Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 12:07
Behavioral task
behavioral1
Sample
430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe
-
Size
487KB
-
MD5
430f4a2033b39973a4a2fab2717fe1e0
-
SHA1
8f7ee530ef281051177cc01ec6771bc7dc259080
-
SHA256
5b8009564cb608a6d5a9952b7cdb7666f2f3ebc73dde0f4c5824c865880b7755
-
SHA512
3f4cdf1829b5e2c8d472b2f515d3165e6194e98b18d86068f386c71429065be80dbbb2ec707e8ad09bfd0b43b2faae46eaae3494b07e96abec6a8398599d0f62
-
SSDEEP
6144:mcm7ImGddXv/VWrXD486jCpoAhlq1mEjBqLyOSlhNFF23ye:I7TcfNWj168w1VjsyvhNFF2ie
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
Processes:
resource yara_rule behavioral2/memory/1668-6-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3144-8-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4320-13-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3168-23-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4292-26-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4564-30-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2504-42-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4252-54-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2592-66-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2652-71-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2140-80-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1528-78-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/948-89-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1352-100-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4984-108-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4596-115-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4508-121-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2900-127-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3544-133-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4040-139-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/724-146-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1244-156-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3444-182-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/808-184-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1400-199-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/5016-200-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1312-207-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/788-211-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/424-215-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4356-221-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3104-222-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/368-229-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3484-236-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4620-249-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3160-250-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1424-255-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1944-265-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3008-272-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1608-280-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4428-290-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3480-291-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3956-307-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2116-308-