Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10b08b4d297b9ddb20f633ceb226dd42761b560ff1ff81d5eee0f01cc0201e0f_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
10b08b4d297b9ddb20f633ceb226dd42761b560ff1ff81d5eee0f01cc0201e0f_NeikiAnalytics.exe
-
Size
195KB
-
MD5
78ed03efe84e86b2bf83b7116d147310
-
SHA1
9dccda4313511df103d8e4839e0e366a82a67202
-
SHA256
10b08b4d297b9ddb20f633ceb226dd42761b560ff1ff81d5eee0f01cc0201e0f
-
SHA512
4062c8c5e276c6503d30b16eafd9077957051796447f1ecc2b943c4c6bec9dd2e70fdec17b495ce930bfb764d6065663e62c4d51ebc4a9e395fe13e478ce9a7c
-
SSDEEP
1536:gvQBeOGtrYSSsrc93UBIfdC67m6AJiqpfg3Cn/uiYs6Uo+:ghOm2sI93UufdC67ciifmCnmiYJUV
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1164-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjvdv.exehtttnb.exellxlrrx.exehtnnth.exehbhntt.exe9dpvv.exerlrxxfx.exe5hbhnt.exe1pvdd.exexfrlrrf.exe5nhntt.exebnttht.exepvpvp.exehhnbnh.exejdddv.exebbhbtt.exedjpvv.exetnthhh.exevpjjj.exexfrlxrl.exetnthtn.exe7jjjd.exetntbtt.exeppdpj.exetbhntb.exevpddj.exenttbhb.exerflllll.exelfrrxxr.exehbbbtt.exexxrrlrf.exetnttth.exejpvvd.exehbhtth.exepdjdd.exellrxlrx.exehbnnht.exevvpvv.exexfffrxx.exevdjdd.exefllxxfl.exettbhnt.exejpdjv.exelrlllll.exehhbbbt.exexrxfllr.exe1hbhhh.exejpddd.exerfxrrrl.exelxllxff.exehbntth.exexrffflf.exehbthhn.exejdvvd.exedjjvp.exebtbnbt.exevdjpj.exelfrlxxl.exebbbhht.exelrxrlll.exebtthnb.exejpvvp.exebnntbb.exedvppd.exepid process 448 vjvdv.exe 4828 htttnb.exe 1424 llxlrrx.exe 4832 htnnth.exe 2484 hbhntt.exe 4756 9dpvv.exe 3772 rlrxxfx.exe 2528 5hbhnt.exe 1888 1pvdd.exe 3572 xfrlrrf.exe 540 5nhntt.exe 4984 bnttht.exe 1672 pvpvp.exe 3088 hhnbnh.exe 3296 jdddv.exe 2240 bbhbtt.exe 3332 djpvv.exe 3968 tnthhh.exe 432 vpjjj.exe 2156 xfrlxrl.exe 1836 tnthtn.exe 4528 7jjjd.exe 2384 tntbtt.exe 2944 ppdpj.exe 4672 tbhntb.exe 1952 vpddj.exe 1372 nttbhb.exe 2104 rflllll.exe 3440 lfrrxxr.exe 4292 hbbbtt.exe 1564 xxrrlrf.exe 3800 tnttth.exe 3852 jpvvd.exe 1320 hbhtth.exe 4284 pdjdd.exe 320 llrxlrx.exe 2252 hbnnht.exe 1368 vvpvv.exe 4456 xfffrxx.exe 764 vdjdd.exe 2868 fllxxfl.exe 3880 ttbhnt.exe 3428 jpdjv.exe 1104 lrlllll.exe 3192 hhbbbt.exe 4768 xrxfllr.exe 1484 1hbhhh.exe 2992 jpddd.exe 2172 rfxrrrl.exe 2420 lxllxff.exe 212 hbntth.exe 4784 xrffflf.exe 3572 hbthhn.exe 2268 jdvvd.exe 4984 djjvp.exe 1820 btbnbt.exe 3188 vdjpj.exe 5056 lfrlxxl.exe 3004 bbbhht.exe 4936 lrxrlll.exe 4908 btthnb.exe 1760 jpvvp.exe 5024 bnntbb.exe 432 dvppd.exe -
Processes:
resource yara_rule behavioral2/memory/1164-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-441-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
