Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe
-
Size
476KB
-
MD5
6308bab32af438b0c71090b1abdd94c0
-
SHA1
a1b8803b66de2bc3ae44edf6794d629e467e47ae
-
SHA256
2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9
-
SHA512
589dd30f485d59dbaeb3217f26f05828aabec9466317822002da7770dab76ae194b3c715c368d5763278cb013fdebcb4adf770189b6c00a5244e9ba15753b9c8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwT+aZKlumArSPBXuGsY:q7Tc2NYHUrAwT+OKomA+5u4
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral1/memory/2936-7-0x0000000001DA0000-0x0000000001E64000-memory.dmp family_blackmoon behavioral1/memory/2256-10-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2084-20-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2972-32-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2084-28-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2728-48-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2904-90-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1488-150-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1868-159-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/764-200-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/828-226-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/852-237-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/768-258-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/308-278-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/308-287-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3028-296-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1572-322-0x0000000000220000-0x00000000002E4000-memory.dmp family_blackmoon behavioral1/memory/2256-328-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2716-351-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2184-369-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2808-368-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2808-367-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2944-385-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2584-384-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1960-407-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1988-427-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2232-433-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1488-439-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2452-451-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2332-457-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/588-475-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2320-481-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/600-487-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/788-493-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1640-511-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3044-523-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1224-541-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1984-547-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1196-2783-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2104-553-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1856-517-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1344-505-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2688-415-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1384-399-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2944-392-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2184-376-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1196-360-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2716-358-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2716-357-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2072-344-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2616-343-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/2256-335-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1572-327-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/768-321-0x0000000001E50000-0x0000000001F14000-memory.dmp family_blackmoon behavioral1/memory/1196-315-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/884-306-0x00000000004D0000-0x0000000000594000-memory.dmp family_blackmoon behavioral1/memory/884-305-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/884-304-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3012-277-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/3012-268-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/768-265-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/768-266-0x0000000001E50000-0x0000000001F14000-memory.dmp family_blackmoon behavioral1/memory/1660-247-0x0000000000400000-0x00000000004C4000-memory.dmp