Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 12:18
Behavioral task
behavioral1
Sample
f9199c7c90e9b6309abebd8742250840_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
f9199c7c90e9b6309abebd8742250840_NeikiAnalytics.exe
-
Size
464KB
-
MD5
f9199c7c90e9b6309abebd8742250840
-
SHA1
c17f194f213dcc3a1fed14d7c4be3d20bf71dd6a
-
SHA256
0e15d9018745b1791f1b2f84446bcc62e656ffcf6aa0aa9c620575c0c26f1cd0
-
SHA512
a13074e7850a492c54b43db4384d47c17e88fa11938916a68c538e2a0f3f6e097896a00930c3553ccea6ce53ecb2f8a9584f466ba86f6b2c20b38dd59863d89d
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VQ:VeR0oykayRFp3lztP+OKaf1VQ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4400-7-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2912-6-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1028-18-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1812-24-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3912-13-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3084-36-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3576-42-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3664-49-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1176-66-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4580-80-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1376-71-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4640-91-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4652-100-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3452-110-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4644-117-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4680-126-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4452-124-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4972-136-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2964-145-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3636-152-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1956-158-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2004-161-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4832-180-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4296-191-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4404-198-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1320-202-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/860-208-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3476-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5116-237-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1068-245-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4716-249-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2196-253-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1872-257-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3100-265-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4652-279-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2928-284-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/824-300-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3764-317-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1408-330-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4488-337-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/224-341-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2380-357-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4564-358-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4564-362-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2204-366-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3080-398-