Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 04:00
Behavioral task
behavioral1
Sample
19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe
-
Size
350KB
-
MD5
19f0c4df6baab173de1da2b99a66f000
-
SHA1
c2981d384671fe029253d6f586bbeac34c2fc5a2
-
SHA256
da8778ac051ef64556d50b0bff656375a10b5dcdd9971e1faab742fdde6920bb
-
SHA512
bdce16985c5fdf97c7f6bd997cde552c4083414a160a57e701c74221797244947703b61d1ac81943558b44fc7a274105bee9934d5d8c1fe5b51d634e04bd6596
-
SSDEEP
6144:4cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4TrHo:+7TcBuGy/Sa+/sie0OpncKe/KFBOfmzg
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1816-7-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1488-14-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/936-12-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1060-25-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2108-30-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1812-19-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1236-42-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/384-53-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/660-59-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3692-66-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4612-82-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5044-99-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1880-105-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/376-117-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3696-129-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4632-124-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4740-112-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/944-141-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1388-140-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4236-151-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1864-167-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2056-174-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1912-182-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3436-191-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/828-198-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/860-205-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1452-209-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/644-211-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/912-216-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/776-220-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2788-232-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4988-238-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4972-242-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1636-250-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2908-257-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1300-261-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5020-268-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2476-272-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4612-283-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4888-285-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2008-291-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5008-294-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1256-301-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3308-309-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2224-325-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1960-336-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1424-349-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2064-350-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3452-422-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1448-453-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3032-463-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