Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05-06-2024 04:09
Behavioral task
behavioral1
Sample
37553cd5bd6107bf33b294c859d04bf0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
37553cd5bd6107bf33b294c859d04bf0_NeikiAnalytics.exe
-
Size
484KB
-
MD5
37553cd5bd6107bf33b294c859d04bf0
-
SHA1
b03e5709d344052c8696a3417a761c2dc349e749
-
SHA256
2ebb86bb941631d5f0ca2bb6f6be97b1075daf14ce111c80843060027c6579e9
-
SHA512
eab318b13d2b8144edb7dcf027b602edaf1af2453611db28a2f1c02896890b3da8adad27e3de9ab833600939663d36fd0206e4908488e39457bcb8f1bf0e6745
-
SSDEEP
12288:N4wFHoSMu49P9mPh2kkkkK4kXkkkkkkkkl888888888888888888nA:Cu49lmPh2kkkkK4kXkkkkkkkkW
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1536-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4872-11-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/836-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2400-27-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2864-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1608-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1068-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2804-58-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4988-61-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1668-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1292-85-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2292-79-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2184-75-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3444-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3096-97-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4140-101-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3720-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2748-116-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4444-126-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2920-132-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1708-143-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/556-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3936-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5036-168-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2368-175-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1072-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1200-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3864-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3880-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4260-213-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2000-232-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3480-236-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/744-237-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1032-244-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4272-248-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4364-261-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5116-274-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4760-278-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4452-283-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1476-292-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2700-299-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/216-303-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1352-310-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4924-317-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4924-321-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/928-335-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4884-342-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4120-373-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3636-418-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4640-428-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2928-435-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2272-439-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3684-461-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3924-466-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3636-506-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