Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 05:06
Behavioral task
behavioral1
Sample
af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe
-
Size
251KB
-
MD5
af689e9ade44e44317421df36090f9f0
-
SHA1
042433e50d04eb277f8c0796e216b100c5284bc6
-
SHA256
d80382a7ff9e24e217528ebb64e5633bfdfa8a9bd9ac823e1b8e075c1536d81f
-
SHA512
25e6a434061f0688f6f5cba6816e197041725470276224fb23f9d79e01502ce4b9ba62b6d3f8611569d2a63607e6628ad72a1af3b761179aa2b4fe8ed67c7b32
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+g:ccm4FmowdHoSi9EIBftapTs4WZazb
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/744-4-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3960-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4084-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2116-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4044-26-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4504-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3740-43-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5000-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3168-92-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2100-104-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4812-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2032-116-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1416-161-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4572-195-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4192-203-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1652-217-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1836-245-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1020-248-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1096-424-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/884-434-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2208-448-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2848-383-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/60-455-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4900-348-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3688-341-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4448-334-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4176-306-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2344-291-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/208-286-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/208-283-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2472-282-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4564-270-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1860-262-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1932-261-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2016-230-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4432-213-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2904-202-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/8-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/456-186-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4848-176-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2052-173-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1752-162-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1236-468-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4176-145-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2464-144-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4540-128-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1820-109-