Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 02:48
Behavioral task
behavioral1
Sample
7bb17cabea901dbb0ab4785784d6ef60_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
7bb17cabea901dbb0ab4785784d6ef60_NeikiAnalytics.exe
-
Size
464KB
-
MD5
7bb17cabea901dbb0ab4785784d6ef60
-
SHA1
affed099124edf1874b2ff9f6790f3a06d0bea2c
-
SHA256
1aa76144adcdaf4cb115c59953a01b36bd05e547da523b733c91bb9c29edd947
-
SHA512
1d391bc543bb3e29091d308ee31e5a960243fe851ae21dac4ff1be3fb63dd78e75f3b394b943e3eec280adc17f2aaafe404de8e80736a4ba06709cbab25dca42
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VS:VeR0oykayRFp3lztP+OKaf1VS
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/1628-9-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3060-17-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1972-29-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2588-37-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2516-47-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2624-55-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2924-65-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2440-68-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2504-84-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2504-83-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2896-91-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2472-103-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1256-101-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2316-121-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1644-119-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2164-137-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1060-165-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2308-163-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1160-243-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/764-259-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2956-272-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1748-301-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1236-311-0x0000000077220000-0x000000007731A000-memory.dmp family_blackmoon behavioral1/memory/2952-326-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2748-359-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2400-378-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3016-334-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/408-233-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1032-441-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2728-215-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1004-192-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1796-504-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2052-523-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1880-537-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2060-575-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2948-611-0x0000000000320000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1548-623-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2652-890-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/1628-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1628-9-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\5xrlrfl.exe family_berbew C:\jjpjd.exe family_berbew