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1096-411-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4004-418-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4808-425-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4440-442-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3076-446-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5044-471-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/888-493-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1528-503-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3004-513-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1864-532-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2912-602-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5064-626-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1768-678-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2960-697-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2352-823-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4436-849-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4436-853-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3208-885-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/2912-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\3pppp.exe family_berbew behavioral2/memory/4400-7-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2912-6-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\btbnnn.exe family_berbew behavioral2/memory/1028-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1812-24-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\jjppv.exe family_berbew behavioral2/memory/3912-13-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\7fxxrxl.exe family_berbew \??\c:\jjppp.exe family_berbew behavioral2/memory/3576-37-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3084-36-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\hntnhb.exe family_berbew behavioral2/memory/3664-44-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\ntbttb.exe family_berbew behavioral2/memory/3576-42-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bhbhhn.exe family_berbew behavioral2/memory/3664-49-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pppdd.exe family_berbew C:\ffxllxl.exe family_berbew behavioral2/memory/1176-61-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bntbtt.exe family_berbew behavioral2/memory/1176-66-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\pdppv.exe family_berbew C:\htbbbt.exe family_berbew behavioral2/memory/4580-80-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\xrfxrlr.exe family_berbew C:\hbhbbb.exe family_berbew behavioral2/memory/1376-71-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4640-91-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vvjdd.exe family_berbew behavioral2/memory/4652-100-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nbhhht.exe family_berbew C:\bnhttt.exe family_berbew C:\vppjj.exe family_berbew behavioral2/memory/3452-110-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tbtnnn.exe family_berbew behavioral2/memory/4644-117-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\ffrrxff.exe family_berbew behavioral2/memory/4680-126-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4452-124-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bhnbhn.exe family_berbew C:\3htthn.exe family_berbew behavioral2/memory/4972-136-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lfrrrrr.exe family_berbew C:\jjvvp.exe family_berbew behavioral2/memory/2964-145-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nttnnb.exe family_berbew behavioral2/memory/3636-152-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1956-158-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\bthtnb.exe family_berbew behavioral2/memory/2004-161-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\dvpvv.exe family_berbew \??