Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 14:56
Behavioral task
behavioral1
Sample
0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe
-
Size
464KB
-
MD5
0b37aec59954ac81ab332ce9306598b0
-
SHA1
1109a45f235b6c8cf64c65c67fa399e3989b3e9c
-
SHA256
eb405e79ff2048c2d8e9a5b7c58157bb63521133e86e3fcfa139d2d2305d5448
-
SHA512
c8bd649470ba91ac20d37b14fcd47f37f3b2b9444bad3c7f9ec95f83c2d4465f2b985075909421d3d6dd95ec7a81caf6accfcf7bb293f8c4251562e9e609cd36
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VB:VeR0oykayRFp3lztP+OKaf1VB
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2332-6-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3888-8-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2284-25-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2248-19-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3116-35-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4004-40-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/732-46-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2132-52-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3388-59-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2984-65-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4728-72-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4744-77-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2908-80-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2800-91-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2776-95-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/384-107-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2856-111-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4580-117-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2136-120-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4088-125-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1396-132-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4896-141-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/380-146-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4556-152-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4232-160-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/388-172-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4812-181-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/552-189-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2884-200-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/688-202-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3556-206-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3120-215-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3996-217-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2132-231-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/940-237-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/660-247-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3088-254-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2576-259-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2376-268-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/404-282-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3492-296-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4532-331-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1704-347-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2088-361-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2132-368-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2956-376-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4584-396-