family_blackmoon behavioral1/memory/1660-246-0x0000000001D80000-0x0000000001E44000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1vvdv.exe9hnhbn.exe7lfrfrf.exe5vvjv.exevjppv.exedjjdp.exetttbth.exehbnbnb.exebhbbhh.exepjdjv.exehhbhbt.exepvdpp.exetthnnn.exe9pjvp.exe3xrflff.exexfrflrf.exe1btbhn.exepdvdj.exetthhtn.exe1dvvj.exerlfxrrf.exethnntn.exehnnbtb.exejjjvp.exebbtbth.exeflrrlll.exenttbnt.exedvjpv.exevddpp.exexxxrfrx.exelllffxr.exebtnntn.exennbbnn.exe3lllrxf.exeddppd.exellrllrr.exe5nhtbh.exepvvjv.exehtnbbh.exedpjdv.exepvpdj.exehnnttb.exeddddv.exe9xxxflx.exebbhhtn.exevppjp.exelllfflx.exennnhth.exejjjpd.exe5tthtb.exedpddp.exellflrxl.exe9fxlxlx.exehttbtt.exeffxlrrf.exevddpj.exebnbtbb.exepjdpj.exettthnt.exepvjvd.exevvjdv.exettnthh.exevjvvd.exetbtbbh.exepid process 2256 1vvdv.exe 2084 9hnhbn.exe 2972 7lfrfrf.exe 2728 5vvjv.exe 2636 vjppv.exe 2752 djjdp.exe 2676 tttbth.exe 2508 hbnbnb.exe 2904 bhbbhh.exe 2528 pjdjv.exe 1932 hhbhbt.exe 2572 pvdpp.exe 2000 tthnnn.exe 2232 9pjvp.exe 1488 3xrflff.exe 1868 xfrflrf.exe 2272 1btbhn.exe 2388 pdvdj.exe 2856 tthhtn.exe 764 1dvvj.exe 580 rlfxrrf.exe 828 thnntn.exe 852 hnnbtb.exe 1660 jjjvp.exe 272 bbtbth.exe 768 flrrlll.exe 3012 nttbnt.exe 308 dvjpv.exe 3028 vddpp.exe 884 xxxrfrx.exe 1196 lllffxr.exe 1572 btnntn.exe 2256 nnbbnn.exe 2616 3lllrxf.exe 2072 ddppd.exe 2716 llrllrr.exe 2808 5nhtbh.exe 2184 pvvjv.exe 2584 htnbbh.exe 2944 dpjdv.exe 1384 pvpdj.exe 1960 hnnttb.exe 2688 ddddv.exe 2432 9xxxflx.exe 1988 bbhhtn.exe 2232 vppjp.exe 1488 lllfflx.exe 2556 nnnhth.exe 2452 jjjpd.exe 2332 5tthtb.exe 2860 dpddp.exe 532 llflrxl.exe 588 9fxlxlx.exe 2320 httbtt.exe 600 ffxlrrf.exe 788 vddpj.exe 2092 bnbtbb.exe 1344 pjdpj.exe 1640 ttthnt.exe 1856 pvjvd.exe 3044 vvjdv.exe 2828 ttnthh.exe 1520 vjvvd.exe 1224 tbtbbh.exe -
Processes:
resource yara_rule behavioral1/memory/2936-7-0x0000000001DA0000-0x0000000001E64000-memory.dmp upx behavioral1/memory/2256-10-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2084-20-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2972-32-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2084-28-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2636-50-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2728-48-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2508-79-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2904-90-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2528-100-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2232-138-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1488-150-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1868-159-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/764-200-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/580-209-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/828-219-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/828-226-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/852-237-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/768-258-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/308-287-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3028-296-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1572-317-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2256-328-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2616-336-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2184-369-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2808-368-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2944-385-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2584-384-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1960-400-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1960-407-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1988-427-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2232-433-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2452-451-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2332-457-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/588-475-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2320-481-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/600-487-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/788-493-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1640-511-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3044-523-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1196-2783-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2104-553-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1856-517-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1344-505-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2688-415-