Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-05-2024 14:55
Behavioral task
behavioral1
Sample
fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe
-
Size
338KB
-
MD5
fc0abb8d5f0ca4a79e5fdf3e244ae2f0
-
SHA1
84d3cbe440fba5d67f7cf6c074126130fa6bf9a4
-
SHA256
446a4c3e66060482bed2f056c181a68733451b8f6e5be908054d33f7e62ccf20
-
SHA512
01b6cadfe4e55a1fd9dc24e98a6cdd5305df46f6a70dbdd8b72dfa6dae77759185f1b78b1b8fa9f214e2605efd69816f13e91853e6e9a0614fe712cf71d2c56b
-
SSDEEP
6144:Kcm4FmowdHoSKAszBd+aQz0192lTk1ycUkpCnAUo0Leu2tZGnOiQ3jiDQIZbdVnR:U4wFHoSK1zBjA892lY196AUo0LX2tZqD
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4864-8-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1884-6-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3388-16-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4592-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4452-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/380-30-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4232-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5024-83-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3976-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2172-98-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5080-126-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2412-174-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/876-199-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4316-203-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4564-213-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/380-241-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3172-258-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2764-262-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4512-297-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1848-307-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2880-332-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4332-344-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1136-351-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1736-356-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4728-369-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1920-325-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/936-324-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1488-287-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/920-263-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1504-228-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4448-217-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/880-207-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4908-179-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4188-167-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4332-161-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2840-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/936-142-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4008-136-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5104-124-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1380-118-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1128-96-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3972-72-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1400-71-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3172-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4764-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/828-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2212-382-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3248-386-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1832-405-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4528-410-