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2376-400-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1616-404-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3620-474-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4032-493-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4820-497-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2776-513-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4424-529-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4704-546-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4956-553-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4956-557-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4664-570-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2272-643-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1456-665-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4992-733-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/388-830-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5000-861-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1680-915-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/2332-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\ppjjd.exe family_berbew behavioral2/memory/2332-6-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3888-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\frrxxff.exe family_berbew C:\hnbnnh.exe family_berbew \??\c:\ppdvd.exe family_berbew behavioral2/memory/2284-25-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2248-19-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xflfrrl.exe family_berbew C:\xlfrrlf.exe family_berbew behavioral2/memory/3116-35-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\dppdp.exe family_berbew behavioral2/memory/4004-40-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pjdjv.exe family_berbew behavioral2/memory/732-46-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2132-47-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\fllxlrf.exe family_berbew behavioral2/memory/2132-52-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2984-60-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3388-59-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\1dpjv.exe family_berbew behavioral2/memory/2984-65-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\ttnnhb.exe family_berbew C:\lffxrrl.exe family_berbew behavioral2/memory/4728-72-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tnnbht.exe family_berbew behavioral2/memory/4744-77-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2908-80-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\5jdvp.exe family_berbew C:\frrrxfl.exe family_berbew behavioral2/memory/2800-91-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2776-95-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\3hhbtb.exe family_berbew \??\c:\pddvv.exe family_berbew C:\hbnttt.exe family_berbew behavioral2/memory/384-107-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\3dddp.exe family_berbew C:\fxfffrx.exe family_berbew behavioral2/memory/2856-111-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4580-117-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2136-120-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4088-125-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\9xxrlff.exe family_berbew C:\bbtnnb.exe family_berbew behavioral2/memory/1396-132-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vjdpj.exe family_berbew C:\7rfxrrl.exe family_berbew