exe35⤵
- Executes dropped EXE
-
\??\c:\rffrfxr.exec:\rffrfxr.exe36⤵
- Executes dropped EXE
-
\??\c:\bnnbbt.exec:\bnnbbt.exe37⤵
- Executes dropped EXE
-
\??\c:\7ddpd.exec:\7ddpd.exe38⤵
- Executes dropped EXE
-
\??\c:\1vjvj.exec:\1vjvj.exe39⤵
- Executes dropped EXE
-
\??\c:\5ffffxr.exec:\5ffffxr.exe40⤵
- Executes dropped EXE
-
\??\c:\bttnbb.exec:\bttnbb.exe41⤵
- Executes dropped EXE
-
\??\c:\tbhbtn.exec:\tbhbtn.exe42⤵
- Executes dropped EXE
-
\??\c:\vppjp.exec:\vppjp.exe43⤵
- Executes dropped EXE
-
\??\c:\frxlfxl.exec:\frxlfxl.exe44⤵
- Executes dropped EXE
-
\??\c:\btthbh.exec:\btthbh.exe45⤵
- Executes dropped EXE
-
\??\c:\nhthbh.exec:\nhthbh.exe46⤵
- Executes dropped EXE
-
\??\c:\5dvpd.exec:\5dvpd.exe47⤵
- Executes dropped EXE
-
\??\c:\3xlxfxr.exec:\3xlxfxr.exe48⤵
- Executes dropped EXE
-
\??\c:\nttnhb.exec:\nttnhb.exe49⤵
- Executes dropped EXE
-
\??\c:\jddvd.exec:\jddvd.exe50⤵
- Executes dropped EXE
-
\??\c:\pjjvp.exec:\pjjvp.exe51⤵
- Executes dropped EXE
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe52⤵
- Executes dropped EXE
-
\??\c:\bnnthb.exec:\bnnthb.exe53⤵
- Executes dropped EXE
-
\??\c:\vjpjv.exec:\vjpjv.exe54⤵
- Executes dropped EXE
-
\??\c:\jddpd.exec:\jddpd.exe55⤵
- Executes dropped EXE
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe56⤵
- Executes dropped EXE
-
\??\c:\ttbnhb.exec:\ttbnhb.exe57⤵
- Executes dropped EXE
-
\??\c:\9bhbhh.exec:\9bhbhh.exe58⤵
- Executes dropped EXE
-
\??\c:\ppvvj.exec:\ppvvj.exe59⤵
- Executes dropped EXE
-
\??\c:\rllfxxr.exec:\rllfxxr.exe60⤵
- Executes dropped EXE
-
\??\c:\thhnbt.exec:\thhnbt.exe61⤵
- Executes dropped EXE
-
\??\c:\9jpjv.exec:\9jpjv.exe62⤵
- Executes dropped EXE
-
\??\c:\dppvj.exec:\dppvj.exe63⤵
- Executes dropped EXE
-
\??\c:\3frrffr.exec:\3frrffr.exe64⤵
- Executes dropped EXE
-
\??\c:\nhnhbt.exec:\nhnhbt.exe65⤵
- Executes dropped EXE
-
\??\c:\jdpdp.exec:\jdpdp.exe66⤵
-
\??\c:\pjvjv.exec:\pjvjv.exe67⤵
-
\??\c:\lrxxllf.exec:\lrxxllf.exe68⤵
-
\??\c:\tbhbnh.exec:\tbhbnh.exe69⤵
-
\??\c:\vjdpp.exec:\vjdpp.exe70⤵
-
\??\c:\fxfrfff.exec:\fxfrfff.exe71⤵
-
\??\c:\vjjvp.exec:\vjjvp.exe72⤵
-
\??\c:\dvjvv.exec:\dvjvv.exe73⤵
-
\??\c:\ffrfxfx.exec:\ffrfxfx.exe74⤵
-