1064-510-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/896-528-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4244-541-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2324-545-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2784-647-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2884-696-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4640-724-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4352-835-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3280-860-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral2/memory/1536-0-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\tbthbh.exe family_berbew behavioral2/memory/1536-6-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4872-11-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\9dpjj.exe family_berbew behavioral2/memory/836-13-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\vddpj.exe family_berbew behavioral2/memory/836-18-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\hhnthb.exe family_berbew behavioral2/memory/2400-27-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\vpjdv.exe family_berbew behavioral2/memory/2864-24-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\jvpjd.exe family_berbew behavioral2/memory/1608-38-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\lfrfxxr.exe family_berbew C:\9fxrfrl.exe family_berbew behavioral2/memory/1068-48-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\bbtnbt.exe family_berbew C:\vdddv.exe family_berbew behavioral2/memory/2804-58-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4988-61-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\flfxxxr.exe family_berbew behavioral2/memory/1668-67-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\ppjpd.exe family_berbew behavioral2/memory/1292-85-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\jjddv.exe family_berbew \??\c:\ntbtbt.exe family_berbew behavioral2/memory/2292-79-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\fxfxrff.exe family_berbew behavioral2/memory/2184-75-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/3444-90-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/3096-97-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\hbhhbn.exe family_berbew C:\jvvvv.exe family_berbew behavioral2/memory/4140-101-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\5tntbb.exe family_berbew C:\xrxlffx.exe family_berbew behavioral2/memory/3720-112-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\tnbttb.exe family_berbew behavioral2/memory/2748-116-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\hthbth.exe family_berbew behavioral2/memory/4444-126-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\dddvp.exe family_berbew behavioral2/memory/2920-132-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\rfllfll.exe family_berbew C:\xfrrfll.exe family_berbew behavioral2/memory/1708-143-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\ddpdp.exe family_berbew C:\btnntt.exe family_berbew behavioral2/memory/556-154-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\pdvjd.exe family_berbew behavioral2/memory/3936-159-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\flxflxf.exe family_berbew C:\bbbttt.exe family_berbew behavioral2/memory/5036-168-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\jjvdp.exe family_berbew behavioral2/memory/2368-175-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\lxfxxrx.exe family_berbew C:\7bhhbh.exe family_berbew behavioral2/memory/1072-189-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/1200-191-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/3864-204-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/3880-208-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral2/memory/4260-213-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