\c:\rrxrxlr.exe family_berbew \??\c:\hntttt.exe family_berbew C:\ddjdv.exe family_berbew behavioral2/memory/4832-180-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\llxfxfl.exe family_berbew behavioral2/memory/4296-191-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4404-198-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1320-202-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/860-208-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3476-212-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
3pppp.exe7fxxrxl.exebtbnnn.exejjppv.exejjppp.exehntnhb.exentbttb.exebhbhhn.exepppdd.exeffxllxl.exebntbtt.exepdppv.exehtbbbt.exexrfxrlr.exehbhbbb.exevvjdd.exenbhhht.exebnhttt.exevppjj.exetbtnnn.exeffrrxff.exebhnbhn.exe3htthn.exelfrrrrr.exejjvvp.exenttnnb.exebthtnb.exedvpvv.exerrxrxlr.exehntttt.exeddjdv.exellxfxfl.exevdvdd.exe5rxrrxr.exe1bbbbb.exenntbbh.exe5vddp.exerrxxxxx.exebbtthn.exe7pvpp.exevvddd.exefxffrrr.exe3jjjp.exerfrrlxx.exethnbbb.exevvdvd.exedjjjj.exethnnnt.exevvjjd.exefffxxff.exenhbthh.exefffflrr.exehbbnhn.exeddvvv.exefffffxx.exexfrrxxf.exehnhhth.exe7jvvd.exe3djdd.exenbbtth.exe7tbhbt.exeddppp.exe7rffrxl.exerrfrxxl.exepid process 4400 3pppp.exe 3912 7fxxrxl.exe 1028 btbnnn.exe 1812 jjppv.exe 3084 jjppp.exe 3576 hntnhb.exe 3664 ntbttb.exe 1236 bhbhhn.exe 3208 pppdd.exe 1176 ffxllxl.exe 1376 bntbtt.exe 2888 pdppv.exe 4580 htbbbt.exe 2556 xrfxrlr.exe 4640 hbhbbb.exe 4652 vvjdd.exe 1448 nbhhht.exe 3452 bnhttt.exe 4644 vppjj.exe 4680 tbtnnn.exe 4452 ffrrxff.exe 4972 bhnbhn.exe 4084 3htthn.exe 2964 lfrrrrr.exe 3636 jjvvp.exe 1956 nttnnb.exe 2004 bthtnb.exe 2144 dvpvv.exe 3424 rrxrxlr.exe 4712 hntttt.exe 4832 ddjdv.exe 980 llxfxfl.exe 4296 vdvdd.exe 2440 5rxrrxr.exe 4404 1bbbbb.exe 1320 nntbbh.exe 860 5vddp.exe 3476 rrxxxxx.exe 740 bbtthn.exe 4168 7pvpp.exe 2728 vvddd.exe 1116 fxffrrr.exe 4320 3jjjp.exe 2684 rfrrlxx.exe 3576 thnbbb.exe 5116 vvdvd.exe 3980 djjjj.exe 1068 thnnnt.exe 4716 vvjjd.exe 2196 fffxxff.exe 1872 nhbthh.exe 1044 fffflrr.exe 3856 hbbnhn.exe 3100 ddvvv.exe 4980 fffffxx.exe 2796 xfrrxxf.exe 3356 hnhhth.exe 4652 7jvvd.exe 2928 3djdd.exe 1448 nbbtth.exe 1196 7tbhbt.exe 4248 ddppp.exe 1768 7rffrxl.exe 824 rrfrxxl.exe -
Processes:
resource yara_rule behavioral2/memory/2912-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\3pppp.exe upx behavioral2/memory/4400-7-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2912-6-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\btbnnn.exe upx behavioral2/memory/1028-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1812-24-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\jjppv.exe upx behavioral2/memory/3912-13-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\7fxxrxl.exe upx \??