\??\c:\hbbntt.exec:\hbbntt.exe75⤵
-
\??\c:\djvvp.exec:\djvvp.exe76⤵
-
\??\c:\lxxrllf.exec:\lxxrllf.exe77⤵
-
\??\c:\rfllxlf.exec:\rfllxlf.exe78⤵
-
\??\c:\bnbtnh.exec:\bnbtnh.exe79⤵
-
\??\c:\9vvpd.exec:\9vvpd.exe80⤵
-
\??\c:\rlrlffx.exec:\rlrlffx.exe81⤵
-
\??\c:\httnhh.exec:\httnhh.exe82⤵
-
\??\c:\hbbhtn.exec:\hbbhtn.exe83⤵
-
\??\c:\dvdpj.exec:\dvdpj.exe84⤵
-
\??\c:\9flxrrf.exec:\9flxrrf.exe85⤵
-
\??\c:\frxffrx.exec:\frxffrx.exe86⤵
-
\??\c:\nnhbtt.exec:\nnhbtt.exe87⤵
-
\??\c:\djppj.exec:\djppj.exe88⤵
-
\??\c:\vpppj.exec:\vpppj.exe89⤵
-
\??\c:\3rfxflr.exec:\3rfxflr.exe90⤵
-
\??\c:\7hbthb.exec:\7hbthb.exe91⤵
-
\??\c:\nnhbnh.exec:\nnhbnh.exe92⤵
-
\??\c:\jpvjd.exec:\jpvjd.exe93⤵
-
\??\c:\1xfxxxx.exec:\1xfxxxx.exe94⤵
-
\??\c:\5rrlffx.exec:\5rrlffx.exe95⤵
-
\??\c:\tbnhbb.exec:\tbnhbb.exe96⤵
-
\??\c:\pvvpd.exec:\pvvpd.exe97⤵
-
\??\c:\rflrllf.exec:\rflrllf.exe98⤵
-
\??\c:\ttbtnh.exec:\ttbtnh.exe99⤵
-
\??\c:\nhnbhb.exec:\nhnbhb.exe100⤵
-
\??\c:\9vvjd.exec:\9vvjd.exe101⤵
-
\??\c:\xlllxrl.exec:\xlllxrl.exe102⤵
-
\??\c:\7nnnbb.exec:\7nnnbb.exe103⤵
-
\??\c:\jddvj.exec:\jddvj.exe104⤵
-
\??\c:\1jpjv.exec:\1jpjv.exe105⤵
-
\??\c:\frrfrlf.exec:\frrfrlf.exe106⤵
-
\??\c:\hhhbbt.exec:\hhhbbt.exe107⤵
-
\??\c:\jpdpj.exec:\jpdpj.exe108⤵
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe109⤵
-
\??\c:\fxfxllf.exec:\fxfxllf.exe110⤵
-
\??\c:\3thnhh.exec:\3thnhh.exe111⤵
-
\??\c:\vdvpp.exec:\vdvpp.exe112⤵
-
\??\c:\9pdvd.exec:\9pdvd.exe113⤵
-
\??\c:\ffllxxr.exec:\ffllxxr.exe114⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe115⤵
-
\??\c:\nhhbtt.exec:\nhhbtt.exe116⤵
-
\??\c:\jpjdv.exec:\jpjdv.exe117⤵
-
\??\c:\vppjd.exec:\vppjd.exe118⤵
-
\??\c:\rrfrlfx.exec:\rrfrlfx.exe119⤵
-
\??\c:\bbhhnn.exec:\bbhhnn.exe120⤵
-
\??\c:\3jpjd.exec:\3jpjd.exe121⤵
-
\??\c:\jppjv.exec:\jppjv.exe122⤵
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe123⤵
-
\??\c:\3htnhb.exec:\3htnhb.exe124⤵
-
\??\c:\jddvj.exec:\jddvj.exe125⤵
-
\??\c:\fxfxrll.exec:\fxfxrll.exe126⤵
-
\??\c:\bbthbt.exec:\bbthbt.exe127⤵
-
\??\c:\ntttnt.exec:\ntttnt.exe128⤵
-
\??\c:\9jvjj.exec:\9jvjj.exe129⤵
-
\??\c:\frxrllf.exec:\frxrllf.exe130⤵
-
\??\c:\nthhnn.exec:\nthhnn.exe131⤵
-
\??\c:\3bbbnn.exec:\3bbbnn.exe132⤵