behavioral2/memory/4896-141-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/380-146-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\7rxxxxx.exe family_berbew behavioral2/memory/4556-152-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vpdvp.exe family_berbew C:\xrrlfxr.exe family_berbew behavioral2/memory/4232-160-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bhhnbn.exe family_berbew C:\llrfxff.exe family_berbew behavioral2/memory/388-172-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\3xxfxxr.exe family_berbew C:\xxlllll.exe family_berbew behavioral2/memory/4812-181-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pjpvp.exe family_berbew behavioral2/memory/552-189-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2332-193-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
ppjjd.exefrrxxff.exehnbnnh.exeppdvd.exexflfrrl.exexlfrrlf.exedppdp.exepjdjv.exefllxlrf.exe1dpjv.exettnnhb.exelffxrrl.exetnnbht.exe5jdvp.exefrrrxfl.exe3hhbtb.exepddvv.exehbnttt.exe3dddp.exefxfffrx.exebbtnnb.exe9xxrlff.exevjdpj.exe7rfxrrl.exe7rxxxxx.exevpdvp.exexrrlfxr.exebhhnbn.exellrfxff.exe3xxfxxr.exexxlllll.exepjpvp.exexrxrlff.exevvdpv.exerxxrffl.exethnnhh.exepjvvp.exeffxrrll.exe1bbbtt.exeppvpj.exefxrllff.exehthtbt.exe9dvvp.exefxxxrrl.exebntbbn.exevpjdp.exeflrlffx.exennnttt.exeddjdd.exelrxrlll.exerxlrllr.exebnhhbb.exe1dvdv.exexrrfxxx.exebbntnb.exedvpdd.exevjjpp.exeflxxlxx.exebhnhhh.exeddvdd.exefflxxxf.exetbthhn.exeppjdv.exelflrlll.exepid process 3888 ppjjd.exe 920 frrxxff.exe 2248 hnbnnh.exe 2284 ppdvd.exe 3116 xflfrrl.exe 4004 xlfrrlf.exe 732 dppdp.exe 2132 pjdjv.exe 3388 fllxlrf.exe 2984 1dpjv.exe 4728 ttnnhb.exe 4744 lffxrrl.exe 2908 tnnbht.exe 2584 5jdvp.exe 2800 frrrxfl.exe 2776 3hhbtb.exe 384 pddvv.exe 2856 hbnttt.exe 4580 3dddp.exe 2136 fxfffrx.exe 4088 bbtnnb.exe 1396 9xxrlff.exe 4896 vjdpj.exe 380 7rfxrrl.exe 4556 7rxxxxx.exe 4232 vpdvp.exe 2540 xrrlfxr.exe 388 bhhnbn.exe 1512 llrfxff.exe 4812 3xxfxxr.exe 1324 xxlllll.exe 552 pjpvp.exe 3392 xrxrlff.exe 2884 vvdpv.exe 688 rxxrffl.exe 3556 thnnhh.exe 1684 pjvvp.exe 3120 ffxrrll.exe 3996 1bbbtt.exe 3500 ppvpj.exe 4400 fxrllff.exe 1948 hthtbt.exe 2132 9dvvp.exe 940 fxxxrrl.exe 4124 bntbbn.exe 5004 vpjdp.exe 660 flrlffx.exe 1072 nnnttt.exe 3088 ddjdd.exe 1840 lrxrlll.exe 2576 rxlrllr.exe 400 bnhhbb.exe 1468 1dvdv.exe 2376 xrrfxxx.exe 1616 bbntnb.exe 2696 dvpdd.exe 404 vjjpp.exe 756 flxxlxx.exe 4940 bhnhhh.exe 1624 ddvdd.exe 3492 fflxxxf.exe 856 tbthhn.exe 1444 ppjdv.exe 2788 lflrlll.exe -
Processes:
resource yara_rule behavioral2/memory/2332-0-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ppjjd.exe upx behavioral2/memory/2332-6-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3888-8-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\frrxxff.exe upx C:\hnbnnh.exe upx \??\c:\ppdvd.exe upx behavioral2/memory/2284-25-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2248-19-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xflfrrl.exe upx C:\xlfrrlf.exe upx behavioral2/memory/3116-35-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\dppdp.exe upx behavioral2/memory/4004-40-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pjdjv.exe upx behavioral2/memory/732-46-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2132-47-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\fllxlrf.exe upx behavioral2/memory/2132-52-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2984-60-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3388-59-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\1dpjv.exe