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/908-312-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3840-338-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4560-342-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/1268-346-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4260-357-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/752-362-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3504-386-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/368-408-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3168-415-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4732-428-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3092-487-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4260-515-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/804-562-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2812-626-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/460-678-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/808-692-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/3988-730-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/2352-879-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral2/memory/4608-1075-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\jvjvv.exe family_berbew \??\c:\ttnttt.exe family_berbew \??\c:\frflllr.exe family_berbew C:\hhntbn.exe family_berbew C:\dvdjd.exe family_berbew C:\rfxxxxx.exe family_berbew C:\1htnhh.exe family_berbew C:\rxfflrf.exe family_berbew C:\ddvpd.exe family_berbew C:\bbbbbt.exe family_berbew C:\pvjjj.exe family_berbew C:\lrxrlfr.exe family_berbew C:\nhhbtn.exe family_berbew C:\lxffxxx.exe family_berbew \??\c:\rlxrrlf.exe family_berbew C:\thhthh.exe family_berbew C:\tthbnb.exe family_berbew \??\c:\ffxflfl.exe family_berbew C:\rrxfrfl.exe family_berbew C:\nhnbth.exe family_berbew \??\c:\rrrfllr.exe family_berbew C:\tnbbnh.exe family_berbew \??\c:\lfllrrf.exe family_berbew \??\c:\bnntbb.exe family_berbew \??\c:\nbhtbt.exe family_berbew C:\xffrlrl.exe family_berbew C:\dpjvj.exe family_berbew C:\thnnhb.exe family_berbew C:\vppvp.exe family_berbew C:\5thbhn.exe family_berbew C:\jpjdv.exe family_berbew C:\tbbthh.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
frflllr.exettnttt.exejvjvv.exehhntbn.exedvdjd.exerfxxxxx.exe1htnhh.exerxfflrf.exeddvpd.exebbbbbt.exepvjjj.exelrxrlfr.exenhhbtn.exelxffxxx.exerlxrrlf.exethhthh.exetthbnb.exeffxflfl.exerrxfrfl.exenhnbth.exerrrfllr.exetnbbnh.exelfllrrf.exebnntbb.exenbhtbt.exexffrlrl.exedpjvj.exethnnhb.exevppvp.exe5thbhn.exejpjdv.exetbbthh.exepdvpj.exefrfrlxf.exebnbbbb.exehnbttt.exedjjpp.exetbhhhn.exedpdpv.exeffrllfl.exevppjj.exelflxfrx.exenttnnt.exejdpvj.exe5lfrffx.exehttbbb.exepvvpj.exerxxlxff.exehntnnn.exepdjdv.exeflrlffx.exehtnntt.exevvvvj.exexrxrxff.exetnthhb.exelrffllx.exehbhhhn.exexfrxrxx.exethhhhh.exejpvdd.exexlrrxxx.exepdjjd.exexfrrfrf.exetttthh.exepid process 3144 frflllr.exe 4320 ttnttt.exe 3168 jvjvv.exe 4292 hhntbn.exe 4564 dvdjd.exe 2504 rfxxxxx.exe 3632 1htnhh.exe 4252 rxfflrf.exe 4696 ddvpd.exe 2592 bbbbbt.exe 2652 pvjjj.exe 1528 lrxrlfr.exe 2140 nhhbtn.exe 948 lxffxxx.exe 2812 rlxrrlf.exe 1352 thhthh.exe 4984 tthbnb.exe 624 ffxflfl.exe 4596 rrxfrfl.exe 4508 nhnbth.exe 2900 rrrfllr.exe 3544 tnbbnh.exe 4040 lfllrrf.exe 724 bnntbb.exe 1244 nbhtbt.exe 4488 