-
\??\c:\1dpjd.exec:\1dpjd.exe133⤵
-
\??\c:\xfrrlll.exec:\xfrrlll.exe134⤵
-
\??\c:\hntnhh.exec:\hntnhh.exe135⤵
-
\??\c:\pjjvp.exec:\pjjvp.exe136⤵
-
\??\c:\rlffxxl.exec:\rlffxxl.exe137⤵
-
\??\c:\nthhbh.exec:\nthhbh.exe138⤵
-
\??\c:\pvpdj.exec:\pvpdj.exe139⤵
-
\??\c:\rxfrffl.exec:\rxfrffl.exe140⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe141⤵
-
\??\c:\vddvp.exec:\vddvp.exe142⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe143⤵
-
\??\c:\lffrfxr.exec:\lffrfxr.exe144⤵
-
\??\c:\nhhhbb.exec:\nhhhbb.exe145⤵
-
\??\c:\7bbtnn.exec:\7bbtnn.exe146⤵
-
\??\c:\dppvj.exec:\dppvj.exe147⤵
-
\??\c:\1rrlffx.exec:\1rrlffx.exe148⤵
-
\??\c:\3bhtnh.exec:\3bhtnh.exe149⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe150⤵
-
\??\c:\5pvpp.exec:\5pvpp.exe151⤵
-
\??\c:\frfxrll.exec:\frfxrll.exe152⤵
-
\??\c:\xlrlxxl.exec:\xlrlxxl.exe153⤵
-
\??\c:\tnbtnt.exec:\tnbtnt.exe154⤵
-
\??\c:\btbnhb.exec:\btbnhb.exe155⤵
-
\??\c:\dvddp.exec:\dvddp.exe156⤵
-
\??\c:\lffrxxl.exec:\lffrxxl.exe157⤵
-
\??\c:\tthbhb.exec:\tthbhb.exe158⤵
-
\??\c:\nbhthh.exec:\nbhthh.exe159⤵
-
\??\c:\jpjvv.exec:\jpjvv.exe160⤵
-
\??\c:\3xrfrrl.exec:\3xrfrrl.exe161⤵
-
\??\c:\rrfxrrx.exec:\rrfxrrx.exe162⤵
-
\??\c:\btbbhh.exec:\btbbhh.exe163⤵
-
\??\c:\1ddjv.exec:\1ddjv.exe164⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe165⤵
-
\??\c:\rlxlrlr.exec:\rlxlrlr.exe166⤵
-
\??\c:\rlfxlll.exec:\rlfxlll.exe167⤵
-
\??\c:\3ntnbt.exec:\3ntnbt.exe168⤵
-
\??\c:\ddpvj.exec:\ddpvj.exe169⤵
-
\??\c:\5lxrlfx.exec:\5lxrlfx.exe170⤵
-
\??\c:\nhnhbn.exec:\nhnhbn.exe171⤵
-
\??\c:\hhtnbb.exec:\hhtnbb.exe172⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe173⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe174⤵
-
\??\c:\5rrfrlf.exec:\5rrfrlf.exe175⤵
-
\??\c:\nbthbt.exec:\nbthbt.exe176⤵
-
\??\c:\jvjvp.exec:\jvjvp.exe177⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe178⤵
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe179⤵
-
\??\c:\hnnhbb.exec:\hnnhbb.exe180⤵
-
\??\c:\dvvdv.exec:\dvvdv.exe181⤵
-
\??\c:\rfrfrrl.exec:\rfrfrrl.exe182⤵
-
\??\c:\nnbtnn.exec:\nnbtnn.exe183⤵
-
\??\c:\htbnhh.exec:\htbnhh.exe184⤵
-
\??\c:\5jjvj.exec:\5jjvj.exe185⤵
-
\??\c:\lflllfl.exec:\lflllfl.exe186⤵