tbthbh.exe9dpjj.exevddpj.exehhnthb.exevpjdv.exejvpjd.exelfrfxxr.exe9fxrfrl.exebbtnbt.exevdddv.exeflfxxxr.exeppjpd.exefxfxrff.exentbtbt.exejjddv.exehbhhbn.exejvvvv.exe5tntbb.exexrxlffx.exetnbttb.exehthbth.exedddvp.exerfllfll.exexfrrfll.exeddpdp.exebtnntt.exepdvjd.exeflxflxf.exebbbttt.exejjvdp.exelxfxxrx.exe7bhhbh.exerfrrrrl.exevjppp.exexlrlllf.exe7nnnnt.exedjvpp.exe3lxxxxr.exentttnn.exepdjjd.exerrrlffx.exenbbbtt.exebttbtb.exepvpjp.exefffxxlx.exenbbbbb.exevpdjj.exexxrrxxf.exerlxxfff.exelfrlffx.exe5tnhtt.exehbttnh.exedjvvv.exelflfllr.exe7bbhbh.exevvdvp.exerfrrllf.exerrxrxrf.exetbhhhh.exevjvpp.exeflrxxxx.exeflxrlff.exedvdvp.exepjddv.exepid process 4872 tbthbh.exe 836 9dpjj.exe 2864 vddpj.exe 2400 hhnthb.exe 1740 vpjdv.exe 1608 jvpjd.exe 3916 lfrfxxr.exe 1068 9fxrfrl.exe 2804 bbtnbt.exe 4988 vdddv.exe 1668 flfxxxr.exe 2184 ppjpd.exe 2292 fxfxrff.exe 1292 ntbtbt.exe 3444 jjddv.exe 3096 hbhhbn.exe 4140 jvvvv.exe 3720 5tntbb.exe 2748 xrxlffx.exe 4992 tnbttb.exe 4444 hthbth.exe 2920 dddvp.exe 4628 rfllfll.exe 1708 xfrrfll.exe 4168 ddpdp.exe 556 btnntt.exe 3936 pdvjd.exe 5036 flxflxf.exe 2368 bbbttt.exe 2236 jjvdp.exe 1072 lxfxxrx.exe 1200 7bhhbh.exe 4308 rfrrrrl.exe 1176 vjppp.exe 4940 xlrlllf.exe 3864 7nnnnt.exe 3880 djvpp.exe 1308 3lxxxxr.exe 4260 ntttnn.exe 724 pdjjd.exe 2876 rrrlffx.exe 4112 nbbbtt.exe 3308 bttbtb.exe 2000 pvpjp.exe 3480 fffxxlx.exe 744 nbbbbb.exe 1032 vpdjj.exe 4272 xxrrxxf.exe 1756 rlxxfff.exe 4380 lfrlffx.exe 1408 5tnhtt.exe 4364 hbttnh.exe 884 djvvv.exe 5096 lflfllr.exe 2896 7bbhbh.exe 5116 vvdvp.exe 4760 rfrrllf.exe 2400 rrxrxrf.exe 4452 tbhhhh.exe 4744 vjvpp.exe 1476 flrxxxx.exe 2956 flxrlff.exe 2700 dvdvp.exe 216 pjddv.exe -
Processes:
resource yara_rule behavioral2/memory/1536-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tbthbh.exe upx behavioral2/memory/1536-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4872-11-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9dpjj.exe upx behavioral2/memory/836-13-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vddpj.exe upx behavioral2/memory/836-18-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hhnthb.exe upx behavioral2/memory/2400-27-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vpjdv.exe upx behavioral2/memory/2864-24-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jvpjd.exe upx behavioral2/memory/1608-38-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lfrfxxr.exe upx C:\9fxrfrl.exe upx behavioral2/memory/1068-48-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bbtnbt.exe upx C:\vdddv.exe upx behavioral2/memory/2804-58-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4988-61-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\flfxxxr.exe upx behavioral2/memory/1668-67-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ppjpd.exe upx behavioral2/memory/1292-85-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\jjddv.exe upx \??\c:\ntbtbt.exe upx behavioral2/memory/2292-79-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\fxfxrff.exe upx behavioral2/memory/2184-75-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3444-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3096-97-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\hbhhbn.exe upx C:\jvvvv.exe upx behavioral2/memory/4140-101-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\5tntbb.exe upx C:\xrxlffx.exe upx behavioral2/memory/3720-112-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tnbttb.exe upx behavioral2/memory/2748-116-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hthbth.exe upx behavioral2/memory/4444-126-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dddvp.exe upx behavioral2/memory/2920-132-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rfllfll.exe upx C:\xfrrfll.exe upx behavioral2/memory/1708-143-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ddpdp.exe upx C:\btnntt.exe upx behavioral2/memory/556-154-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pdvjd.exe upx behavioral2/memory/3936-159-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\flxflxf.exe upx C:\bbbttt.exe upx behavioral2/memory/5036-168-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jjvdp.exe upx behavioral2/memory/2368-175-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lxfxxrx.exe upx C:\7bhhbh.exe upx behavioral2/memory/1072-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1200-191-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3864-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3880-208-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4260-213-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