10b08b4d297b9ddb20f633ceb226dd42761b560ff1ff81d5eee0f01cc0201e0f_NeikiAnalytics.exevjvdv.exehtttnb.exellxlrrx.exehtnnth.exehbhntt.exe9dpvv.exerlrxxfx.exe5hbhnt.exe1pvdd.exexfrlrrf.exe5nhntt.exebnttht.exepvpvp.exehhnbnh.exejdddv.exebbhbtt.exedjpvv.exetnthhh.exevpjjj.exexfrlxrl.exetnthtn.exedescription pid process target process PID 1164 wrote to memory of 448 1164 10b08b4d297b9ddb20f633ceb226dd42761b560ff1ff81d5eee0f01cc0201e0f_NeikiAnalytics.exe vjvdv.exe PID 1164 wrote to memory of 448 1164 10b08b4d297b9ddb20f633ceb226dd42761b560ff1ff81d5eee0f01cc0201e0f_NeikiAnalytics.exe vjvdv.exe PID 1164 wrote to memory of 448 1164 10b08b4d297b9ddb20f633ceb226dd42761b560ff1ff81d5eee0f01cc0201e0f_NeikiAnalytics.exe vjvdv.exe PID 448 wrote to memory of 4828 448 vjvdv.exe htttnb.exe PID 448 wrote to memory of 4828 448 vjvdv.exe htttnb.exe PID 448 wrote to memory of 4828 448 vjvdv.exe htttnb.exe PID 4828 wrote to memory of 1424 4828 htttnb.exe llxlrrx.exe PID 4828 wrote to memory of 1424 4828 htttnb.exe llxlrrx.exe PID 4828 wrote to memory of 1424 4828 htttnb.exe llxlrrx.exe PID 1424 wrote to memory of 4832 1424 llxlrrx.exe htnnth.exe PID 1424 wrote to memory of 4832 1424 llxlrrx.exe htnnth.exe PID 1424 wrote to memory of 4832 1424 llxlrrx.exe htnnth.exe PID 4832 wrote to memory of 2484 4832 htnnth.exe hbhntt.exe PID 4832 wrote to memory of 2484 4832 htnnth.exe hbhntt.exe PID 4832 wrote to memory of 2484 4832 htnnth.exe hbhntt.exe PID 2484 wrote to memory of 4756 2484 hbhntt.exe 9dpvv.exe PID 2484 wrote to memory of 4756 2484 hbhntt.exe 9dpvv.exe PID 2484 wrote to memory of 4756 2484 hbhntt.exe 9dpvv.exe PID 4756 wrote to memory of 3772 4756 9dpvv.exe rlrxxfx.exe PID 4756 wrote to memory of 3772 4756 9dpvv.exe rlrxxfx.exe PID 4756 wrote to memory of 3772 4756 9dpvv.exe rlrxxfx.exe PID 3772 wrote to memory of 2528 3772 rlrxxfx.exe 5hbhnt.exe PID 3772 wrote to memory of 2528 3772 rlrxxfx.exe 5hbhnt.exe PID 3772 wrote to memory of 2528 3772 rlrxxfx.exe 5hbhnt.exe PID 2528 wrote to memory of 1888 2528 5hbhnt.exe 1pvdd.exe PID 2528 wrote to memory of 1888 2528 5hbhnt.exe 1pvdd.exe PID 2528 wrote to memory of 1888 2528 5hbhnt.exe 1pvdd.exe PID 1888 wrote to memory of 3572 1888 1pvdd.exe xfrlrrf.exe PID 1888 wrote to memory of 3572 1888 1pvdd.exe xfrlrrf.exe PID 1888 wrote to memory of 3572 1888 1pvdd.exe xfrlrrf.exe PID 3572 wrote to memory of 540 3572 xfrlrrf.exe 5nhntt.exe PID 3572 wrote to memory of 540 3572 xfrlrrf.exe 5nhntt.exe PID 3572 wrote to memory of 540 3572 xfrlrrf.exe 