xffrlrl.exe 3332 dpjvj.exe 1156 thnnhb.exe 4384 vppvp.exe 3444 5thbhn.exe 808 jpjdv.exe 4552 tbbthh.exe 2400 pdvpj.exe 1400 frfrlxf.exe 5016 bnbbbb.exe 1312 hnbttt.exe 788 djjpp.exe 424 tbhhhn.exe 4572 dpdpv.exe 4356 ffrllfl.exe 368 vppjj.exe 4044 lflxfrx.exe 3484 nttnnt.exe 1716 jdpvj.exe 3116 5lfrffx.exe 1192 httbbb.exe 4620 pvvpj.exe 3160 rxxlxff.exe 1424 hntnnn.exe 3632 pdjdv.exe 3364 flrlffx.exe 1944 htnntt.exe 4948 vvvvj.exe 3008 xrxrxff.exe 1608 tnthhb.exe 3852 lrffllx.exe 660 hbhhhn.exe 4428 xfrxrxx.exe 3480 thhhhh.exe 4456 jpvdd.exe 3948 xlrrxxx.exe 4092 pdjjd.exe 3956 xfrrfrf.exe 2116 tttthh.exe -
Processes:
resource yara_rule behavioral2/memory/1668-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3144-8-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4320-13-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3168-23-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4292-26-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2504-37-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4564-30-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2504-42-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4252-49-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4252-54-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2592-66-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2652-71-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2140-80-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1528-78-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/948-89-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1352-95-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1352-100-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4984-108-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/624-109-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4596-115-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4508-121-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2900-127-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3544-133-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4040-139-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1244-151-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/724-146-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1244-156-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3444-182-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/808-184-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1400-199-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/5016-200-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1312-207-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/788-211-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/424-215-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4356-219-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4356-221-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3104-222-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/368-229-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3484-236-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4620-249-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3160-250-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1424-255-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3632-258-