upx behavioral2/memory/2984-65-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\ttnnhb.exe upx C:\lffxrrl.exe upx behavioral2/memory/4728-72-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tnnbht.exe upx behavioral2/memory/4744-77-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2908-80-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\5jdvp.exe upx C:\frrrxfl.exe upx behavioral2/memory/2800-91-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2776-95-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\3hhbtb.exe upx \??\c:\pddvv.exe upx C:\hbnttt.exe upx behavioral2/memory/384-107-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\3dddp.exe upx C:\fxfffrx.exe upx behavioral2/memory/2856-111-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4580-117-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2136-120-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4088-125-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\9xxrlff.exe upx C:\bbtnnb.exe upx behavioral2/memory/1396-132-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vjdpj.exe upx C:\7rfxrrl.exe upx behavioral2/memory/4896-141-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/380-146-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\7rxxxxx.exe upx behavioral2/memory/4556-152-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vpdvp.exe upx C:\xrrlfxr.exe upx behavioral2/memory/4232-160-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bhhnbn.exe upx C:\llrfxff.exe upx behavioral2/memory/388-172-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\3xxfxxr.exe upx C:\xxlllll.exe upx behavioral2/memory/4812-181-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pjpvp.exe upx behavioral2/memory/552-189-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2332-193-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exeppjjd.exefrrxxff.exehnbnnh.exeppdvd.exexflfrrl.exexlfrrlf.exedppdp.exepjdjv.exefllxlrf.exe1dpjv.exettnnhb.exelffxrrl.exetnnbht.exe5jdvp.exefrrrxfl.exe3hhbtb.exepddvv.exehbnttt.exe3dddp.exefxfffrx.exebbtnnb.exedescription pid process target process PID 2332 wrote to memory of 3888 2332 0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe ppjjd.exe PID 2332 wrote to memory of 3888 2332 0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe ppjjd.exe PID 2332 wrote to memory of 3888 2332 0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe ppjjd.exe PID 3888 wrote to memory of 920 3888 ppjjd.exe frrxxff.exe PID 3888 wrote to memory of 920 3888 ppjjd.exe frrxxff.exe PID 3888 wrote to memory of 920 3888 ppjjd.exe frrxxff.exe PID 920 wrote to memory of 2248 920 frrxxff.exe hnbnnh.exe PID 920 wrote to memory of 2248 920 frrxxff.exe hnbnnh.exe PID 920 wrote to memory of 2248 920 frrxxff.exe hnbnnh.exe PID 2248 wrote to memory of 2284 2248 hnbnnh.exe ppdvd.exe PID 2248 wrote to memory of 2284 2248 hnbnnh.exe ppdvd.exe PID 2248 wrote to memory of 2284 2248 hnbnnh.exe ppdvd.exe PID 2284 wrote to memory of 3116 2284 ppdvd.exe xflfrrl.exe PID 2284 wrote to memory of 3116 2284 ppdvd.exe xflfrrl.exe PID 2284 wrote to memory of 3116 2284 ppdvd.exe xflfrrl.exe PID 3116 wrote to memory of 4004 3116 xflfrrl.exe xlfrrlf.exe PID 3116 wrote to memory of 4004 3116 xflfrrl.exe xlfrrlf.exe PID 3116 wrote to memory of 4004 3116 xflfrrl.exe xlfrrlf.exe PID 4004 wrote to memory of 