Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 13:56
Behavioral task
behavioral1
Sample
9549d952e8ea35ecac445212c4b25850_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
9549d952e8ea35ecac445212c4b25850_NeikiAnalytics.exe
-
Size
312KB
-
MD5
9549d952e8ea35ecac445212c4b25850
-
SHA1
26f6d6ac25f623906b1b4c6c10026bec32aa3ad0
-
SHA256
3a0f844e11947619398e51b091d44f05a511a5ce6d3b36e107dc69cc1d896311
-
SHA512
cf5cd39ecbb103481e52d25de04ddb2262c8449812af478fed0c321fb5a53ca27b7cb7d156a6eee16f6278799c4a30dc8a2fbdb18fa0bca476e68fee0a7a3b26
-
SSDEEP
6144:/cm4FmowdHoSyZuo3F2Y9iE9MAkOCOu0EajNVBZr6y2WfX:N4wFHoSMu49P9miX
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/1188-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1952-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3064-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1808-22-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2656-57-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2752-66-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2540-71-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2752-68-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2936-101-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2396-103-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2396-110-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2600-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/628-120-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1640-132-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1572-155-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1312-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2124-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2292-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/776-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/844-223-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2460-232-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2360-282-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1388-302-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1592-327-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3052-341-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2648-355-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1312-474-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2804-487-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2864-488-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/596-516-0x0000000001B60000-0x0000000001B96000-memory.dmp family_blackmoon behavioral1/memory/1704-542-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1264-561-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2004-583-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3056-609-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3056-608-0x00000000002B0000-0x00000000002E6000-memory.dmp family_blackmoon behavioral1/memory/2236-610-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3028-661-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2544-689-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2376-764-0x00000000002A0000-0x00000000002D6000-memory.dmp family_blackmoon behavioral1/memory/1336-842-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2680-1019-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2180-1038-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/1952-0-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1952-7-0x0000000000440000-0x0000000000476000-memory.dmp family_berbew \??