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1944-265-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3008-272-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1608-276-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1608-280-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4428-290-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3480-291-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3956-307-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/2116-308-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/908-312-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3836-331-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3840-338-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4560-342-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1268-346-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4260-353-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4260-357-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/752-358-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/752-362-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/1672-363-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3220-367-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/3504-386-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/368-408-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exefrflllr.exettnttt.exejvjvv.exehhntbn.exedvdjd.exerfxxxxx.exe1htnhh.exerxfflrf.exeddvpd.exebbbbbt.exepvjjj.exelrxrlfr.exenhhbtn.exelxffxxx.exerlxrrlf.exethhthh.exetthbnb.exeffxflfl.exerrxfrfl.exenhnbth.exerrrfllr.exedescription pid process target process PID 1668 wrote to memory of 3144 1668 430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe frflllr.exe PID 1668 wrote to memory of 3144 1668 430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe frflllr.exe PID 1668 wrote to memory of 3144 1668 430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe frflllr.exe PID 3144 wrote to memory of 4320 3144 frflllr.exe ttnttt.exe PID 3144 wrote to memory of 4320 3144 frflllr.exe ttnttt.exe PID 3144 wrote to memory of 4320 3144 frflllr.exe ttnttt.exe PID 4320 wrote to memory of 3168 4320 ttnttt.exe jvjvv.exe PID 4320 wrote to memory of 3168 4320 ttnttt.exe jvjvv.exe PID 4320 wrote to memory of 3168 4320 ttnttt.exe jvjvv.exe PID 3168 wrote to memory of 4292 3168 jvjvv.exe hhntbn.exe PID 3168 wrote to memory of 4292 3168 jvjvv.exe hhntbn.exe PID 3168 wrote to memory of 4292 3168 jvjvv.exe hhntbn.exe PID 4292 wrote to memory of 4564 4292 hhntbn.exe dvdjd.exe PID 4292 wrote to memory of 4564 4292 hhntbn.exe dvdjd.exe PID 4292 wrote to memory of 4564 4292 hhntbn.exe dvdjd.exe PID 4564 wrote to memory of 2504 4564 dvdjd.exe rfxxxxx.exe PID 4564 wrote to memory of 2504 4564 dvdjd.exe rfxxxxx.exe PID 4564 wrote to memory of 2504 4564 dvdjd.exe rfxxxxx.exe PID 2504 wrote to memory of 3632 2504 rfxxxxx.exe 1htnhh.exe PID 2504 wrote to memory of 3632 2504 rfxxxxx.exe 1htnhh.exe PID 2504 wrote to memory of 3632 2504 rfxxxxx.exe 1htnhh.exe PID 3632 wrote to memory of 4252 3632 1htnhh.exe rxfflrf.exe PID 3632 wrote to memory of 4252 3632 1htnhh.exe rxfflrf.exe PID 3632 wrote to memory of 4252 3632 1htnhh.exe rxfflrf.exe PID 4252 wrote to memory of 4696 4252 rxfflrf.exe ddvpd.exe PID 4252 wrote to memory of 