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/800-431-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1968-435-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1128-461-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1764-467-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2880-505-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2456-527-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2520-570-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3832-574-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3492-656-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1908-675-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2908-677-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3524-689-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2704-890-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1908-972-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\tbbthh.exe family_berbew C:\dvpdd.exe family_berbew C:\9rrrrxx.exe family_berbew \??\c:\tnhtbt.exe family_berbew \??\c:\ddjpd.exe family_berbew C:\vpvvj.exe family_berbew C:\fxxrlff.exe family_berbew \??\c:\bthhhh.exe family_berbew \??\c:\vvpvv.exe family_berbew \??\c:\3ppdp.exe family_berbew \??\c:\3llfllr.exe family_berbew \??\c:\hbtntn.exe family_berbew C:\rflxlfr.exe family_berbew C:\frxrrrr.exe family_berbew \??\c:\hhtnnh.exe family_berbew C:\7vpjd.exe family_berbew \??\c:\9frlxxr.exe family_berbew \??\c:\ffxfxff.exe family_berbew \??\c:\tnhbtn.exe family_berbew C:\frrxrrx.exe family_berbew \??\c:\pvvpj.exe family_berbew \??\c:\hhttnh.exe family_berbew \??\c:\vpvpj.exe family_berbew \??\c:\lrrfxrf.exe family_berbew \??\c:\5rxrlrr.exe family_berbew \??\c:\9ttnbb.exe family_berbew \??\c:\djvjj.exe family_berbew \??\c:\bhbhtn.exe family_berbew \??\c:\1jppj.exe family_berbew \??\c:\9nnhhh.exe family_berbew \??\c:\9flfxxr.exe family_berbew \??\c:\jpvjd.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
tbbthh.exedvpdd.exe9rrrrxx.exetnhtbt.exeddjpd.exevpvvj.exefxxrlff.exebthhhh.exevvpvv.exe3ppdp.exe3llfllr.exehbtntn.exejpvjd.exerflxlfr.exe9flfxxr.exe9nnhhh.exe1jppj.exefrxrrrr.exehhtnnh.exebhbhtn.exe7vpjd.exe9frlxxr.exeffxfxff.exetnhbtn.exedjvjj.exefrrxrrx.exe9ttnbb.exepvvpj.exe5rxrlrr.exelrrfxrf.exehhttnh.exevpvpj.exerxlfxrl.exehtnbnh.exepjjpp.exe7ddpd.exefxlfxxf.exejjvvv.exexllxlxr.exerrrrrrr.exennbttt.exevjdvp.exe1jjjv.exeffffllr.exebthbhh.exe5hnhnn.exe9vdpj.exevjjdd.exerfffxxx.exehhhthh.exennhbnn.exejdjdv.exejdjdv.exexrrxffl.exefxllffr.exethhbtb.exe7hnhtn.exejvdvv.exejvvvp.exe9rxrxrx.exebtttnn.exebtthnt.exe1jdvp.exevjvvv.exepid process 4864 tbbthh.exe 3388 dvpdd.exe 4592 9rrrrxx.exe 4452 tnhtbt.exe 380 ddjpd.exe 828 vpvvj.exe 4968 fxxrlff.exe 4764 bthhhh.exe 3172 vvpvv.exe 4232 3ppdp.exe 1400 3llfllr.exe 3972 hbtntn.exe 5024 jpvjd.exe 3976 rflxlfr.exe 2172 9flfxxr.exe 1128 9nnhhh.exe 4280 1jppj.exe 1888 frxrrrr.exe 1380 hhtnnh.exe 5080 bhbhtn.exe 5104 7vpjd.exe 4008 9frlxxr.exe 936 ffxfxff.exe 3004 tnhbtn.exe 2840 djvjj.exe 3924 frrxrrx.exe 4332 9ttnbb.exe 4188 pvvpj.exe 2412 5rxrlrr.exe 4908 lrrfxrf.exe 1828 hhttnh.exe 4816 vpvpj.exe 1656 rxlfxrl.exe 876 htnbnh.exe 4316 pjjpp.exe 880 7ddpd.exe 4564 fxlfxxf.exe 4448 jjvvv.exe 3208 xllxlxr.exe 5116 rrrrrrr.exe 1504 nnbttt.exe 5044 vjdvp.exe 4528 1jjjv.exe 4392 ffffllr.exe 380 bthbhh.exe 856 5hnhnn.exe 4508 9vdpj.exe 2768 vjjdd.exe 3936 rfffxxx.exe 3172 hhhthh.exe 2764 nnhbnn.exe 920 jdjdv.exe 1844 jdjdv.exe 1400 xrrxffl.exe 2704 fxllffr.exe 1464 thhbtb.exe 640 7hnhtn.exe 3536 jvdvv.exe 3976 jvvvp.exe 1488 9rxrxrx.exe 2920 btttnn.exe 4512 btthnt.exe 4280 1jdvp.exe 4928 vjvvv.exe -
Processes:
