Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 22:32
Behavioral task
behavioral1
Sample
081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe
-
Size
212KB
-
MD5
081a7d566ac990d82a1ed60b834a22b0
-
SHA1
ca5ad62e37ae1193d821f861520542ffdbbdff11
-
SHA256
e62497ff6d4effe189801b4761939b082811183d69ce45196f025bf07b7a5c72
-
SHA512
8e2b9ae3f8ff155e6b6155419e7eec1f30a3216c435db666fead1c9d6562090e1f67d2de3f78f86a13ac421b18a7b44ee43544bf4f5cd66057a5c75f0122396e
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+lZ:V4wFHoSBK/ubLcfv
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3160-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4980-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2500-15-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1620-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4756-234-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3364-238-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4384-241-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4404-240-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4232-227-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/836-202-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4832-192-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3004-180-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1884-174-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1556-168-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1048-162-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3012-156-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3164-150-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/668-139-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/812-123-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3428-117-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2340-102-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1064-95-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3236-89-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4792-83-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4656-77-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1304-71-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1780-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3516-49-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4188-43-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3084-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3780-25-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/452-250-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/452-253-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/396-271-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3648-272-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5036-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2180-321-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1712-327-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4636-338-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3748-357-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2364-367-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1072-374-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4704-394-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4884-406-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4384-413-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3780-421-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3276-432-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2456-453-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4240-471-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/668-483-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2160-487-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2132-497-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2932-504-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2068-544-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3152-602-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