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2688-408-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1384-399-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2944-392-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2584-377-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2184-376-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1196-360-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2716-358-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2072-344-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2616-343-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/2256-335-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1572-327-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1196-315-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/884-305-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/884-304-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3028-288-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3012-277-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/3012-268-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/768-265-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/768-266-0x0000000001E50000-0x0000000001F14000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe1vvdv.exe9hnhbn.exe7lfrfrf.exe5vvjv.exevjppv.exedjjdp.exetttbth.exehbnbnb.exebhbbhh.exepjdjv.exehhbhbt.exepvdpp.exetthnnn.exe9pjvp.exe3xrflff.exedescription pid process target process PID 2936 wrote to memory of 2256 2936 2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe nnbbnn.exe PID 2936 wrote to memory of 2256 2936 2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe nnbbnn.exe PID 2936 wrote to memory of 2256 2936 2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe nnbbnn.exe PID 2936 wrote to memory of 2256 2936 2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe nnbbnn.exe PID 2256 wrote to memory of 2084 2256 1vvdv.exe 9bbbhb.exe PID 2256 wrote to memory of 2084 2256 1vvdv.exe 9bbbhb.exe PID 2256 wrote to memory of 2084 2256 1vvdv.exe 9bbbhb.exe PID 2256 wrote to memory of 2084 2256 1vvdv.exe 9bbbhb.exe PID 2084 wrote to memory of 2972 2084 9hnhbn.exe 7lfrfrf.exe PID 2084 wrote to memory of 2972 2084 9hnhbn.exe 7lfrfrf.exe PID 2084 wrote to memory of 2972 2084 9hnhbn.exe 7lfrfrf.exe PID 2084 wrote to memory of 2972 2084 9hnhbn.exe 7lfrfrf.exe PID 2972 wrote to memory of 2728 2972 7lfrfrf.exe nnhnth.exe PID 2972 wrote to memory of 2728 2972 7lfrfrf.exe nnhnth.exe PID 2972 wrote to memory of 2728 2972 7lfrfrf.exe nnhnth.exe PID 2972 wrote to memory of 2728 2972 7lfrfrf.exe nnhnth.exe PID 2728 wrote to memory of 2636 2728 5vvjv.exe vjppv.exe PID 2728 wrote to memory of 2636 2728 5vvjv.exe vjppv.exe PID 2728 wrote to memory of 2636 2728 5vvjv.exe vjppv.exe PID 2728 wrote to memory of 2636 2728 5vvjv.exe vjppv.exe PID 2636 wrote to memory of 2752 2636 vjppv.exe djjdp.exe PID 2636 wrote to memory of 2752 2636 vjppv.exe djjdp.exe PID 2636 wrote to memory of 2752 2636 vjppv.exe djjdp.exe PID 2636 wrote to memory of 2752 2636 vjppv.exe djjdp.exe PID 2752 wrote to memory of 2676 2752 djjdp.exe hnnthn.exe PID 2752 wrote to memory of 2676 2752 djjdp.exe hnnthn.exe PID 2752 wrote to memory of 2676 2752 djjdp.exe hnnthn.exe PID 2752 wrote to memory of 2676 2752 djjdp.exe hnnthn.exe PID 2676 wrote to memory of 2508 2676 tttbth.exe hbnbnb.exe PID 2676 wrote to memory of 2508 2676 tttbth.exe hbnbnb.exe PID 2676 wrote to memory of 2508 2676 tttbth.exe hbnbnb.exe PID 2676 wrote to memory of 2508 2676 tttbth.exe hbnbnb.exe PID 2508 wrote to memory of 2904 2508 hbnbnb.exe bhbbhh.exe PID 2508 wrote to memory of 2904 2508 hbnbnb.exe bhbbhh.exe PID 2508 wrote to memory of 2904 2508 hbnbnb.exe bhbbhh.exe PID 2508 wrote to memory of 2904 2508 hbnbnb.exe bhbbhh.exe PID 2904 wrote to memory of 2528 2904 bhbbhh.exe pjdjv.exe PID 2904 wrote to memory of 2528 2904 bhbbhh.exe pjdjv.exe PID 2904 wrote to memory of 2528 2904 bhbbhh.exe pjdjv.exe PID 2904 wrote to memory of 2528 2904 bhbbhh.exe pjdjv.exe PID 2528 wrote to memory of 1932 2528 pjdjv.exe hhbhbt.exe PID 2528 wrote to memory of 1932 2528 pjdjv.exe hhbhbt.exe PID 2528 wrote to memory of 1932 2528 pjdjv.exe hhbhbt.exe PID 2528 wrote to memory of 1932 2528 pjdjv.exe hhbhbt.exe PID 1932 wrote to memory of 2572 1932 hhbhbt.exe pvdpp.exe PID 1932 wrote to memory of 2572 1932 hhbhbt.exe pvdpp.exe PID 1932 wrote to memory of 2572 1932 hhbhbt.exe pvdpp.exe PID 1932 wrote to memory of 2572 1932 hhbhbt.exe pvdpp.exe PID 2572 wrote to memory of 2000 2572 pvdpp.exe tthnnn.exe PID 2572 wrote to memory of 2000 2572 