\c:\jjppp.exe upx behavioral2/memory/3576-37-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3084-36-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\hntnhb.exe upx behavioral2/memory/3664-44-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ntbttb.exe upx behavioral2/memory/3576-42-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bhbhhn.exe upx behavioral2/memory/3664-49-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pppdd.exe upx C:\ffxllxl.exe upx behavioral2/memory/1176-61-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bntbtt.exe upx behavioral2/memory/1176-66-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\pdppv.exe upx C:\htbbbt.exe upx behavioral2/memory/4580-80-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\xrfxrlr.exe upx C:\hbhbbb.exe upx behavioral2/memory/1376-71-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4640-91-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vvjdd.exe upx behavioral2/memory/4652-100-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nbhhht.exe upx C:\bnhttt.exe upx C:\vppjj.exe upx behavioral2/memory/3452-110-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tbtnnn.exe upx behavioral2/memory/4644-117-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ffrrxff.exe upx behavioral2/memory/4680-126-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4452-124-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bhnbhn.exe upx C:\3htthn.exe upx behavioral2/memory/4972-136-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lfrrrrr.exe upx C:\jjvvp.exe upx behavioral2/memory/2964-145-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nttnnb.exe upx behavioral2/memory/3636-152-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1956-158-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\bthtnb.exe upx behavioral2/memory/2004-161-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\dvpvv.exe upx \??\c:\rrxrxlr.exe upx \??\c:\hntttt.exe upx C:\ddjdv.exe upx behavioral2/memory/4832-180-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\llxfxfl.exe upx behavioral2/memory/4296-191-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4404-198-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1320-202-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/860-208-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3476-212-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f9199c7c90e9b6309abebd8742250840_NeikiAnalytics.exe3pppp.exe7fxxrxl.exebtbnnn.exejjppv.exejjppp.exehntnhb.exentbttb.exebhbhhn.exepppdd.exeffxllxl.exebntbtt.exepdppv.exehtbbbt.exexrfxrlr.exehbhbbb.exevvjdd.exenbhhht.exebnhttt.exevppjj.exetbtnnn.exeffrrxff.exedescription pid process target process PID 2912 wrote to memory of 4400 2912 f9199c7c90e9b6309abebd8742250840_NeikiAnalytics.exe 3pppp.exe PID 2912 wrote to memory of 4400 2912 f9199c7c90e9b6309abebd8742250840_NeikiAnalytics.exe 3pppp.exe PID 2912 wrote to memory of 4400 2912 f9199c7c90e9b6309abebd8742250840_NeikiAnalytics.exe 3pppp.exe PID 4400 wrote to memory of 3912 4400 3pppp.exe 7fxxrxl.exe PID 4400 wrote to memory of 3912 4400 3pppp.exe 7fxxrxl.exe PID 4400 wrote to memory of 3912 4400 3pppp.exe 7fxxrxl.exe PID 3912 wrote to memory of 1028 3912 7fxxrxl.exe btbnnn.exe PID 3912 wrote to memory of 1028 3912 7fxxrxl.exe btbnnn.exe PID 3912 wrote to memory of 1028 3912 7fxxrxl.exe btbnnn.exe PID 1028 wrote to memory of 1812 1028 btbnnn.exe jjppv.exe PID 1028 wrote to memory of 1812 1028 btbnnn.exe jjppv.exe PID 1028 wrote to memory of 1812 1028 btbnnn.exe jjppv.exe PID 1812 wrote to memory of 3084 1812 jjppv.exe jjppp.exe PID 1812 wrote to memory of 3084 1812 jjppv.exe jjppp.exe PID 1812 wrote to memory of 3084 1812 jjppv.exe jjppp.exe PID 3084 wrote to memory of 3576 3084 jjppp.exe hntnhb.exe PID 3084 wrote to memory of 3576 3084 jjppp.exe hntnhb.exe PID 3084 wrote to memory of 3576 3084 jjppp.exe