3536-618-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1680-663-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1544-690-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1376-700-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1064-757-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/844-842-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1308-855-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2488-910-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1620-990-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/3160-0-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\ffffxxr.exe family_berbew behavioral2/memory/3160-5-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\nhnhhn.exe family_berbew behavioral2/memory/4980-13-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2500-15-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1620-19-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew C:\pdpjj.exe family_berbew C:\jpvvd.exe family_berbew C:\lxrlrrr.exe family_berbew \??\c:\nbhhhn.exe family_berbew \??\c:\ppvvv.exe family_berbew \??\c:\jdppj.exe family_berbew \??\c:\nnhtnn.exe family_berbew \??\c:\vvjpv.exe family_berbew \??\c:\5bnhhn.exe family_berbew \??\c:\dvvdv.exe family_berbew \??\c:\nntnnn.exe family_berbew \??\c:\jdvpv.exe family_berbew \??\c:\7xffxxx.exe family_berbew \??\c:\htnnnn.exe family_berbew behavioral2/memory/4756-234-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3364-238-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4384-241-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4404-240-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4232-227-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/836-202-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4832-192-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\vdppv.exe family_berbew behavioral2/memory/3004-180-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1884-174-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\ntbhhh.exe family_berbew behavioral2/memory/1556-168-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1048-162-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\lfrlrrx.exe family_berbew behavioral2/memory/3012-156-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3164-150-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\1pddd.exe family_berbew behavioral2/memory/668-139-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\tnhbbb.exe family_berbew \??\c:\lxfxxrl.exe family_berbew \??\c:\jvjjj.exe family_berbew behavioral2/memory/812-123-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3428-117-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\bbhbnt.exe family_berbew \??\c:\rrxxxxx.exe family_berbew behavioral2/memory/2340-102-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\rrxxrrl.exe family_berbew behavioral2/memory/1064-95-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\vvpjp.exe family_berbew behavioral2/memory/3236-89-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4792-83-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4656-77-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\thtttt.exe family_berbew behavioral2/memory/1304-71-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\xxfxxxx.exe family_berbew \??\c:\3fxxxlr.exe family_berbew behavioral2/memory/1780-60-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3516-49-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\1nbnnn.exe family_berbew behavioral2/memory/4188-43-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3084-37-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3780-25-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew \??\c:\nnttbn.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