2644-482-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1404-489-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1144-499-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/936-527-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1752-537-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3956-544-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4556-560-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4608-573-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3988-674-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1636-681-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2912-745-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3160-1274-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3068-1336-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\pdjdd.exe family_berbew \??\c:\llrrrrl.exe family_berbew C:\tbhbth.exe family_berbew \??\c:\xrxxxfx.exe family_berbew \??\c:\jpvpj.exe family_berbew C:\3nhhbh.exe family_berbew C:\ntbbbb.exe family_berbew C:\jpppp.exe family_berbew C:\pdppv.exe family_berbew C:\nhbntb.exe family_berbew C:\rfxxrxr.exe family_berbew C:\tthnhh.exe family_berbew \??\c:\vpvvp.exe family_berbew C:\bbtttt.exe family_berbew C:\lfxrrrl.exe family_berbew C:\nhhbhb.exe family_berbew C:\rlxflll.exe family_berbew C:\hhbbhb.exe family_berbew \??\c:\lrllxrr.exe family_berbew \??\c:\xrflfrr.exe family_berbew \??\c:\1xlfxxx.exe family_berbew \??\c:\nbhbbt.exe family_berbew \??\c:\xxxxrrr.exe family_berbew \??\c:\vpjjj.exe family_berbew \??\c:\bnbhnt.exe family_berbew \??\c:\7fxrxff.exe family_berbew C:\flrrllf.exe family_berbew C:\vpjdd.exe family_berbew C:\vjvjp.exe family_berbew C:\nthhnn.exe family_berbew C:\nhnhbb.exe family_berbew C:\rflflxx.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
pdjdd.exellrrrrl.exetbhbth.exejpvpj.exexrxxxfx.exe3nhhbh.exentbbbb.exejpppp.exepdppv.exenhbntb.exerfxxrxr.exetthnhh.exevpvvp.exebbtttt.exelfxrrrl.exenhhbhb.exerlxflll.exehhbbhb.exelrllxrr.exexrflfrr.exevpjjj.exe1xlfxxx.exenbhbbt.exexxxxrrr.exebnbhnt.exe7fxrxff.exeflrrllf.exevpjdd.exevjvjp.exenthhnn.exenhnhbb.exerflflxx.exevvjdp.exerxfxxxf.exetbtnnn.exevvjpj.exefxlfllr.exe3hbbhn.exevjjdv.exelfxrrlf.exetnbbbh.exejvvpp.exexxffrrl.exehhhhbb.exevjjpd.exerxlfxxx.exeddjjp.exexxrlfrr.exehhbbnb.exelfrfxff.exe1hnhbb.exelrffxxr.exethbhbh.exejjvvd.exexlrlllf.exexxfrrrr.exehnhnnh.exevpdvv.exehbhhhh.exejpdvp.exehbnnbb.exe9vdvv.exerrlfrrx.exehttttn.exepid process 1488 pdjdd.exe 936 llrrrrl.exe 1812 tbhbth.exe 1060 jpvpj.exe 2108 xrxxxfx.exe 3944 3nhhbh.exe 1236 ntbbbb.exe 384 jpppp.exe 660 pdppv.exe 3692 nhbntb.exe 2608 rfxxrxr.exe 3836 tthnhh.exe 4612 vpvvp.exe 4760 bbtttt.exe 2384 lfxrrrl.exe 5044 nhhbhb.exe 3168 rlxflll.exe 1880 hhbbhb.exe 4740 lrllxrr.exe 376 xrflfrr.exe 4632 vpjjj.exe 3696 1xlfxxx.exe 1388 nbhbbt.exe 944 xxxxrrr.exe 4236 bnbhnt.exe 1652 7fxrxff.exe 1132 flrrllf.exe 1864 vpjdd.exe 2056 vjvjp.exe 1912 nthhnn.exe 1980 nhnhbb.exe 3436 rflflxx.exe 3660 vvjdp.exe 828 rxfxxxf.exe 4408 tbtnnn.exe 860 vvjpj.exe 1452 fxlfllr.exe 644 3hbbhn.exe 912 vjjdv.exe 1816 lfxrrlf.exe 2336 tnbbbh.exe 4992 jvvpp.exe 2788 xxffrrl.exe 4988 hhhhbb.exe 1752 vjjpd.exe 4972 rxlfxxx.exe 3944 ddjjp.exe 1636 xxrlfrr.exe 2908 hhbbnb.exe 1300 lfrfxff.exe 3048 1hnhbb.exe 5020 lrffxxr.exe 2476 thbhbh.exe 2264 jjvvd.exe 436 xlrlllf.exe 4612 xxfrrrr.exe 4888 hnhnnh.exe 2008 vpdvv.exe 5008 hbhhhh.exe 4800 jpdvp.exe 1256 hbnnbb.exe 1392 9vdvv.exe 3308 rrlfrrx.exe 3672 httttn.exe -
Processes:
resource yara_rule behavioral2/memory/1816-7-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1488-14-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/936-12-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1060-25-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2108-30-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1812-19-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1236-42-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/384-48-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/384-53-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/660-59-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3692-66-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2608-67-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4612-77-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4612-82-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4760-84-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5044-99-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1880-105-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/376-117-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3696-129-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4632-124-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4740-112-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/944-141-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1388-140-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4236-151-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1864-167-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2056-174-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1912-182-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3436-191-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/828-198-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/860-205-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1452-209-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/644-211-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/912-214-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/912-216-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/776-220-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2336-224-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2788-232-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4988-238-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4972-242-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1636-250-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2908-253-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2908-257-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1300-261-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5020-268-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2476-272-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/436-277-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4612-283-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4888-285-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2008-291-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5008-294-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1256-301-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3308-309-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2224-325-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1080-329-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1960-336-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1424-349-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2064-350-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3068-360-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1428-379-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2240-401-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4764-412-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3452-422-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1448-453-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3032-463-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exepdjdd.exellrrrrl.exetbhbth.exejpvpj.exexrxxxfx.exe3nhhbh.exentbbbb.exejpppp.exepdppv.exenhbntb.exerfxxrxr.exetthnhh.exevpvvp.exebbtttt.exelfxrrrl.exenhhbhb.exerlxflll.exehhbbhb.exelrllxrr.exexrflfrr.exevpjjj.exedescription