37553cd5bd6107bf33b294c859d04bf0_NeikiAnalytics.exetbthbh.exe9dpjj.exevddpj.exehhnthb.exevpjdv.exejvpjd.exelfrfxxr.exe9fxrfrl.exebbtnbt.exevdddv.exeflfxxxr.exeppjpd.exefxfxrff.exentbtbt.exejjddv.exehbhhbn.exejvvvv.exe5tntbb.exexrxlffx.exetnbttb.exehthbth.exedescription pid process target process PID 1536 wrote to memory of 4872 1536 37553cd5bd6107bf33b294c859d04bf0_NeikiAnalytics.exe tbthbh.exe PID 1536 wrote to memory of 4872 1536 37553cd5bd6107bf33b294c859d04bf0_NeikiAnalytics.exe tbthbh.exe PID 1536 wrote to memory of 4872 1536 37553cd5bd6107bf33b294c859d04bf0_NeikiAnalytics.exe tbthbh.exe PID 4872 wrote to memory of 836 4872 tbthbh.exe 9dpjj.exe PID 4872 wrote to memory of 836 4872 tbthbh.exe 9dpjj.exe PID 4872 wrote to memory of 836 4872 tbthbh.exe 9dpjj.exe PID 836 wrote to memory of 2864 836 9dpjj.exe vddpj.exe PID 836 wrote to memory of 2864 836 9dpjj.exe vddpj.exe PID 836 wrote to memory of 2864 836 9dpjj.exe vddpj.exe PID 2864 wrote to memory of 2400 2864 vddpj.exe hhnthb.exe PID 2864 wrote to memory of 2400 2864 vddpj.exe hhnthb.exe PID 2864 wrote to memory of 2400 2864 vddpj.exe hhnthb.exe PID 2400 wrote to memory of 1740 2400 hhnthb.exe vpjdv.exe PID 2400 wrote to memory of 1740 2400 hhnthb.exe vpjdv.exe PID 2400 wrote to memory of 1740 2400 hhnthb.exe vpjdv.exe PID 1740 wrote to memory of 1608 1740 vpjdv.exe jvpjd.exe PID 1740 wrote to memory of 1608 1740 vpjdv.exe jvpjd.exe PID 1740 wrote to memory of 1608 1740 vpjdv.exe jvpjd.exe PID 1608 wrote to memory of 3916 1608 jvpjd.exe lfrfxxr.exe PID 1608 wrote to memory of 3916 1608 jvpjd.exe lfrfxxr.exe PID 1608 wrote to memory of 3916 1608 jvpjd.exe lfrfxxr.exe PID 3916 wrote to memory of 1068 3916 lfrfxxr.exe 9fxrfrl.exe PID 3916 wrote to memory of 1068 3916 lfrfxxr.exe 9fxrfrl.exe PID 3916 wrote to memory of 1068 3916 lfrfxxr.exe 9fxrfrl.exe PID 1068 wrote to memory of 2804 1068 9fxrfrl.exe bbtnbt.exe PID 1068 wrote to memory of 2804 1068 9fxrfrl.exe bbtnbt.exe PID 1068 wrote to memory of 2804 1068 9fxrfrl.exe bbtnbt.exe PID 2804 wrote to memory of 4988 2804 bbtnbt.exe vdddv.exe PID 2804 wrote to memory of 4988 2804 bbtnbt.exe vdddv.exe PID 2804 wrote to memory of 4988 2804 bbtnbt.exe vdddv.exe PID 4988 wrote to memory of 1668 4988 vdddv.exe flfxxxr.exe PID 4988 wrote to memory of 1668 4988 vdddv.exe flfxxxr.exe PID 4988 wrote to memory of 1668 4988 vdddv.exe flfxxxr.exe PID 1668 wrote to memory of 2184 1668 flfxxxr.exe ppjpd.exe PID 1668 wrote to memory of 2184 1668 flfxxxr.exe ppjpd.exe PID 1668 wrote to memory of 2184 1668 flfxxxr.exe ppjpd.exe PID 2184 wrote to memory of 2292 2184 ppjpd.exe fxfxrff.exe PID 2184 wrote to memory of 2292 2184 ppjpd.exe fxfxrff.exe PID 2184 wrote to memory of 2292 2184 ppjpd.exe fxfxrff.exe PID 2292 wrote to memory of 1292 2292 fxfxrff.exe ntbtbt.exe PID 2292 wrote to memory of 1292 2292 fxfxrff.exe ntbtbt.exe PID 2292 wrote to memory of 1292 2292 fxfxrff.exe ntbtbt.exe PID 1292 wrote to memory of 3444 1292 ntbtbt.exe jjddv.exe PID 1292 wrote to memory of 3444 1292 ntbtbt.exe jjddv.exe PID 1292 wrote to memory of 3444 1292 ntbtbt.exe jjddv.exe PID 3444 wrote to memory of 3096 3444 jjddv.exe hbhhbn.exe PID 3444 wrote to memory of 3096 3444 jjddv.exe hbhhbn.exe PID 3444 wrote to memory of 3096 3444 jjddv.exe hbhhbn.exe PID 3096 wrote to memory of 4140 3096 hbhhbn.exe jvvvv.exe PID 3096 wrote to memory of 4140 3096 hbhhbn.exe jvvvv.exe PID 3096 wrote to memory of 4140 3096 hbhhbn.exe jvvvv.exe PID 4140 wrote to memory of 3720 4140 jvvvv.exe 5tntbb.exe PID 4140 wrote to memory of 3720 4140 jvvvv.exe 5tntbb.exe PID 4140 wrote to memory of 3720 4140 