behavioral1/memory/3060-17-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1972-19-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1972-23-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew C:\7frxfll.exe family_berbew behavioral1/memory/1972-29-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hhhntt.exe family_berbew behavioral1/memory/2588-37-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xxfrxxr.exe family_berbew behavioral1/memory/2516-47-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tthtnt.exe family_berbew behavioral1/memory/2624-55-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2924-65-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\7xrxrxl.exe family_berbew behavioral1/memory/2440-68-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\5hnbth.exe family_berbew behavioral1/memory/2504-84-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew behavioral1/memory/2504-83-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lxlxxff.exe family_berbew behavioral1/memory/2896-91-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hhbnbh.exe family_berbew C:\rxrxffr.exe family_berbew behavioral1/memory/2472-103-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1256-101-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hbtbht.exe family_berbew C:\vdjvp.exe family_berbew behavioral1/memory/2316-121-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1644-119-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xrlrxfx.exe family_berbew behavioral1/memory/2164-137-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vdvdv.exe family_berbew behavioral1/memory/2136-146-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\rlrffxr.exe family_berbew C:\bbbhtn.exe family_berbew behavioral1/memory/1060-165-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\jpjvj.exe family_berbew behavioral1/memory/2308-163-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tnttbn.exe family_berbew C:\frxlxrf.exe family_berbew \??\c:\9jjjv.exe family_berbew C:\fxxfrfx.exe family_berbew \??\c:\jdpjv.exe family_berbew \??\c:\xllllxf.exe family_berbew C:\vdvpd.exe family_berbew behavioral1/memory/1160-243-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/764-259-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\vvppj.exe family_berbew behavioral1/memory/2956-272-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\fxlrxxf.exe family_berbew C:\vvvpd.exe family_berbew behavioral1/memory/1748-301-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1236-311-0x0000000077220000-0x000000007731A000-memory.dmp family_berbew behavioral1/memory/2952-319-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2952-326-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2748-359-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2400-378-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2896-397-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2700-404-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/3016-334-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1236-310-0x0000000077320000-0x000000007743F000-memory.dmp family_berbew \??\c:\nnhnhb.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