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4660-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4108-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3716-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5104-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1684-60-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1020-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/736-478-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4460-509-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3392-525-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3808-562-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2100-585-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2912-702-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3544-755-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4648-829-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2728-905-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3440-969-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3440-972-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\lflflfl.exe family_berbew C:\hbbtnh.exe family_berbew C:\jppjd.exe family_berbew \??\c:\xflffxl.exe family_berbew C:\5lrfxlf.exe family_berbew \??\c:\vdjdd.exe family_berbew \??\c:\rrfrrxx.exe family_berbew C:\nthntn.exe family_berbew \??\c:\5ppjv.exe family_berbew \??\c:\lrxrrrx.exe family_berbew C:\9bnhtn.exe family_berbew \??\c:\ntnhtn.exe family_berbew \??\c:\lxffllf.exe family_berbew \??\c:\vddvp.exe family_berbew \??\c:\flxxxfl.exe family_berbew \??\c:\xrffxxx.exe family_berbew \??\c:\ppddj.exe family_berbew \??\c:\xxfllrr.exe family_berbew \??\c:\9nhbtt.exe family_berbew \??\c:\jvvvv.exe family_berbew C:\xrfrlll.exe family_berbew \??\c:\jvdvp.exe family_berbew \??\c:\tnnttt.exe family_berbew \??\c:\1rffxfx.exe family_berbew \??\c:\vjpjj.exe family_berbew \??\c:\1fllfll.exe family_berbew \??\c:\ddvvp.exe family_berbew \??\c:\thnnnn.exe family_berbew \??\c:\hbhhhn.exe family_berbew \??\c:\hbbbtb.exe family_berbew \??\c:\pvpdp.exe family_berbew \??\c:\vddvp.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
lflflfl.exehbbtnh.exejppjd.exexflffxl.exe5lrfxlf.exevdjdd.exevddvp.exerrfrrxx.exenthntn.exe5ppjv.exelrxrrrx.exe9bnhtn.exentnhtn.exepvpdp.exelxffllf.exehbbbtb.exehbhhhn.exevddvp.exeflxxxfl.exexrffxxx.exethnnnn.exeddvvp.exeppddj.exe1fllfll.exexxfllrr.exe9nhbtt.exevjpjj.exejvvvv.exe1rffxfx.exexrfrlll.exetnnttt.exejvdvp.exevppjj.exellrlllf.exe5hbbtb.exehtnnhh.exejjvvj.exe5jjvp.exerxfxxxx.exe1bhbhn.exeppppp.exejddvj.exellfxrxx.exe1lxrlxx.exehtbtnn.exetnnhhh.exedpdpv.exerrrlllx.exehhhbbt.exetnnnhn.exejdpjv.exepjpjd.exerrfflrl.exelfrllrr.exetbnnnt.exetnbtnn.exe1ppjj.exevjvdp.exe5rrlllf.exe3lllllf.exehbbttt.exehhttnb.exevvppj.exejjvvv.exepid process 3960 lflflfl.exe 2116 hbbtnh.exe 4084 jppjd.exe 4044 xflffxl.exe 4504 5lrfxlf.exe 3740 vdjdd.exe 5000 vddvp.exe 1020 rrfrrxx.exe 1684 nthntn.exe 2448 5ppjv.exe 5104 lrxrrrx.exe 3716 9bnhtn.exe 4108 ntnhtn.exe 3168 pvpdp.exe 4660 lxffllf.exe 2100 hbbbtb.exe 1820 hbhhhn.exe 2032 vddvp.exe 4812 flxxxfl.exe 4540 xrffxxx.exe 3852 thnnnn.exe 4348 ddvvp.exe 4176 ppddj.exe 2464 1fllfll.exe 2460 xxfllrr.exe 1416 9nhbtt.exe 1752 vjpjj.exe 2052 jvvvv.exe 4848 1rffxfx.exe 2108 xrfrlll.exe 456 tnnttt.exe 4572 jvdvp.exe 8 vppjj.exe 2904 llrlllf.exe 4192 5hbbtb.exe 1628 htnnhh.exe 4432 jjvvj.exe 1652 5jjvp.exe 1256 rxfxxxx.exe 1040 1bhbhn.exe 928 ppppp.exe 4696 jddvj.exe 2016 llfxrxx.exe 4036 1lxrlxx.exe 1428 htbtnn.exe 4144 tnnhhh.exe 1836 dpdpv.exe 1020 rrrlllx.exe 1220 hhhbbt.exe 4280 tnnnhn.exe 4264 jdpjv.exe 1932 pjpjd.exe 1860 rrfflrl.exe 3096 lfrllrr.exe 4564 tbnnnt.exe 4032 tnbtnn.exe 2100 1ppjj.exe 2472 vjvdp.exe 208 5rrlllf.exe 1544 3lllllf.exe 2344 hbbttt.exe 556 hhttnb.exe 60 vvppj.exe 760 jjvvv.exe -