732 4004 xlfrrlf.exe dppdp.exe PID 4004 wrote to memory of 732 4004 xlfrrlf.exe dppdp.exe PID 4004 wrote to memory of 732 4004 xlfrrlf.exe dppdp.exe PID 732 wrote to memory of 2132 732 dppdp.exe pjdjv.exe PID 732 wrote to memory of 2132 732 dppdp.exe pjdjv.exe PID 732 wrote to memory of 2132 732 dppdp.exe pjdjv.exe PID 2132 wrote to memory of 3388 2132 pjdjv.exe fllxlrf.exe PID 2132 wrote to memory of 3388 2132 pjdjv.exe fllxlrf.exe PID 2132 wrote to memory of 3388 2132 pjdjv.exe fllxlrf.exe PID 3388 wrote to memory of 2984 3388 fllxlrf.exe 1dpjv.exe PID 3388 wrote to memory of 2984 3388 fllxlrf.exe 1dpjv.exe PID 3388 wrote to memory of 2984 3388 fllxlrf.exe 1dpjv.exe PID 2984 wrote to memory of 4728 2984 1dpjv.exe ttnnhb.exe PID 2984 wrote to memory of 4728 2984 1dpjv.exe ttnnhb.exe PID 2984 wrote to memory of 4728 2984 1dpjv.exe ttnnhb.exe PID 4728 wrote to memory of 4744 4728 ttnnhb.exe lffxrrl.exe PID 4728 wrote to memory of 4744 4728 ttnnhb.exe lffxrrl.exe PID 4728 wrote to memory of 4744 4728 ttnnhb.exe lffxrrl.exe PID 4744 wrote to memory of 2908 4744 lffxrrl.exe tnnbht.exe PID 4744 wrote to memory of 2908 4744 lffxrrl.exe tnnbht.exe PID 4744 wrote to memory of 2908 4744 lffxrrl.exe tnnbht.exe PID 2908 wrote to memory of 2584 2908 tnnbht.exe 5jdvp.exe PID 2908 wrote to memory of 2584 2908 tnnbht.exe 5jdvp.exe PID 2908 wrote to memory of 2584 2908 tnnbht.exe 5jdvp.exe PID 2584 wrote to memory of 2800 2584 5jdvp.exe frrrxfl.exe PID 2584 wrote to memory of 2800 2584 5jdvp.exe frrrxfl.exe PID 2584 wrote to memory of 2800 2584 5jdvp.exe frrrxfl.exe PID 2800 wrote to memory of 2776 2800 frrrxfl.exe 3hhbtb.exe PID 2800 wrote to memory of 2776 2800 frrrxfl.exe 3hhbtb.exe PID 2800 wrote to memory of 2776 2800 frrrxfl.exe 3hhbtb.exe PID 2776 wrote to memory of 384 2776 3hhbtb.exe pddvv.exe PID 2776 wrote to memory of 384 2776 3hhbtb.exe pddvv.exe PID 2776 wrote to memory of 384 2776 3hhbtb.exe pddvv.exe PID 384 wrote to memory of 2856 384 pddvv.exe hbnttt.exe PID 384 wrote to memory of 2856 384 pddvv.exe hbnttt.exe PID 384 wrote to memory of 2856 384 pddvv.exe hbnttt.exe PID 2856 wrote to memory of 4580 2856 hbnttt.exe 3dddp.exe PID 2856 wrote to memory of 4580 2856 hbnttt.exe 3dddp.exe PID 2856 wrote to memory of 4580 2856 hbnttt.exe 3dddp.exe PID 4580 wrote to memory of 2136 4580 3dddp.exe fxfffrx.exe PID 4580 wrote to memory of 2136 4580 3dddp.exe fxfffrx.exe PID 4580 wrote to memory of 2136 4580 3dddp.exe fxfffrx.exe PID 2136 wrote to memory of 4088 2136 fxfffrx.exe bbtnnb.exe PID 2136 wrote to memory of 4088 2136 fxfffrx.exe bbtnnb.exe PID 2136 wrote to memory of 4088 2136 fxfffrx.exe bbtnnb.exe PID 4088 wrote to memory of 1396 4088 bbtnnb.exe 9xxrlff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0b37aec59954ac81ab332ce9306598b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\ppjjd.exec:\ppjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrxxff.exec:\frrxxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hnbnnh.exec:\hnbnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ppdvd.exec:\ppdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xflfrrl.exec:\xflfrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xlfrrlf.exec:\xlfrrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dppdp.exec:\dppdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdjv.exec:\pjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fllxlrf.exec:\fllxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