hntnhb.exe PID 3576 wrote to memory of 3664 3576 hntnhb.exe ntbttb.exe PID 3576 wrote to memory of 3664 3576 hntnhb.exe ntbttb.exe PID 3576 wrote to memory of 3664 3576 hntnhb.exe ntbttb.exe PID 3664 wrote to memory of 1236 3664 ntbttb.exe bhbhhn.exe PID 3664 wrote to memory of 1236 3664 ntbttb.exe bhbhhn.exe PID 3664 wrote to memory of 1236 3664 ntbttb.exe bhbhhn.exe PID 1236 wrote to memory of 3208 1236 bhbhhn.exe pppdd.exe PID 1236 wrote to memory of 3208 1236 bhbhhn.exe pppdd.exe PID 1236 wrote to memory of 3208 1236 bhbhhn.exe pppdd.exe PID 3208 wrote to memory of 1176 3208 pppdd.exe ffxllxl.exe PID 3208 wrote to memory of 1176 3208 pppdd.exe ffxllxl.exe PID 3208 wrote to memory of 1176 3208 pppdd.exe ffxllxl.exe PID 1176 wrote to memory of 1376 1176 ffxllxl.exe bntbtt.exe PID 1176 wrote to memory of 1376 1176 ffxllxl.exe bntbtt.exe PID 1176 wrote to memory of 1376 1176 ffxllxl.exe bntbtt.exe PID 1376 wrote to memory of 2888 1376 bntbtt.exe pdppv.exe PID 1376 wrote to memory of 2888 1376 bntbtt.exe pdppv.exe PID 1376 wrote to memory of 2888 1376 bntbtt.exe pdppv.exe PID 2888 wrote to memory of 4580 2888 pdppv.exe htbbbt.exe PID 2888 wrote to memory of 4580 2888 pdppv.exe htbbbt.exe PID 2888 wrote to memory of 4580 2888 pdppv.exe htbbbt.exe PID 4580 wrote to memory of 2556 4580 htbbbt.exe xrfxrlr.exe PID 4580 wrote to memory of 2556 4580 htbbbt.exe xrfxrlr.exe PID 4580 wrote to memory of 2556 4580 htbbbt.exe xrfxrlr.exe PID 2556 wrote to memory of 4640 2556 xrfxrlr.exe hbhbbb.exe PID 2556 wrote to memory of 4640 2556 xrfxrlr.exe hbhbbb.exe PID 2556 wrote to memory of 4640 2556 xrfxrlr.exe hbhbbb.exe PID 4640 wrote to memory of 4652 4640 hbhbbb.exe vvjdd.exe PID 4640 wrote to memory of 4652 4640 hbhbbb.exe vvjdd.exe PID 4640 wrote to memory of 4652 4640 hbhbbb.exe vvjdd.exe PID 4652 wrote to memory of 1448 4652 vvjdd.exe nbhhht.exe PID 4652 wrote to memory of 1448 4652 vvjdd.exe nbhhht.exe PID 4652 wrote to memory of 1448 4652 vvjdd.exe nbhhht.exe PID 1448 wrote to memory of 3452 1448 nbhhht.exe bnhttt.exe PID 1448 wrote to memory of 3452 1448 nbhhht.exe bnhttt.exe PID 1448 wrote to memory of 3452 1448 nbhhht.exe bnhttt.exe PID 3452 wrote to memory of 4644 3452 bnhttt.exe vppjj.exe PID 3452 wrote to memory of 4644 3452 bnhttt.exe vppjj.exe PID 3452 wrote to memory of 4644 3452 bnhttt.exe vppjj.exe PID 4644 wrote to memory of 4680 4644 vppjj.exe tbtnnn.exe PID 4644 wrote to memory of 4680 4644 vppjj.exe tbtnnn.exe PID 4644 wrote to memory of 4680 4644 vppjj.exe tbtnnn.exe PID 4680 wrote to memory of 4452 4680 tbtnnn.exe ffrrxff.exe PID 4680 wrote to memory of 4452 4680 tbtnnn.exe ffrrxff.exe PID 4680 wrote to memory of 4452 4680 tbtnnn.exe ffrrxff.exe PID 4452 wrote to memory of 4972 4452 ffrrxff.exe bhnbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9199c7c90e9b6309abebd8742250840_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f9199c7c90e9b6309abebd8742250840_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\3pppp.exec:\3pppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7fxxrxl.exec:\7fxxrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbnnn.exec:\btbnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjppv.exec:\jjppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jjppp.exec:\jjppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hntnhb.exec:\hntnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ntbttb.exec:\ntbttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbhhn.exec:\bhbhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pppdd.exec:\pppdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxllxl.exec:\ffxllxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bntbtt.exec:\bntbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdppv.exec:\pdppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htbbbt.exec:\htbbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xrfxrlr.exec:\xrfxrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhbbb.exec:\hbhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvjdd.exec:\vvjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbhhht.exec:\nbhhht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnhttt.exec:\bnhttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vppjj.exec:\vppjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbtnnn.exec:\tbtnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffrrxff.exec:\ffrrxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhnbhn.exec:\bhnbhn.exe23⤵
- Executes dropped EXE
-
\??\c:\3htthn.exec:\3htthn.exe24⤵
- Executes dropped EXE
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe25⤵
- Executes dropped EXE
-
\??\c:\jjvvp.exec:\jjvvp.exe26⤵
- Executes dropped EXE
-
\??\c:\nttnnb.exec:\nttnnb.exe27⤵
- Executes dropped EXE
-
\??\c:\bthtnb.exec:\bthtnb.exe28⤵
- Executes dropped EXE
-
\??\c:\dvpvv.exec:\dvpvv.exe29⤵
- Executes dropped EXE
-
\??\c:\rrxrxlr.exec:\rrxrxlr.exe30⤵
- Executes dropped EXE
-
\??\c:\hntttt.exec:\hntttt.exe31⤵
- Executes dropped EXE
-
\??\c:\ddjdv.exec:\ddjdv.exe32⤵
- Executes dropped EXE
-
\??\c:\llxfxfl.exec:\llxfxfl.exe33⤵
- Executes dropped EXE
-
\??\c:\vdvdd.exec:\vdvdd.exe34⤵
- Executes dropped EXE
-
\??\c:\5rxrrxr.exec:\5rxrrxr.exe35⤵
- Executes dropped EXE
-
\??\c:\1bbbbb.exec:\1bbbbb.exe36⤵
- Executes dropped EXE
-
\??\c:\nntbbh.exec:\nntbbh.exe37⤵
- Executes dropped EXE
-
\??\c:\5vddp.exec:\5vddp.exe38⤵
- Executes dropped EXE
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe39⤵
- Executes dropped EXE
-
\??\c:\bbtthn.exec:\bbtthn.exe40⤵
- Executes dropped EXE
-
\??\c:\7pvpp.exec:\7pvpp.exe41⤵
- Executes dropped EXE
-
\??\c:\vvddd.exec:\vvddd.exe42⤵
- Executes dropped EXE
-
\??\c:\fxffrrr.exec:\fxffrrr.exe43⤵
- Executes dropped EXE
-
\??\c:\3jjjp.exec:\3jjjp.exe44⤵
- Executes dropped EXE
-
\??\c:\rfrrlxx.exec:\rfrrlxx.exe45⤵
- Executes dropped EXE
-
\??\c:\thnbbb.exec:\thnbbb.exe46⤵
- Executes dropped EXE
-
\??\c:\vvdvd.exec:\vvdvd.exe47⤵
- Executes dropped EXE
-
\??\c:\djjjj.exec:\djjjj.exe48⤵
- Executes dropped EXE
-
\??\c:\thnnnt.exec:\thnnnt.exe49⤵
- Executes dropped EXE
-
\??\c:\vvjjd.exec:\vvjjd.exe50⤵
- Executes dropped EXE
-
\??\c:\fffxxff.exec:\fffxxff.exe51⤵
- Executes dropped EXE
-
\??\c:\nhbthh.exec:\nhbthh.exe52⤵
- Executes dropped EXE
-
\??\c:\fffflrr.exec:\fffflrr.exe53⤵
- Executes dropped EXE
-
\??\c:\hbbnhn.exec:\hbbnhn.exe54⤵
- Executes dropped EXE
-
\??\c:\ddvvv.exec:\ddvvv.exe55⤵
- Executes dropped EXE
-
\??\c:\fffffxx.exec:\fffffxx.exe56⤵
- Executes dropped EXE
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe57⤵
- Executes dropped EXE
-
\??\c:\hnhhth.exec:\hnhhth.exe58⤵
- Executes dropped EXE
-
\??\c:\7jvvd.exec:\7jvvd.exe59⤵
- Executes dropped EXE
-
\??\c:\3djdd.exec:\3djdd.exe60⤵
- Executes dropped EXE
-
\??\c:\nbbtth.exec:\nbbtth.exe61⤵
- Executes dropped EXE
-
\??\c:\7tbhbt.exec:\7tbhbt.exe62⤵
- Executes dropped EXE
-
\??\c:\ddppp.exec:\ddppp.exe63⤵
- Executes dropped EXE
-
\??\c:\7rffrxl.exec:\7rffrxl.exe64⤵
- Executes dropped EXE