5xrlrfl.exejjpjd.exe7frxfll.exehhhntt.exexxfrxxr.exetthtnt.exe7xrxrxl.exe5hnbth.exelxlxxff.exehhbnbh.exerxrxffr.exehbtbht.exevdjvp.exexrlrxfx.exevdvdv.exerlrffxr.exebbbhtn.exejpjvj.exetnttbn.exefrxlxrf.exe9jjjv.exejdpjv.exefxxfrfx.exeppjpj.exexllllxf.exebnnbnh.exevdvpd.exe3xrxffr.exennhnhb.exevvppj.exefxlrxxf.exevvvpd.exe7lflxlr.exenhbbnt.exevpjvd.exehnhnbb.exepjjpd.exefxrrrxf.exebnhhtb.exedvppv.exe3xlrxfr.exentthth.exedddjd.exexlfrfxf.exehhtthh.exehhbtnt.exevdvdv.exefxlrxxr.exe1xrllrx.exebbhnhn.exepdjpd.exexlrrflr.exebtnbtn.exejvvjj.exedvdpp.exelllflxx.exebtnbbh.exejjdvd.exe9bhbnb.exe7vjpd.exelfrxrrf.exevjjpp.exexflrrfx.exettbhtt.exepid process 3060 5xrlrfl.exe 1972 jjpjd.exe 2588 7frxfll.exe 2516 hhhntt.exe 2624 xxfrxxr.exe 2924 tthtnt.exe 2440 7xrxrxl.exe 2504 5hnbth.exe 2896 lxlxxff.exe 1256 hhbnbh.exe 2472 rxrxffr.exe 1644 hbtbht.exe 2316 vdjvp.exe 2164 xrlrxfx.exe 780 vdvdv.exe 2136 rlrffxr.exe 2308 bbbhtn.exe 1060 jpjvj.exe 2860 tnttbn.exe 592 frxlxrf.exe 1004 9jjjv.exe 1420 jdpjv.exe 2728 fxxfrfx.exe 2112 ppjpj.exe 408 xllllxf.exe 1160 bnnbnh.exe 1712 vdvpd.exe 764 3xrxffr.exe 920 nnhnhb.exe 2956 vvppj.exe 1664 fxlrxxf.exe 2936 vvvpd.exe 3004 7lflxlr.exe 1748 nhbbnt.exe 1236 vpjvd.exe 2952 hnhnbb.exe 3016 pjjpd.exe 2572 fxrrrxf.exe 2640 bnhhtb.exe 2668 dvppv.exe 2576 3xlrxfr.exe 2748 ntthth.exe 2496 dddjd.exe 2400 xlfrfxf.exe 2928 hhtthh.exe 376 hhbtnt.exe 1768 vdvdv.exe 2896 fxlrxxr.exe 2700 1xrllrx.exe 1580 bbhnhn.exe 2168 pdjpd.exe 2732 xlrrflr.exe 1472 btnbtn.exe 1032 jvvjj.exe 2564 dvdpp.exe 1336 lllflxx.exe 2020 btnbbh.exe 2024 jjdvd.exe 1060 9bhbnb.exe 2868 7vjpd.exe 720 lfrxrrf.exe 588 vjjpp.exe 2368 xflrrfx.exe 1796 ttbhtt.exe -
Processes:
resource yara_rule behavioral1/memory/1628-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1628-7-0x00000000003B0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1628-9-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\5xrlrfl.exe upx C:\jjpjd.exe upx behavioral1/memory/3060-17-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1972-19-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1972-23-0x0000000000220000-0x000000000025A000-memory.dmp upx C:\7frxfll.exe upx behavioral1/memory/1972-29-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hhhntt.exe upx behavioral1/memory/2588-37-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xxfrxxr.exe upx behavioral1/memory/2516-47-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tthtnt.exe upx behavioral1/memory/2624-55-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2924-65-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\7xrxrxl.exe upx behavioral1/memory/2440-68-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\5hnbth.exe upx behavioral1/memory/2504-83-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lxlxxff.exe upx behavioral1/memory/2896-91-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hhbnbh.exe upx C:\rxrxffr.exe upx behavioral1/memory/2472-103-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1256-101-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hbtbht.exe upx C:\vdjvp.exe upx behavioral1/memory/2316-121-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1644-119-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xrlrxfx.exe upx behavioral1/memory/2164-137-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vdvdv.exe upx behavioral1/memory/2136-146-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\rlrffxr.exe upx C:\bbbhtn.exe upx behavioral1/memory/1060-165-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\jpjvj.exe upx behavioral1/memory/2308-163-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tnttbn.exe upx C:\frxlxrf.exe upx \??