resource yara_rule behavioral2/memory/1884-0-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\tbbthh.exe upx behavioral2/memory/4864-8-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1884-6-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\dvpdd.exe upx C:\9rrrrxx.exe upx behavioral2/memory/3388-16-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4592-18-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\tnhtbt.exe upx behavioral2/memory/4452-29-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\ddjpd.exe upx behavioral2/memory/380-30-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\vpvvj.exe upx C:\fxxrlff.exe upx behavioral2/memory/4764-47-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\bthhhh.exe upx \??\c:\vvpvv.exe upx \??\c:\3ppdp.exe upx \??\c:\3llfllr.exe upx behavioral2/memory/4232-65-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\hbtntn.exe upx C:\rflxlfr.exe upx behavioral2/memory/5024-83-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3976-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2172-98-0x0000000000400000-0x0000000000428000-memory.dmp upx C:\frxrrrr.exe upx \??\c:\hhtnnh.exe upx C:\7vpjd.exe upx behavioral2/memory/5080-126-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\9frlxxr.exe upx \??\c:\ffxfxff.exe upx \??\c:\tnhbtn.exe upx C:\frrxrrx.exe upx \??\c:\pvvpj.exe upx behavioral2/memory/2412-174-0x0000000000400000-0x0000000000428000-memory.dmp upx \??\c:\hhttnh.exe upx \??\c:\vpvpj.exe upx behavioral2/memory/4816-190-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/876-199-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4316-203-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4564-208-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4564-213-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1504-224-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/380-241-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3172-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2764-262-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4512-297-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1848-307-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1576-333-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2880-332-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4332-344-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1736-352-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1136-351-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1736-356-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4728-369-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4332-340-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1920-325-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/936-324-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3024-314-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1488-287-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2704-271-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/920-263-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3172-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1504-228-0x0000000000400000-0x0000000000428000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exetbbthh.exedvpdd.exe9rrrrxx.exetnhtbt.exeddjpd.exevpvvj.exefxxrlff.exebthhhh.exevvpvv.exe3ppdp.exe3llfllr.exehbtntn.exejpvjd.exerflxlfr.exe9flfxxr.exe9nnhhh.exe1jppj.exefrxrrrr.exehhtnnh.exebhbhtn.exe7vpjd.exedescription pid process target process PID 1884 wrote to memory of 4864 1884 fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe tbbthh.exe PID 1884 wrote to memory of 4864 1884 fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe tbbthh.exe PID 1884 wrote to memory of 4864 1884 fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe tbbthh.exe PID 4864 wrote to memory of 3388 4864 tbbthh.exe dvpdd.exe PID 4864 wrote to memory of 3388 4864 tbbthh.exe dvpdd.exe PID 4864 wrote to memory of 3388 4864 tbbthh.exe dvpdd.exe PID 3388 wrote to memory of 4592 3388 dvpdd.exe 9rrrrxx.exe PID 3388 wrote to memory of 4592 3388 dvpdd.exe 9rrrrxx.exe PID 3388 wrote to memory of 4592 3388 dvpdd.exe 9rrrrxx.exe PID 4592 wrote to memory of 4452 4592 9rrrrxx.exe tnhtbt.exe PID 4592 wrote to memory of 4452 4592 9rrrrxx.exe tnhtbt.exe PID 4592 wrote to memory of 4452 4592 9rrrrxx.exe tnhtbt.exe PID 4452 wrote to memory of 380 4452 tnhtbt.exe ddjpd.exe PID 4452 wrote to memory of 380 4452 tnhtbt.exe ddjpd.exe PID 4452 wrote to memory of 380 4452 tnhtbt.exe ddjpd.exe PID 380 wrote to memory of 828 380 ddjpd.exe vpvvj.exe PID 380 wrote to memory of 828 380 ddjpd.exe vpvvj.exe PID 380 wrote to memory of 828 380 ddjpd.exe vpvvj.exe PID 828 wrote to memory of 4968 828 vpvvj.exe fxxrlff.exe PID 828 wrote to memory of 4968 828 vpvvj.exe fxxrlff.exe PID 828 wrote to memory of 4968 828 vpvvj.exe fxxrlff.exe PID 4968 wrote to memory of 4764 4968 fxxrlff.exe bthhhh.exe PID 4968 wrote to memory of 4764 4968 fxxrlff.exe bthhhh.exe PID 4968 wrote to memory of 4764 4968 fxxrlff.exe bthhhh.exe PID 4764 wrote to memory of 3172 4764 bthhhh.exe vvpvv.exe PID 4764 wrote to memory of 3172 4764 bthhhh.exe vvpvv.exe PID 4764 wrote to memory of 3172 4764 bthhhh.exe vvpvv.exe PID 3172 wrote to memory of 4232 3172 vvpvv.exe 3ppdp.exe PID 3172 wrote to memory of 4232 3172 vvpvv.exe 3ppdp.exe PID 3172 wrote to memory of 4232 3172 vvpvv.exe 3ppdp.exe PID 4232 wrote to memory of 1400 4232 3ppdp.exe 3llfllr.exe PID 4232 wrote to memory of 1400 4232 3ppdp.exe 3llfllr.exe PID 4232 wrote to memory of 1400 4232 3ppdp.exe 3llfllr.exe PID 1400 wrote to memory of 3972 1400 3llfllr.exe hbtntn.exe PID 1400 wrote to memory of 3972 1400 3llfllr.exe hbtntn.exe PID 1400 wrote to memory of 3972 1400 3llfllr.exe hbtntn.exe PID 3972 wrote to memory of 5024 3972 hbtntn.exe jpvjd.exe PID 3972 wrote to memory of 5024 3972 hbtntn.exe jpvjd.exe PID 3972 wrote to memory of 5024 3972 hbtntn.exe jpvjd.exe PID 5024 wrote to memory of 3976 5024 jpvjd.exe rflxlfr.exe PID 5024 wrote to memory of 3976 5024 jpvjd.exe rflxlfr.exe PID 5024 wrote to memory of 3976 5024 jpvjd.exe rflxlfr.exe PID 3976 wrote to memory of 2172 3976 rflxlfr.exe 9flfxxr.exe PID 3976 wrote to memory of 2172 3976 rflxlfr.exe 9flfxxr.exe PID 3976 wrote to memory of 2172 3976 rflxlfr.exe 9flfxxr.exe PID 2172 wrote to memory of 1128 2172 9flfxxr.exe 9nnhhh.exe PID 2172 wrote to memory of 1128 2172 9flfxxr.exe 9nnhhh.exe PID 2172 wrote to memory of 1128 2172 9flfxxr.exe 9nnhhh.exe PID 1128 wrote to memory of 4280 1128 9nnhhh.exe 1jppj.exe PID 1128 wrote to memory of 4280 1128 9nnhhh.exe 1jppj.exe PID 1128 wrote to memory of 4280 1128 9nnhhh.exe 1jppj.exe PID 4280 wrote to memory of 1888 4280 1jppj.exe frxrrrr.exe PID 4280 wrote to memory of 1888 4280 1jppj.exe frxrrrr.exe PID 4280 wrote to memory of 1888 4280 1jppj.exe frxrrrr.exe PID 1888 wrote to memory of 1380 1888 frxrrrr.exe hhtnnh.exe PID 1888 wrote to memory of 1380 1888 frxrrrr.exe hhtnnh.exe PID 1888 wrote to memory of 1380 1888 frxrrrr.exe hhtnnh.exe PID 1380 wrote to memory of 5080 1380 hhtnnh.exe bhbhtn.exe PID 1380 wrote to memory of 5080 1380 hhtnnh.exe bhbhtn.exe PID 1380 wrote to memory of 5080 1380 hhtnnh.exe bhbhtn.exe PID 5080 wrote to memory of 5104 5080 bhbhtn.exe 7vpjd.exe PID 5080 wrote to memory of 5104 5080 bhbhtn.exe 7vpjd.exe PID 5080 wrote to memory of 5104 5080 bhbhtn.exe 7vpjd.exe PID 5104 wrote