ffffxxr.exennttbn.exenhnhhn.exepdpjj.exejpvvd.exelxrlrrr.exenbhhhn.exe1nbnnn.exeppvvv.exejdppj.exe3fxxxlr.exexxfxxxx.exethtttt.exennhtnn.exevvjpv.exevvpjp.exerrxxrrl.exerrxxxxx.exe5bnhhn.exebbhbnt.exedvvdv.exejvjjj.exelxfxxrl.exetnhbbb.exenntnnn.exe1pddd.exejdvpv.exelfrlrrx.exe7xffxxx.exentbhhh.exehtnnnn.exevdppv.exefxllrlf.exelxlfxxx.exehhbnnn.exevvpvv.exejvjjj.exe5fllxxl.exe5rfxflr.exennhhbb.exe5tttnh.exejjvpp.exe7dddv.exerlfffff.exe5lllfff.exehhnnbh.exenhbtnt.exevpppp.exedjjdv.exevdppp.exexxfrrfl.exebbbbhh.exedpvvp.exevjppp.exefxffxxx.exehhnhhh.exetttnnn.exedvvvp.exeflrllrr.exehbhbnn.exevdvvp.exejdjjd.exeffxrrrr.exehbbbbn.exepid process 4980 ffffxxr.exe 2500 nnttbn.exe 1620 nhnhhn.exe 3780 pdpjj.exe 3084 jpvvd.exe 4188 lxrlrrr.exe 3516 nbhhhn.exe 4484 1nbnnn.exe 1780 ppvvv.exe 2284 jdppj.exe 1304 3fxxxlr.exe 4656 xxfxxxx.exe 4792 thtttt.exe 3236 nnhtnn.exe 1064 vvjpv.exe 2340 vvpjp.exe 3880 rrxxrrl.exe 4476 rrxxxxx.exe 3428 5bnhhn.exe 812 bbhbnt.exe 2028 dvvdv.exe 5036 jvjjj.exe 668 lxfxxrl.exe 3360 tnhbbb.exe 3164 nntnnn.exe 3012 1pddd.exe 1048 jdvpv.exe 1556 lfrlrrx.exe 1884 7xffxxx.exe 3004 ntbhhh.exe 4836 htnnnn.exe 4084 vdppv.exe 4832 fxllrlf.exe 3748 lxlfxxx.exe 1992 hhbnnn.exe 836 vvpvv.exe 2968 jvjjj.exe 3808 5fllxxl.exe 4776 5rfxflr.exe 1608 nnhhbb.exe 3956 5tttnh.exe 1052 jjvpp.exe 404 7dddv.exe 4232 rlfffff.exe 1812 5lllfff.exe 4756 hhnnbh.exe 3364 nhbtnt.exe 4384 vpppp.exe 4404 djjdv.exe 1516 vdppp.exe 452 xxfrrfl.exe 4508 bbbbhh.exe 1424 dpvvp.exe 4188 vjppp.exe 1840 fxffxxx.exe 3700 hhnhhh.exe 396 tttnnn.exe 3648 dvvvp.exe 1304 flrllrr.exe 1360 hbhbnn.exe 976 vdvvp.exe 3736 jdjjd.exe 1416 ffxrrrr.exe 3976 hbbbbn.exe -
Processes:
resource yara_rule behavioral2/memory/3160-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ffffxxr.exe upx behavioral2/memory/3160-5-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nhnhhn.exe upx behavioral2/memory/4980-13-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2500-15-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1620-19-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pdpjj.exe upx C:\jpvvd.exe upx C:\lxrlrrr.exe upx \??\c:\nbhhhn.exe upx \??\c:\ppvvv.exe upx \??\c:\jdppj.exe upx \??\c:\nnhtnn.exe upx \??\c:\vvjpv.exe upx \??\c:\5bnhhn.exe upx \??\c:\dvvdv.exe upx \??\c:\nntnnn.exe upx \??\c:\jdvpv.exe upx \??\c:\7xffxxx.exe upx \??\c:\htnnnn.exe upx behavioral2/memory/4756-234-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3364-238-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4384-241-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4404-240-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4232-227-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/836-202-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4832-192-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\vdppv.exe upx behavioral2/memory/3004-180-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1884-174-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ntbhhh.exe upx behavioral2/memory/1556-168-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1048-162-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\lfrlrrx.exe upx behavioral2/memory/3012-156-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3164-150-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1pddd.exe upx behavioral2/memory/668-139-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\tnhbbb.exe upx \??\c:\lxfxxrl.exe upx \??\c:\jvjjj.exe upx behavioral2/memory/812-123-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3428-117-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\bbhbnt.exe upx \??\c:\rrxxxxx.exe upx behavioral2/memory/2340-102-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rrxxrrl.exe upx behavioral2/memory/1064-95-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\vvpjp.exe upx behavioral2/memory/3236-89-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4792-83-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4656-77-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\thtttt.exe upx behavioral2/memory/1304-71-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\xxfxxxx.exe upx \??