jvvvv.exe 5tntbb.exe PID 3720 wrote to memory of 2748 3720 5tntbb.exe xrxlffx.exe PID 3720 wrote to memory of 2748 3720 5tntbb.exe xrxlffx.exe PID 3720 wrote to memory of 2748 3720 5tntbb.exe xrxlffx.exe PID 2748 wrote to memory of 4992 2748 xrxlffx.exe tnbttb.exe PID 2748 wrote to memory of 4992 2748 xrxlffx.exe tnbttb.exe PID 2748 wrote to memory of 4992 2748 xrxlffx.exe tnbttb.exe PID 4992 wrote to memory of 4444 4992 tnbttb.exe hthbth.exe PID 4992 wrote to memory of 4444 4992 tnbttb.exe hthbth.exe PID 4992 wrote to memory of 4444 4992 tnbttb.exe hthbth.exe PID 4444 wrote to memory of 2920 4444 hthbth.exe dddvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\37553cd5bd6107bf33b294c859d04bf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\37553cd5bd6107bf33b294c859d04bf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\tbthbh.exec:\tbthbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\9dpjj.exec:\9dpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\vddpj.exec:\vddpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\hhnthb.exec:\hhnthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\vpjdv.exec:\vpjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jvpjd.exec:\jvpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\lfrfxxr.exec:\lfrfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\9fxrfrl.exec:\9fxrfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\bbtnbt.exec:\bbtnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vdddv.exec:\vdddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\flfxxxr.exec:\flfxxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\ppjpd.exec:\ppjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\fxfxrff.exec:\fxfxrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\ntbtbt.exec:\ntbtbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\jjddv.exec:\jjddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\hbhhbn.exec:\hbhhbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\jvvvv.exec:\jvvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\5tntbb.exec:\5tntbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\xrxlffx.exec:\xrxlffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tnbttb.exec:\tnbttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\hthbth.exec:\hthbth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\dddvp.exec:\dddvp.exe23⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rfllfll.exec:\rfllfll.exe24⤵
- Executes dropped EXE
PID:4628 -
\??\c:\xfrrfll.exec:\xfrrfll.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ddpdp.exec:\ddpdp.exe26⤵
- Executes dropped EXE
PID:4168 -
\??\c:\btnntt.exec:\btnntt.exe27⤵
- Executes dropped EXE
PID:556 -
\??\c:\pdvjd.exec:\pdvjd.exe28⤵
- Executes dropped EXE
PID:3936 -
\??\c:\flxflxf.exec:\flxflxf.exe29⤵
- Executes dropped EXE
PID:5036 -
\??\c:\bbbttt.exec:\bbbttt.exe30⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jjvdp.exec:\jjvdp.exe31⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lxfxxrx.exec:\lxfxxrx.exe32⤵
- Executes dropped EXE
PID:1072 -
\??\c:\7bhhbh.exec:\7bhhbh.exe33⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rfrrrrl.exec:\rfrrrrl.exe34⤵
- Executes dropped EXE
PID:4308 -
\??\c:\vjppp.exec:\vjppp.exe35⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xlrlllf.exec:\xlrlllf.exe36⤵
- Executes dropped EXE
PID:4940 -
\??\c:\7nnnnt.exec:\7nnnnt.exe37⤵
- Executes dropped EXE
PID:3864 -
\??\c:\djvpp.exec:\djvpp.exe38⤵
- Executes dropped EXE
PID:3880 -
\??\c:\3lxxxxr.exec:\3lxxxxr.exe39⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ntttnn.exec:\ntttnn.exe40⤵
- Executes dropped EXE
PID:4260 -
\??\c:\pdjjd.exec:\pdjjd.exe41⤵
- Executes dropped EXE
PID:724 -
\??\c:\rrrlffx.exec:\rrrlffx.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nbbbtt.exec:\nbbbtt.exe43⤵
- Executes dropped EXE
PID:4112 -
\??\c:\bttbtb.exec:\bttbtb.exe44⤵
- Executes dropped EXE
PID:3308 -
\??\c:\pvpjp.exec:\pvpjp.exe45⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fffxxlx.exec:\fffxxlx.exe46⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nbbbbb.exec:\nbbbbb.exe47⤵