Processes:
resource yara_rule behavioral2/memory/744-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lflflfl.exe upx behavioral2/memory/744-4-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3960-6-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hbbtnh.exe upx behavioral2/memory/3960-12-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jppjd.exe upx behavioral2/memory/4084-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2116-18-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\xflffxl.exe upx behavioral2/memory/4044-26-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5lrfxlf.exe upx \??\c:\vdjdd.exe upx behavioral2/memory/4504-35-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3740-43-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5000-41-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rrfrrxx.exe upx behavioral2/memory/5000-47-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nthntn.exe upx \??\c:\5ppjv.exe upx \??\c:\lrxrrrx.exe upx C:\9bnhtn.exe upx \??\c:\ntnhtn.exe upx behavioral2/memory/3168-86-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3168-92-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lxffllf.exe upx behavioral2/memory/2100-104-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vddvp.exe upx \??\c:\flxxxfl.exe upx behavioral2/memory/4812-118-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2032-116-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\xrffxxx.exe upx \??\c:\ppddj.exe upx \??\c:\xxfllrr.exe upx \??\c:\9nhbtt.exe upx behavioral2/memory/1416-161-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\jvvvv.exe upx C:\xrfrlll.exe upx behavioral2/memory/4572-195-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4192-203-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1652-217-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1836-245-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1020-248-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2576-307-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/736-320-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1856-330-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2848-379-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1096-424-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/884-434-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1096-420-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3808-410-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4076-403-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2208-444-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2208-448-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4620-390-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2848-383-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/60-455-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4900-348-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3688-341-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4448-334-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4176-306-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2344-291-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/208-286-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/208-283-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exelflflfl.exehbbtnh.exejppjd.exexflffxl.exe5lrfxlf.exevdjdd.exevddvp.exerrfrrxx.exenthntn.exe5ppjv.exelrxrrrx.exe9bnhtn.exentnhtn.exepvpdp.exelxffllf.exehbbbtb.exehbhhhn.exevddvp.exeflxxxfl.exexrffxxx.exethnnnn.exedescription