\c:\7ddjv.exe family_berbew behavioral1/memory/1188-12-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1952-10-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/3064-31-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\9dvdp.exe family_berbew behavioral1/memory/1808-22-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\lrrxrrl.exe family_berbew \??\c:\1xllxrr.exe family_berbew behavioral1/memory/2704-44-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/memory/2704-46-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew C:\hbnnhn.exe family_berbew behavioral1/memory/2656-48-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\nhbtbh.exe family_berbew behavioral1/memory/2656-57-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2752-66-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/memory/2752-64-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/memory/2540-71-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\rlxxxfx.exe family_berbew behavioral1/memory/2752-68-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\tntthn.exe family_berbew C:\pppvv.exe family_berbew C:\hhthtb.exe family_berbew behavioral1/memory/2936-101-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\9vpvj.exe family_berbew behavioral1/memory/2396-103-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\tthhth.exe family_berbew behavioral1/memory/2396-110-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\rrfrxrf.exe family_berbew behavioral1/memory/2600-122-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/628-120-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\tbnhbh.exe family_berbew behavioral1/memory/1640-132-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\5vdpd.exe family_berbew C:\bbtnnn.exe family_berbew behavioral1/memory/1572-155-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\jdvvd.exe family_berbew C:\9thtbn.exe family_berbew behavioral1/memory/1312-163-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\xxxlxfr.exe family_berbew behavioral1/memory/2124-174-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\bttbhn.exe family_berbew behavioral1/memory/2292-189-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\5rxfrrf.exe family_berbew C:\3nnthn.exe family_berbew C:\jjvpv.exe family_berbew behavioral1/memory/776-206-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\nnbbnt.exe family_berbew C:\pvvpj.exe family_berbew behavioral1/memory/844-223-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2460-232-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\lrlfrrl.exe family_berbew C:\5jvjd.exe family_berbew C:\ffrxlrx.exe family_berbew C:\1pdpv.exe family_berbew C:\xxxrlfr.exe family_berbew C:\btnbhb.exe family_berbew behavioral1/memory/2360-282-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\dddpj.exe family_berbew behavioral1/memory/1388-302-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1592-327-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/3052-334-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/3052-341-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