\c:\3fxxxlr.exe upx behavioral2/memory/1780-60-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3516-49-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1nbnnn.exe upx behavioral2/memory/4188-43-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3084-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3780-25-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nnttbn.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exeffffxxr.exennttbn.exenhnhhn.exepdpjj.exejpvvd.exelxrlrrr.exenbhhhn.exe1nbnnn.exeppvvv.exejdppj.exe3fxxxlr.exexxfxxxx.exethtttt.exennhtnn.exevvjpv.exevvpjp.exerrxxrrl.exerrxxxxx.exe5bnhhn.exebbhbnt.exedvvdv.exedescription pid process target process PID 3160 wrote to memory of 4980 3160 081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe ffffxxr.exe PID 3160 wrote to memory of 4980 3160 081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe ffffxxr.exe PID 3160 wrote to memory of 4980 3160 081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe ffffxxr.exe PID 4980 wrote to memory of 2500 4980 ffffxxr.exe nnttbn.exe PID 4980 wrote to memory of 2500 4980 ffffxxr.exe nnttbn.exe PID 4980 wrote to memory of 2500 4980 ffffxxr.exe nnttbn.exe PID 2500 wrote to memory of 1620 2500 nnttbn.exe nhnhhn.exe PID 2500 wrote to memory of 1620 2500 nnttbn.exe nhnhhn.exe PID 2500 wrote to memory of 1620 2500 nnttbn.exe nhnhhn.exe PID 1620 wrote to memory of 3780 1620 nhnhhn.exe pdpjj.exe PID 1620 wrote to memory of 3780 1620 nhnhhn.exe pdpjj.exe PID 1620 wrote to memory of 3780 1620 nhnhhn.exe pdpjj.exe PID 3780 wrote to memory of 3084 3780 pdpjj.exe jpvvd.exe PID 3780 wrote to memory of 3084 3780 pdpjj.exe jpvvd.exe PID 3780 wrote to memory of 3084 3780 pdpjj.exe jpvvd.exe PID 3084 wrote to memory of 4188 3084 jpvvd.exe vjppp.exe PID 3084 wrote to memory of 4188 3084 jpvvd.exe vjppp.exe PID 3084 wrote to memory of 4188 3084 jpvvd.exe vjppp.exe PID 4188 wrote to memory of 3516 4188 lxrlrrr.exe nbhhhn.exe PID 4188 wrote to memory of 3516 4188 lxrlrrr.exe nbhhhn.exe PID 4188 wrote to memory of 3516 4188 lxrlrrr.exe nbhhhn.exe PID 3516 wrote to memory of 4484 3516 nbhhhn.exe 1nbnnn.exe PID 3516 wrote to memory of 4484 3516 nbhhhn.exe 1nbnnn.exe PID 3516 wrote to memory of 4484 3516 nbhhhn.exe 1nbnnn.exe PID 4484 wrote to memory of 1780 4484 1nbnnn.exe ppvvv.exe PID 4484 wrote to memory of 1780 4484 1nbnnn.exe ppvvv.exe PID 4484 wrote to memory of 1780 4484 1nbnnn.exe ppvvv.exe PID 1780 wrote to memory of 2284 1780 ppvvv.exe jdppj.exe PID 1780 wrote to memory of 2284 1780 ppvvv.exe jdppj.exe PID 1780 wrote to memory of 2284 1780 ppvvv.exe jdppj.exe PID 2284 wrote to memory of 1304 2284 jdppj.exe flrllrr.exe PID 2284 wrote to memory of 1304 2284 jdppj.exe flrllrr.exe PID 2284 wrote to memory of 1304 2284 jdppj.exe flrllrr.exe PID 1304 wrote to memory of 4656 1304 3fxxxlr.exe xxfxxxx.exe PID 1304 wrote to memory of 4656 1304 3fxxxlr.exe xxfxxxx.exe PID 1304 wrote to memory of 4656 1304 3fxxxlr.exe xxfxxxx.exe PID 4656 wrote to memory of 4792 4656 xxfxxxx.exe thtttt.exe PID 4656 wrote to memory of 4792 4656 xxfxxxx.exe thtttt.exe PID 4656 wrote to memory of 4792 4656 xxfxxxx.exe thtttt.exe PID 4792 wrote to memory of 3236 4792 thtttt.exe nnhtnn.exe PID 4792 wrote to memory of 3236 4792 thtttt.exe nnhtnn.exe PID 4792 wrote to memory of 3236 4792 thtttt.exe nnhtnn.exe PID 3236 wrote to memory of 1064 3236 nnhtnn.exe vvjpv.exe PID 3236 wrote to memory of 1064 3236 nnhtnn.exe vvjpv.exe PID 3236 wrote to memory of 1064 3236 nnhtnn.exe vvjpv.exe PID 1064 wrote to memory of 2340 1064 vvjpv.exe vvpjp.exe PID 1064 wrote to memory of 2340 1064 vvjpv.exe vvpjp.exe PID 1064 wrote to memory of 2340 1064 vvjpv.exe vvpjp.exe PID 2340 wrote to memory of 3880 2340 vvpjp.exe rrxxrrl.exe PID 2340 wrote to memory of 3880 2340 vvpjp.exe rrxxrrl.exe PID 2340 wrote to memory of 3880 2340 vvpjp.exe rrxxrrl.exe PID 3880 wrote to memory of 4476 