5nhntt.exe PID 540 wrote to memory of 4984 540 5nhntt.exe bnttht.exe PID 540 wrote to memory of 4984 540 5nhntt.exe bnttht.exe PID 540 wrote to memory of 4984 540 5nhntt.exe bnttht.exe PID 4984 wrote to memory of 1672 4984 bnttht.exe pvpvp.exe PID 4984 wrote to memory of 1672 4984 bnttht.exe pvpvp.exe PID 4984 wrote to memory of 1672 4984 bnttht.exe pvpvp.exe PID 1672 wrote to memory of 3088 1672 pvpvp.exe hhnbnh.exe PID 1672 wrote to memory of 3088 1672 pvpvp.exe hhnbnh.exe PID 1672 wrote to memory of 3088 1672 pvpvp.exe hhnbnh.exe PID 3088 wrote to memory of 3296 3088 hhnbnh.exe jdddv.exe PID 3088 wrote to memory of 3296 3088 hhnbnh.exe jdddv.exe PID 3088 wrote to memory of 3296 3088 hhnbnh.exe jdddv.exe PID 3296 wrote to memory of 2240 3296 jdddv.exe bbhbtt.exe PID 3296 wrote to memory of 2240 3296 jdddv.exe bbhbtt.exe PID 3296 wrote to memory of 2240 3296 jdddv.exe bbhbtt.exe PID 2240 wrote to memory of 3332 2240 bbhbtt.exe djpvv.exe PID 2240 wrote to memory of 3332 2240 bbhbtt.exe djpvv.exe PID 2240 wrote to memory of 3332 2240 bbhbtt.exe djpvv.exe PID 3332 wrote to memory of 3968 3332 djpvv.exe tnthhh.exe PID 3332 wrote to memory of 3968 3332 djpvv.exe tnthhh.exe PID 3332 wrote to memory of 3968 3332 djpvv.exe tnthhh.exe PID 3968 wrote to memory of 432 3968 tnthhh.exe vpjjj.exe PID 3968 wrote to memory of 432 3968 tnthhh.exe vpjjj.exe PID 3968 wrote to memory of 432 3968 tnthhh.exe vpjjj.exe PID 432 wrote to memory of 2156 432 vpjjj.exe xfrlxrl.exe PID 432 wrote to memory of 2156 432 vpjjj.exe xfrlxrl.exe PID 432 wrote to memory of 2156 432 vpjjj.exe xfrlxrl.exe PID 2156 wrote to memory of 1836 2156 xfrlxrl.exe tnthtn.exe PID 2156 wrote to memory of 1836 2156 xfrlxrl.exe tnthtn.exe PID 2156 wrote to memory of 1836 2156 xfrlxrl.exe tnthtn.exe PID 1836 wrote to memory of 4528 1836 tnthtn.exe 7jjjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10b08b4d297b9ddb20f633ceb226dd42761b560ff1ff81d5eee0f01cc0201e0f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10b08b4d297b9ddb20f633ceb226dd42761b560ff1ff81d5eee0f01cc0201e0f_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vjvdv.exec:\vjvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htttnb.exec:\htttnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llxlrrx.exec:\llxlrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnnth.exec:\htnnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbhntt.exec:\hbhntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9dpvv.exec:\9dpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlrxxfx.exec:\rlrxxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5hbhnt.exec:\5hbhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1pvdd.exec:\1pvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrlrrf.exec:\xfrlrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5nhntt.exec:\5nhntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bnttht.exec:\bnttht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvpvp.exec:\pvpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhnbnh.exec:\hhnbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdddv.exec:\jdddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbhbtt.exec:\bbhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djpvv.exec:\djpvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnthhh.exec:\tnthhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpjjj.exec:\vpjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrlxrl.exec:\xfrlxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnthtn.exec:\tnthtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7jjjd.exec:\7jjjd.exe23⤵
- Executes dropped EXE
-
\??\c:\tntbtt.exec:\tntbtt.exe24⤵
- Executes dropped EXE
-
\??\c:\ppdpj.exec:\ppdpj.exe25⤵
- Executes dropped EXE
-
\??\c:\tbhntb.exec:\tbhntb.exe26⤵
- Executes dropped EXE
-
\??\c:\vpddj.exec:\vpddj.exe27⤵
- Executes dropped EXE
-
\??\c:\nttbhb.exec:\nttbhb.exe28⤵
- Executes dropped EXE
-
\??\c:\rflllll.exec:\rflllll.exe29⤵
- Executes dropped EXE
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe30⤵
- Executes dropped EXE
-
\??\c:\hbbbtt.exec:\hbbbtt.exe31⤵
- Executes dropped EXE
-
\??\c:\xxrrlrf.exec:\xxrrlrf.exe32⤵
- Executes dropped EXE
-
\??\c:\tnttth.exec:\tnttth.exe33⤵
- Executes dropped EXE
-
\??\c:\jpvvd.exec:\jpvvd.exe34⤵
- Executes dropped EXE
-
\??\c:\hbhtth.exec:\hbhtth.exe35⤵
- Executes dropped EXE
-
\??\c:\pdjdd.exec:\pdjdd.exe36⤵
- Executes dropped EXE
-
\??\c:\llrxlrx.exec:\llrxlrx.exe37⤵
- Executes dropped EXE
-
\??\c:\hbnnht.exec:\hbnnht.exe38⤵
- Executes dropped EXE
-
\??\c:\vvpvv.exec:\vvpvv.exe39⤵
- Executes dropped EXE
-
\??\c:\xfffrxx.exec:\xfffrxx.exe40⤵
- Executes dropped EXE
-
\??\c:\vdjdd.exec:\vdjdd.exe41⤵
- Executes dropped EXE
-
\??\c:\fllxxfl.exec:\fllxxfl.exe42⤵
- Executes dropped EXE
-
\??\c:\ttbhnt.exec:\ttbhnt.exe43⤵
- Executes dropped EXE
-
\??\c:\jpdjv.exec:\jpdjv.exe44⤵
- Executes dropped EXE
-
\??\c:\lrlllll.exec:\lrlllll.exe45⤵
- Executes dropped EXE
-
\??\c:\hhbbbt.exec:\hhbbbt.exe46⤵
- Executes dropped EXE
-
\??\c:\xrxfllr.exec:\xrxfllr.exe47⤵
- Executes dropped EXE
-
\??\c:\1hbhhh.exec:\1hbhhh.exe48⤵