-
\??\c:\rrfrxxl.exec:\rrfrxxl.exe65⤵
- Executes dropped EXE
-
\??\c:\hnntbh.exec:\hnntbh.exe66⤵
-
\??\c:\pjddv.exec:\pjddv.exe67⤵
-
\??\c:\fffffll.exec:\fffffll.exe68⤵
-
\??\c:\nhbbbh.exec:\nhbbbh.exe69⤵
-
\??\c:\bbbbhn.exec:\bbbbhn.exe70⤵
-
\??\c:\ddvdv.exec:\ddvdv.exe71⤵
-
\??\c:\1fffffr.exec:\1fffffr.exe72⤵
-
\??\c:\nhtnnn.exec:\nhtnnn.exe73⤵
-
\??\c:\vjjdp.exec:\vjjdp.exe74⤵
-
\??\c:\7pdjd.exec:\7pdjd.exe75⤵
-
\??\c:\7rxrrrl.exec:\7rxrrrl.exe76⤵
-
\??\c:\nnnnnn.exec:\nnnnnn.exe77⤵
-
\??\c:\jpddd.exec:\jpddd.exe78⤵
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe79⤵
-
\??\c:\3rxfxfl.exec:\3rxfxfl.exe80⤵
-
\??\c:\tnhbnt.exec:\tnhbnt.exe81⤵
-
\??\c:\djjjj.exec:\djjjj.exe82⤵
-
\??\c:\lxxxffx.exec:\lxxxffx.exe83⤵
-
\??\c:\bbtntt.exec:\bbtntt.exe84⤵
-
\??\c:\djppv.exec:\djppv.exe85⤵
-
\??\c:\rxxxfll.exec:\rxxxfll.exe86⤵
-
\??\c:\bbbbth.exec:\bbbbth.exe87⤵
-
\??\c:\pjjdd.exec:\pjjdd.exe88⤵
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe89⤵
-
\??\c:\7hhnhh.exec:\7hhnhh.exe90⤵
-
\??\c:\hhnhtb.exec:\hhnhtb.exe91⤵
-
\??\c:\pddvp.exec:\pddvp.exe92⤵
-
\??\c:\1llllrx.exec:\1llllrx.exe93⤵
-
\??\c:\nhbbnh.exec:\nhbbnh.exe94⤵
-
\??\c:\pjppp.exec:\pjppp.exe95⤵
-
\??\c:\llrrrxx.exec:\llrrrxx.exe96⤵
-
\??\c:\thhbbh.exec:\thhbbh.exe97⤵
-
\??\c:\9jppp.exec:\9jppp.exe98⤵
-
\??\c:\llllflx.exec:\llllflx.exe99⤵
-
\??\c:\vjpvv.exec:\vjpvv.exe100⤵
-
\??\c:\7rfxxxx.exec:\7rfxxxx.exe101⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe102⤵
-
\??\c:\vvdpv.exec:\vvdpv.exe103⤵
-
\??\c:\jjppj.exec:\jjppj.exe104⤵
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe105⤵
-
\??\c:\hthnbh.exec:\hthnbh.exe106⤵
-
\??\c:\pdvdd.exec:\pdvdd.exe107⤵
-
\??\c:\7xllrfr.exec:\7xllrfr.exe108⤵
-
\??\c:\httttb.exec:\httttb.exe109⤵
-
\??\c:\jjpjv.exec:\jjpjv.exe110⤵
-
\??\c:\7vjdj.exec:\7vjdj.exe111⤵
-
\??\c:\xxffllx.exec:\xxffllx.exe112⤵
-
\??\c:\tntttb.exec:\tntttb.exe113⤵
-
\??\c:\dpddd.exec:\dpddd.exe114⤵
-
\??\c:\dpvvj.exec:\dpvvj.exe115⤵
-
\??\c:\xlllfff.exec:\xlllfff.exe116⤵
-
\??\c:\hhnnhn.exec:\hhnnhn.exe117⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe118⤵
-
\??\c:\rxlllrr.exec:\rxlllrr.exe119⤵
-
\??\c:\bnbhnn.exec:\bnbhnn.exe120⤵
-
\??\c:\vpdvj.exec:\vpdvj.exe121⤵
-
\??\c:\xxxxlfl.exec:\xxxxlfl.exe122⤵
-
\??\c:\btnnhh.exec:\btnnhh.exe123⤵
-
\??\c:\9hhbbb.exec:\9hhbbb.exe124⤵
-
\??\c:\vvppj.exec:\vvppj.exe125⤵
-
\??\c:\xlrxxxr.exec:\xlrxxxr.exe126⤵
-
\??\c:\1nbtnn.exec:\1nbtnn.exe127⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe128⤵
-
\??\c:\1ffxllf.exec:\1ffxllf.exe129⤵
-
\??\c:\fxfxrrf.exec:\fxfxrrf.exe130⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe131⤵
-
\??\c:\jdjvp.exec:\jdjvp.exe132⤵
-
\??\c:\7xflxxx.exec:\7xflxxx.exe133⤵
-
\??\c:\rrfflrx.exec:\rrfflrx.exe134⤵
-
\??\c:\btbbbh.exec:\btbbbh.exe135⤵
-
\??\c:\djpdv.exec:\djpdv.exe136⤵
-
\??\c:\rffxxfx.exec:\rffxxfx.exe137⤵
-
\??\c:\tbhbth.exec:\tbhbth.exe138⤵
-
\??\c:\7nbtnn.exec:\7nbtnn.exe139⤵
-
\??\c:\9pdvp.exec:\9pdvp.exe140⤵
-
\??\c:\fllffxr.exec:\fllffxr.exe141⤵
-
\??\c:\bhnhhh.exec:\bhnhhh.exe142⤵
-
\??\c:\tbtthn.exec:\tbtthn.exe143⤵
-
\??\c:\vdppp.exec:\vdppp.exe144⤵
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe145⤵
-
\??\c:\nttbhh.exec:\nttbhh.exe146⤵
-
\??\c:\tbbhbn.exec:\tbbhbn.exe147⤵
-
\??\c:\vjppj.exec:\vjppj.exe148⤵
-
\??\c:\flxrlll.exec:\flxrlll.exe149⤵
-
\??\c:\5btnnn.exec:\5btnnn.exe150⤵
-
\??\c:\vjdpj.exec:\vjdpj.exe151⤵
-
\??\c:\rxllfff.exec:\rxllfff.exe152⤵
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe153⤵
-