\c:\9jjjv.exe upx C:\fxxfrfx.exe upx \??\c:\jdpjv.exe upx \??\c:\xllllxf.exe upx C:\vdvpd.exe upx behavioral1/memory/1160-243-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/764-259-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\vvppj.exe upx behavioral1/memory/2956-272-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\fxlrxxf.exe upx C:\vvvpd.exe upx behavioral1/memory/1748-301-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1236-311-0x0000000077220000-0x000000007731A000-memory.dmp upx behavioral1/memory/2952-319-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2952-326-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2748-359-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2400-378-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2896-397-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2700-404-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/3016-334-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nnhnhb.exe upx \??\c:\3xrxffr.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7bb17cabea901dbb0ab4785784d6ef60_NeikiAnalytics.exe5xrlrfl.exejjpjd.exe7frxfll.exehhhntt.exexxfrxxr.exetthtnt.exe7xrxrxl.exe5hnbth.exelxlxxff.exehhbnbh.exerxrxffr.exehbtbht.exevdjvp.exexrlrxfx.exevdvdv.exedescription pid process target process PID 1628 wrote to memory of 3060 1628 7bb17cabea901dbb0ab4785784d6ef60_NeikiAnalytics.exe 5xrlrfl.exe PID 1628 wrote to memory of 3060 1628 7bb17cabea901dbb0ab4785784d6ef60_NeikiAnalytics.exe 5xrlrfl.exe PID 1628 wrote to memory of 3060 1628 7bb17cabea901dbb0ab4785784d6ef60_NeikiAnalytics.exe 5xrlrfl.exe PID 1628 wrote to memory of 3060 1628 7bb17cabea901dbb0ab4785784d6ef60_NeikiAnalytics.exe 5xrlrfl.exe PID 3060 wrote to memory of 1972 3060 5xrlrfl.exe jjpjd.exe PID 3060 wrote to memory of 1972 3060 5xrlrfl.exe jjpjd.exe PID 3060 wrote to memory of 1972 3060 5xrlrfl.exe jjpjd.exe PID 3060 wrote to memory of 1972 3060 5xrlrfl.exe jjpjd.exe PID 1972 wrote to memory of 2588 1972 jjpjd.exe 7frxfll.exe PID 1972 wrote to memory of 2588 1972 jjpjd.exe 7frxfll.exe PID 1972 wrote to memory of 2588 1972 jjpjd.exe 7frxfll.exe PID 1972 wrote to memory of 2588 1972 jjpjd.exe 7frxfll.exe PID 2588 wrote to memory of 2516 2588 7frxfll.exe hhhntt.exe PID 2588 wrote to memory of 2516 2588 7frxfll.exe hhhntt.exe PID 2588 wrote to memory of 2516 2588 7frxfll.exe hhhntt.exe PID 2588 wrote to memory of 2516 2588 7frxfll.exe hhhntt.exe PID 2516 wrote to memory of 2624 2516 hhhntt.exe xxfrxxr.exe PID 2516 wrote to memory of 2624 2516 hhhntt.exe xxfrxxr.exe PID 2516 wrote to memory of 2624 2516 hhhntt.exe xxfrxxr.exe PID 2516 wrote to memory of 2624 2516 hhhntt.exe xxfrxxr.exe PID 2624 wrote to memory of 2924 2624 xxfrxxr.exe tthtnt.exe PID 2624 wrote to memory of 2924 2624 xxfrxxr.exe tthtnt.exe PID 2624 wrote to memory of 2924 2624 xxfrxxr.exe tthtnt.exe PID 2624 wrote to memory of 2924 2624 xxfrxxr.exe tthtnt.exe PID 2924 wrote to memory of 2440 2924 tthtnt.exe 7xrxrxl.exe PID 2924 wrote to memory of 2440 2924 tthtnt.exe 