- Executes dropped EXE
-
\??\c:\jpddd.exec:\jpddd.exe49⤵
- Executes dropped EXE
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe50⤵
- Executes dropped EXE
-
\??\c:\lxllxff.exec:\lxllxff.exe51⤵
- Executes dropped EXE
-
\??\c:\hbntth.exec:\hbntth.exe52⤵
- Executes dropped EXE
-
\??\c:\xrffflf.exec:\xrffflf.exe53⤵
- Executes dropped EXE
-
\??\c:\hbthhn.exec:\hbthhn.exe54⤵
- Executes dropped EXE
-
\??\c:\jdvvd.exec:\jdvvd.exe55⤵
- Executes dropped EXE
-
\??\c:\djjvp.exec:\djjvp.exe56⤵
- Executes dropped EXE
-
\??\c:\btbnbt.exec:\btbnbt.exe57⤵
- Executes dropped EXE
-
\??\c:\vdjpj.exec:\vdjpj.exe58⤵
- Executes dropped EXE
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe59⤵
- Executes dropped EXE
-
\??\c:\bbbhht.exec:\bbbhht.exe60⤵
- Executes dropped EXE
-
\??\c:\lrxrlll.exec:\lrxrlll.exe61⤵
- Executes dropped EXE
-
\??\c:\btthnb.exec:\btthnb.exe62⤵
- Executes dropped EXE
-
\??\c:\jpvvp.exec:\jpvvp.exe63⤵
- Executes dropped EXE
-
\??\c:\bnntbb.exec:\bnntbb.exe64⤵
- Executes dropped EXE
-
\??\c:\dvppd.exec:\dvppd.exe65⤵
- Executes dropped EXE
-
\??\c:\3flrfrf.exec:\3flrfrf.exe66⤵
-
\??\c:\tbhbhh.exec:\tbhbhh.exe67⤵
-
\??\c:\jjdjp.exec:\jjdjp.exe68⤵
-
\??\c:\vdjjj.exec:\vdjjj.exe69⤵
-
\??\c:\5xrrfll.exec:\5xrrfll.exe70⤵
-
\??\c:\nntbbn.exec:\nntbbn.exe71⤵
-
\??\c:\djvdj.exec:\djvdj.exe72⤵
-
\??\c:\5rrllll.exec:\5rrllll.exe73⤵
-
\??\c:\bhnnnn.exec:\bhnnnn.exe74⤵
-
\??\c:\ddppv.exec:\ddppv.exe75⤵
-
\??\c:\rxfrrxx.exec:\rxfrrxx.exe76⤵
-
\??\c:\nbhnht.exec:\nbhnht.exe77⤵
-
\??\c:\vvddj.exec:\vvddj.exe78⤵
-
\??\c:\rfrxrrx.exec:\rfrxrrx.exe79⤵
-
\??\c:\5vpdd.exec:\5vpdd.exe80⤵
-
\??\c:\jdjpv.exec:\jdjpv.exe81⤵
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe82⤵
-
\??\c:\bnhtbt.exec:\bnhtbt.exe83⤵
-
\??\c:\vdvvj.exec:\vdvvj.exe84⤵
-
\??\c:\lxlxfxf.exec:\lxlxfxf.exe85⤵
-
\??\c:\btthnh.exec:\btthnh.exe86⤵
-
\??\c:\7jjpv.exec:\7jjpv.exe87⤵
-
\??\c:\rlxflll.exec:\rlxflll.exe88⤵
-
\??\c:\hbbhnt.exec:\hbbhnt.exe89⤵
-
\??\c:\bbnnnb.exec:\bbnnnb.exe90⤵
-
\??\c:\9vpvv.exec:\9vpvv.exe91⤵
-
\??\c:\lxlllll.exec:\lxlllll.exe92⤵
-
\??\c:\bnbntn.exec:\bnbntn.exe93⤵
-
\??\c:\djjdj.exec:\djjdj.exe94⤵
-
\??\c:\llrfffl.exec:\llrfffl.exe95⤵
-
\??\c:\lfxrlxl.exec:\lfxrlxl.exe96⤵
-
\??\c:\7pppp.exec:\7pppp.exe97⤵
-
\??\c:\frfllrx.exec:\frfllrx.exe98⤵
-
\??\c:\bhnbhn.exec:\bhnbhn.exe99⤵
-
\??\c:\vpvdv.exec:\vpvdv.exe100⤵
-
\??\c:\ffllrrr.exec:\ffllrrr.exe101⤵
-
\??\c:\tbtnbh.exec:\tbtnbh.exe102⤵
-
\??\c:\ddjpp.exec:\ddjpp.exe103⤵
-
\??\c:\ddpdp.exec:\ddpdp.exe104⤵
-
\??\c:\flxffrf.exec:\flxffrf.exe105⤵
-
\??\c:\bhttbt.exec:\bhttbt.exe106⤵