7ddjv.exelrrxrrl.exe9dvdp.exe1xllxrr.exehbnnhn.exenhbtbh.exerlxxxfx.exetntthn.exepppvv.exehhthtb.exe9vpvj.exetthhth.exerrfrxrf.exetbnhbh.exe5vdpd.exebbtnnn.exejdvvd.exe9thtbn.exexxxlxfr.exebttbhn.exe5rxfrrf.exe3nnthn.exejjvpv.exennbbnt.exepvvpj.exelrlfrrl.exe5jvjd.exeffrxlrx.exe1pdpv.exexxxrlfr.exebtnbhb.exedddpj.exexffxxrx.exebnnthh.exevvdvj.exerxxfrrl.exehnhbth.exejjdjd.exe3lllxlx.exe3tnhnt.exejddvp.exe3rxlxxl.exehhhnth.exe3dpjv.exehhbnbh.exe9tnthb.exefxxxfrx.exe1bhntb.exe3httbb.exejdvdj.exellrlxff.exehbnbhn.exejppvp.exexxxrflx.exe1bhhnt.exedvjvv.exeflfxlfx.exebnhtbt.exe9vvvj.exedjdjp.exenhbtbb.exejdvdj.exellxrflx.exe1ffxxll.exepid process 1188 7ddjv.exe 1808 lrrxrrl.exe 3064 9dvdp.exe 2704 1xllxrr.exe 2656 hbnnhn.exe 2752 nhbtbh.exe 2540 rlxxxfx.exe 2496 tntthn.exe 2668 pppvv.exe 2936 hhthtb.exe 2396 9vpvj.exe 628 tthhth.exe 2600 rrfrxrf.exe 1640 tbnhbh.exe 2176 5vdpd.exe 1572 bbtnnn.exe 1312 jdvvd.exe 2960 9thtbn.exe 2124 xxxlxfr.exe 2292 bttbhn.exe 2304 5rxfrrf.exe 776 3nnthn.exe 1492 jjvpv.exe 844 nnbbnt.exe 2460 pvvpj.exe 1140 lrlfrrl.exe 316 5jvjd.exe 1528 ffrxlrx.exe 1864 1pdpv.exe 2884 xxxrlfr.exe 2360 btnbhb.exe 2892 dddpj.exe 2312 xffxxrx.exe 1388 bnnthh.exe 2196 vvdvj.exe 2260 rxxfrrl.exe 2092 hnhbth.exe 1592 jjdjd.exe 2776 3lllxlx.exe 3052 3tnhnt.exe 3064 jddvp.exe 2648 3rxlxxl.exe 2848 hhhnth.exe 2616 3dpjv.exe 2524 hhbnbh.exe 2664 9tnthb.exe 2544 fxxxfrx.exe 2620 1bhntb.exe 2928 3httbb.exe 2208 jdvdj.exe 2936 llrlxff.exe 876 hbnbhn.exe 2024 jppvp.exe 1928 xxxrflx.exe 1644 1bhhnt.exe 1640 dvjvv.exe 2408 flfxlfx.exe 1280 bnhtbt.exe 1352 9vvvj.exe 1312 djdjp.exe 2324 nhbtbb.exe 2804 jdvdj.exe 2864 llxrflx.exe 1156 1ffxxll.exe -
Processes:
resource yara_rule behavioral1/memory/1952-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1952-7-0x0000000000440000-0x0000000000476000-memory.dmp upx \??\c:\7ddjv.exe upx behavioral1/memory/1188-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1952-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3064-31-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\9dvdp.exe upx behavioral1/memory/1808-22-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lrrxrrl.exe upx \??\c:\1xllxrr.exe upx C:\hbnnhn.exe upx behavioral1/memory/2656-48-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhbtbh.exe upx behavioral1/memory/2656-57-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2752-64-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/memory/2540-71-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rlxxxfx.exe upx behavioral1/memory/2752-68-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\tntthn.exe upx C:\pppvv.exe upx C:\hhthtb.exe upx behavioral1/memory/2936-101-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9vpvj.exe upx behavioral1/memory/2396-103-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tthhth.exe upx behavioral1/memory/2396-110-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rrfrxrf.exe upx behavioral1/memory/2600-122-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/628-120-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tbnhbh.exe upx behavioral1/memory/1640-132-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5vdpd.exe upx C:\bbtnnn.exe upx behavioral1/memory/1572-155-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jdvvd.exe