7xrxrxl.exe PID 2924 wrote to memory of 2440 2924 tthtnt.exe 7xrxrxl.exe PID 2924 wrote to memory of 2440 2924 tthtnt.exe 7xrxrxl.exe PID 2440 wrote to memory of 2504 2440 7xrxrxl.exe 5hnbth.exe PID 2440 wrote to memory of 2504 2440 7xrxrxl.exe 5hnbth.exe PID 2440 wrote to memory of 2504 2440 7xrxrxl.exe 5hnbth.exe PID 2440 wrote to memory of 2504 2440 7xrxrxl.exe 5hnbth.exe PID 2504 wrote to memory of 2896 2504 5hnbth.exe lxlxxff.exe PID 2504 wrote to memory of 2896 2504 5hnbth.exe lxlxxff.exe PID 2504 wrote to memory of 2896 2504 5hnbth.exe lxlxxff.exe PID 2504 wrote to memory of 2896 2504 5hnbth.exe lxlxxff.exe PID 2896 wrote to memory of 1256 2896 lxlxxff.exe hhbnbh.exe PID 2896 wrote to memory of 1256 2896 lxlxxff.exe hhbnbh.exe PID 2896 wrote to memory of 1256 2896 lxlxxff.exe hhbnbh.exe PID 2896 wrote to memory of 1256 2896 lxlxxff.exe hhbnbh.exe PID 1256 wrote to memory of 2472 1256 hhbnbh.exe rxrxffr.exe PID 1256 wrote to memory of 2472 1256 hhbnbh.exe rxrxffr.exe PID 1256 wrote to memory of 2472 1256 hhbnbh.exe rxrxffr.exe PID 1256 wrote to memory of 2472 1256 hhbnbh.exe rxrxffr.exe PID 2472 wrote to memory of 1644 2472 rxrxffr.exe hbtbht.exe PID 2472 wrote to memory of 1644 2472 rxrxffr.exe hbtbht.exe PID 2472 wrote to memory of 1644 2472 rxrxffr.exe hbtbht.exe PID 2472 wrote to memory of 1644 2472 rxrxffr.exe hbtbht.exe PID 1644 wrote to memory of 2316 1644 hbtbht.exe vdjvp.exe PID 1644 wrote to memory of 2316 1644 hbtbht.exe vdjvp.exe PID 1644 wrote to memory of 2316 1644 hbtbht.exe vdjvp.exe PID 1644 wrote to memory of 2316 1644 hbtbht.exe vdjvp.exe PID 2316 wrote to memory of 2164 2316 vdjvp.exe xrlrxfx.exe PID 2316 wrote to memory of 2164 2316 vdjvp.exe xrlrxfx.exe PID 2316 wrote to memory of 2164 2316 vdjvp.exe xrlrxfx.exe PID 2316 wrote to memory of 2164 2316 vdjvp.exe xrlrxfx.exe PID 2164 wrote to memory of 780 2164 xrlrxfx.exe vdvdv.exe PID 2164 wrote to memory of 780 2164 xrlrxfx.exe vdvdv.exe PID 2164 wrote to memory of 780 2164 xrlrxfx.exe vdvdv.exe PID 2164 wrote to memory of 780 2164 xrlrxfx.exe vdvdv.exe PID 780 wrote to memory of 2136 780 vdvdv.exe rlrffxr.exe PID 780 wrote to memory of 2136 780 vdvdv.exe rlrffxr.exe PID 780 wrote to memory of 2136 780 vdvdv.exe rlrffxr.exe PID 780 wrote to memory of 2136 780 vdvdv.exe rlrffxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bb17cabea901dbb0ab4785784d6ef60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7bb17cabea901dbb0ab4785784d6ef60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\5xrlrfl.exec:\5xrlrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjpjd.exec:\jjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7frxfll.exec:\7frxfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhhntt.exec:\hhhntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxfrxxr.exec:\xxfrxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthtnt.exec:\tthtnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7xrxrxl.exec:\7xrxrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hnbth.exec:\5hnbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxlxxff.exec:\lxlxxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbnbh.exec:\hhbnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrxffr.exec:\rxrxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbtbht.exec:\hbtbht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjvp.exec:\vdjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrlrxfx.exec:\xrlrxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdvdv.exec:\vdvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrffxr.exec:\rlrffxr.exe17⤵