pid process target process PID 744 wrote to memory of 3960 744 af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe lflflfl.exe PID 744 wrote to memory of 3960 744 af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe lflflfl.exe PID 744 wrote to memory of 3960 744 af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe lflflfl.exe PID 3960 wrote to memory of 2116 3960 lflflfl.exe hbbtnh.exe PID 3960 wrote to memory of 2116 3960 lflflfl.exe hbbtnh.exe PID 3960 wrote to memory of 2116 3960 lflflfl.exe hbbtnh.exe PID 2116 wrote to memory of 4084 2116 hbbtnh.exe jppjd.exe PID 2116 wrote to memory of 4084 2116 hbbtnh.exe jppjd.exe PID 2116 wrote to memory of 4084 2116 hbbtnh.exe jppjd.exe PID 4084 wrote to memory of 4044 4084 jppjd.exe xflffxl.exe PID 4084 wrote to memory of 4044 4084 jppjd.exe xflffxl.exe PID 4084 wrote to memory of 4044 4084 jppjd.exe xflffxl.exe PID 4044 wrote to memory of 4504 4044 xflffxl.exe 5lrfxlf.exe PID 4044 wrote to memory of 4504 4044 xflffxl.exe 5lrfxlf.exe PID 4044 wrote to memory of 4504 4044 xflffxl.exe 5lrfxlf.exe PID 4504 wrote to memory of 3740 4504 5lrfxlf.exe vdjdd.exe PID 4504 wrote to memory of 3740 4504 5lrfxlf.exe vdjdd.exe PID 4504 wrote to memory of 3740 4504 5lrfxlf.exe vdjdd.exe PID 3740 wrote to memory of 5000 3740 vdjdd.exe jvdvp.exe PID 3740 wrote to memory of 5000 3740 vdjdd.exe jvdvp.exe PID 3740 wrote to memory of 5000 3740 vdjdd.exe jvdvp.exe PID 5000 wrote to memory of 1020 5000 vddvp.exe rrrlllx.exe PID 5000 wrote to memory of 1020 5000 vddvp.exe rrrlllx.exe PID 5000 wrote to memory of 1020 5000 vddvp.exe rrrlllx.exe PID 1020 wrote to memory of 1684 1020 rrfrrxx.exe nthntn.exe PID 1020 wrote to memory of 1684 1020 rrfrrxx.exe nthntn.exe PID 1020 wrote to memory of 1684 1020 rrfrrxx.exe nthntn.exe PID 1684 wrote to memory of 2448 1684 nthntn.exe 5ppjv.exe PID 1684 wrote to memory of 2448 1684 nthntn.exe 5ppjv.exe PID 1684 wrote to memory of 2448 1684 nthntn.exe 5ppjv.exe PID 2448 wrote to memory of 5104 2448 5ppjv.exe lrxrrrx.exe PID 2448 wrote to memory of 5104 2448 5ppjv.exe lrxrrrx.exe PID 2448 wrote to memory of 5104 2448 5ppjv.exe lrxrrrx.exe PID 5104 wrote to memory of 3716 5104 lrxrrrx.exe 9bnhtn.exe PID 5104 wrote to memory of 3716 5104 lrxrrrx.exe 9bnhtn.exe PID 5104 wrote to memory of 3716 5104 lrxrrrx.exe 9bnhtn.exe PID 3716 wrote to memory of 4108 3716 9bnhtn.exe ntnhtn.exe PID 3716 wrote to memory of 4108 3716 9bnhtn.exe ntnhtn.exe PID 3716 wrote to memory of 4108 3716 9bnhtn.exe ntnhtn.exe PID 4108 wrote to memory of 3168 4108 ntnhtn.exe pvpdp.exe PID 4108 wrote to memory of 3168 4108 ntnhtn.exe pvpdp.exe PID 4108 wrote to memory of 3168 4108 ntnhtn.exe pvpdp.exe PID 3168 wrote to memory of 4660 3168 pvpdp.exe lxffllf.exe PID 3168 wrote to memory of 4660 3168 pvpdp.exe lxffllf.exe PID 3168 wrote to memory of 4660 3168 pvpdp.exe lxffllf.exe PID 4660 wrote to memory of 2100 4660 lxffllf.exe hbbbtb.exe PID 4660 wrote to memory of 2100 4660 lxffllf.exe hbbbtb.exe PID 4660 wrote to memory of 2100 4660 