to memory of 4008 5104 7vpjd.exe 9frlxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fc0abb8d5f0ca4a79e5fdf3e244ae2f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\tbbthh.exec:\tbbthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\dvpdd.exec:\dvpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\9rrrrxx.exec:\9rrrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\tnhtbt.exec:\tnhtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\ddjpd.exec:\ddjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\vpvvj.exec:\vpvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\fxxrlff.exec:\fxxrlff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\bthhhh.exec:\bthhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\vvpvv.exec:\vvpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\3ppdp.exec:\3ppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\3llfllr.exec:\3llfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\hbtntn.exec:\hbtntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\jpvjd.exec:\jpvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\rflxlfr.exec:\rflxlfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\9flfxxr.exec:\9flfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\9nnhhh.exec:\9nnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\1jppj.exec:\1jppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\frxrrrr.exec:\frxrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\hhtnnh.exec:\hhtnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\bhbhtn.exec:\bhbhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\7vpjd.exec:\7vpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\9frlxxr.exec:\9frlxxr.exe23⤵
- Executes dropped EXE
PID:4008 -
\??\c:\ffxfxff.exec:\ffxfxff.exe24⤵
- Executes dropped EXE
PID:936 -
\??\c:\tnhbtn.exec:\tnhbtn.exe25⤵
- Executes dropped EXE
PID:3004 -
\??\c:\djvjj.exec:\djvjj.exe26⤵
- Executes dropped EXE
PID:2840 -
\??\c:\frrxrrx.exec:\frrxrrx.exe27⤵
- Executes dropped EXE
PID:3924 -
\??\c:\9ttnbb.exec:\9ttnbb.exe28⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pvvpj.exec:\pvvpj.exe29⤵
- Executes dropped EXE
PID:4188 -
\??\c:\5rxrlrr.exec:\5rxrlrr.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe31⤵
- Executes dropped EXE
PID:4908 -
\??\c:\hhttnh.exec:\hhttnh.exe32⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vpvpj.exec:\vpvpj.exe33⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe34⤵
- Executes dropped EXE
PID:1656 -
\??\c:\htnbnh.exec:\htnbnh.exe35⤵
- Executes dropped EXE
PID:876 -
\??\c:\pjjpp.exec:\pjjpp.exe36⤵
- Executes dropped EXE
PID:4316 -
\??\c:\7ddpd.exec:\7ddpd.exe37⤵
- Executes dropped EXE
PID:880 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe38⤵
- Executes dropped EXE
PID:4564 -
\??\c:\jjvvv.exec:\jjvvv.exe39⤵
- Executes dropped EXE
PID:4448 -
\??\c:\xllxlxr.exec:\xllxlxr.exe40⤵
- Executes dropped EXE
PID:3208 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe41⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nnbttt.exec:\nnbttt.exe42⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vjdvp.exec:\vjdvp.exe43⤵
- Executes dropped EXE
PID:5044 -
\??\c:\1jjjv.exec:\1jjjv.exe44⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ffffllr.exec:\ffffllr.exe45⤵
- Executes dropped EXE
PID:4392 -
\??\c:\bthbhh.exec:\bthbhh.exe46⤵
- Executes dropped EXE
PID:380 -
\??\c:\5hnhnn.exec:\5hnhnn.exe47⤵
- Executes dropped EXE
PID:856 -
\??\c:\9vdpj.exec:\9vdpj.exe48⤵
- Executes dropped EXE
PID:4508 -
\??\c:\vjjdd.exec:\vjjdd.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rfffxxx.exec:\rfffxxx.exe50⤵
- Executes dropped EXE
PID:3936 -
\??\c:\hhhthh.exec:\hhhthh.exe51⤵