1dpjv.exec:\1dpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnnhb.exec:\ttnnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lffxrrl.exec:\lffxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnbht.exec:\tnnbht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5jdvp.exec:\5jdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\frrrxfl.exec:\frrrxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3hhbtb.exec:\3hhbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pddvv.exec:\pddvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnttt.exec:\hbnttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3dddp.exec:\3dddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxfffrx.exec:\fxfffrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnnb.exec:\bbtnnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9xxrlff.exec:\9xxrlff.exe23⤵
- Executes dropped EXE
-
\??\c:\vjdpj.exec:\vjdpj.exe24⤵
- Executes dropped EXE
-
\??\c:\7rfxrrl.exec:\7rfxrrl.exe25⤵
- Executes dropped EXE
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe26⤵
- Executes dropped EXE
-
\??\c:\vpdvp.exec:\vpdvp.exe27⤵
- Executes dropped EXE
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe28⤵
- Executes dropped EXE
-
\??\c:\bhhnbn.exec:\bhhnbn.exe29⤵
- Executes dropped EXE
-
\??\c:\llrfxff.exec:\llrfxff.exe30⤵
- Executes dropped EXE
-
\??\c:\3xxfxxr.exec:\3xxfxxr.exe31⤵
- Executes dropped EXE
-
\??\c:\xxlllll.exec:\xxlllll.exe32⤵
- Executes dropped EXE
-
\??\c:\pjpvp.exec:\pjpvp.exe33⤵
- Executes dropped EXE
-
\??\c:\xrxrlff.exec:\xrxrlff.exe34⤵
- Executes dropped EXE
-
\??\c:\9hhbtt.exec:\9hhbtt.exe35⤵
-
\??\c:\vvdpv.exec:\vvdpv.exe36⤵
- Executes dropped EXE
-
\??\c:\rxxrffl.exec:\rxxrffl.exe37⤵
- Executes dropped EXE
-
\??\c:\thnnhh.exec:\thnnhh.exe38⤵
- Executes dropped EXE
-
\??\c:\pjvvp.exec:\pjvvp.exe39⤵
- Executes dropped EXE
-
\??\c:\ffxrrll.exec:\ffxrrll.exe40⤵
- Executes dropped EXE
-
\??\c:\1bbbtt.exec:\1bbbtt.exe41⤵
- Executes dropped EXE
-
\??\c:\ppvpj.exec:\ppvpj.exe42⤵
- Executes dropped EXE
-
\??\c:\fxrllff.exec:\fxrllff.exe43⤵
- Executes dropped EXE
-
\??\c:\hthtbt.exec:\hthtbt.exe44⤵
- Executes dropped EXE
-
\??\c:\9dvvp.exec:\9dvvp.exe45⤵
- Executes dropped EXE
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe46⤵
- Executes dropped EXE
-
\??\c:\bntbbn.exec:\bntbbn.exe47⤵
- Executes dropped EXE
-
\??\c:\vpjdp.exec:\vpjdp.exe48⤵
- Executes dropped EXE
-
\??\c:\flrlffx.exec:\flrlffx.exe49⤵
- Executes dropped EXE
-
\??\c:\nnnttt.exec:\nnnttt.exe50⤵
- Executes dropped EXE
-
\??\c:\ddjdd.exec:\ddjdd.exe51⤵
- Executes dropped EXE
-
\??\c:\lrxrlll.exec:\lrxrlll.exe52⤵
- Executes dropped EXE
-
\??\c:\rxlrllr.exec:\rxlrllr.exe53⤵
- Executes dropped EXE
-
\??\c:\bnhhbb.exec:\bnhhbb.exe54⤵
- Executes dropped EXE
-
\??\c:\1dvdv.exec:\1dvdv.exe55⤵
- Executes dropped EXE
-
\??\c:\xrrfxxx.exec:\xrrfxxx.exe56⤵
- Executes dropped EXE
-
\??\c:\bbntnb.exec:\bbntnb.exe57⤵
- Executes dropped EXE
-
\??\c:\dvpdd.exec:\dvpdd.exe58⤵
- Executes dropped EXE
-
\??\c:\vjjpp.exec:\vjjpp.exe59⤵
- Executes dropped EXE
-
\??\c:\flxxlxx.exec:\flxxlxx.exe60⤵
- Executes dropped EXE
-
\??\c:\bhnhhh.exec:\bhnhhh.exe61⤵
- Executes dropped EXE
-
\??\c:\ddvdd.exec:\ddvdd.exe62⤵
- Executes dropped EXE
-
\??\c:\fflxxxf.exec:\fflxxxf.exe63⤵
- Executes dropped EXE
-
\??\c:\tbthhn.exec:\tbthhn.exe64⤵
- Executes dropped EXE
-
\??\c:\ppjdv.exec:\ppjdv.exe65⤵
- Executes dropped EXE
-
\??\c:\lflrlll.exec:\lflrlll.exe66⤵