- Executes dropped EXE
PID:744 -
\??\c:\vpdjj.exec:\vpdjj.exe48⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe49⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rlxxfff.exec:\rlxxfff.exe50⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lfrlffx.exec:\lfrlffx.exe51⤵
- Executes dropped EXE
PID:4380 -
\??\c:\5tnhtt.exec:\5tnhtt.exe52⤵
- Executes dropped EXE
PID:1408 -
\??\c:\hbttnh.exec:\hbttnh.exe53⤵
- Executes dropped EXE
PID:4364 -
\??\c:\djvvv.exec:\djvvv.exe54⤵
- Executes dropped EXE
PID:884 -
\??\c:\lflfllr.exec:\lflfllr.exe55⤵
- Executes dropped EXE
PID:5096 -
\??\c:\7bbhbh.exec:\7bbhbh.exe56⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vvdvp.exec:\vvdvp.exe57⤵
- Executes dropped EXE
PID:5116 -
\??\c:\rfrrllf.exec:\rfrrllf.exe58⤵
- Executes dropped EXE
PID:4760 -
\??\c:\rrxrxrf.exec:\rrxrxrf.exe59⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tbhhhh.exec:\tbhhhh.exe60⤵
- Executes dropped EXE
PID:4452 -
\??\c:\vjvpp.exec:\vjvpp.exe61⤵
- Executes dropped EXE
PID:4744 -
\??\c:\flrxxxx.exec:\flrxxxx.exe62⤵
- Executes dropped EXE
PID:1476 -
\??\c:\flxrlff.exec:\flxrlff.exe63⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dvdvp.exec:\dvdvp.exe64⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pjddv.exec:\pjddv.exe65⤵
- Executes dropped EXE
PID:216 -
\??\c:\rrxxflx.exec:\rrxxflx.exe66⤵PID:1196
-
\??\c:\tbbtth.exec:\tbbtth.exe67⤵PID:4988
-
\??\c:\tbnhbb.exec:\tbnhbb.exe68⤵PID:1352
-
\??\c:\ppvpd.exec:\ppvpd.exe69⤵PID:392
-
\??\c:\rxrrxxx.exec:\rxrrxxx.exe70⤵PID:4924
-
\??\c:\bbntbb.exec:\bbntbb.exe71⤵PID:3444
-
\??\c:\nnthnt.exec:\nnthnt.exe72⤵PID:2724
-
\??\c:\jpddd.exec:\jpddd.exe73⤵PID:4112
-
\??\c:\rllllrr.exec:\rllllrr.exe74⤵PID:1412
-
\??\c:\tbntbb.exec:\tbntbb.exe75⤵PID:928
-
\??\c:\vjvjj.exec:\vjvjj.exe76⤵PID:4884
-
\??\c:\vdjdv.exec:\vdjdv.exe77⤵PID:4272
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe78⤵PID:2928
-
\??\c:\hhbtnn.exec:\hhbtnn.exe79⤵PID:2272
-
\??\c:\jjjdd.exec:\jjjdd.exe80⤵PID:4356
-
\??\c:\xrlffff.exec:\xrlffff.exe81⤵PID:4628
-
\??\c:\ttbbtt.exec:\ttbbtt.exe82⤵PID:4468
-
\??\c:\pjvpj.exec:\pjvpj.exe83⤵PID:2896
-
\??\c:\9xlxrfl.exec:\9xlxrfl.exe84⤵PID:5116
-
\??\c:\pjdvv.exec:\pjdvv.exe85⤵PID:5108
-
\??\c:\5djvv.exec:\5djvv.exe86⤵PID:4120
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe87⤵PID:2368
-
\??\c:\bbhhhn.exec:\bbhhhn.exe88⤵PID:3656
-
\??\c:\jpvvv.exec:\jpvvv.exe89⤵PID:1072
-
\??\c:\rfxrrxf.exec:\rfxrrxf.exe90⤵PID:3128
-
\??\c:\xlllrxr.exec:\xlllrxr.exe91⤵PID:4192
-
\??\c:\ttbttt.exec:\ttbttt.exe92⤵PID:4424
-
\??\c:\ppjdv.exec:\ppjdv.exe93⤵PID:5056
-
\??\c:\lflllrr.exec:\lflllrr.exe94⤵PID:4376
-
\??\c:\3thhhh.exec:\3thhhh.exe95⤵PID:4728
-
\??\c:\7vddj.exec:\7vddj.exe96⤵PID:2292
-
\??\c:\rllrlfl.exec:\rllrlfl.exe97⤵PID:1964
-
\??\c:\nbhnnn.exec:\nbhnnn.exe98⤵PID:4092
-
\??\c:\vpppj.exec:\vpppj.exe99⤵PID:4080
-
\??\c:\flrxxfl.exec:\flrxxfl.exe100⤵PID:3536
-
\??\c:\bthnhh.exec:\bthnhh.exe101⤵PID:3636
-
\??\c:\vjvpp.exec:\vjvpp.exe102⤵PID:1080
-
\??\c:\pdjpd.exec:\pdjpd.exe103⤵PID:4640
-
\??\c:\lrxxxrr.exec:\lrxxxrr.exe104⤵PID:4212
-
\??\c:\pvjjd.exec:\pvjjd.exe105⤵PID:2928
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe106⤵PID:2272
-
\??\c:\hntntb.exec:\hntntb.exe107⤵PID:1084
-
\??\c:\vjpjd.exec:\vjpjd.exe108⤵PID:3824
-
\??\c:\dvjjp.exec:\dvjjp.exe109⤵PID:3412
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe110⤵PID:2248
-
\??\c:\5nttnt.exec:\5nttnt.exe111⤵PID:4816
-
\??\c:\dvdvv.exec:\dvdvv.exe112⤵PID:2220
-
\??\c:\3rllfff.exec:\3rllfff.exe113⤵PID:3684
-
\??\c:\btttnn.exec:\btttnn.exe114⤵PID:2956
-
\??\c:\djddv.exec:\djddv.exe115⤵PID:3924
-
\??\c:\rrfxrll.exec:\rrfxrll.exe116⤵PID:4708
-
\??\c:\hhtnhn.exec:\hhtnhn.exe117⤵PID:2804
-
\??\c:\vppvj.exec:\vppvj.exe118⤵PID:4676
-
\??\c:\lxxxrll.exec:\lxxxrll.exe119⤵PID:5024
-
\??\c:\lrfffrr.exec:\lrfffrr.exe120⤵PID:4944
-
\??\c:\3bnnnb.exec:\3bnnnb.exe121⤵PID:4224
-
\??\c:\jvdjj.exec:\jvdjj.exe122⤵PID:2284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-