-
\??\c:\ttbnth.exec:\ttbnth.exe107⤵
-
\??\c:\jpppp.exec:\jpppp.exe108⤵
-
\??\c:\xlrxlxl.exec:\xlrxlxl.exe109⤵
-
\??\c:\tnttbh.exec:\tnttbh.exe110⤵
-
\??\c:\jdpvj.exec:\jdpvj.exe111⤵
-
\??\c:\rxfffll.exec:\rxfffll.exe112⤵
-
\??\c:\rrfrxlr.exec:\rrfrxlr.exe113⤵
-
\??\c:\hthnnt.exec:\hthnnt.exe114⤵
-
\??\c:\djjvv.exec:\djjvv.exe115⤵
-
\??\c:\xlxlllr.exec:\xlxlllr.exe116⤵
-
\??\c:\hbtttt.exec:\hbtttt.exe117⤵
-
\??\c:\nthhbb.exec:\nthhbb.exe118⤵
-
\??\c:\vjppd.exec:\vjppd.exe119⤵
-
\??\c:\rlrxrxx.exec:\rlrxrxx.exe120⤵
-
\??\c:\hhbbtt.exec:\hhbbtt.exe121⤵
-
\??\c:\pvjpj.exec:\pvjpj.exe122⤵
-
\??\c:\frxffrx.exec:\frxffrx.exe123⤵
-
\??\c:\fxllrrx.exec:\fxllrrx.exe124⤵
-
\??\c:\ntthbh.exec:\ntthbh.exe125⤵
-
\??\c:\ddvjv.exec:\ddvjv.exe126⤵
-
\??\c:\rxrrfxl.exec:\rxrrfxl.exe127⤵
-
\??\c:\tnhhnn.exec:\tnhhnn.exe128⤵
-
\??\c:\hhtbtt.exec:\hhtbtt.exe129⤵
-
\??\c:\vdpvv.exec:\vdpvv.exe130⤵
-
\??\c:\xrfrllr.exec:\xrfrllr.exe131⤵
-
\??\c:\bbnbbt.exec:\bbnbbt.exe132⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe133⤵
-
\??\c:\rfllfff.exec:\rfllfff.exe134⤵
-
\??\c:\fxffxxr.exec:\fxffxxr.exe135⤵
-
\??\c:\nthhhh.exec:\nthhhh.exe136⤵
-
\??\c:\ppddj.exec:\ppddj.exe137⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe138⤵
-
\??\c:\rxllxxr.exec:\rxllxxr.exe139⤵
-
\??\c:\nnnttb.exec:\nnnttb.exe140⤵
-
\??\c:\jpvvv.exec:\jpvvv.exe141⤵
-
\??\c:\rfrffrl.exec:\rfrffrl.exe142⤵
-
\??\c:\btnbht.exec:\btnbht.exe143⤵
-
\??\c:\vjvdj.exec:\vjvdj.exe144⤵
-
\??\c:\xxxrllr.exec:\xxxrllr.exe145⤵
-
\??\c:\bbhnbb.exec:\bbhnbb.exe146⤵
-
\??\c:\tbnthn.exec:\tbnthn.exe147⤵
-
\??\c:\1fxxfrr.exec:\1fxxfrr.exe148⤵
-
\??\c:\hntbbn.exec:\hntbbn.exe149⤵
-
\??\c:\pvjpv.exec:\pvjpv.exe150⤵
-
\??\c:\rrxllrf.exec:\rrxllrf.exe151⤵
-
\??\c:\7nbtbn.exec:\7nbtbn.exe152⤵
-
\??\c:\ddjjp.exec:\ddjjp.exe153⤵
-
\??\c:\jjdjj.exec:\jjdjj.exe154⤵
-
\??\c:\fxfrlrl.exec:\fxfrlrl.exe155⤵
-
\??\c:\nnbnht.exec:\nnbnht.exe156⤵
-
\??\c:\9jvvd.exec:\9jvvd.exe157⤵
-
\??\c:\pvpdv.exec:\pvpdv.exe158⤵
-
\??\c:\rlffflf.exec:\rlffflf.exe159⤵
-
\??\c:\thttnn.exec:\thttnn.exe160⤵
-
\??\c:\pvjjv.exec:\pvjjv.exe161⤵
-
\??\c:\vvdjj.exec:\vvdjj.exe162⤵
-
\??\c:\xlrfxlr.exec:\xlrfxlr.exe163⤵
-
\??\c:\9rrxfxl.exec:\9rrxfxl.exe164⤵
-
\??\c:\tbntbb.exec:\tbntbb.exe165⤵
-
\??\c:\jvjvp.exec:\jvjvp.exe166⤵
-
\??\c:\1rxflxx.exec:\1rxflxx.exe167⤵
-
\??\c:\bbhhhn.exec:\bbhhhn.exe168⤵
-
\??\c:\jvpjp.exec:\jvpjp.exe169⤵
-
\??\c:\1pdjp.exec:\1pdjp.exe170⤵
-
\??\c:\1fxllfr.exec:\1fxllfr.exe171⤵
-
\??\c:\llrrfxl.exec:\llrrfxl.exe172⤵
-
\??\c:\nntnbh.exec:\nntnbh.exe173⤵
-