lxffllf.exe hbbbtb.exe PID 2100 wrote to memory of 1820 2100 hbbbtb.exe hbhhhn.exe PID 2100 wrote to memory of 1820 2100 hbbbtb.exe hbhhhn.exe PID 2100 wrote to memory of 1820 2100 hbbbtb.exe hbhhhn.exe PID 1820 wrote to memory of 2032 1820 hbhhhn.exe vddvp.exe PID 1820 wrote to memory of 2032 1820 hbhhhn.exe vddvp.exe PID 1820 wrote to memory of 2032 1820 hbhhhn.exe vddvp.exe PID 2032 wrote to memory of 4812 2032 vddvp.exe flxxxfl.exe PID 2032 wrote to memory of 4812 2032 vddvp.exe flxxxfl.exe PID 2032 wrote to memory of 4812 2032 vddvp.exe flxxxfl.exe PID 4812 wrote to memory of 4540 4812 flxxxfl.exe xrffxxx.exe PID 4812 wrote to memory of 4540 4812 flxxxfl.exe xrffxxx.exe PID 4812 wrote to memory of 4540 4812 flxxxfl.exe xrffxxx.exe PID 4540 wrote to memory of 3852 4540 xrffxxx.exe thnnnn.exe PID 4540 wrote to memory of 3852 4540 xrffxxx.exe thnnnn.exe PID 4540 wrote to memory of 3852 4540 xrffxxx.exe thnnnn.exe PID 3852 wrote to memory of 4348 3852 thnnnn.exe ddvvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\af689e9ade44e44317421df36090f9f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\lflflfl.exec:\lflflfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\hbbtnh.exec:\hbbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\jppjd.exec:\jppjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\xflffxl.exec:\xflffxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\5lrfxlf.exec:\5lrfxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\vdjdd.exec:\vdjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\vddvp.exec:\vddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\rrfrrxx.exec:\rrfrrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\nthntn.exec:\nthntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\5ppjv.exec:\5ppjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lrxrrrx.exec:\lrxrrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\9bnhtn.exec:\9bnhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\ntnhtn.exec:\ntnhtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\pvpdp.exec:\pvpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\lxffllf.exec:\lxffllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\hbbbtb.exec:\hbbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hbhhhn.exec:\hbhhhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\vddvp.exec:\vddvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\flxxxfl.exec:\flxxxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\xrffxxx.exec:\xrffxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\thnnnn.exec:\thnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\ddvvp.exec:\ddvvp.exe23⤵
- Executes dropped EXE
PID:4348 -
\??\c:\ppddj.exec:\ppddj.exe24⤵
- Executes dropped EXE
PID:4176 -
\??\c:\1fllfll.exec:\1fllfll.exe25⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xxfllrr.exec:\xxfllrr.exe26⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9nhbtt.exec:\9nhbtt.exe27⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vjpjj.exec:\vjpjj.exe28⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jvvvv.exec:\jvvvv.exe29⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1rffxfx.exec:\1rffxfx.exe30⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xrfrlll.exec:\xrfrlll.exe31⤵
- Executes dropped EXE
PID:2108 -
\??\c:\tnnttt.exec:\tnnttt.exe32⤵
- Executes dropped EXE
PID:456 -
\??\c:\jvdvp.exec:\jvdvp.exe33⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vppjj.exec:\vppjj.exe34⤵