4696 4252 rxfflrf.exe ddvpd.exe PID 4252 wrote to memory of 4696 4252 rxfflrf.exe ddvpd.exe PID 4696 wrote to memory of 2592 4696 ddvpd.exe bbbbbt.exe PID 4696 wrote to memory of 2592 4696 ddvpd.exe bbbbbt.exe PID 4696 wrote to memory of 2592 4696 ddvpd.exe bbbbbt.exe PID 2592 wrote to memory of 2652 2592 bbbbbt.exe pvjjj.exe PID 2592 wrote to memory of 2652 2592 bbbbbt.exe pvjjj.exe PID 2592 wrote to memory of 2652 2592 bbbbbt.exe pvjjj.exe PID 2652 wrote to memory of 1528 2652 pvjjj.exe lrxrlfr.exe PID 2652 wrote to memory of 1528 2652 pvjjj.exe lrxrlfr.exe PID 2652 wrote to memory of 1528 2652 pvjjj.exe lrxrlfr.exe PID 1528 wrote to memory of 2140 1528 lrxrlfr.exe nhhbtn.exe PID 1528 wrote to memory of 2140 1528 lrxrlfr.exe nhhbtn.exe PID 1528 wrote to memory of 2140 1528 lrxrlfr.exe nhhbtn.exe PID 2140 wrote to memory of 948 2140 nhhbtn.exe lxffxxx.exe PID 2140 wrote to memory of 948 2140 nhhbtn.exe lxffxxx.exe PID 2140 wrote to memory of 948 2140 nhhbtn.exe lxffxxx.exe PID 948 wrote to memory of 2812 948 lxffxxx.exe rlxrrlf.exe PID 948 wrote to memory of 2812 948 lxffxxx.exe rlxrrlf.exe PID 948 wrote to memory of 2812 948 lxffxxx.exe rlxrrlf.exe PID 2812 wrote to memory of 1352 2812 rlxrrlf.exe thhthh.exe PID 2812 wrote to memory of 1352 2812 rlxrrlf.exe thhthh.exe PID 2812 wrote to memory of 1352 2812 rlxrrlf.exe thhthh.exe PID 1352 wrote to memory of 4984 1352 thhthh.exe tthbnb.exe PID 1352 wrote to memory of 4984 1352 thhthh.exe tthbnb.exe PID 1352 wrote to memory of 4984 1352 thhthh.exe tthbnb.exe PID 4984 wrote to memory of 624 4984 tthbnb.exe ffxflfl.exe PID 4984 wrote to memory of 624 4984 tthbnb.exe ffxflfl.exe PID 4984 wrote to memory of 624 4984 tthbnb.exe ffxflfl.exe PID 624 wrote to memory of 4596 624 ffxflfl.exe rrxfrfl.exe PID 624 wrote to memory of 4596 624 ffxflfl.exe rrxfrfl.exe PID 624 wrote to memory of 4596 624 ffxflfl.exe rrxfrfl.exe PID 4596 wrote to memory of 4508 4596 rrxfrfl.exe nhnbth.exe PID 4596 wrote to memory of 4508 4596 rrxfrfl.exe nhnbth.exe PID 4596 wrote to memory of 4508 4596 rrxfrfl.exe nhnbth.exe PID 4508 wrote to memory of 2900 4508 nhnbth.exe rrrfllr.exe PID 4508 wrote to memory of 2900 4508 nhnbth.exe rrrfllr.exe PID 4508 wrote to memory of 2900 4508 nhnbth.exe rrrfllr.exe PID 2900 wrote to memory of 3544 2900 rrrfllr.exe tnbbnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\frflllr.exec:\frflllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ttnttt.exec:\ttnttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jvjvv.exec:\jvjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhntbn.exec:\hhntbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dvdjd.exec:\dvdjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rfxxxxx.exec:\rfxxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1htnhh.exec:\1htnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxfflrf.exec:\rxfflrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvpd.exec:\ddvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbbbbt.exec:\bbbbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjjj.exec:\pvjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxrlfr.exec:\lrxrlfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhbtn.exec:\nhhbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxffxxx.exec:\lxffxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxrrlf.exec:\rlxrrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\thhthh.exec:\thhthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthbnb.exec:\tthbnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxflfl.exec:\ffxflfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrxfrfl.exec:\rrxfrfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhnbth.exec:\nhnbth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rrrfllr.exec:\rrrfllr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnbbnh.exec:\tnbbnh.exe23⤵
- Executes dropped EXE
-
\??\c:\lfllrrf.exec:\lfllrrf.exe24⤵
- Executes dropped EXE
-
\??\c:\bnntbb.exec:\bnntbb.exe25⤵
- Executes dropped EXE
-
\??\c:\nbhtbt.exec:\nbhtbt.exe26⤵
- Executes dropped EXE
-
\??\c:\xffrlrl.exec:\xffrlrl.exe27⤵
- Executes dropped EXE
-
\??\c:\dpjvj.exec:\dpjvj.exe28⤵
- Executes dropped EXE
-
\??\c:\thnnhb.exec:\thnnhb.exe29⤵
- Executes dropped EXE
-
\??\c:\vppvp.exec:\vppvp.exe30⤵
- Executes dropped EXE
-
\??\c:\5thbhn.exec:\5thbhn.exe31⤵
- Executes dropped EXE
-
\??\c:\jpjdv.exec:\jpjdv.exe32⤵
- Executes dropped EXE
-
\??\c:\tbbthh.exec:\tbbthh.exe33⤵
- Executes dropped EXE
-
\??\c:\pdvpj.exec:\pdvpj.exe34⤵
- Executes dropped EXE
-
\??\c:\frfrlxf.exec:\frfrlxf.exe35⤵
- Executes dropped EXE
-
\??\c:\bnbbbb.exec:\bnbbbb.exe36⤵
- Executes dropped EXE
-
\??\c:\hnbttt.exec:\hnbttt.exe37⤵
- Executes dropped EXE
-
\??\c:\djjpp.exec:\djjpp.exe38⤵
- Executes dropped EXE
-
\??\c:\tbhhhn.exec:\tbhhhn.exe39⤵
- Executes dropped EXE
-
\??\c:\dpdpv.exec:\dpdpv.exe40⤵
- Executes dropped EXE
-
\??\c:\ffrllfl.exec:\ffrllfl.exe41⤵
- Executes dropped EXE
-
\??\c:\ttthhn.exec:\ttthhn.exe42⤵
-
\??\c:\vppjj.exec:\vppjj.exe43⤵
- Executes dropped EXE
-
\??\c:\lflxfrx.exec:\lflxfrx.exe44⤵
- Executes dropped EXE
-
\??\c:\nttnnt.exec:\nttnnt.exe45⤵
- Executes dropped EXE
-
\??\c:\jdpvj.exec:\jdpvj.exe46⤵
- Executes dropped EXE
-
\??\c:\5lfrffx.exec:\5lfrffx.exe47⤵
- Executes dropped EXE
-
\??\c:\httbbb.exec:\httbbb.exe48⤵
- Executes dropped EXE
-
\??\c:\pvvpj.exec:\pvvpj.exe49⤵
- Executes dropped EXE
-
\??\c:\rxxlxff.exec:\rxxlxff.exe50⤵
- Executes dropped EXE
-
\??\c:\hntnnn.exec:\hntnnn.exe51⤵
- Executes dropped EXE
-
\??\c:\pdjdv.exec:\pdjdv.exe52⤵
- Executes dropped EXE
-
\??\c:\flrlffx.exec:\flrlffx.exe53⤵
- Executes dropped EXE
-
\??\c:\htnntt.exec:\htnntt.exe54⤵
- Executes dropped EXE
-
\??\c:\vvvvj.exec:\vvvvj.exe55⤵
- Executes dropped EXE
-
\??\c:\xrxrxff.exec:\xrxrxff.exe56⤵
- Executes dropped EXE
-
\??\c:\tnthhb.exec:\tnthhb.exe57⤵
- Executes dropped EXE
-
\??\c:\lrffllx.exec:\lrffllx.exe58⤵
- Executes dropped EXE
-
\??\c:\hbhhhn.exec:\hbhhhn.exe59⤵
- Executes dropped EXE
-
\??\c:\xfrxrxx.exec:\xfrxrxx.exe60⤵
- Executes dropped EXE
-
\??\c:\thhhhh.exec:\thhhhh.exe61⤵
- Executes dropped EXE
-
\??\c:\jpvdd.exec:\jpvdd.exe62⤵
- Executes dropped EXE
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe63⤵
- Executes dropped EXE
-
\??\c:\pdjjd.exec:\pdjjd.exe64⤵
- Executes dropped EXE
-
\??\c:\xfrrfrf.exec:\xfrrfrf.exe65⤵
- Executes dropped EXE
-
\??\c:\tttthh.exec:\tttthh.exe66⤵
- Executes dropped EXE
-
\??\c:\fflffxf.exec:\fflffxf.exe67⤵
-
\??\c:\hhtbnb.exec:\hhtbnb.exe68⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe69⤵