pid process target process PID 1816 wrote to memory of 1488 1816 19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe pdjdd.exe PID 1816 wrote to memory of 1488 1816 19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe pdjdd.exe PID 1816 wrote to memory of 1488 1816 19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe pdjdd.exe PID 1488 wrote to memory of 936 1488 pdjdd.exe llrrrrl.exe PID 1488 wrote to memory of 936 1488 pdjdd.exe llrrrrl.exe PID 1488 wrote to memory of 936 1488 pdjdd.exe llrrrrl.exe PID 936 wrote to memory of 1812 936 llrrrrl.exe tbhbth.exe PID 936 wrote to memory of 1812 936 llrrrrl.exe tbhbth.exe PID 936 wrote to memory of 1812 936 llrrrrl.exe tbhbth.exe PID 1812 wrote to memory of 1060 1812 tbhbth.exe jpvpj.exe PID 1812 wrote to memory of 1060 1812 tbhbth.exe jpvpj.exe PID 1812 wrote to memory of 1060 1812 tbhbth.exe jpvpj.exe PID 1060 wrote to memory of 2108 1060 jpvpj.exe xrxxxfx.exe PID 1060 wrote to memory of 2108 1060 jpvpj.exe xrxxxfx.exe PID 1060 wrote to memory of 2108 1060 jpvpj.exe xrxxxfx.exe PID 2108 wrote to memory of 3944 2108 xrxxxfx.exe 3nhhbh.exe PID 2108 wrote to memory of 3944 2108 xrxxxfx.exe 3nhhbh.exe PID 2108 wrote to memory of 3944 2108 xrxxxfx.exe 3nhhbh.exe PID 3944 wrote to memory of 1236 3944 3nhhbh.exe ntbbbb.exe PID 3944 wrote to memory of 1236 3944 3nhhbh.exe ntbbbb.exe PID 3944 wrote to memory of 1236 3944 3nhhbh.exe ntbbbb.exe PID 1236 wrote to memory of 384 1236 ntbbbb.exe jpppp.exe PID 1236 wrote to memory of 384 1236 ntbbbb.exe jpppp.exe PID 1236 wrote to memory of 384 1236 ntbbbb.exe jpppp.exe PID 384 wrote to memory of 660 384 jpppp.exe pdppv.exe PID 384 wrote to memory of 660 384 jpppp.exe pdppv.exe PID 384 wrote to memory of 660 384 jpppp.exe pdppv.exe PID 660 wrote to memory of 3692 660 pdppv.exe nhbntb.exe PID 660 wrote to memory of 3692 660 pdppv.exe nhbntb.exe PID 660 wrote to memory of 3692 660 pdppv.exe nhbntb.exe PID 3692 wrote to memory of 2608 3692 nhbntb.exe rfxxrxr.exe PID 3692 wrote to memory of 2608 3692 nhbntb.exe rfxxrxr.exe PID 3692 wrote to memory of 2608 3692 nhbntb.exe rfxxrxr.exe PID 2608 wrote to memory of 3836 2608 rfxxrxr.exe tthnhh.exe PID 2608 wrote to memory of 3836 2608 rfxxrxr.exe tthnhh.exe PID 2608 wrote to memory of 3836 2608 rfxxrxr.exe tthnhh.exe PID 3836 wrote to memory of 4612 3836 tthnhh.exe vpvvp.exe PID 3836 wrote to memory of 4612 3836 tthnhh.exe vpvvp.exe PID 3836 wrote to memory of 4612 3836 tthnhh.exe vpvvp.exe PID 4612 wrote to memory of 4760 4612 vpvvp.exe bbtttt.exe PID 4612 wrote to memory of 4760 4612 vpvvp.exe bbtttt.exe PID 4612 wrote to memory of 4760 4612 vpvvp.exe bbtttt.exe PID 4760 wrote to memory of 2384 4760 bbtttt.exe lfxrrrl.exe PID 4760 wrote to memory of 2384 4760 bbtttt.exe lfxrrrl.exe PID 4760 wrote to memory of 2384 4760 bbtttt.exe lfxrrrl.exe PID 2384 wrote to memory of 5044 2384 lfxrrrl.exe nhhbhb.exe PID 2384 wrote to memory of 5044 2384 lfxrrrl.exe nhhbhb.exe PID 2384 wrote to memory of 5044 2384 lfxrrrl.exe nhhbhb.exe PID 5044 wrote to memory of 3168 5044 nhhbhb.exe rlxflll.exe PID 5044 wrote to memory of 3168 5044 nhhbhb.exe rlxflll.exe PID 5044 wrote to memory of 3168 5044 nhhbhb.exe rlxflll.exe PID 3168 wrote to memory of 1880 3168 rlxflll.exe hhbbhb.exe PID 3168 wrote to memory of 1880 3168 rlxflll.exe hhbbhb.exe PID 3168 wrote to memory of 1880 3168 rlxflll.exe hhbbhb.exe PID 1880 wrote to memory of 4740 1880 hhbbhb.exe lrllxrr.exe PID 1880 wrote to memory of 4740 1880 hhbbhb.exe lrllxrr.exe PID 1880 wrote to memory of 4740 1880 hhbbhb.exe lrllxrr.exe PID 4740 wrote to memory of 376 4740 