- Executes dropped EXE
PID:8 -
\??\c:\llrlllf.exec:\llrlllf.exe35⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5hbbtb.exec:\5hbbtb.exe36⤵
- Executes dropped EXE
PID:4192 -
\??\c:\htnnhh.exec:\htnnhh.exe37⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jjvvj.exec:\jjvvj.exe38⤵
- Executes dropped EXE
PID:4432 -
\??\c:\5jjvp.exec:\5jjvp.exe39⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rxfxxxx.exec:\rxfxxxx.exe40⤵
- Executes dropped EXE
PID:1256 -
\??\c:\1bhbhn.exec:\1bhbhn.exe41⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ppppp.exec:\ppppp.exe42⤵
- Executes dropped EXE
PID:928 -
\??\c:\jddvj.exec:\jddvj.exe43⤵
- Executes dropped EXE
PID:4696 -
\??\c:\llfxrxx.exec:\llfxrxx.exe44⤵
- Executes dropped EXE
PID:2016 -
\??\c:\1lxrlxx.exec:\1lxrlxx.exe45⤵
- Executes dropped EXE
PID:4036 -
\??\c:\htbtnn.exec:\htbtnn.exe46⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tnnhhh.exec:\tnnhhh.exe47⤵
- Executes dropped EXE
PID:4144 -
\??\c:\dpdpv.exec:\dpdpv.exe48⤵
- Executes dropped EXE
PID:1836 -
\??\c:\rrrlllx.exec:\rrrlllx.exe49⤵
- Executes dropped EXE
PID:1020 -
\??\c:\hhhbbt.exec:\hhhbbt.exe50⤵
- Executes dropped EXE
PID:1220 -
\??\c:\tnnnhn.exec:\tnnnhn.exe51⤵
- Executes dropped EXE
PID:4280 -
\??\c:\jdpjv.exec:\jdpjv.exe52⤵
- Executes dropped EXE
PID:4264 -
\??\c:\pjpjd.exec:\pjpjd.exe53⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rrfflrl.exec:\rrfflrl.exe54⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lfrllrr.exec:\lfrllrr.exe55⤵
- Executes dropped EXE
PID:3096 -
\??\c:\tbnnnt.exec:\tbnnnt.exe56⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tnbtnn.exec:\tnbtnn.exe57⤵
- Executes dropped EXE
PID:4032 -
\??\c:\1ppjj.exec:\1ppjj.exe58⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vjvdp.exec:\vjvdp.exe59⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5rrlllf.exec:\5rrlllf.exe60⤵
- Executes dropped EXE
PID:208 -
\??\c:\3lllllf.exec:\3lllllf.exe61⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hbbttt.exec:\hbbttt.exe62⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhttnb.exec:\hhttnb.exe63⤵
- Executes dropped EXE
PID:556 -
\??\c:\vvppj.exec:\vvppj.exe64⤵
- Executes dropped EXE
PID:60 -
\??\c:\jjvvv.exec:\jjvvv.exe65⤵
- Executes dropped EXE
PID:760 -
\??\c:\xxxlxxx.exec:\xxxlxxx.exe66⤵PID:4176
-
\??\c:\nbnntb.exec:\nbnntb.exe67⤵PID:2576
-
\??\c:\hnnhbb.exec:\hnnhbb.exe68⤵PID:1236
-
\??\c:\vdvvv.exec:\vdvvv.exe69⤵PID:1516
-
\??\c:\dddvv.exec:\dddvv.exe70⤵PID:1500
-
\??\c:\rflllff.exec:\rflllff.exe71⤵PID:736
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe72⤵PID:4480
-
\??\c:\nbbbtt.exec:\nbbbtt.exe73⤵PID:2940
-
\??\c:\bthhnn.exec:\bthhnn.exe74⤵PID:1856
-
\??\c:\jjddd.exec:\jjddd.exe75⤵PID:4448
-
\??\c:\dpjdv.exec:\dpjdv.exe76⤵PID:4808
-
\??\c:\3rllffr.exec:\3rllffr.exe77⤵PID:3688
-
\??\c:\flxxrxf.exec:\flxxrxf.exe78⤵PID:4900
-
\??\c:\ttttnt.exec:\ttttnt.exe79⤵PID:564
-
\??\c:\htbbtb.exec:\htbbtb.exe80⤵PID:3180
-
\??\c:\jjddd.exec:\jjddd.exe81⤵PID:2128
-
\??\c:\1dvvd.exec:\1dvvd.exe82⤵PID:4260
-
\??\c:\vvdvv.exec:\vvdvv.exe83⤵PID:744
-
\??\c:\rflfflf.exec:\rflfflf.exe84⤵PID:3392
-
\??\c:\7nttnt.exec:\7nttnt.exe85⤵PID:5072
-
\??\c:\nhhhnn.exec:\nhhhnn.exe86⤵PID:1256
-
\??\c:\ttbttt.exec:\ttbttt.exe87⤵PID:3712
-
\??\c:\vdppj.exec:\vdppj.exe88⤵PID:928
-
\??\c:\lllllff.exec:\lllllff.exe89⤵PID:2848
-
\??\c:\7httnh.exec:\7httnh.exe90⤵PID:776
-
\??\c:\tnhhhh.exec:\tnhhhh.exe91⤵PID:2332