upx C:\9thtbn.exe upx behavioral1/memory/1312-163-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xxxlxfr.exe upx behavioral1/memory/2124-174-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bttbhn.exe upx behavioral1/memory/2292-189-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5rxfrrf.exe upx C:\3nnthn.exe upx C:\jjvpv.exe upx behavioral1/memory/776-206-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nnbbnt.exe upx C:\pvvpj.exe upx behavioral1/memory/844-223-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2460-232-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lrlfrrl.exe upx C:\5jvjd.exe upx C:\ffrxlrx.exe upx C:\1pdpv.exe upx C:\xxxrlfr.exe upx C:\btnbhb.exe upx behavioral1/memory/2360-282-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dddpj.exe upx behavioral1/memory/1388-302-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1592-327-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3052-334-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3052-341-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2648-355-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2616-363-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2208-402-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9549d952e8ea35ecac445212c4b25850_NeikiAnalytics.exe7ddjv.exelrrxrrl.exe9dvdp.exe1xllxrr.exehbnnhn.exenhbtbh.exerlxxxfx.exetntthn.exepppvv.exehhthtb.exe9vpvj.exetthhth.exerrfrxrf.exetbnhbh.exe5vdpd.exedescription pid process target process PID 1952 wrote to memory of 1188 1952 9549d952e8ea35ecac445212c4b25850_NeikiAnalytics.exe 7ddjv.exe PID 1952 wrote to memory of 1188 1952 9549d952e8ea35ecac445212c4b25850_NeikiAnalytics.exe 7ddjv.exe PID 1952 wrote to memory of 1188 1952 9549d952e8ea35ecac445212c4b25850_NeikiAnalytics.exe 7ddjv.exe PID 1952 wrote to memory of 1188 1952 9549d952e8ea35ecac445212c4b25850_NeikiAnalytics.exe 7ddjv.exe PID 1188 wrote to memory of 1808 1188 7ddjv.exe lrrxrrl.exe PID 1188 wrote to memory of 1808 1188 7ddjv.exe lrrxrrl.exe PID 1188 wrote to memory of 1808 1188 7ddjv.exe lrrxrrl.exe PID 1188 wrote to memory of 1808 1188 7ddjv.exe lrrxrrl.exe PID 1808 wrote to memory of 3064 1808 lrrxrrl.exe 9dvdp.exe PID 1808 wrote to memory of 3064 1808 lrrxrrl.exe 9dvdp.exe PID 1808 wrote to memory of 3064 1808 lrrxrrl.exe 9dvdp.exe PID 1808 wrote to memory of 3064 1808 lrrxrrl.exe 9dvdp.exe PID 3064 wrote to memory of 2704 3064 9dvdp.exe 1xllxrr.exe PID 3064 wrote to memory of 2704 3064 9dvdp.exe 1xllxrr.exe PID 3064 wrote to memory of 2704 3064 9dvdp.exe 1xllxrr.exe PID 3064 wrote to memory of 2704 3064 9dvdp.exe 1xllxrr.exe PID 2704 wrote to memory of 2656 2704 1xllxrr.exe hbnnhn.exe PID 2704 wrote to memory of 2656 2704 1xllxrr.exe hbnnhn.exe PID 2704 wrote to memory of 2656 2704 1xllxrr.exe hbnnhn.exe PID 2704 wrote to memory of 2656 2704 1xllxrr.exe hbnnhn.exe PID 2656 wrote to memory of 2752 2656 hbnnhn.exe nhbtbh.exe PID 2656 wrote to memory of 2752 2656 hbnnhn.exe nhbtbh.exe PID 2656 wrote to memory of 2752 2656 hbnnhn.exe nhbtbh.exe PID 2656 wrote to memory of 2752 2656 hbnnhn.exe nhbtbh.exe PID 2752 wrote to memory of 2540 2752 nhbtbh.exe rlxxxfx.exe PID 2752 wrote to memory of 2540 2752 nhbtbh.exe rlxxxfx.exe PID 2752 wrote to