-
\??\c:\nhnnbh.exec:\nhnnbh.exe187⤵
-
\??\c:\nbbbtt.exec:\nbbbtt.exe188⤵
-
\??\c:\9jvvp.exec:\9jvvp.exe189⤵
-
\??\c:\xfrlfxx.exec:\xfrlfxx.exe190⤵
-
\??\c:\fxllfll.exec:\fxllfll.exe191⤵
-
\??\c:\tnnbbh.exec:\tnnbbh.exe192⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe193⤵
-
\??\c:\xrxxlxx.exec:\xrxxlxx.exe194⤵
-
\??\c:\xrxrlff.exec:\xrxrlff.exe195⤵
-
\??\c:\vpdvp.exec:\vpdvp.exe196⤵
-
\??\c:\jdjjp.exec:\jdjjp.exe197⤵
-
\??\c:\xxxlxxx.exec:\xxxlxxx.exe198⤵
-
\??\c:\bnnhbb.exec:\bnnhbb.exe199⤵
-
\??\c:\nhhbbb.exec:\nhhbbb.exe200⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe201⤵
-
\??\c:\xlrlfff.exec:\xlrlfff.exe202⤵
-
\??\c:\hnthbt.exec:\hnthbt.exe203⤵
-
\??\c:\bnthbb.exec:\bnthbb.exe204⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe205⤵
-
\??\c:\5llfrlf.exec:\5llfrlf.exe206⤵
-
\??\c:\tthhhn.exec:\tthhhn.exe207⤵
-
\??\c:\vvjjj.exec:\vvjjj.exe208⤵
-
\??\c:\fllxrrf.exec:\fllxrrf.exe209⤵
-
\??\c:\btbhbn.exec:\btbhbn.exe210⤵
-
\??\c:\tbnhbb.exec:\tbnhbb.exe211⤵
-
\??\c:\3dppd.exec:\3dppd.exe212⤵
-
\??\c:\xxxlllf.exec:\xxxlllf.exe213⤵
-
\??\c:\hthbhb.exec:\hthbhb.exe214⤵
-
\??\c:\nntnhh.exec:\nntnhh.exe215⤵
-
\??\c:\jdjvd.exec:\jdjvd.exe216⤵
-
\??\c:\rrrfxxr.exec:\rrrfxxr.exe217⤵
-
\??\c:\xlrrfff.exec:\xlrrfff.exe218⤵
-
\??\c:\tnnhtt.exec:\tnnhtt.exe219⤵
-
\??\c:\vjpjv.exec:\vjpjv.exe220⤵
-
\??\c:\1rxfrfx.exec:\1rxfrfx.exe221⤵
-
\??\c:\3hhhbb.exec:\3hhhbb.exe222⤵
-
\??\c:\9hbtnh.exec:\9hbtnh.exe223⤵
-
\??\c:\7dddv.exec:\7dddv.exe224⤵
-
\??\c:\lflfxrl.exec:\lflfxrl.exe225⤵
-
\??\c:\nbnbtn.exec:\nbnbtn.exe226⤵
-
\??\c:\dddvj.exec:\dddvj.exe227⤵
-
\??\c:\rrxrlfr.exec:\rrxrlfr.exe228⤵
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe229⤵
-
\??\c:\nhnhbt.exec:\nhnhbt.exe230⤵
-
\??\c:\vpddj.exec:\vpddj.exe231⤵
-
\??\c:\3flxxrx.exec:\3flxxrx.exe232⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe233⤵
-
\??\c:\5ddvp.exec:\5ddvp.exe234⤵
-
\??\c:\fllxfxr.exec:\fllxfxr.exe235⤵
-
\??\c:\bnhtnb.exec:\bnhtnb.exe236⤵
-
\??\c:\dpvvj.exec:\dpvvj.exe237⤵
-
\??\c:\dvpjd.exec:\dvpjd.exe238⤵
-
\??\c:\frllrxr.exec:\frllrxr.exe239⤵
-
\??\c:\7nbthb.exec:\7nbthb.exe240⤵
-
\??\c:\jjdpj.exec:\jjdpj.exe241⤵