-
\??\c:\rlxxffl.exec:\rlxxffl.exe70⤵
-
\??\c:\1tbtbh.exec:\1tbtbh.exe71⤵
-
\??\c:\3jjpv.exec:\3jjpv.exe72⤵
-
\??\c:\5ffxrxf.exec:\5ffxrxf.exe73⤵
-
\??\c:\7lxlrfl.exec:\7lxlrfl.exe74⤵
-
\??\c:\hhhbtn.exec:\hhhbtn.exe75⤵
-
\??\c:\xrrlfll.exec:\xrrlfll.exe76⤵
-
\??\c:\llxfflx.exec:\llxfflx.exe77⤵
-
\??\c:\thbbht.exec:\thbbht.exe78⤵
-
\??\c:\5jpjj.exec:\5jpjj.exe79⤵
-
\??\c:\7rflfxr.exec:\7rflfxr.exe80⤵
-
\??\c:\nbnnth.exec:\nbnnth.exe81⤵
-
\??\c:\llxxxrr.exec:\llxxxrr.exe82⤵
-
\??\c:\bnnthh.exec:\bnnthh.exe83⤵
-
\??\c:\tnnnth.exec:\tnnnth.exe84⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe85⤵
-
\??\c:\xffxllf.exec:\xffxllf.exe86⤵
-
\??\c:\ttbnnt.exec:\ttbnnt.exe87⤵
-
\??\c:\pvjjv.exec:\pvjjv.exe88⤵
-
\??\c:\lrxxfrx.exec:\lrxxfrx.exe89⤵
-
\??\c:\hbbthb.exec:\hbbthb.exe90⤵
-
\??\c:\ddddv.exec:\ddddv.exe91⤵
-
\??\c:\vpdjp.exec:\vpdjp.exe92⤵
-
\??\c:\llrxrff.exec:\llrxrff.exe93⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe94⤵
-
\??\c:\vvdpp.exec:\vvdpp.exe95⤵
-
\??\c:\rlrrfrr.exec:\rlrrfrr.exe96⤵
-
\??\c:\1nhhtn.exec:\1nhhtn.exe97⤵
-
\??\c:\9jdpd.exec:\9jdpd.exe98⤵
-
\??\c:\7llfxxr.exec:\7llfxxr.exe99⤵
-
\??\c:\1bhhhn.exec:\1bhhhn.exe100⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe101⤵
-
\??\c:\3rrlfff.exec:\3rrlfff.exe102⤵
-
\??\c:\hbnnnn.exec:\hbnnnn.exe103⤵
-
\??\c:\pjjjd.exec:\pjjjd.exe104⤵
-
\??\c:\7pvvv.exec:\7pvvv.exe105⤵
-
\??\c:\fflllll.exec:\fflllll.exe106⤵
-
\??\c:\ntbttn.exec:\ntbttn.exe107⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe108⤵
-
\??\c:\7rfxffr.exec:\7rfxffr.exe109⤵
-
\??\c:\1hhhbb.exec:\1hhhbb.exe110⤵
-
\??\c:\jvpvp.exec:\jvpvp.exe111⤵
-
\??\c:\xxffllr.exec:\xxffllr.exe112⤵
-
\??\c:\nbbhnb.exec:\nbbhnb.exe113⤵
-
\??\c:\vdpjd.exec:\vdpjd.exe114⤵
-
\??\c:\jdjjj.exec:\jdjjj.exe115⤵
-
\??\c:\rllxfxf.exec:\rllxfxf.exe116⤵
-
\??\c:\htbbtt.exec:\htbbtt.exe117⤵
-
\??\c:\jvjvv.exec:\jvjvv.exe118⤵
-
\??\c:\xflxxxf.exec:\xflxxxf.exe119⤵
-
\??\c:\9ntnnh.exec:\9ntnnh.exe120⤵
-
\??\c:\lxrxfll.exec:\lxrxfll.exe121⤵
-
\??\c:\frfxrrl.exec:\frfxrrl.exe122⤵
-
\??\c:\bnnbnh.exec:\bnnbnh.exe123⤵
-
\??\c:\flxlrfl.exec:\flxlrfl.exe124⤵
-
\??\c:\bhbbhh.exec:\bhbbhh.exe125⤵
-
\??\c:\vppdv.exec:\vppdv.exe126⤵
-
\??\c:\rlflxrx.exec:\rlflxrx.exe127⤵
-
\??\c:\bthbbb.exec:\bthbbb.exe128⤵
-
\??\c:\3rrlxxr.exec:\3rrlxxr.exe129⤵
-
\??\c:\9llxfxl.exec:\9llxfxl.exe130⤵
-
\??\c:\5jpdv.exec:\5jpdv.exe131⤵
-
\??\c:\xxffffx.exec:\xxffffx.exe132⤵
-
\??\c:\hhhbnt.exec:\hhhbnt.exe133⤵
-
\??\c:\1djjj.exec:\1djjj.exe134⤵
-
\??\c:\xrxrlfl.exec:\xrxrlfl.exe135⤵
-
\??\c:\tbhhhh.exec:\tbhhhh.exe136⤵
-
\??\c:\hbnhnb.exec:\hbnhnb.exe137⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe138⤵
-
\??\c:\xlrlrll.exec:\xlrlrll.exe139⤵
-
\??\c:\bhtnnt.exec:\bhtnnt.exe140⤵
-
\??\c:\llrllfx.exec:\llrllfx.exe141⤵
-
\??\c:\5bhbhn.exec:\5bhbhn.exe142⤵
-
\??\c:\pjvjv.exec:\pjvjv.exe143⤵
-
\??\c:\llrfxrr.exec:\llrfxrr.exe144⤵
-
\??\c:\tnbthh.exec:\tnbthh.exe145⤵
-
\??\c:\vjdvp.exec:\vjdvp.exe146⤵
-
\??\c:\llrlxxl.exec:\llrlxxl.exe147⤵
-
\??\c:\nhbbht.exec:\nhbbht.exe148⤵
-
\??\c:\dvdjj.exec:\dvdjj.exe149⤵
-
\??\c:\xxxlffx.exec:\xxxlffx.exe150⤵
-
\??\c:\bnhbbb.exec:\bnhbbb.exe151⤵
-
\??\c:\bbtttt.exec:\bbtttt.exe152⤵
-
\??\c:\jvpdd.exec:\jvpdd.exe153⤵
-
\??\c:\1frfffx.exec:\1frfffx.exe154⤵
-