memory of 2540 2752 nhbtbh.exe rlxxxfx.exe PID 2752 wrote to memory of 2540 2752 nhbtbh.exe rlxxxfx.exe PID 2540 wrote to memory of 2496 2540 rlxxxfx.exe tntthn.exe PID 2540 wrote to memory of 2496 2540 rlxxxfx.exe tntthn.exe PID 2540 wrote to memory of 2496 2540 rlxxxfx.exe tntthn.exe PID 2540 wrote to memory of 2496 2540 rlxxxfx.exe tntthn.exe PID 2496 wrote to memory of 2668 2496 tntthn.exe pppvv.exe PID 2496 wrote to memory of 2668 2496 tntthn.exe pppvv.exe PID 2496 wrote to memory of 2668 2496 tntthn.exe pppvv.exe PID 2496 wrote to memory of 2668 2496 tntthn.exe pppvv.exe PID 2668 wrote to memory of 2936 2668 pppvv.exe hhthtb.exe PID 2668 wrote to memory of 2936 2668 pppvv.exe hhthtb.exe PID 2668 wrote to memory of 2936 2668 pppvv.exe hhthtb.exe PID 2668 wrote to memory of 2936 2668 pppvv.exe hhthtb.exe PID 2936 wrote to memory of 2396 2936 hhthtb.exe 9vpvj.exe PID 2936 wrote to memory of 2396 2936 hhthtb.exe 9vpvj.exe PID 2936 wrote to memory of 2396 2936 hhthtb.exe 9vpvj.exe PID 2936 wrote to memory of 2396 2936 hhthtb.exe 9vpvj.exe PID 2396 wrote to memory of 628 2396 9vpvj.exe tthhth.exe PID 2396 wrote to memory of 628 2396 9vpvj.exe tthhth.exe PID 2396 wrote to memory of 628 2396 9vpvj.exe tthhth.exe PID 2396 wrote to memory of 628 2396 9vpvj.exe tthhth.exe PID 628 wrote to memory of 2600 628 tthhth.exe rrfrxrf.exe PID 628 wrote to memory of 2600 628 tthhth.exe rrfrxrf.exe PID 628 wrote to memory of 2600 628 tthhth.exe rrfrxrf.exe PID 628 wrote to memory of 2600 628 tthhth.exe rrfrxrf.exe PID 2600 wrote to memory of 1640 2600 rrfrxrf.exe tbnhbh.exe PID 2600 wrote to memory of 1640 2600 rrfrxrf.exe tbnhbh.exe PID 2600 wrote to memory of 1640 2600 rrfrxrf.exe tbnhbh.exe PID 2600 wrote to memory of 1640 2600 rrfrxrf.exe tbnhbh.exe PID 1640 wrote to memory of 2176 1640 tbnhbh.exe 5vdpd.exe PID 1640 wrote to memory of 2176 1640 tbnhbh.exe 5vdpd.exe PID 1640 wrote to memory of 2176 1640 tbnhbh.exe 5vdpd.exe PID 1640 wrote to memory of 2176 1640 tbnhbh.exe 5vdpd.exe PID 2176 wrote to memory of 1572 2176 5vdpd.exe bbtnnn.exe PID 2176 wrote to memory of 1572 2176 5vdpd.exe bbtnnn.exe PID 2176 wrote to memory of 1572 2176 5vdpd.exe bbtnnn.exe PID 2176 wrote to memory of 1572 2176 5vdpd.exe bbtnnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9549d952e8ea35ecac445212c4b25850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9549d952e8ea35ecac445212c4b25850_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\7ddjv.exec:\7ddjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrrxrrl.exec:\lrrxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9dvdp.exec:\9dvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1xllxrr.exec:\1xllxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnnhn.exec:\hbnnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbtbh.exec:\nhbtbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxxxfx.exec:\rlxxxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tntthn.exec:\tntthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pppvv.exec:\pppvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhthtb.exec:\hhthtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9vpvj.exec:\9vpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthhth.exec:\tthhth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrfrxrf.exec:\rrfrxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbnhbh.exec:\tbnhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vdpd.exec:\5vdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtnnn.exec:\bbtnnn.exe17⤵