\??\c:\jdppp.exec:\jdppp.exe174⤵
-
\??\c:\xflffff.exec:\xflffff.exe175⤵
-
\??\c:\lfllxxr.exec:\lfllxxr.exe176⤵
-
\??\c:\bhhnth.exec:\bhhnth.exe177⤵
-
\??\c:\7vdpv.exec:\7vdpv.exe178⤵
-
\??\c:\5xfflrf.exec:\5xfflrf.exe179⤵
-
\??\c:\9tntbn.exec:\9tntbn.exe180⤵
-
\??\c:\ppddj.exec:\ppddj.exe181⤵
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe182⤵
-
\??\c:\fxlflfx.exec:\fxlflfx.exe183⤵
-
\??\c:\nbtbbh.exec:\nbtbbh.exe184⤵
-
\??\c:\dddvj.exec:\dddvj.exe185⤵
-
\??\c:\ffflxfr.exec:\ffflxfr.exe186⤵
-
\??\c:\ttbbbb.exec:\ttbbbb.exe187⤵
-
\??\c:\htbbth.exec:\htbbth.exe188⤵
-
\??\c:\jdjpd.exec:\jdjpd.exe189⤵
-
\??\c:\rrxxfrx.exec:\rrxxfrx.exe190⤵
-
\??\c:\hhtbbh.exec:\hhtbbh.exe191⤵
-
\??\c:\ppjpv.exec:\ppjpv.exe192⤵
-
\??\c:\ddvpp.exec:\ddvpp.exe193⤵
-
\??\c:\xlrfllr.exec:\xlrfllr.exe194⤵
-
\??\c:\3tbhnt.exec:\3tbhnt.exe195⤵
-
\??\c:\3vvvp.exec:\3vvvp.exe196⤵
-
\??\c:\pvpdv.exec:\pvpdv.exe197⤵
-
\??\c:\xxflrxf.exec:\xxflrxf.exe198⤵
-
\??\c:\bhnbnb.exec:\bhnbnb.exe199⤵
-
\??\c:\5tnnnt.exec:\5tnnnt.exe200⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe201⤵
-
\??\c:\rllrrrr.exec:\rllrrrr.exe202⤵
-
\??\c:\tbhbhb.exec:\tbhbhb.exe203⤵
-
\??\c:\pvddj.exec:\pvddj.exe204⤵
-
\??\c:\xxlrxff.exec:\xxlrxff.exe205⤵
-
\??\c:\thtbhh.exec:\thtbhh.exe206⤵
-
\??\c:\vdjvd.exec:\vdjvd.exe207⤵
-
\??\c:\btbbbn.exec:\btbbbn.exe208⤵
-
\??\c:\3pdvv.exec:\3pdvv.exe209⤵
-
\??\c:\xfrxlxx.exec:\xfrxlxx.exe210⤵
-
\??\c:\flxrfrx.exec:\flxrfrx.exe211⤵
-
\??\c:\bnbhnb.exec:\bnbhnb.exe212⤵
-
\??\c:\vjvpd.exec:\vjvpd.exe213⤵
-
\??\c:\xfrllll.exec:\xfrllll.exe214⤵
-
\??\c:\ntbtnn.exec:\ntbtnn.exe215⤵
-
\??\c:\thtnhh.exec:\thtnhh.exe216⤵
-
\??\c:\pvvjj.exec:\pvvjj.exe217⤵
-
\??\c:\rflllrr.exec:\rflllrr.exe218⤵
-
\??\c:\ntnbhn.exec:\ntnbhn.exe219⤵
-
\??\c:\bnhtnt.exec:\bnhtnt.exe220⤵
-
\??\c:\vpvvd.exec:\vpvvd.exe221⤵
-
\??\c:\rfxlxlf.exec:\rfxlxlf.exe222⤵
-
\??\c:\fffflrx.exec:\fffflrx.exe223⤵
-
\??\c:\hnbhhn.exec:\hnbhhn.exe224⤵
-
\??\c:\7pjdd.exec:\7pjdd.exe225⤵
-
\??\c:\1rfxxfr.exec:\1rfxxfr.exe226⤵
-
\??\c:\ttnhbt.exec:\ttnhbt.exe227⤵
-
\??\c:\ttnbnh.exec:\ttnbnh.exe228⤵
-
\??\c:\jpdjv.exec:\jpdjv.exe229⤵
-
\??\c:\9rflffl.exec:\9rflffl.exe230⤵
-
\??\c:\5tnnnt.exec:\5tnnnt.exe231⤵
-
\??\c:\nhbntb.exec:\nhbntb.exe232⤵
-
\??\c:\dvvjv.exec:\dvvjv.exe233⤵
-
\??\c:\xrflrff.exec:\xrflrff.exe234⤵
-
\??\c:\frrrlrl.exec:\frrrlrl.exe235⤵
-
\??\c:\9hbnhh.exec:\9hbnhh.exe236⤵
-
\??\c:\tnhhbt.exec:\tnhhbt.exe237⤵
-
\??\c:\jjddd.exec:\jjddd.exe238⤵
-
\??\c:\5rffxxx.exec:\5rffxxx.exe239⤵
-
\??\c:\xfrxxxf.exec:\xfrxxxf.exe240⤵
-
\??\c:\bbnntt.exec:\bbnntt.exe241⤵