3880 rrxxrrl.exe rrxxxxx.exe PID 3880 wrote to memory of 4476 3880 rrxxrrl.exe rrxxxxx.exe PID 3880 wrote to memory of 4476 3880 rrxxrrl.exe rrxxxxx.exe PID 4476 wrote to memory of 3428 4476 rrxxxxx.exe 5bnhhn.exe PID 4476 wrote to memory of 3428 4476 rrxxxxx.exe 5bnhhn.exe PID 4476 wrote to memory of 3428 4476 rrxxxxx.exe 5bnhhn.exe PID 3428 wrote to memory of 812 3428 5bnhhn.exe bbhbnt.exe PID 3428 wrote to memory of 812 3428 5bnhhn.exe bbhbnt.exe PID 3428 wrote to memory of 812 3428 5bnhhn.exe bbhbnt.exe PID 812 wrote to memory of 2028 812 bbhbnt.exe dvvdv.exe PID 812 wrote to memory of 2028 812 bbhbnt.exe dvvdv.exe PID 812 wrote to memory of 2028 812 bbhbnt.exe dvvdv.exe PID 2028 wrote to memory of 5036 2028 dvvdv.exe rrxxxxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\081a7d566ac990d82a1ed60b834a22b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\ffffxxr.exec:\ffffxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\nnttbn.exec:\nnttbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nhnhhn.exec:\nhnhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\pdpjj.exec:\pdpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\jpvvd.exec:\jpvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\lxrlrrr.exec:\lxrlrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\nbhhhn.exec:\nbhhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\1nbnnn.exec:\1nbnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\ppvvv.exec:\ppvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\jdppj.exec:\jdppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\3fxxxlr.exec:\3fxxxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\thtttt.exec:\thtttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\nnhtnn.exec:\nnhtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\vvjpv.exec:\vvjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\vvpjp.exec:\vvpjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\rrxxrrl.exec:\rrxxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\5bnhhn.exec:\5bnhhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\bbhbnt.exec:\bbhbnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\dvvdv.exec:\dvvdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\jvjjj.exec:\jvjjj.exe23⤵
- Executes dropped EXE
PID:5036 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe24⤵
- Executes dropped EXE
PID:668 -
\??\c:\tnhbbb.exec:\tnhbbb.exe25⤵
- Executes dropped EXE
PID:3360 -
\??\c:\nntnnn.exec:\nntnnn.exe26⤵
- Executes dropped EXE
PID:3164 -
\??\c:\1pddd.exec:\1pddd.exe27⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jdvpv.exec:\jdvpv.exe28⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe29⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7xffxxx.exec:\7xffxxx.exe30⤵
- Executes dropped EXE
PID:1884 -
\??\c:\ntbhhh.exec:\ntbhhh.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\htnnnn.exec:\htnnnn.exe32⤵
- Executes dropped EXE
PID:4836 -
\??\c:\vdppv.exec:\vdppv.exe33⤵
- Executes dropped EXE
PID:4084 -
\??\c:\fxllrlf.exec:\fxllrlf.exe34⤵
- Executes dropped EXE
PID:4832 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe35⤵
- Executes dropped EXE
PID:3748 -
\??\c:\hhbnnn.exec:\hhbnnn.exe36⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vvpvv.exec:\vvpvv.exe37⤵
- Executes dropped EXE
PID:836 -
\??\c:\jvjjj.exec:\jvjjj.exe38⤵
- Executes dropped EXE
PID:2968 -
\??\c:\5fllxxl.exec:\5fllxxl.exe39⤵
- Executes dropped EXE
PID:3808 -
\??\c:\5rfxflr.exec:\5rfxflr.exe40⤵
- Executes dropped EXE
PID:4776 -
\??\c:\nnhhbb.exec:\nnhhbb.exe41⤵
- Executes dropped EXE
PID:1608 -
\??\c:\5tttnh.exec:\5tttnh.exe42⤵
- Executes dropped EXE
PID:3956 -
\??\c:\jjvpp.exec:\jjvpp.exe43⤵
- Executes dropped EXE
PID:1052 -
\??\c:\7dddv.exec:\7dddv.exe44⤵
- Executes dropped EXE
PID:404 -
\??\c:\rlfffff.exec:\rlfffff.exe45⤵
- Executes dropped EXE
PID:4232 -
\??\c:\5lllfff.exec:\5lllfff.exe46⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hhnnbh.exec:\hhnnbh.exe47⤵