- Executes dropped EXE
-
\??\c:\jdvvd.exec:\jdvvd.exe18⤵
- Executes dropped EXE
-
\??\c:\9thtbn.exec:\9thtbn.exe19⤵
- Executes dropped EXE
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe20⤵
- Executes dropped EXE
-
\??\c:\bttbhn.exec:\bttbhn.exe21⤵
- Executes dropped EXE
-
\??\c:\5rxfrrf.exec:\5rxfrrf.exe22⤵
- Executes dropped EXE
-
\??\c:\3nnthn.exec:\3nnthn.exe23⤵
- Executes dropped EXE
-
\??\c:\jjvpv.exec:\jjvpv.exe24⤵
- Executes dropped EXE
-
\??\c:\nnbbnt.exec:\nnbbnt.exe25⤵
- Executes dropped EXE
-
\??\c:\pvvpj.exec:\pvvpj.exe26⤵
- Executes dropped EXE
-
\??\c:\lrlfrrl.exec:\lrlfrrl.exe27⤵
- Executes dropped EXE
-
\??\c:\5jvjd.exec:\5jvjd.exe28⤵
- Executes dropped EXE
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe29⤵
- Executes dropped EXE
-
\??\c:\1pdpv.exec:\1pdpv.exe30⤵
- Executes dropped EXE
-
\??\c:\xxxrlfr.exec:\xxxrlfr.exe31⤵
- Executes dropped EXE
-
\??\c:\btnbhb.exec:\btnbhb.exe32⤵
- Executes dropped EXE
-
\??\c:\dddpj.exec:\dddpj.exe33⤵
- Executes dropped EXE
-
\??\c:\xffxxrx.exec:\xffxxrx.exe34⤵
- Executes dropped EXE
-
\??\c:\bnnthh.exec:\bnnthh.exe35⤵
- Executes dropped EXE
-
\??\c:\vvdvj.exec:\vvdvj.exe36⤵
- Executes dropped EXE
-
\??\c:\rxxfrrl.exec:\rxxfrrl.exe37⤵
- Executes dropped EXE
-
\??\c:\hnhbth.exec:\hnhbth.exe38⤵
- Executes dropped EXE
-
\??\c:\jjdjd.exec:\jjdjd.exe39⤵
- Executes dropped EXE
-
\??\c:\3lllxlx.exec:\3lllxlx.exe40⤵
- Executes dropped EXE
-
\??\c:\3tnhnt.exec:\3tnhnt.exe41⤵
- Executes dropped EXE
-
\??\c:\jddvp.exec:\jddvp.exe42⤵
- Executes dropped EXE
-
\??\c:\3rxlxxl.exec:\3rxlxxl.exe43⤵
- Executes dropped EXE
-
\??\c:\hhhnth.exec:\hhhnth.exe44⤵
- Executes dropped EXE
-
\??\c:\3dpjv.exec:\3dpjv.exe45⤵
- Executes dropped EXE
-
\??\c:\hhbnbh.exec:\hhbnbh.exe46⤵
- Executes dropped EXE
-
\??\c:\9tnthb.exec:\9tnthb.exe47⤵
- Executes dropped EXE
-
\??\c:\fxxxfrx.exec:\fxxxfrx.exe48⤵
- Executes dropped EXE
-
\??\c:\1bhntb.exec:\1bhntb.exe49⤵
- Executes dropped EXE
-
\??\c:\3httbb.exec:\3httbb.exe50⤵
- Executes dropped EXE
-
\??\c:\jdvdj.exec:\jdvdj.exe51⤵
- Executes dropped EXE
-
\??\c:\llrlxff.exec:\llrlxff.exe52⤵
- Executes dropped EXE
-
\??\c:\hbnbhn.exec:\hbnbhn.exe53⤵
- Executes dropped EXE
-
\??\c:\jppvp.exec:\jppvp.exe54⤵
- Executes dropped EXE
-
\??\c:\xxxrflx.exec:\xxxrflx.exe55⤵
- Executes dropped EXE
-
\??\c:\1bhhnt.exec:\1bhhnt.exe56⤵
- Executes dropped EXE
-
\??\c:\dvjvv.exec:\dvjvv.exe57⤵
- Executes dropped EXE
-
\??\c:\flfxlfx.exec:\flfxlfx.exe58⤵
- Executes dropped EXE
-
\??\c:\bnhtbt.exec:\bnhtbt.exe59⤵
- Executes dropped EXE
-
\??\c:\9vvvj.exec:\9vvvj.exe60⤵
- Executes dropped EXE
-
\??\c:\djdjp.exec:\djdjp.exe61⤵
- Executes dropped EXE
-
\??\c:\nhbtbb.exec:\nhbtbb.exe62⤵
- Executes dropped EXE
-
\??\c:\jdvdj.exec:\jdvdj.exe63⤵
- Executes dropped EXE
-
\??\c:\llxrflx.exec:\llxrflx.exe64⤵
- Executes dropped EXE
-
\??\c:\1ffxxll.exec:\1ffxxll.exe65⤵
- Executes dropped EXE
-
\??\c:\bbhthn.exec:\bbhthn.exe66⤵
-
\??\c:\djjdv.exec:\djjdv.exe67⤵
-
\??\c:\1rrrfrx.exec:\1rrrfrx.exe68⤵
-
\??\c:\9tnbnt.exec:\9tnbnt.exe69⤵