- Executes dropped EXE
-
\??\c:\bbbhtn.exec:\bbbhtn.exe18⤵
- Executes dropped EXE
-
\??\c:\jpjvj.exec:\jpjvj.exe19⤵
- Executes dropped EXE
-
\??\c:\tnttbn.exec:\tnttbn.exe20⤵
- Executes dropped EXE
-
\??\c:\frxlxrf.exec:\frxlxrf.exe21⤵
- Executes dropped EXE
-
\??\c:\9jjjv.exec:\9jjjv.exe22⤵
- Executes dropped EXE
-
\??\c:\jdpjv.exec:\jdpjv.exe23⤵
- Executes dropped EXE
-
\??\c:\fxxfrfx.exec:\fxxfrfx.exe24⤵
- Executes dropped EXE
-
\??\c:\ppjpj.exec:\ppjpj.exe25⤵
- Executes dropped EXE
-
\??\c:\xllllxf.exec:\xllllxf.exe26⤵
- Executes dropped EXE
-
\??\c:\bnnbnh.exec:\bnnbnh.exe27⤵
- Executes dropped EXE
-
\??\c:\vdvpd.exec:\vdvpd.exe28⤵
- Executes dropped EXE
-
\??\c:\3xrxffr.exec:\3xrxffr.exe29⤵
- Executes dropped EXE
-
\??\c:\nnhnhb.exec:\nnhnhb.exe30⤵
- Executes dropped EXE
-
\??\c:\vvppj.exec:\vvppj.exe31⤵
- Executes dropped EXE
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe32⤵
- Executes dropped EXE
-
\??\c:\vvvpd.exec:\vvvpd.exe33⤵
- Executes dropped EXE
-
\??\c:\7lflxlr.exec:\7lflxlr.exe34⤵
- Executes dropped EXE
-
\??\c:\nhbbnt.exec:\nhbbnt.exe35⤵
- Executes dropped EXE
-
\??\c:\vpjvd.exec:\vpjvd.exe36⤵
- Executes dropped EXE
-
\??\c:\9lxrflr.exec:\9lxrflr.exe37⤵
-
\??\c:\hnhnbb.exec:\hnhnbb.exe38⤵
- Executes dropped EXE
-
\??\c:\pjjpd.exec:\pjjpd.exe39⤵
- Executes dropped EXE
-
\??\c:\fxrrrxf.exec:\fxrrrxf.exe40⤵
- Executes dropped EXE
-
\??\c:\bnhhtb.exec:\bnhhtb.exe41⤵
- Executes dropped EXE
-
\??\c:\dvppv.exec:\dvppv.exe42⤵
- Executes dropped EXE
-
\??\c:\3xlrxfr.exec:\3xlrxfr.exe43⤵
- Executes dropped EXE
-
\??\c:\ntthth.exec:\ntthth.exe44⤵
- Executes dropped EXE
-
\??\c:\dddjd.exec:\dddjd.exe45⤵
- Executes dropped EXE
-
\??\c:\xlfrfxf.exec:\xlfrfxf.exe46⤵
- Executes dropped EXE
-
\??\c:\hhtthh.exec:\hhtthh.exe47⤵
- Executes dropped EXE
-
\??\c:\hhbtnt.exec:\hhbtnt.exe48⤵
- Executes dropped EXE
-
\??\c:\vdvdv.exec:\vdvdv.exe49⤵
- Executes dropped EXE
-
\??\c:\fxlrxxr.exec:\fxlrxxr.exe50⤵
- Executes dropped EXE
-
\??\c:\1xrllrx.exec:\1xrllrx.exe51⤵
- Executes dropped EXE
-
\??\c:\bbhnhn.exec:\bbhnhn.exe52⤵
- Executes dropped EXE
-
\??\c:\pdjpd.exec:\pdjpd.exe53⤵
- Executes dropped EXE
-
\??\c:\xlrrflr.exec:\xlrrflr.exe54⤵
- Executes dropped EXE
-
\??\c:\btnbtn.exec:\btnbtn.exe55⤵
- Executes dropped EXE
-
\??\c:\jvvjj.exec:\jvvjj.exe56⤵
- Executes dropped EXE
-
\??\c:\dvdpp.exec:\dvdpp.exe57⤵
- Executes dropped EXE
-
\??\c:\lllflxx.exec:\lllflxx.exe58⤵
- Executes dropped EXE
-
\??\c:\btnbbh.exec:\btnbbh.exe59⤵
- Executes dropped EXE
-
\??\c:\jjdvd.exec:\jjdvd.exe60⤵
- Executes dropped EXE
-
\??\c:\9bhbnb.exec:\9bhbnb.exe61⤵
- Executes dropped EXE
-
\??\c:\7vjpd.exec:\7vjpd.exe62⤵
- Executes dropped EXE
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe63⤵
- Executes dropped EXE
-
\??\c:\vjjpp.exec:\vjjpp.exe64⤵
- Executes dropped EXE
-
\??\c:\xflrrfx.exec:\xflrrfx.exe65⤵
- Executes dropped EXE
-
\??\c:\ttbhtt.exec:\ttbhtt.exe66⤵
- Executes dropped EXE
-
\??\c:\3jvdp.exec:\3jvdp.exe67⤵
-
\??\c:\httbnb.exec:\httbnb.exe68⤵