- Executes dropped EXE
PID:3172 -
\??\c:\nnhbnn.exec:\nnhbnn.exe52⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdjdv.exec:\jdjdv.exe53⤵
- Executes dropped EXE
PID:920 -
\??\c:\jdjdv.exec:\jdjdv.exe54⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xrrxffl.exec:\xrrxffl.exe55⤵
- Executes dropped EXE
PID:1400 -
\??\c:\fxllffr.exec:\fxllffr.exe56⤵
- Executes dropped EXE
PID:2704 -
\??\c:\thhbtb.exec:\thhbtb.exe57⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7hnhtn.exec:\7hnhtn.exe58⤵
- Executes dropped EXE
PID:640 -
\??\c:\jvdvv.exec:\jvdvv.exe59⤵
- Executes dropped EXE
PID:3536 -
\??\c:\jvvvp.exec:\jvvvp.exe60⤵
- Executes dropped EXE
PID:3976 -
\??\c:\9rxrxrx.exec:\9rxrxrx.exe61⤵
- Executes dropped EXE
PID:1488 -
\??\c:\btttnn.exec:\btttnn.exe62⤵
- Executes dropped EXE
PID:2920 -
\??\c:\btthnt.exec:\btthnt.exe63⤵
- Executes dropped EXE
PID:4512 -
\??\c:\1jdvp.exec:\1jdvp.exe64⤵
- Executes dropped EXE
PID:4280 -
\??\c:\vjvvv.exec:\vjvvv.exe65⤵
- Executes dropped EXE
PID:4928 -
\??\c:\frrllll.exec:\frrllll.exe66⤵PID:1848
-
\??\c:\3btnhn.exec:\3btnhn.exe67⤵PID:3504
-
\??\c:\btnbtb.exec:\btnbtb.exe68⤵PID:752
-
\??\c:\jvjdv.exec:\jvjdv.exe69⤵PID:3024
-
\??\c:\dddpd.exec:\dddpd.exe70⤵PID:4008
-
\??\c:\lflxrlr.exec:\lflxrlr.exe71⤵PID:936
-
\??\c:\fffrlxl.exec:\fffrlxl.exe72⤵PID:1920
-
\??\c:\hntnnn.exec:\hntnnn.exe73⤵PID:2880
-
\??\c:\tbhbbb.exec:\tbhbbb.exe74⤵PID:1576
-
\??\c:\7vvpj.exec:\7vvpj.exe75⤵PID:2856
-
\??\c:\lffrlfr.exec:\lffrlfr.exe76⤵PID:4332
-
\??\c:\lrxxlfr.exec:\lrxxlfr.exe77⤵PID:4188
-
\??\c:\7hnntb.exec:\7hnntb.exe78⤵PID:1136
-
\??\c:\3nnbtt.exec:\3nnbtt.exe79⤵PID:1736
-
\??\c:\djpjd.exec:\djpjd.exe80⤵PID:3116
-
\??\c:\pvdvd.exec:\pvdvd.exe81⤵PID:4400
-
\??\c:\lflxxrx.exec:\lflxxrx.exe82⤵PID:3932
-
\??\c:\7flxlfr.exec:\7flxlfr.exe83⤵PID:4728
-
\??\c:\tbhbtb.exec:\tbhbtb.exe84⤵PID:2688
-
\??\c:\dpvpj.exec:\dpvpj.exe85⤵PID:4304
-
\??\c:\ddvpp.exec:\ddvpp.exe86⤵PID:2596
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe87⤵PID:2212
-
\??\c:\btbnhh.exec:\btbnhh.exe88⤵PID:3248
-
\??\c:\3pddd.exec:\3pddd.exe89⤵PID:3204
-
\??\c:\1lllflr.exec:\1lllflr.exe90⤵PID:4412
-
\??\c:\bthbtn.exec:\bthbtn.exe91⤵PID:4864
-
\??\c:\dvvvp.exec:\dvvvp.exe92⤵PID:3208
-
\??\c:\xrfxffl.exec:\xrfxffl.exe93⤵PID:4736
-
\??\c:\hhtntt.exec:\hhtntt.exe94⤵PID:1832
-
\??\c:\hbnnhh.exec:\hbnnhh.exe95⤵PID:5044
-
\??\c:\vjpdj.exec:\vjpdj.exe96⤵PID:4528
-
\??\c:\lrlffxx.exec:\lrlffxx.exe97⤵PID:3152
-
\??\c:\5hnhbb.exec:\5hnhbb.exe98⤵PID:4916
-
\??\c:\ntnhhb.exec:\ntnhhb.exe99⤵PID:4432
-
\??\c:\vjpjp.exec:\vjpjp.exe100⤵PID:1164
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe101⤵PID:2028
-
\??\c:\thhhbb.exec:\thhhbb.exe102⤵PID:800
-
\??\c:\jvdvv.exec:\jvdvv.exe103⤵PID:3052
-
\??\c:\rllfxff.exec:\rllfxff.exe104⤵PID:1968
-
\??\c:\rxrlffr.exec:\rxrlffr.exe105⤵PID:3220
-
\??\c:\hbnnhb.exec:\hbnnhb.exe106⤵PID:3080
-
\??\c:\7jvpp.exec:\7jvpp.exe107⤵PID:3928
-
\??\c:\xxxffll.exec:\xxxffll.exe108⤵PID:5024
-
\??\c:\1xlfllf.exec:\1xlfllf.exe109⤵PID:1552
-
\??\c:\thnhht.exec:\thnhht.exe110⤵PID:2832
-
\??\c:\7jjpj.exec:\7jjpj.exe111⤵PID:2172
-
\??\c:\9rrlffx.exec:\9rrlffx.exe112⤵PID:1128
-
\??\c:\7nnhnh.exec:\7nnhnh.exe113⤵PID:1764
-
\??\c:\jvvvp.exec:\jvvvp.exe114⤵PID:1192
-
\??\c:\rxxrfrl.exec:\rxxrfrl.exe115⤵PID:1888
-
\??\c:\bnnhhb.exec:\bnnhhb.exe116⤵PID:3324
-
\??\c:\dvdvj.exec:\dvdvj.exe117⤵PID:2092
-
\??\c:\jjjvp.exec:\jjjvp.exe118⤵PID:4160
-
\??\c:\3lrlllf.exec:\3lrlllf.exe119⤵PID:1356
-
\??\c:\5tbtnt.exec:\5tbtnt.exe120⤵PID:3676
-
\??\c:\jpvvv.exec:\jpvvv.exe121⤵PID:3648
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe122⤵PID:4868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-