\??\c:\tbnbtb.exec:\tbnbtb.exe155⤵
-
\??\c:\pdvvp.exec:\pdvvp.exe156⤵
-
\??\c:\llxxllx.exec:\llxxllx.exe157⤵
-
\??\c:\nnhtbh.exec:\nnhtbh.exe158⤵
-
\??\c:\dvjjj.exec:\dvjjj.exe159⤵
-
\??\c:\vdpjj.exec:\vdpjj.exe160⤵
-
\??\c:\lfrlrfx.exec:\lfrlrfx.exe161⤵
-
\??\c:\tbtttb.exec:\tbtttb.exe162⤵
-
\??\c:\vvjvj.exec:\vvjvj.exe163⤵
-
\??\c:\lrllfll.exec:\lrllfll.exe164⤵
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe165⤵
-
\??\c:\nnthhb.exec:\nnthhb.exe166⤵
-
\??\c:\vvppd.exec:\vvppd.exe167⤵
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe168⤵
-
\??\c:\5thnhh.exec:\5thnhh.exe169⤵
-
\??\c:\nhtnhh.exec:\nhtnhh.exe170⤵
-
\??\c:\xrxxlxx.exec:\xrxxlxx.exe171⤵
-
\??\c:\lllfrxr.exec:\lllfrxr.exe172⤵
-
\??\c:\ntnhhb.exec:\ntnhhb.exe173⤵
-
\??\c:\jpvpp.exec:\jpvpp.exe174⤵
-
\??\c:\5lxrlfx.exec:\5lxrlfx.exe175⤵
-
\??\c:\hbnntn.exec:\hbnntn.exe176⤵
-
\??\c:\vpjvd.exec:\vpjvd.exe177⤵
-
\??\c:\fxlxlfr.exec:\fxlxlfr.exe178⤵
-
\??\c:\1btbtt.exec:\1btbtt.exe179⤵
-
\??\c:\pdpjd.exec:\pdpjd.exe180⤵
-
\??\c:\7vdvv.exec:\7vdvv.exe181⤵
-
\??\c:\rrrfffx.exec:\rrrfffx.exe182⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe183⤵
-
\??\c:\xfffrrl.exec:\xfffrrl.exe184⤵
-
\??\c:\nhbthb.exec:\nhbthb.exe185⤵
-
\??\c:\5pvvd.exec:\5pvvd.exe186⤵
-
\??\c:\xxfxllr.exec:\xxfxllr.exe187⤵
-
\??\c:\9bbnbh.exec:\9bbnbh.exe188⤵
-
\??\c:\dvpvv.exec:\dvpvv.exe189⤵
-
\??\c:\rrxrllf.exec:\rrxrllf.exe190⤵
-
\??\c:\nhtnbt.exec:\nhtnbt.exe191⤵
-
\??\c:\vjdpd.exec:\vjdpd.exe192⤵
-
\??\c:\tnthhb.exec:\tnthhb.exe193⤵
-
\??\c:\tbhnhb.exec:\tbhnhb.exe194⤵
-
\??\c:\vdddv.exec:\vdddv.exe195⤵
-
\??\c:\bnttbt.exec:\bnttbt.exe196⤵
-
\??\c:\vjvvd.exec:\vjvvd.exe197⤵
-
\??\c:\pdvdj.exec:\pdvdj.exe198⤵
-
\??\c:\rxrlxff.exec:\rxrlxff.exe199⤵
-
\??\c:\pvpvd.exec:\pvpvd.exe200⤵
-
\??\c:\xlxxxxr.exec:\xlxxxxr.exe201⤵
-
\??\c:\tnnnnn.exec:\tnnnnn.exe202⤵
-
\??\c:\ddddj.exec:\ddddj.exe203⤵
-
\??\c:\lxrfrff.exec:\lxrfrff.exe204⤵
-
\??\c:\rffxllx.exec:\rffxllx.exe205⤵
-
\??\c:\pjpjd.exec:\pjpjd.exe206⤵
-
\??\c:\frrfffr.exec:\frrfffr.exe207⤵
-
\??\c:\thtbth.exec:\thtbth.exe208⤵
-
\??\c:\vvjpd.exec:\vvjpd.exe209⤵
-
\??\c:\lxfflff.exec:\lxfflff.exe210⤵
-
\??\c:\fxlrlff.exec:\fxlrlff.exe211⤵
-
\??\c:\dddvj.exec:\dddvj.exe212⤵
-
\??\c:\vpvjj.exec:\vpvjj.exe213⤵
-
\??\c:\nbbbbt.exec:\nbbbbt.exe214⤵
-
\??\c:\jdpdj.exec:\jdpdj.exe215⤵
-
\??\c:\lllxrlf.exec:\lllxrlf.exe216⤵
-
\??\c:\hntnnn.exec:\hntnnn.exe217⤵
-
\??\c:\pjdvp.exec:\pjdvp.exe218⤵
-
\??\c:\lfrflxl.exec:\lfrflxl.exe219⤵
-
\??\c:\3hhbbb.exec:\3hhbbb.exe220⤵
-
\??\c:\jddjj.exec:\jddjj.exe221⤵
-
\??\c:\lllfrff.exec:\lllfrff.exe222⤵
-
\??\c:\tnthhh.exec:\tnthhh.exe223⤵
-
\??\c:\vjpjd.exec:\vjpjd.exe224⤵
-
\??\c:\9xfxrxr.exec:\9xfxrxr.exe225⤵
-
\??\c:\hbtbnh.exec:\hbtbnh.exe226⤵
-
\??\c:\vpdpj.exec:\vpdpj.exe227⤵
-
\??\c:\rlrlffx.exec:\rlrlffx.exe228⤵
-
\??\c:\3tnhhb.exec:\3tnhhb.exe229⤵
-
\??\c:\vvjdv.exec:\vvjdv.exe230⤵
-
\??\c:\xfxflrr.exec:\xfxflrr.exe231⤵
-
\??\c:\thnnht.exec:\thnnht.exe232⤵
-
\??\c:\bnhhth.exec:\bnhhth.exe233⤵
-
\??\c:\3jjdv.exec:\3jjdv.exe234⤵
-
\??\c:\5flxrrr.exec:\5flxrrr.exe235⤵
-
\??\c:\ttbbbb.exec:\ttbbbb.exe236⤵
-
\??\c:\vdddd.exec:\vdddd.exe237⤵
-
\??\c:\7xfxxff.exec:\7xfxxff.exe238⤵
-
\??\c:\llrllff.exec:\llrllff.exe239⤵
-
\??\c:\nnhhbb.exec:\nnhhbb.exe240⤵
-
\??\c:\pvdpd.exec:\pvdpd.exe241⤵