-
\??\c:\7flllrf.exec:\7flllrf.exe69⤵
-
\??\c:\5nbntt.exec:\5nbntt.exe70⤵
-
\??\c:\djjvj.exec:\djjvj.exe71⤵
-
\??\c:\lffxxfl.exec:\lffxxfl.exe72⤵
-
\??\c:\tbnnhn.exec:\tbnnhn.exe73⤵
-
\??\c:\nnbntb.exec:\nnbntb.exe74⤵
-
\??\c:\jdddj.exec:\jdddj.exe75⤵
-
\??\c:\rlxfrrl.exec:\rlxfrrl.exe76⤵
-
\??\c:\bhbttt.exec:\bhbttt.exe77⤵
-
\??\c:\1dvdj.exec:\1dvdj.exe78⤵
-
\??\c:\xlffllx.exec:\xlffllx.exe79⤵
-
\??\c:\3bttbn.exec:\3bttbn.exe80⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe81⤵
-
\??\c:\lxfffxr.exec:\lxfffxr.exe82⤵
-
\??\c:\1hnthn.exec:\1hnthn.exe83⤵
-
\??\c:\pdvjv.exec:\pdvjv.exe84⤵
-
\??\c:\9vdpv.exec:\9vdpv.exe85⤵
-
\??\c:\xlrrfxf.exec:\xlrrfxf.exe86⤵
-
\??\c:\vpvjv.exec:\vpvjv.exe87⤵
-
\??\c:\rlxlxxx.exec:\rlxlxxx.exe88⤵
-
\??\c:\nhbnbn.exec:\nhbnbn.exe89⤵
-
\??\c:\dvvpp.exec:\dvvpp.exe90⤵
-
\??\c:\llxlxrr.exec:\llxlxrr.exe91⤵
-
\??\c:\nbttbn.exec:\nbttbn.exe92⤵
-
\??\c:\vpjvj.exec:\vpjvj.exe93⤵
-
\??\c:\ffllrxl.exec:\ffllrxl.exe94⤵
-
\??\c:\nhbbhn.exec:\nhbbhn.exe95⤵
-
\??\c:\5ppdj.exec:\5ppdj.exe96⤵
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe97⤵
-
\??\c:\rrlxlrl.exec:\rrlxlrl.exe98⤵
-
\??\c:\nhhbnt.exec:\nhhbnt.exe99⤵
-
\??\c:\dddpd.exec:\dddpd.exe100⤵
-
\??\c:\5fflrfr.exec:\5fflrfr.exe101⤵
-
\??\c:\hbbnbb.exec:\hbbnbb.exe102⤵
-
\??\c:\ddvvj.exec:\ddvvj.exe103⤵
-
\??\c:\fxllrlx.exec:\fxllrlx.exe104⤵
-
\??\c:\rrrfxlf.exec:\rrrfxlf.exe105⤵
-
\??\c:\bthntb.exec:\bthntb.exe106⤵
-
\??\c:\vddjv.exec:\vddjv.exe107⤵
-
\??\c:\rrffrfr.exec:\rrffrfr.exe108⤵
-
\??\c:\lfrxflx.exec:\lfrxflx.exe109⤵
-
\??\c:\tnnhbn.exec:\tnnhbn.exe110⤵
-
\??\c:\pjddp.exec:\pjddp.exe111⤵
-
\??\c:\1lfxxlr.exec:\1lfxxlr.exe112⤵
-
\??\c:\thnhtt.exec:\thnhtt.exe113⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe114⤵
-
\??\c:\1pjpd.exec:\1pjpd.exe115⤵
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe116⤵
-
\??\c:\tnttth.exec:\tnttth.exe117⤵
-
\??\c:\pjdjd.exec:\pjdjd.exe118⤵
-
\??\c:\rrlrrrx.exec:\rrlrrrx.exe119⤵
-
\??\c:\nhtntt.exec:\nhtntt.exe120⤵
-
\??\c:\vjdjj.exec:\vjdjj.exe121⤵
-
\??\c:\lxrxxfr.exec:\lxrxxfr.exe122⤵
-
\??\c:\bhbbnt.exec:\bhbbnt.exe123⤵
-
\??\c:\btttbb.exec:\btttbb.exe124⤵
-
\??\c:\dpvvd.exec:\dpvvd.exe125⤵
-
\??\c:\fxrflrr.exec:\fxrflrr.exe126⤵
-
\??\c:\ntntnh.exec:\ntntnh.exe127⤵
-
\??\c:\vpvpv.exec:\vpvpv.exe128⤵
-
\??\c:\9jdjp.exec:\9jdjp.exe129⤵
-
\??\c:\xxllrfr.exec:\xxllrfr.exe130⤵
-
\??\c:\nnttbn.exec:\nnttbn.exe131⤵
-
\??\c:\vdjpj.exec:\vdjpj.exe132⤵
-
\??\c:\1xlrffl.exec:\1xlrffl.exe133⤵
-
\??\c:\ffxfrfr.exec:\ffxfrfr.exe134⤵
-
\??\c:\hhnttt.exec:\hhnttt.exe135⤵
-
\??\c:\ddjdp.exec:\ddjdp.exe136⤵
-
\??\c:\rflxflr.exec:\rflxflr.exe137⤵
-
\??\c:\llxrlrf.exec:\llxrlrf.exe138⤵
-
\??\c:\1nhtbb.exec:\1nhtbb.exe139⤵
-
\??\c:\jjddd.exec:\jjddd.exe140⤵
-
\??\c:\lfxlrfl.exec:\lfxlrfl.exe141⤵
-
\??\c:\1rllrxf.exec:\1rllrxf.exe142⤵
-
\??\c:\hbthtb.exec:\hbthtb.exe143⤵
-
\??\c:\3pppj.exec:\3pppj.exe144⤵
-
\??\c:\1lrxlfl.exec:\1lrxlfl.exe145⤵
-
\??\c:\frxfxff.exec:\frxfxff.exe146⤵
-
\??\c:\tnnhnh.exec:\tnnhnh.exe147⤵
-
\??\c:\vdvdj.exec:\vdvdj.exe148⤵
-
\??\c:\9lflrxr.exec:\9lflrxr.exe149⤵
-
\??\c:\lxfflrx.exec:\lxfflrx.exe150⤵
-
\??\c:\tnhntb.exec:\tnhntb.exe151⤵
-
\??\c:\ppjjp.exec:\ppjjp.exe152⤵
-
\??\c:\xrlrflf.exec:\xrlrflf.exe153⤵
-
\??\c:\tnnbnb.exec:\tnnbnb.exe154⤵
-
\??\c:\5nnbtb.exec:\5nnbtb.exe155⤵