lrllxrr.exe xrflfrr.exe PID 4740 wrote to memory of 376 4740 lrllxrr.exe xrflfrr.exe PID 4740 wrote to memory of 376 4740 lrllxrr.exe xrflfrr.exe PID 376 wrote to memory of 4632 376 xrflfrr.exe vpjjj.exe PID 376 wrote to memory of 4632 376 xrflfrr.exe vpjjj.exe PID 376 wrote to memory of 4632 376 xrflfrr.exe vpjjj.exe PID 4632 wrote to memory of 3696 4632 vpjjj.exe 1xlfxxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\19f0c4df6baab173de1da2b99a66f000_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\pdjdd.exec:\pdjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\llrrrrl.exec:\llrrrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\tbhbth.exec:\tbhbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\jpvpj.exec:\jpvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\xrxxxfx.exec:\xrxxxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\3nhhbh.exec:\3nhhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\ntbbbb.exec:\ntbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\jpppp.exec:\jpppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\pdppv.exec:\pdppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\nhbntb.exec:\nhbntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\rfxxrxr.exec:\rfxxrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tthnhh.exec:\tthnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\vpvvp.exec:\vpvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\bbtttt.exec:\bbtttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\nhhbhb.exec:\nhhbhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\rlxflll.exec:\rlxflll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\hhbbhb.exec:\hhbbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\lrllxrr.exec:\lrllxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\xrflfrr.exec:\xrflfrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\vpjjj.exec:\vpjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\1xlfxxx.exec:\1xlfxxx.exe23⤵
- Executes dropped EXE
PID:3696 -
\??\c:\nbhbbt.exec:\nbhbbt.exe24⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\bnbhnt.exec:\bnbhnt.exe26⤵
- Executes dropped EXE
PID:4236 -
\??\c:\7fxrxff.exec:\7fxrxff.exe27⤵
- Executes dropped EXE
PID:1652 -
\??\c:\flrrllf.exec:\flrrllf.exe28⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vpjdd.exec:\vpjdd.exe29⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vjvjp.exec:\vjvjp.exe30⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nthhnn.exec:\nthhnn.exe31⤵
- Executes dropped EXE
PID:1912 -
\??\c:\nhnhbb.exec:\nhnhbb.exe32⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rflflxx.exec:\rflflxx.exe33⤵
- Executes dropped EXE
PID:3436 -
\??\c:\vvjdp.exec:\vvjdp.exe34⤵
- Executes dropped EXE
PID:3660 -
\??\c:\rxfxxxf.exec:\rxfxxxf.exe35⤵
- Executes dropped EXE
PID:828 -
\??\c:\tbtnnn.exec:\tbtnnn.exe36⤵
- Executes dropped EXE
PID:4408 -
\??\c:\vvjpj.exec:\vvjpj.exe37⤵
- Executes dropped EXE
PID:860 -
\??\c:\fxlfllr.exec:\fxlfllr.exe38⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3hbbhn.exec:\3hbbhn.exe39⤵
- Executes dropped EXE
PID:644 -
\??\c:\vjjdv.exec:\vjjdv.exe40⤵
- Executes dropped EXE
PID:912 -
\??\c:\7dpjv.exec:\7dpjv.exe41⤵PID:776
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe42⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tnbbbh.exec:\tnbbbh.exe43⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jvvpp.exec:\jvvpp.exe44⤵
- Executes dropped EXE
PID:4992 -
\??\c:\xxffrrl.exec:\xxffrrl.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hhhhbb.exec:\hhhhbb.exe46⤵
- Executes dropped EXE
PID:4988 -
\??\c:\vjjpd.exec:\vjjpd.exe47⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe48⤵
- Executes dropped EXE
PID:4972 -
\??\c:\ddjjp.exec:\ddjjp.exe49⤵
- Executes dropped EXE
PID:3944 -