- Executes dropped EXE
PID:4756 -
\??\c:\nhbtnt.exec:\nhbtnt.exe48⤵
- Executes dropped EXE
PID:3364 -
\??\c:\vpppp.exec:\vpppp.exe49⤵
- Executes dropped EXE
PID:4384 -
\??\c:\djjdv.exec:\djjdv.exe50⤵
- Executes dropped EXE
PID:4404 -
\??\c:\vdppp.exec:\vdppp.exe51⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xxfrrfl.exec:\xxfrrfl.exe52⤵
- Executes dropped EXE
PID:452 -
\??\c:\bbbbhh.exec:\bbbbhh.exe53⤵
- Executes dropped EXE
PID:4508 -
\??\c:\dpvvp.exec:\dpvvp.exe54⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vjppp.exec:\vjppp.exe55⤵
- Executes dropped EXE
PID:4188 -
\??\c:\fxffxxx.exec:\fxffxxx.exe56⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hhnhhh.exec:\hhnhhh.exe57⤵
- Executes dropped EXE
PID:3700 -
\??\c:\tttnnn.exec:\tttnnn.exe58⤵
- Executes dropped EXE
PID:396 -
\??\c:\dvvvp.exec:\dvvvp.exe59⤵
- Executes dropped EXE
PID:3648 -
\??\c:\flrllrr.exec:\flrllrr.exe60⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hbhbnn.exec:\hbhbnn.exe61⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vdvvp.exec:\vdvvp.exe62⤵
- Executes dropped EXE
PID:976 -
\??\c:\jdjjd.exec:\jdjjd.exe63⤵
- Executes dropped EXE
PID:3736 -
\??\c:\ffxrrrr.exec:\ffxrrrr.exe64⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hbbbbn.exec:\hbbbbn.exe65⤵
- Executes dropped EXE
PID:3976 -
\??\c:\vvvdv.exec:\vvvdv.exe66⤵PID:3184
-
\??\c:\dvjjj.exec:\dvjjj.exe67⤵PID:608
-
\??\c:\xrfffff.exec:\xrfffff.exe68⤵PID:4240
-
\??\c:\bbhbbb.exec:\bbhbbb.exe69⤵PID:2488
-
\??\c:\nhtntt.exec:\nhtntt.exe70⤵PID:4672
-
\??\c:\jdjjd.exec:\jdjjd.exe71⤵PID:1724
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe72⤵PID:5036
-
\??\c:\tnnnnh.exec:\tnnnnh.exe73⤵PID:2376
-
\??\c:\jdvvv.exec:\jdvvv.exe74⤵PID:2180
-
\??\c:\pvjvp.exec:\pvjvp.exe75⤵PID:1712
-
\??\c:\xxxlfxx.exec:\xxxlfxx.exe76⤵PID:2132
-
\??\c:\btnhtb.exec:\btnhtb.exe77⤵PID:3128
-
\??\c:\ttbtnn.exec:\ttbtnn.exe78⤵PID:2932
-
\??\c:\vjvpj.exec:\vjvpj.exe79⤵PID:4636
-
\??\c:\5jjdv.exec:\5jjdv.exe80⤵PID:4228
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe81⤵PID:1680
-
\??\c:\nhttnn.exec:\nhttnn.exe82⤵PID:3768
-
\??\c:\9jvvv.exec:\9jvvv.exe83⤵PID:3232
-
\??\c:\ddpjd.exec:\ddpjd.exe84⤵PID:3748
-
\??\c:\xllllxx.exec:\xllllxx.exe85⤵PID:4152
-
\??\c:\bbbbbn.exec:\bbbbbn.exe86⤵PID:836
-
\??\c:\5hbthh.exec:\5hbthh.exe87⤵PID:2364
-
\??\c:\pjjjj.exec:\pjjjj.exe88⤵PID:4600
-
\??\c:\pjpjd.exec:\pjpjd.exe89⤵PID:1072
-
\??\c:\xxlfrrf.exec:\xxlfrrf.exe90⤵PID:4692
-
\??\c:\vjjvj.exec:\vjjvj.exe91⤵PID:3288
-
\??\c:\vdvvd.exec:\vdvvd.exe92⤵PID:2080
-
\??\c:\9xfffll.exec:\9xfffll.exe93⤵PID:4984
-
\??\c:\nhnnhn.exec:\nhnnhn.exe94⤵PID:2808
-
\??\c:\9thhhn.exec:\9thhhn.exe95⤵PID:4232
-
\??\c:\ppvpj.exec:\ppvpj.exe96⤵PID:4704
-
\??\c:\lrxrlll.exec:\lrxrlll.exe97⤵PID:940
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe98⤵PID:3532
-
\??\c:\btbbtb.exec:\btbbtb.exe99⤵PID:4612
-
\??\c:\1jvdv.exec:\1jvdv.exe100⤵PID:4884
-
\??\c:\jvpvv.exec:\jvpvv.exe101⤵PID:4384
-
\??\c:\fxffxxx.exec:\fxffxxx.exe102⤵PID:2584
-
\??\c:\3xxxxff.exec:\3xxxxff.exe103⤵PID:1704
-
\??\c:\9btttt.exec:\9btttt.exe104⤵PID:3780
-
\??\c:\7vjpj.exec:\7vjpj.exe105⤵PID:5056
-
\??\c:\vvddj.exec:\vvddj.exe106⤵PID:3516
-
\??\c:\fxxxlll.exec:\fxxxlll.exe107⤵PID:3276
-
\??\c:\lfxrlll.exec:\lfxrlll.exe108⤵PID:3152
-
\??\c:\hbhbbb.exec:\hbhbbb.exe109⤵PID:4676
-
\??\c:\vvddv.exec:\vvddv.exe110⤵PID:2952
-
\??\c:\jjjdd.exec:\jjjdd.exe111⤵PID:1660
-
\??\c:\pvvdv.exec:\pvvdv.exe112⤵PID:1624
-
\??\c:\xxxxfxx.exec:\xxxxfxx.exe113⤵PID:2456
-
\??\c:\ttbtnt.exec:\ttbtnt.exe114⤵PID:368
-
\??\c:\ntbhhh.exec:\ntbhhh.exe115⤵PID:1060
-
\??\c:\jdjdv.exec:\jdjdv.exe116⤵PID:3976
-
\??\c:\7vjdv.exec:\7vjdv.exe117⤵PID:3184
-
\??\c:\9pppp.exec:\9pppp.exe118⤵PID:3428
-
\??\c:\xrrxrxx.exec:\xrrxrxx.exe119⤵PID:4240
-
\??\c:\ttnnnn.exec:\ttnnnn.exe120⤵PID:3988
-
\??\c:\pdjvp.exec:\pdjvp.exe121⤵PID:1728
-
\??\c:\rflrrrx.exec:\rflrrrx.exe122⤵PID:668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-