-
\??\c:\7vvdp.exec:\7vvdp.exe70⤵
-
\??\c:\9rflrfl.exec:\9rflrfl.exe71⤵
-
\??\c:\nnnttb.exec:\nnnttb.exe72⤵
-
\??\c:\nnhtbn.exec:\nnhtbn.exe73⤵
-
\??\c:\jdvpd.exec:\jdvpd.exe74⤵
-
\??\c:\llfrlxl.exec:\llfrlxl.exe75⤵
-
\??\c:\nnhnbn.exec:\nnhnbn.exe76⤵
-
\??\c:\dppdd.exec:\dppdd.exe77⤵
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe78⤵
-
\??\c:\flxrrlf.exec:\flxrrlf.exe79⤵
-
\??\c:\vdvvd.exec:\vdvvd.exe80⤵
-
\??\c:\lrxxlrf.exec:\lrxxlrf.exe81⤵
-
\??\c:\xxxflrl.exec:\xxxflrl.exe82⤵
-
\??\c:\hbbbbb.exec:\hbbbbb.exe83⤵
-
\??\c:\pjvpv.exec:\pjvpv.exe84⤵
-
\??\c:\fxlfrfx.exec:\fxlfrfx.exe85⤵
-
\??\c:\nhnnbt.exec:\nhnnbt.exe86⤵
-
\??\c:\ddvpv.exec:\ddvpv.exe87⤵
-
\??\c:\5rlxfrx.exec:\5rlxfrx.exe88⤵
-
\??\c:\xxlxxrl.exec:\xxlxxrl.exe89⤵
-
\??\c:\ddjvv.exec:\ddjvv.exe90⤵
-
\??\c:\fflxflx.exec:\fflxflx.exe91⤵
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe92⤵
-
\??\c:\hnhnth.exec:\hnhnth.exe93⤵
-
\??\c:\vvjjv.exec:\vvjjv.exe94⤵
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe95⤵
-
\??\c:\ttnnbh.exec:\ttnnbh.exe96⤵
-
\??\c:\1jdjv.exec:\1jdjv.exe97⤵
-
\??\c:\1jdjp.exec:\1jdjp.exe98⤵
-
\??\c:\rrllrxl.exec:\rrllrxl.exe99⤵
-
\??\c:\bthbnb.exec:\bthbnb.exe100⤵
-
\??\c:\vvdpp.exec:\vvdpp.exe101⤵
-
\??\c:\rxxxlrx.exec:\rxxxlrx.exe102⤵
-
\??\c:\7bhhbh.exec:\7bhhbh.exe103⤵
-
\??\c:\3lrxxff.exec:\3lrxxff.exe104⤵
-
\??\c:\llxllfr.exec:\llxllfr.exe105⤵
-
\??\c:\jvjdj.exec:\jvjdj.exe106⤵
-
\??\c:\llflxfx.exec:\llflxfx.exe107⤵
-
\??\c:\5lflrfx.exec:\5lflrfx.exe108⤵
-
\??\c:\bttbth.exec:\bttbth.exe109⤵
-
\??\c:\9jvdp.exec:\9jvdp.exe110⤵
-
\??\c:\rxxfxxr.exec:\rxxfxxr.exe111⤵
-
\??\c:\xxrxffx.exec:\xxrxffx.exe112⤵
-
\??\c:\bbbnhn.exec:\bbbnhn.exe113⤵
-
\??\c:\ddjpj.exec:\ddjpj.exe114⤵
-
\??\c:\xxxflfx.exec:\xxxflfx.exe115⤵
-
\??\c:\llrfxfr.exec:\llrfxfr.exe116⤵
-
\??\c:\hnnnnn.exec:\hnnnnn.exe117⤵
-
\??\c:\5ddpp.exec:\5ddpp.exe118⤵
-
\??\c:\1fflfrf.exec:\1fflfrf.exe119⤵
-
\??\c:\hhhnbh.exec:\hhhnbh.exe120⤵
-
\??\c:\vdvvj.exec:\vdvvj.exe121⤵
-
\??\c:\dvppj.exec:\dvppj.exe122⤵
-
\??\c:\lrxxlfr.exec:\lrxxlfr.exe123⤵
-
\??\c:\hnhnhn.exec:\hnhnhn.exe124⤵
-
\??\c:\vvpjj.exec:\vvpjj.exe125⤵
-
\??\c:\xfxlxlx.exec:\xfxlxlx.exe126⤵
-
\??\c:\bthtnn.exec:\bthtnn.exe127⤵
-
\??\c:\nthnbh.exec:\nthnbh.exe128⤵
-
\??\c:\pvjjp.exec:\pvjjp.exe129⤵
-
\??\c:\fffxlrf.exec:\fffxlrf.exe130⤵
-
\??\c:\tbhtht.exec:\tbhtht.exe131⤵
-
\??\c:\hbnnhh.exec:\hbnnhh.exe132⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe133⤵
-
\??\c:\3ffxlrf.exec:\3ffxlrf.exe134⤵
-
\??\c:\thhtnt.exec:\thhtnt.exe135⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe136⤵
-
\??\c:\xfxlfrr.exec:\xfxlfrr.exe137⤵
-
\??\c:\nhttnh.exec:\nhttnh.exe138⤵
-
\??\c:\ddvjv.exec:\ddvjv.exe139⤵
-
\??\c:\ddpdp.exec:\ddpdp.exe140⤵
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe141⤵
-
\??\c:\1nhbnb.exec:\1nhbnb.exe142⤵
-
\??\c:\djvjv.exec:\djvjv.exe143⤵
-
\??\c:\jdpdp.exec:\jdpdp.exe144⤵
-
\??\c:\flrllll.exec:\flrllll.exe145⤵
-
\??\c:\nntnhn.exec:\nntnhn.exe146⤵
-
\??\c:\ppdvj.exec:\ppdvj.exe147⤵
-
\??\c:\xfrllff.exec:\xfrllff.exe148⤵
-
\??\c:\htnhbt.exec:\htnhbt.exe149⤵
-
\??\c:\bhntnb.exec:\bhntnb.exe150⤵
-
\??\c:\vvvdp.exec:\vvvdp.exe151⤵
-
\??\c:\lxxfxll.exec:\lxxfxll.exe152⤵
-
\??\c:\ttnhtb.exec:\ttnhtb.exe153⤵
-
\??\c:\pvjpv.exec:\pvjpv.exe154⤵
-
\??\c:\ddjvp.exec:\ddjvp.exe155⤵