- Executes dropped EXE
-
\??\c:\ttbhhh.exec:\ttbhhh.exe67⤵
-
\??\c:\1thbtb.exec:\1thbtb.exe68⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe69⤵
-
\??\c:\7xlfrrf.exec:\7xlfrrf.exe70⤵
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe71⤵
-
\??\c:\nbthhb.exec:\nbthhb.exe72⤵
-
\??\c:\jdjdp.exec:\jdjdp.exe73⤵
-
\??\c:\lxxrrfx.exec:\lxxrrfx.exe74⤵
-
\??\c:\btbnhb.exec:\btbnhb.exe75⤵
-
\??\c:\ntnhhh.exec:\ntnhhh.exe76⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe77⤵
-
\??\c:\flrrlxx.exec:\flrrlxx.exe78⤵
-
\??\c:\nhhhbb.exec:\nhhhbb.exe79⤵
-
\??\c:\jdjpp.exec:\jdjpp.exe80⤵
-
\??\c:\1dvpj.exec:\1dvpj.exe81⤵
-
\??\c:\lffxrrl.exec:\lffxrrl.exe82⤵
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe83⤵
-
\??\c:\5bhtnn.exec:\5bhtnn.exe84⤵
-
\??\c:\pdjvp.exec:\pdjvp.exe85⤵
-
\??\c:\7rfflxf.exec:\7rfflxf.exe86⤵
-
\??\c:\hhbbnh.exec:\hhbbnh.exe87⤵
-
\??\c:\pppjv.exec:\pppjv.exe88⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe89⤵
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe90⤵
-
\??\c:\nnnhhb.exec:\nnnhhb.exe91⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe92⤵
-
\??\c:\lffxxxx.exec:\lffxxxx.exe93⤵
-
\??\c:\nnhhhh.exec:\nnhhhh.exe94⤵
-
\??\c:\jpvpd.exec:\jpvpd.exe95⤵
-
\??\c:\lffxrrx.exec:\lffxrrx.exe96⤵
-
\??\c:\htbntb.exec:\htbntb.exe97⤵
-
\??\c:\ddjjv.exec:\ddjjv.exe98⤵
-
\??\c:\xflffff.exec:\xflffff.exe99⤵
-
\??\c:\hthhbb.exec:\hthhbb.exe100⤵
-
\??\c:\pjvjp.exec:\pjvjp.exe101⤵
-
\??\c:\xxrllll.exec:\xxrllll.exe102⤵
-
\??\c:\7thbnn.exec:\7thbnn.exe103⤵
-
\??\c:\1ppjv.exec:\1ppjv.exe104⤵
-
\??\c:\xlxrllf.exec:\xlxrllf.exe105⤵
-
\??\c:\1nbtbb.exec:\1nbtbb.exe106⤵
-
\??\c:\vdvpj.exec:\vdvpj.exe107⤵
-
\??\c:\dpddv.exec:\dpddv.exe108⤵
-
\??\c:\flrlfff.exec:\flrlfff.exe109⤵
-
\??\c:\nttttt.exec:\nttttt.exe110⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe111⤵
-
\??\c:\jdddv.exec:\jdddv.exe112⤵
-
\??\c:\5rrlffx.exec:\5rrlffx.exe113⤵
-
\??\c:\httnhh.exec:\httnhh.exe114⤵
-
\??\c:\dvjvd.exec:\dvjvd.exe115⤵
-
\??\c:\lxrrlxr.exec:\lxrrlxr.exe116⤵
-
\??\c:\nnnnhh.exec:\nnnnhh.exe117⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe118⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe119⤵
-
\??\c:\xxlllfl.exec:\xxlllfl.exe120⤵
-
\??\c:\htbhbb.exec:\htbhbb.exe121⤵
-
\??\c:\jjvdd.exec:\jjvdd.exe122⤵
-
\??\c:\jdjpp.exec:\jdjpp.exe123⤵
-
\??\c:\9rlflll.exec:\9rlflll.exe124⤵
-
\??\c:\ttbnbb.exec:\ttbnbb.exe125⤵
-
\??\c:\jvvpj.exec:\jvvpj.exe126⤵
-
\??\c:\frxllfx.exec:\frxllfx.exe127⤵
-
\??\c:\nhhtht.exec:\nhhtht.exe128⤵
-
\??\c:\htbnbh.exec:\htbnbh.exe129⤵
-
\??\c:\pjjdv.exec:\pjjdv.exe130⤵
-
\??\c:\3xrxrxl.exec:\3xrxrxl.exe131⤵
-
\??\c:\btbtnn.exec:\btbtnn.exe132⤵
-
\??\c:\jdjdj.exec:\jdjdj.exe133⤵
-
\??\c:\pvjdv.exec:\pvjdv.exe134⤵
-
\??\c:\7fxlxxr.exec:\7fxlxxr.exe135⤵
-
\??\c:\bbtbtn.exec:\bbtbtn.exe136⤵
-
\??\c:\jjvpp.exec:\jjvpp.exe137⤵
-
\??\c:\flrlfxr.exec:\flrlfxr.exe138⤵
-
\??\c:\7ttnnn.exec:\7ttnnn.exe139⤵
-
\??\c:\jdvvv.exec:\jdvvv.exe140⤵
-
\??\c:\lfxrlll.exec:\lfxrlll.exe141⤵
-
\??\c:\hbbbtn.exec:\hbbbtn.exe142⤵
-
\??\c:\1ttttt.exec:\1ttttt.exe143⤵
-
\??\c:\vjpjj.exec:\vjpjj.exe144⤵
-
\??\c:\9lllfff.exec:\9lllfff.exe145⤵
-
\??\c:\ttbbtt.exec:\ttbbtt.exe146⤵
-
\??\c:\pvpjv.exec:\pvpjv.exe147⤵
-
\??\c:\lrxxrll.exec:\lrxxrll.exe148⤵
-
\??\c:\rffffff.exec:\rffffff.exe149⤵
-
\??\c:\bbnnnn.exec:\bbnnnn.exe150⤵
-
\??\c:\jppjj.exec:\jppjj.exe151⤵
-
\??\c:\fflfxff.exec:\fflfxff.exe152⤵
-
\??\c:\thnnhh.exec:\thnnhh.exe153⤵
-
\??\c:\bhbtnh.exec:\bhbtnh.exe154⤵