-
\??\c:\1jjpv.exec:\1jjpv.exe156⤵
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe157⤵
-
\??\c:\bntbbh.exec:\bntbbh.exe158⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe159⤵
-
\??\c:\5rrxflr.exec:\5rrxflr.exe160⤵
-
\??\c:\ffxlxfx.exec:\ffxlxfx.exe161⤵
-
\??\c:\bhbhth.exec:\bhbhth.exe162⤵
-
\??\c:\jjvpd.exec:\jjvpd.exe163⤵
-
\??\c:\lfxfllr.exec:\lfxfllr.exe164⤵
-
\??\c:\lrlrffx.exec:\lrlrffx.exe165⤵
-
\??\c:\tnbtht.exec:\tnbtht.exe166⤵
-
\??\c:\tnnnnh.exec:\tnnnnh.exe167⤵
-
\??\c:\jjjvj.exec:\jjjvj.exe168⤵
-
\??\c:\rlllrxr.exec:\rlllrxr.exe169⤵
-
\??\c:\nhttbb.exec:\nhttbb.exe170⤵
-
\??\c:\jvddj.exec:\jvddj.exe171⤵
-
\??\c:\vjppv.exec:\vjppv.exe172⤵
-
\??\c:\xflflfl.exec:\xflflfl.exe173⤵
-
\??\c:\bnhnnn.exec:\bnhnnn.exe174⤵
-
\??\c:\ppvpp.exec:\ppvpp.exe175⤵
-
\??\c:\ffllrrx.exec:\ffllrrx.exe176⤵
-
\??\c:\1lrxlll.exec:\1lrxlll.exe177⤵
-
\??\c:\9bbhbt.exec:\9bbhbt.exe178⤵
-
\??\c:\7vpvd.exec:\7vpvd.exe179⤵
-
\??\c:\jjjvp.exec:\jjjvp.exe180⤵
-
\??\c:\7rlxflr.exec:\7rlxflr.exe181⤵
-
\??\c:\bbnnbb.exec:\bbnnbb.exe182⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe183⤵
-
\??\c:\vjvdd.exec:\vjvdd.exe184⤵
-
\??\c:\xrlfxlr.exec:\xrlfxlr.exe185⤵
-
\??\c:\thtnnb.exec:\thtnnb.exe186⤵
-
\??\c:\dpdvd.exec:\dpdvd.exe187⤵
-
\??\c:\jdvjj.exec:\jdvjj.exe188⤵
-
\??\c:\fxxfrff.exec:\fxxfrff.exe189⤵
-
\??\c:\bnbbhb.exec:\bnbbhb.exe190⤵
-
\??\c:\jjdpd.exec:\jjdpd.exe191⤵
-
\??\c:\ppjpj.exec:\ppjpj.exe192⤵
-
\??\c:\9xllxrf.exec:\9xllxrf.exe193⤵
-
\??\c:\5ttnhh.exec:\5ttnhh.exe194⤵
-
\??\c:\bhthhb.exec:\bhthhb.exe195⤵
-
\??\c:\1pvdp.exec:\1pvdp.exe196⤵
-
\??\c:\3rrxxlx.exec:\3rrxxlx.exe197⤵
-
\??\c:\rrrfllx.exec:\rrrfllx.exe198⤵
-
\??\c:\hthnhh.exec:\hthnhh.exe199⤵
-
\??\c:\dvvdp.exec:\dvvdp.exe200⤵
-
\??\c:\lxfxlrr.exec:\lxfxlrr.exe201⤵
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe202⤵
-
\??\c:\tthnht.exec:\tthnht.exe203⤵
-
\??\c:\jdvdj.exec:\jdvdj.exe204⤵
-
\??\c:\dvppv.exec:\dvppv.exe205⤵
-
\??\c:\rrrxlrx.exec:\rrrxlrx.exe206⤵
-
\??\c:\lrlflrf.exec:\lrlflrf.exe207⤵
-
\??\c:\nnnthn.exec:\nnnthn.exe208⤵
-
\??\c:\vdvdd.exec:\vdvdd.exe209⤵
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe210⤵
-
\??\c:\fxfrffx.exec:\fxfrffx.exe211⤵
-
\??\c:\9nhnbh.exec:\9nhnbh.exe212⤵
-
\??\c:\vddpd.exec:\vddpd.exe213⤵
-
\??\c:\xxxfxlx.exec:\xxxfxlx.exe214⤵
-
\??\c:\9lxllrx.exec:\9lxllrx.exe215⤵
-
\??\c:\hntbhb.exec:\hntbhb.exe216⤵
-
\??\c:\vvvdd.exec:\vvvdd.exe217⤵
-
\??\c:\9ddjj.exec:\9ddjj.exe218⤵
-
\??\c:\7xfrflr.exec:\7xfrflr.exe219⤵
-
\??\c:\bbthtb.exec:\bbthtb.exe220⤵
-
\??\c:\nhhnhn.exec:\nhhnhn.exe221⤵
-
\??\c:\jjjpp.exec:\jjjpp.exe222⤵
-
\??\c:\fllxlrf.exec:\fllxlrf.exe223⤵
-
\??\c:\fxrllll.exec:\fxrllll.exe224⤵
-
\??\c:\thhthb.exec:\thhthb.exe225⤵
-
\??\c:\3jjjp.exec:\3jjjp.exe226⤵
-
\??\c:\fllrlff.exec:\fllrlff.exe227⤵
-
\??\c:\xrffrxx.exec:\xrffrxx.exe228⤵
-
\??\c:\7bhtnb.exec:\7bhtnb.exe229⤵
-
\??\c:\vjddd.exec:\vjddd.exe230⤵
-
\??\c:\7xxlrrl.exec:\7xxlrrl.exe231⤵
-
\??\c:\tnhbhn.exec:\tnhbhn.exe232⤵
-
\??\c:\jppjv.exec:\jppjv.exe233⤵
-
\??\c:\jpvjd.exec:\jpvjd.exe234⤵
-
\??\c:\9rllrrx.exec:\9rllrrx.exe235⤵
-
\??\c:\nhtttb.exec:\nhtttb.exe236⤵
-
\??\c:\vjvjd.exec:\vjvjd.exe237⤵
-
\??\c:\5djjj.exec:\5djjj.exe238⤵
-
\??\c:\fxxxflx.exec:\fxxxflx.exe239⤵
-
\??\c:\nbtbhh.exec:\nbtbhh.exe240⤵
-
\??\c:\5jjpd.exec:\5jjpd.exe241⤵