-
\??\c:\pvddd.exec:\pvddd.exe92⤵PID:4620
-
\??\c:\jvdvv.exec:\jvdvv.exe93⤵PID:824
-
\??\c:\jvdvp.exec:\jvdvp.exe94⤵PID:5000
-
\??\c:\xxrllxf.exec:\xxrllxf.exe95⤵PID:2876
-
\??\c:\ffffxxx.exec:\ffffxxx.exe96⤵PID:4076
-
\??\c:\tbnttt.exec:\tbnttt.exe97⤵PID:3112
-
\??\c:\7tbbtb.exec:\7tbbtb.exe98⤵PID:3808
-
\??\c:\jdjpj.exec:\jdjpj.exe99⤵PID:4712
-
\??\c:\jvvpd.exec:\jvvpd.exe100⤵PID:3212
-
\??\c:\rlllfff.exec:\rlllfff.exe101⤵PID:1096
-
\??\c:\1xfxrff.exec:\1xfxrff.exe102⤵PID:4584
-
\??\c:\thhbbb.exec:\thhbbb.exe103⤵PID:512
-
\??\c:\1hhhhh.exec:\1hhhhh.exe104⤵PID:4508
-
\??\c:\9pvpj.exec:\9pvpj.exe105⤵PID:884
-
\??\c:\dpvvp.exec:\dpvvp.exe106⤵PID:2352
-
\??\c:\xrlrxxx.exec:\xrlrxxx.exe107⤵PID:3584
-
\??\c:\llffrrl.exec:\llffrrl.exe108⤵PID:2208
-
\??\c:\nbbthh.exec:\nbbthh.exe109⤵PID:2344
-
\??\c:\nhbnhh.exec:\nhbnhh.exe110⤵PID:1868
-
\??\c:\dpvpp.exec:\dpvpp.exe111⤵PID:60
-
\??\c:\7ppjj.exec:\7ppjj.exe112⤵PID:760
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe113⤵PID:4528
-
\??\c:\xrrrlxf.exec:\xrrrlxf.exe114⤵PID:2584
-
\??\c:\3nnnnn.exec:\3nnnnn.exe115⤵PID:1236
-
\??\c:\7dpvv.exec:\7dpvv.exe116⤵PID:3856
-
\??\c:\jjdjp.exec:\jjdjp.exe117⤵PID:1624
-
\??\c:\llxrrrr.exec:\llxrrrr.exe118⤵PID:736
-
\??\c:\rfrlxff.exec:\rfrlxff.exe119⤵PID:1608
-
\??\c:\btttbh.exec:\btttbh.exe120⤵PID:2940
-
\??\c:\pvddj.exec:\pvddj.exe121⤵PID:456
-
\??\c:\1fxxxff.exec:\1fxxxff.exe122⤵PID:212
-
\??\c:\xfrxlrl.exec:\xfrxlrl.exe123⤵PID:1508
-
\??\c:\hbbttt.exec:\hbbttt.exe124⤵PID:1376
-
\??\c:\bnbbhn.exec:\bnbbhn.exe125⤵PID:3792
-
\??\c:\ddjjp.exec:\ddjjp.exe126⤵PID:4460
-
\??\c:\xlrxrrl.exec:\xlrxrrl.exe127⤵PID:2440
-
\??\c:\htnhnn.exec:\htnhnn.exe128⤵PID:4880
-
\??\c:\5jpdv.exec:\5jpdv.exe129⤵PID:3516
-
\??\c:\dvddd.exec:\dvddd.exe130⤵PID:2552
-
\??\c:\lxrlxlr.exec:\lxrlxlr.exe131⤵PID:4172
-
\??\c:\bttnnn.exec:\bttnnn.exe132⤵PID:3392
-
\??\c:\vpvvp.exec:\vpvvp.exe133⤵PID:5072
-
\??\c:\fxlfxlf.exec:\fxlfxlf.exe134⤵PID:1256
-
\??\c:\lrrrfll.exec:\lrrrfll.exe135⤵PID:4044
-
\??\c:\7vvvv.exec:\7vvvv.exe136⤵PID:3668
-
\??\c:\xrflxff.exec:\xrflxff.exe137⤵PID:776
-
\??\c:\pvvjv.exec:\pvvjv.exe138⤵PID:872
-
\??\c:\3vjjj.exec:\3vjjj.exe139⤵PID:3364
-
\??\c:\1rrrlrl.exec:\1rrrlrl.exe140⤵PID:3828
-
\??\c:\xxllrxf.exec:\xxllrxf.exe141⤵PID:1836
-
\??\c:\rlfrfxr.exec:\rlfrfxr.exe142⤵PID:1460
-
\??\c:\pdjjd.exec:\pdjjd.exe143⤵PID:4992
-
\??\c:\nnbbbb.exec:\nnbbbb.exe144⤵PID:3112
-
\??\c:\jdjjd.exec:\jdjjd.exe145⤵PID:3808
-
\??\c:\rlllllf.exec:\rlllllf.exe146⤵PID:3400
-
\??\c:\hbnhtt.exec:\hbnhtt.exe147⤵PID:2396
-
\??\c:\5nbtnn.exec:\5nbtnn.exe148⤵PID:1096
-
\??\c:\bnhthh.exec:\bnhthh.exe149⤵PID:3640
-
\??\c:\3jjvd.exec:\3jjvd.exe150⤵PID:2620
-
\??\c:\vvvvp.exec:\vvvvp.exe151⤵PID:2100
-
\??\c:\lffffll.exec:\lffffll.exe152⤵PID:1736
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe153⤵PID:1544
-
\??\c:\nnhbtt.exec:\nnhbtt.exe154⤵PID:4268
-
\??\c:\pjppj.exec:\pjppj.exe155⤵PID:1868
-
\??\c:\9vvvv.exec:\9vvvv.exe156⤵PID:60
-
\??\c:\fxllflf.exec:\fxllflf.exe157⤵PID:2012
-
\??\c:\xlrrllf.exec:\xlrrllf.exe158⤵PID:1940
-
\??\c:\hhbthh.exec:\hhbthh.exe159⤵PID:1912
-
\??\c:\thnnhn.exec:\thnnhn.exe160⤵PID:2052
-
\??\c:\pvjvj.exec:\pvjvj.exe161⤵PID:1480
-
\??\c:\vpjdv.exec:\vpjdv.exe162⤵PID:2612
-
\??\c:\3lrrxxl.exec:\3lrrxxl.exe163⤵PID:3988
-
\??\c:\hhbhnb.exec:\hhbhnb.exe164⤵PID:4592
-
\??\c:\jvjjp.exec:\jvjjp.exe165⤵PID:2992
-
\??\c:\1vppp.exec:\1vppp.exe166⤵PID:3116
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe167⤵PID:4440