-
\??\c:\jpvjv.exec:\jpvjv.exe155⤵
-
\??\c:\rrxxxff.exec:\rrxxxff.exe156⤵
-
\??\c:\hbhbbt.exec:\hbhbbt.exe157⤵
-
\??\c:\nhnbbb.exec:\nhnbbb.exe158⤵
-
\??\c:\dpddp.exec:\dpddp.exe159⤵
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe160⤵
-
\??\c:\lrxxxrr.exec:\lrxxxrr.exe161⤵
-
\??\c:\nbhhhh.exec:\nbhhhh.exe162⤵
-
\??\c:\3jppp.exec:\3jppp.exe163⤵
-
\??\c:\frxlffx.exec:\frxlffx.exe164⤵
-
\??\c:\5bbntt.exec:\5bbntt.exe165⤵
-
\??\c:\nbhbtn.exec:\nbhbtn.exe166⤵
-
\??\c:\jvdvp.exec:\jvdvp.exe167⤵
-
\??\c:\7frrfff.exec:\7frrfff.exe168⤵
-
\??\c:\1bbbtb.exec:\1bbbtb.exe169⤵
-
\??\c:\ddjdv.exec:\ddjdv.exe170⤵
-
\??\c:\pvvpv.exec:\pvvpv.exe171⤵
-
\??\c:\rrxrllf.exec:\rrxrllf.exe172⤵
-
\??\c:\bbnhnt.exec:\bbnhnt.exe173⤵
-
\??\c:\jvdvv.exec:\jvdvv.exe174⤵
-
\??\c:\rxfffff.exec:\rxfffff.exe175⤵
-
\??\c:\rfffxxx.exec:\rfffxxx.exe176⤵
-
\??\c:\nhnnnt.exec:\nhnnnt.exe177⤵
-
\??\c:\dpdvv.exec:\dpdvv.exe178⤵
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe179⤵
-
\??\c:\ttnhht.exec:\ttnhht.exe180⤵
-
\??\c:\hnnbtn.exec:\hnnbtn.exe181⤵
-
\??\c:\pppjd.exec:\pppjd.exe182⤵
-
\??\c:\rflfxxf.exec:\rflfxxf.exe183⤵
-
\??\c:\rxxxxfr.exec:\rxxxxfr.exe184⤵
-
\??\c:\tbttnh.exec:\tbttnh.exe185⤵
-
\??\c:\pvvvp.exec:\pvvvp.exe186⤵
-
\??\c:\frrxxrx.exec:\frrxxrx.exe187⤵
-
\??\c:\thbbbn.exec:\thbbbn.exe188⤵
-
\??\c:\ntnhnh.exec:\ntnhnh.exe189⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe190⤵
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe191⤵
-
\??\c:\hthtbh.exec:\hthtbh.exe192⤵
-
\??\c:\ttnnnh.exec:\ttnnnh.exe193⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe194⤵
-
\??\c:\7rxrrff.exec:\7rxrrff.exe195⤵
-
\??\c:\bnnnnt.exec:\bnnnnt.exe196⤵
-
\??\c:\bbttnn.exec:\bbttnn.exe197⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe198⤵
-
\??\c:\flrlflr.exec:\flrlflr.exe199⤵
-
\??\c:\hbhbhb.exec:\hbhbhb.exe200⤵
-
\??\c:\tnnhbb.exec:\tnnhbb.exe201⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe202⤵
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe203⤵
-
\??\c:\hbtthh.exec:\hbtthh.exe204⤵
-
\??\c:\bnnnnn.exec:\bnnnnn.exe205⤵
-
\??\c:\jddvd.exec:\jddvd.exe206⤵
-
\??\c:\9rrlffx.exec:\9rrlffx.exe207⤵
-
\??\c:\lffxrfx.exec:\lffxrfx.exe208⤵
-
\??\c:\tbthnn.exec:\tbthnn.exe209⤵
-
\??\c:\ddvvv.exec:\ddvvv.exe210⤵
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe211⤵
-
\??\c:\xrrlffx.exec:\xrrlffx.exe212⤵
-
\??\c:\1pdvv.exec:\1pdvv.exe213⤵
-
\??\c:\vpppj.exec:\vpppj.exe214⤵
-
\??\c:\llxrllr.exec:\llxrllr.exe215⤵
-
\??\c:\tttnhh.exec:\tttnhh.exe216⤵
-
\??\c:\vddvp.exec:\vddvp.exe217⤵
-
\??\c:\xlrrffx.exec:\xlrrffx.exe218⤵
-
\??\c:\bthhhh.exec:\bthhhh.exe219⤵
-
\??\c:\7tttnn.exec:\7tttnn.exe220⤵
-
\??\c:\dpdpj.exec:\dpdpj.exe221⤵
-
\??\c:\xrxrfxr.exec:\xrxrfxr.exe222⤵
-
\??\c:\nnnhtt.exec:\nnnhtt.exe223⤵
-
\??\c:\jpdvv.exec:\jpdvv.exe224⤵
-
\??\c:\rflffxl.exec:\rflffxl.exe225⤵
-
\??\c:\hbbtnt.exec:\hbbtnt.exe226⤵
-
\??\c:\vpjvp.exec:\vpjvp.exe227⤵
-
\??\c:\xlrflfr.exec:\xlrflfr.exe228⤵
-
\??\c:\7rxxxxr.exec:\7rxxxxr.exe229⤵
-
\??\c:\9hbntn.exec:\9hbntn.exe230⤵
-
\??\c:\7pvpp.exec:\7pvpp.exe231⤵
-
\??\c:\xfrlffx.exec:\xfrlffx.exe232⤵
-
\??\c:\ntthtn.exec:\ntthtn.exe233⤵
-
\??\c:\jddjd.exec:\jddjd.exe234⤵
-
\??\c:\frxrlrl.exec:\frxrlrl.exe235⤵
-
\??\c:\bntnhh.exec:\bntnhh.exe236⤵
-
\??\c:\5pvvp.exec:\5pvvp.exe237⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe238⤵
-
\??\c:\5bbtnn.exec:\5bbtnn.exe239⤵
-
\??\c:\htbhhh.exec:\htbhhh.exe240⤵
-
\??\c:\vdjvj.exec:\vdjvj.exe241⤵