-
\??\c:\ffrfxfx.exec:\ffrfxfx.exe156⤵
-
\??\c:\tthtnh.exec:\tthtnh.exe157⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe158⤵
-
\??\c:\rrrfxfx.exec:\rrrfxfx.exe159⤵
-
\??\c:\rxxrlxr.exec:\rxxrlxr.exe160⤵
-
\??\c:\nbntbt.exec:\nbntbt.exe161⤵
-
\??\c:\djdjd.exec:\djdjd.exe162⤵
-
\??\c:\tnhnht.exec:\tnhnht.exe163⤵
-
\??\c:\hbtbnn.exec:\hbtbnn.exe164⤵
-
\??\c:\jdvvj.exec:\jdvvj.exe165⤵
-
\??\c:\1rrflxf.exec:\1rrflxf.exe166⤵
-
\??\c:\3xllxrx.exec:\3xllxrx.exe167⤵
-
\??\c:\tbtbnt.exec:\tbtbnt.exe168⤵
-
\??\c:\pjjvv.exec:\pjjvv.exe169⤵
-
\??\c:\vjddj.exec:\vjddj.exe170⤵
-
\??\c:\rrrflfl.exec:\rrrflfl.exe171⤵
-
\??\c:\bnhnbn.exec:\bnhnbn.exe172⤵
-
\??\c:\vppdd.exec:\vppdd.exe173⤵
-
\??\c:\vpdpj.exec:\vpdpj.exe174⤵
-
\??\c:\5lllrxf.exec:\5lllrxf.exe175⤵
-
\??\c:\ntbtbn.exec:\ntbtbn.exe176⤵
-
\??\c:\nhbhtb.exec:\nhbhtb.exe177⤵
-
\??\c:\vvjpj.exec:\vvjpj.exe178⤵
-
\??\c:\3pvpv.exec:\3pvpv.exe179⤵
-
\??\c:\rlrfrfx.exec:\rlrfrfx.exe180⤵
-
\??\c:\bnnnnh.exec:\bnnnnh.exe181⤵
-
\??\c:\pvvjv.exec:\pvvjv.exe182⤵
-
\??\c:\pjjvd.exec:\pjjvd.exe183⤵
-
\??\c:\rxxrlxl.exec:\rxxrlxl.exe184⤵
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe185⤵
-
\??\c:\hhbnbn.exec:\hhbnbn.exe186⤵
-
\??\c:\vddvj.exec:\vddvj.exe187⤵
-
\??\c:\pvvpv.exec:\pvvpv.exe188⤵
-
\??\c:\lfxlxrr.exec:\lfxlxrr.exe189⤵
-
\??\c:\nttnnh.exec:\nttnnh.exe190⤵
-
\??\c:\5nntbn.exec:\5nntbn.exe191⤵
-
\??\c:\pvpdp.exec:\pvpdp.exe192⤵
-
\??\c:\7lrxrfl.exec:\7lrxrfl.exe193⤵
-
\??\c:\fflrlxl.exec:\fflrlxl.exe194⤵
-
\??\c:\nnbnhn.exec:\nnbnhn.exe195⤵
-
\??\c:\1dpvp.exec:\1dpvp.exe196⤵
-
\??\c:\ppjpd.exec:\ppjpd.exe197⤵
-
\??\c:\5xlffxl.exec:\5xlffxl.exe198⤵
-
\??\c:\hbnhbn.exec:\hbnhbn.exe199⤵
-
\??\c:\tnnnbh.exec:\tnnnbh.exe200⤵
-
\??\c:\7ddvp.exec:\7ddvp.exe201⤵
-
\??\c:\rflxrff.exec:\rflxrff.exe202⤵
-
\??\c:\hbtbhh.exec:\hbtbhh.exe203⤵
-
\??\c:\ttbhnn.exec:\ttbhnn.exe204⤵
-
\??\c:\jdjvv.exec:\jdjvv.exe205⤵
-
\??\c:\xrlxfrf.exec:\xrlxfrf.exe206⤵
-
\??\c:\5xlflff.exec:\5xlflff.exe207⤵
-
\??\c:\ntnthh.exec:\ntnthh.exe208⤵
-
\??\c:\vvppj.exec:\vvppj.exe209⤵
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe210⤵
-
\??\c:\xxfrffx.exec:\xxfrffx.exe211⤵
-
\??\c:\1tnhbn.exec:\1tnhbn.exe212⤵
-
\??\c:\1nnhtn.exec:\1nnhtn.exe213⤵
-
\??\c:\dvpvp.exec:\dvpvp.exe214⤵
-
\??\c:\ffxfllr.exec:\ffxfllr.exe215⤵
-
\??\c:\5llxllx.exec:\5llxllx.exe216⤵
-
\??\c:\7nhthh.exec:\7nhthh.exe217⤵
-
\??\c:\1vvjv.exec:\1vvjv.exe218⤵
-
\??\c:\jpjdd.exec:\jpjdd.exe219⤵
-
\??\c:\xxrlxlx.exec:\xxrlxlx.exe220⤵
-
\??\c:\3nnbnt.exec:\3nnbnt.exe221⤵
-
\??\c:\7hbnnb.exec:\7hbnnb.exe222⤵
-
\??\c:\7djdj.exec:\7djdj.exe223⤵
-
\??\c:\llfrflx.exec:\llfrflx.exe224⤵
-
\??\c:\5nntnn.exec:\5nntnn.exe225⤵
-
\??\c:\tnntbh.exec:\tnntbh.exe226⤵
-
\??\c:\1dvjp.exec:\1dvjp.exe227⤵
-
\??\c:\ddpvd.exec:\ddpvd.exe228⤵
-
\??\c:\fxxfxxl.exec:\fxxfxxl.exe229⤵
-
\??\c:\bhbhhh.exec:\bhbhhh.exe230⤵
-
\??\c:\3jvpj.exec:\3jvpj.exe231⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe232⤵
-
\??\c:\3xxffrx.exec:\3xxffrx.exe233⤵
-
\??\c:\hbtbth.exec:\hbtbth.exe234⤵
-
\??\c:\1pjpd.exec:\1pjpd.exe235⤵
-
\??\c:\vvppj.exec:\vvppj.exe236⤵
-
\??\c:\rxrfxlf.exec:\rxrfxlf.exe237⤵
-
\??\c:\bbhnhb.exec:\bbhnhb.exe238⤵
-
\??\c:\dpjjp.exec:\dpjjp.exe239⤵
-
\??\c:\vdpjv.exec:\vdpjv.exe240⤵
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe241⤵