\??\c:\xxrlfrr.exec:\xxrlfrr.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hhbbnb.exec:\hhbbnb.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lfrfxff.exec:\lfrfxff.exe52⤵
- Executes dropped EXE
PID:1300 -
\??\c:\1hnhbb.exec:\1hnhbb.exe53⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lrffxxr.exec:\lrffxxr.exe54⤵
- Executes dropped EXE
PID:5020 -
\??\c:\thbhbh.exec:\thbhbh.exe55⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jjvvd.exec:\jjvvd.exe56⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xlrlllf.exec:\xlrlllf.exe57⤵
- Executes dropped EXE
PID:436 -
\??\c:\xxfrrrr.exec:\xxfrrrr.exe58⤵
- Executes dropped EXE
PID:4612 -
\??\c:\hnhnnh.exec:\hnhnnh.exe59⤵
- Executes dropped EXE
PID:4888 -
\??\c:\vpdvv.exec:\vpdvv.exe60⤵
- Executes dropped EXE
PID:2008 -
\??\c:\hbhhhh.exec:\hbhhhh.exe61⤵
- Executes dropped EXE
PID:5008 -
\??\c:\jpdvp.exec:\jpdvp.exe62⤵
- Executes dropped EXE
PID:4800 -
\??\c:\hbnnbb.exec:\hbnnbb.exe63⤵
- Executes dropped EXE
PID:1256 -
\??\c:\9vdvv.exec:\9vdvv.exe64⤵
- Executes dropped EXE
PID:1392 -
\??\c:\rrlfrrx.exec:\rrlfrrx.exe65⤵
- Executes dropped EXE
PID:3308 -
\??\c:\httttn.exec:\httttn.exe66⤵
- Executes dropped EXE
PID:3672 -
\??\c:\jddvp.exec:\jddvp.exe67⤵PID:3060
-
\??\c:\xxlllrr.exec:\xxlllrr.exe68⤵PID:3228
-
\??\c:\bbhbbb.exec:\bbhbbb.exe69⤵PID:4960
-
\??\c:\bhbbnn.exec:\bhbbnn.exe70⤵PID:4528
-
\??\c:\jjvpj.exec:\jjvpj.exe71⤵PID:2224
-
\??\c:\lrxrxxl.exec:\lrxrxxl.exe72⤵PID:1080
-
\??\c:\bhnnhn.exec:\bhnnhn.exe73⤵PID:1416
-
\??\c:\jpdvv.exec:\jpdvv.exe74⤵PID:1960
-
\??\c:\1vpjj.exec:\1vpjj.exe75⤵PID:3484
-
\??\c:\fxfffrr.exec:\fxfffrr.exe76⤵PID:1248
-
\??\c:\1hbttt.exec:\1hbttt.exe77⤵PID:1424
-
\??\c:\djppv.exec:\djppv.exe78⤵PID:2064
-
\??\c:\1lrflrx.exec:\1lrflrx.exe79⤵PID:3792
-
\??\c:\tnbbnb.exec:\tnbbnb.exe80⤵PID:1696
-
\??\c:\djvvv.exec:\djvvv.exe81⤵PID:3068
-
\??\c:\pdddv.exec:\pdddv.exe82⤵PID:2784
-
\??\c:\lllfxlx.exec:\lllfxlx.exe83⤵PID:884
-
\??\c:\7ttnhb.exec:\7ttnhb.exe84⤵PID:3480
-
\??\c:\ddjjd.exec:\ddjjd.exe85⤵PID:2096
-
\??\c:\rfrrllr.exec:\rfrrllr.exe86⤵PID:644
-
\??\c:\bhttnn.exec:\bhttnn.exe87⤵PID:1428
-
\??\c:\9bnhhh.exec:\9bnhhh.exe88⤵PID:1816
-
\??\c:\jppvp.exec:\jppvp.exe89⤵PID:3852
-
\??\c:\flrrffx.exec:\flrrffx.exe90⤵PID:4492
-
\??\c:\btttth.exec:\btttth.exe91⤵PID:3988
-
\??\c:\nhbbnb.exec:\nhbbnb.exe92⤵PID:336
-
\??\c:\pvjdp.exec:\pvjdp.exe93⤵PID:4972
-
\??\c:\xlfxfff.exec:\xlfxfff.exe94⤵PID:2240
-
\??\c:\hbbtbb.exec:\hbbtbb.exe95⤵PID:1636
-
\??\c:\pppvj.exec:\pppvj.exe96⤵PID:2888
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe97⤵PID:4764
-
\??\c:\xxlfffr.exec:\xxlfffr.exe98⤵PID:5020
-
\??\c:\thhbtt.exec:\thhbtt.exe99⤵PID:3452
-
\??\c:\dvddj.exec:\dvddj.exe100⤵PID:2180
-
\??\c:\hnbbtn.exec:\hnbbtn.exe101⤵PID:436
-
\??\c:\thnnbh.exec:\thnnbh.exe102⤵PID:2944
-
\??\c:\frxrrff.exec:\frxrrff.exe103⤵PID:2580
-
\??\c:\3nbtbh.exec:\3nbtbh.exe104⤵PID:3680
-
\??\c:\pjvpp.exec:\pjvpp.exe105⤵PID:5044
-
\??\c:\jjvpj.exec:\jjvpj.exe106⤵PID:3128
-
\??\c:\xlrlflf.exec:\xlrlflf.exe107⤵PID:1880
-
\??\c:\bttnnb.exec:\bttnnb.exe108⤵PID:4740
-
\??\c:\ffrllll.exec:\ffrllll.exe109⤵PID:1448
-
\??\c:\1fllffx.exec:\1fllffx.exe110⤵PID:4632
-
\??\c:\vpdvp.exec:\vpdvp.exe111⤵PID:3696
-
\??\c:\5lxlrlr.exec:\5lxlrlr.exe112⤵PID:3032
-
\??\c:\hbhtnh.exec:\hbhtnh.exe113⤵PID:676
-
\??\c:\9rrlffx.exec:\9rrlffx.exe114⤵PID:396
-
\??\c:\btnhnn.exec:\btnhnn.exe115⤵PID:1336
-
\??\c:\dddvv.exec:\dddvv.exe116⤵PID:1128
-
\??\c:\nbbtnn.exec:\nbbtnn.exe117⤵PID:1744
-
\??\c:\jjppp.exec:\jjppp.exe118⤵PID:2644
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe119⤵PID:2380
-
\??\c:\xlrlllf.exec:\xlrlllf.exe120⤵PID:1404
-
\??\c:\dpjjp.exec:\dpjjp.exe121⤵PID:4812
-
\??\c:\flrlxrl.exec:\flrlxrl.exe122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-