\??\c:\1thbbh.exec:\1thbbh.exe154⤵
-
\??\c:\3dddv.exec:\3dddv.exe155⤵
-
\??\c:\9rxxxrl.exec:\9rxxxrl.exe156⤵
-
\??\c:\9btnnn.exec:\9btnnn.exe157⤵
-
\??\c:\jjdvv.exec:\jjdvv.exe158⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe159⤵
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe160⤵
-
\??\c:\httnhh.exec:\httnhh.exe161⤵
-
\??\c:\vdjdv.exec:\vdjdv.exe162⤵
-
\??\c:\rrlffrr.exec:\rrlffrr.exe163⤵
-
\??\c:\9xffffl.exec:\9xffffl.exe164⤵
-
\??\c:\bbnnnt.exec:\bbnnnt.exe165⤵
-
\??\c:\pjppj.exec:\pjppj.exe166⤵
-
\??\c:\lxxrrlr.exec:\lxxrrlr.exe167⤵
-
\??\c:\bbnnhb.exec:\bbnnhb.exe168⤵
-
\??\c:\ppdvp.exec:\ppdvp.exe169⤵
-
\??\c:\dvdpj.exec:\dvdpj.exe170⤵
-
\??\c:\rlrlfxl.exec:\rlrlfxl.exe171⤵
-
\??\c:\btbhnt.exec:\btbhnt.exe172⤵
-
\??\c:\dvjpp.exec:\dvjpp.exe173⤵
-
\??\c:\3xxrffx.exec:\3xxrffx.exe174⤵
-
\??\c:\hhtntt.exec:\hhtntt.exe175⤵
-
\??\c:\7ddvv.exec:\7ddvv.exe176⤵
-
\??\c:\pdpjj.exec:\pdpjj.exe177⤵
-
\??\c:\rrxrrll.exec:\rrxrrll.exe178⤵
-
\??\c:\tnhtbh.exec:\tnhtbh.exe179⤵
-
\??\c:\dvdvv.exec:\dvdvv.exe180⤵
-
\??\c:\flfrffx.exec:\flfrffx.exe181⤵
-
\??\c:\hbbnhb.exec:\hbbnhb.exe182⤵
-
\??\c:\3ddpj.exec:\3ddpj.exe183⤵
-
\??\c:\jjjdd.exec:\jjjdd.exe184⤵
-
\??\c:\rlfxlff.exec:\rlfxlff.exe185⤵
-
\??\c:\tnbbth.exec:\tnbbth.exe186⤵
-
\??\c:\bnnhbt.exec:\bnnhbt.exe187⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe188⤵
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe189⤵
-
\??\c:\nbhbtb.exec:\nbhbtb.exe190⤵
-
\??\c:\jvpvp.exec:\jvpvp.exe191⤵
-
\??\c:\xfllffr.exec:\xfllffr.exe192⤵
-
\??\c:\7bhhbh.exec:\7bhhbh.exe193⤵
-
\??\c:\dvvdp.exec:\dvvdp.exe194⤵
-
\??\c:\rxxxxlr.exec:\rxxxxlr.exe195⤵
-
\??\c:\hbbthh.exec:\hbbthh.exe196⤵
-
\??\c:\nnnnbn.exec:\nnnnbn.exe197⤵
-
\??\c:\vvpjd.exec:\vvpjd.exe198⤵
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe199⤵
-
\??\c:\hhhhhn.exec:\hhhhhn.exe200⤵
-
\??\c:\jdppp.exec:\jdppp.exe201⤵
-
\??\c:\rffxxxx.exec:\rffxxxx.exe202⤵
-
\??\c:\9xrlllf.exec:\9xrlllf.exe203⤵
-
\??\c:\pvvpj.exec:\pvvpj.exe204⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe205⤵
-
\??\c:\9flrlxf.exec:\9flrlxf.exe206⤵
-
\??\c:\hhnhhn.exec:\hhnhhn.exe207⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe208⤵
-
\??\c:\3lrrllr.exec:\3lrrllr.exe209⤵
-
\??\c:\httnnt.exec:\httnnt.exe210⤵
-
\??\c:\vvjdj.exec:\vvjdj.exe211⤵
-
\??\c:\xffrfxr.exec:\xffrfxr.exe212⤵
-
\??\c:\fllllrl.exec:\fllllrl.exe213⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe214⤵
-
\??\c:\dddvj.exec:\dddvj.exe215⤵
-
\??\c:\frlffll.exec:\frlffll.exe216⤵
-
\??\c:\lrfffll.exec:\lrfffll.exe217⤵
-
\??\c:\nbbnbb.exec:\nbbnbb.exe218⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe219⤵
-
\??\c:\flrlllf.exec:\flrlllf.exe220⤵
-
\??\c:\nbbbbh.exec:\nbbbbh.exe221⤵
-
\??\c:\thnttt.exec:\thnttt.exe222⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe223⤵
-
\??\c:\xxxrrrf.exec:\xxxrrrf.exe224⤵
-
\??\c:\tbbbbb.exec:\tbbbbb.exe225⤵
-
\??\c:\hhhhhh.exec:\hhhhhh.exe226⤵
-
\??\c:\vjppp.exec:\vjppp.exe227⤵
-
\??\c:\rlrxxfl.exec:\rlrxxfl.exe228⤵
-
\??\c:\bhnnnt.exec:\bhnnnt.exe229⤵
-
\??\c:\jjppj.exec:\jjppj.exe230⤵
-
\??\c:\jvddj.exec:\jvddj.exe231⤵
-
\??\c:\fflllrr.exec:\fflllrr.exe232⤵
-
\??\c:\hbhhhh.exec:\hbhhhh.exe233⤵
-
\??\c:\pdppd.exec:\pdppd.exe234⤵
-
\??\c:\fxxffxf.exec:\fxxffxf.exe235⤵
-
\??\c:\bhhhbb.exec:\bhhhbb.exe236⤵
-
\??\c:\jdjdv.exec:\jdjdv.exe237⤵
-
\??\c:\5rrllrl.exec:\5rrllrl.exe238⤵
-
\??\c:\ttnhnt.exec:\ttnhnt.exe239⤵
-
\??\c:\tnbbnt.exec:\tnbbnt.exe240⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe241⤵