-
\??\c:\frfffff.exec:\frfffff.exe168⤵PID:4460
-
\??\c:\ttnthb.exec:\ttnthb.exe169⤵PID:4372
-
\??\c:\jpdvv.exec:\jpdvv.exe170⤵PID:828
-
\??\c:\pjdpp.exec:\pjdpp.exe171⤵PID:3360
-
\??\c:\rllfxxf.exec:\rllfxxf.exe172⤵PID:3200
-
\??\c:\9lllfll.exec:\9lllfll.exe173⤵PID:1040
-
\??\c:\bbbbbb.exec:\bbbbbb.exe174⤵PID:2316
-
\??\c:\pjdvv.exec:\pjdvv.exe175⤵PID:2176
-
\??\c:\3vppj.exec:\3vppj.exe176⤵PID:3668
-
\??\c:\lrrrrfl.exec:\lrrrrfl.exe177⤵PID:3340
-
\??\c:\xrrrxll.exec:\xrrrxll.exe178⤵PID:872
-
\??\c:\jdpdj.exec:\jdpdj.exe179⤵PID:824
-
\??\c:\jvpjj.exec:\jvpjj.exe180⤵PID:3036
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe181⤵PID:1460
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe182⤵PID:4992
-
\??\c:\nnnttt.exec:\nnnttt.exe183⤵PID:4228
-
\??\c:\dpvvp.exec:\dpvvp.exe184⤵PID:4124
-
\??\c:\pppdp.exec:\pppdp.exe185⤵PID:3096
-
\??\c:\rrllflx.exec:\rrllflx.exe186⤵PID:4864
-
\??\c:\tbttth.exec:\tbttth.exe187⤵PID:4564
-
\??\c:\ddddv.exec:\ddddv.exe188⤵PID:2912
-
\??\c:\rlrrffr.exec:\rlrrffr.exe189⤵PID:3648
-
\??\c:\5rxrxrr.exec:\5rxrxrr.exe190⤵PID:2380
-
\??\c:\tbnhbh.exec:\tbnhbh.exe191⤵PID:1484
-
\??\c:\jddvd.exec:\jddvd.exe192⤵PID:3128
-
\??\c:\jddvj.exec:\jddvj.exe193⤵PID:5008
-
\??\c:\rxflrlx.exec:\rxflrlx.exe194⤵PID:1660
-
\??\c:\jvvjd.exec:\jvvjd.exe195⤵PID:760
-
\??\c:\rrffrfr.exec:\rrffrfr.exe196⤵PID:2476
-
\??\c:\hbhbtn.exec:\hbhbtn.exe197⤵PID:3616
-
\??\c:\djvpj.exec:\djvpj.exe198⤵PID:4884
-
\??\c:\fxxfrxr.exec:\fxxfrxr.exe199⤵PID:2308
-
\??\c:\nttntb.exec:\nttntb.exe200⤵PID:2260
-
\??\c:\djpjd.exec:\djpjd.exe201⤵PID:4408
-
\??\c:\rfxrflf.exec:\rfxrflf.exe202⤵PID:212
-
\??\c:\llfxffl.exec:\llfxffl.exe203⤵PID:4980
-
\??\c:\hhtbtt.exec:\hhtbtt.exe204⤵PID:4080
-
\??\c:\5llfxff.exec:\5llfxff.exe205⤵PID:4308
-
\??\c:\bthtnh.exec:\bthtnh.exe206⤵PID:3544
-
\??\c:\pjvvp.exec:\pjvvp.exe207⤵PID:4948
-
\??\c:\xffxxlf.exec:\xffxxlf.exe208⤵PID:744
-
\??\c:\rlflxlf.exec:\rlflxlf.exe209⤵PID:1424
-
\??\c:\nnhbtt.exec:\nnhbtt.exe210⤵PID:3268
-
\??\c:\htnntb.exec:\htnntb.exe211⤵PID:4520
-
\??\c:\jjpvj.exec:\jjpvj.exe212⤵PID:1216
-
\??\c:\rffrlxx.exec:\rffrlxx.exe213⤵PID:2848
-
\??\c:\bnbnnn.exec:\bnbnnn.exe214⤵PID:1652
-
\??\c:\httnhn.exec:\httnhn.exe215⤵PID:2164
-
\??\c:\dpvvd.exec:\dpvvd.exe216⤵PID:2096
-
\??\c:\xrfffrf.exec:\xrfffrf.exe217⤵PID:3636
-
\??\c:\1bnhnt.exec:\1bnhnt.exe218⤵PID:2056
-
\??\c:\jvdvp.exec:\jvdvp.exe219⤵PID:2952
-
\??\c:\pvvpj.exec:\pvvpj.exe220⤵PID:2876
-
\??\c:\fxffxlf.exec:\fxffxlf.exe221⤵PID:2680
-
\??\c:\tnbbnn.exec:\tnbbnn.exe222⤵PID:4476
-
\??\c:\ddpdj.exec:\ddpdj.exe223⤵PID:4712
-
\??\c:\vjpjd.exec:\vjpjd.exe224⤵PID:3400
-
\??\c:\lfffxxl.exec:\lfffxxl.exe225⤵PID:4544
-
\??\c:\bhhhhh.exec:\bhhhhh.exe226⤵PID:1096
-
\??\c:\thnnnn.exec:\thnnnn.exe227⤵PID:4584
-
\??\c:\vdpvd.exec:\vdpvd.exe228⤵PID:2720
-
\??\c:\llllxrl.exec:\llllxrl.exe229⤵PID:4648
-
\??\c:\lxfxllf.exec:\lxfxllf.exe230⤵PID:3300
-
\??\c:\tthhnn.exec:\tthhnn.exe231⤵PID:1484
-
\??\c:\djpjp.exec:\djpjp.exe232⤵PID:1544
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe233⤵PID:2184
-
\??\c:\rlllflf.exec:\rlllflf.exe234⤵PID:2460
-
\??\c:\thnnnn.exec:\thnnnn.exe235⤵PID:760
-
\??\c:\ttnbht.exec:\ttnbht.exe236⤵PID:2476
-
\??\c:\pjjdd.exec:\pjjdd.exe237⤵PID:5040
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe238⤵PID:1856
-
\??\c:\ffxfrrr.exec:\ffxfrrr.exe239⤵PID:312
-
\??\c:\frrlffr.exec:\frrlffr.exe240⤵PID:4572
-
\??\c:\nhhhtt.exec:\nhhhtt.exe241⤵PID:3320
-