pvdpp.exe tthnnn.exe PID 2572 wrote to memory of 2000 2572 pvdpp.exe tthnnn.exe PID 2572 wrote to memory of 2000 2572 pvdpp.exe tthnnn.exe PID 2000 wrote to memory of 2232 2000 tthnnn.exe 9pjvp.exe PID 2000 wrote to memory of 2232 2000 tthnnn.exe 9pjvp.exe PID 2000 wrote to memory of 2232 2000 tthnnn.exe 9pjvp.exe PID 2000 wrote to memory of 2232 2000 tthnnn.exe 9pjvp.exe PID 2232 wrote to memory of 1488 2232 9pjvp.exe lllfflx.exe PID 2232 wrote to memory of 1488 2232 9pjvp.exe lllfflx.exe PID 2232 wrote to memory of 1488 2232 9pjvp.exe lllfflx.exe PID 2232 wrote to memory of 1488 2232 9pjvp.exe lllfflx.exe PID 1488 wrote to memory of 1868 1488 3xrflff.exe xfrflrf.exe PID 1488 wrote to memory of 1868 1488 3xrflff.exe xfrflrf.exe PID 1488 wrote to memory of 1868 1488 3xrflff.exe xfrflrf.exe PID 1488 wrote to memory of 1868 1488 3xrflff.exe xfrflrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2768556ff2fe01a160d69cdc02e90917c7a0299aacfeab7a04cbe5b398a3e2b9_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\1vvdv.exec:\1vvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9hnhbn.exec:\9hnhbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lfrfrf.exec:\7lfrfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vvjv.exec:\5vvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjppv.exec:\vjppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\djjdp.exec:\djjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tttbth.exec:\tttbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnbnb.exec:\hbnbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bhbbhh.exec:\bhbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pjdjv.exec:\pjdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbhbt.exec:\hhbhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvdpp.exec:\pvdpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tthnnn.exec:\tthnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\9pjvp.exec:\9pjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3xrflff.exec:\3xrflff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfrflrf.exec:\xfrflrf.exe17⤵
- Executes dropped EXE
-
\??\c:\1btbhn.exec:\1btbhn.exe18⤵
- Executes dropped EXE
-
\??\c:\pdvdj.exec:\pdvdj.exe19⤵
- Executes dropped EXE
-
\??\c:\tthhtn.exec:\tthhtn.exe20⤵
- Executes dropped EXE
-
\??\c:\1dvvj.exec:\1dvvj.exe21⤵
- Executes dropped EXE
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe22⤵
- Executes dropped EXE
-
\??\c:\thnntn.exec:\thnntn.exe23⤵
- Executes dropped EXE
-
\??\c:\hnnbtb.exec:\hnnbtb.exe24⤵
- Executes dropped EXE
-
\??\c:\jjjvp.exec:\jjjvp.exe25⤵
- Executes dropped EXE
-
\??\c:\bbtbth.exec:\bbtbth.exe26⤵
- Executes dropped EXE
-
\??\c:\flrrlll.exec:\flrrlll.exe27⤵
- Executes dropped EXE
-
\??\c:\nttbnt.exec:\nttbnt.exe28⤵
- Executes dropped EXE
-
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
-
\??\c:\vddpp.exec:\vddpp.exe30⤵
- Executes dropped EXE
-
\??\c:\xxxrfrx.exec:\xxxrfrx.exe31⤵
- Executes dropped EXE
-
\??\c:\lllffxr.exec:\lllffxr.exe32⤵
- Executes dropped EXE
-
\??\c:\btnntn.exec:\btnntn.exe33⤵
- Executes dropped EXE
-
\??\c:\nnbbnn.exec:\nnbbnn.exe34⤵
- Executes dropped EXE
-
\??\c:\3lllrxf.exec:\3lllrxf.exe35⤵
- Executes dropped EXE
-
\??\c:\ddppd.exec:\ddppd.exe36⤵
- Executes dropped EXE
-
\??\c:\llrllrr.exec:\llrllrr.exe37⤵
- Executes dropped EXE
-
\??\c:\5nhtbh.exec:\5nhtbh.exe38⤵
- Executes dropped EXE
-
\??\c:\pvvjv.exec:\pvvjv.exe39⤵
- Executes dropped EXE
-
\??\c:\htnbbh.exec:\htnbbh.exe40⤵
- Executes dropped EXE
-
\??\c:\dpjdv.exec:\dpjdv.exe41⤵
- Executes dropped EXE
-
\??\c:\pvpdj.exec:\pvpdj.exe42⤵
- Executes dropped EXE
-
\??\c:\hnnttb.exec:\hnnttb.exe43⤵
- Executes dropped EXE
-
\??\c:\ddddv.exec:\ddddv.exe44⤵
- Executes dropped EXE
-
\??\c:\9xxxflx.exec:\9xxxflx.exe45⤵
- Executes dropped EXE
-
\??\c:\bbhhtn.exec:\bbhhtn.exe46⤵
- Executes dropped EXE
-
\??\c:\vppjp.exec:\vppjp.exe47⤵
- Executes dropped EXE
-
\??\c:\lllfflx.exec:\lllfflx.exe48⤵
- Executes dropped EXE
-
\??\c:\nnnhth.exec:\nnnhth.exe49⤵
- Executes dropped EXE
-
\??\c:\jjjpd.exec:\jjjpd.exe50⤵
- Executes dropped EXE
-
\??\c:\5tthtb.exec:\5tthtb.exe51⤵
- Executes dropped EXE
-
\??\c:\dpddp.exec:\dpddp.exe52⤵
- Executes dropped EXE
-
\??\c:\llflrxl.exec:\llflrxl.exe53⤵
- Executes dropped EXE
-
\??\c:\9fxlxlx.exec:\9fxlxlx.exe54⤵
- Executes dropped EXE
-
\??\c:\httbtt.exec:\httbtt.exe55⤵
- Executes dropped EXE
-
\??\c:\ffxlrrf.exec:\ffxlrrf.exe56⤵
- Executes dropped EXE
-
\??\c:\vddpj.exec:\vddpj.exe57⤵
- Executes dropped EXE
-
\??\c:\bnbtbb.exec:\bnbtbb.exe58⤵
- Executes dropped EXE
-
\??\c:\pjdpj.exec:\pjdpj.exe59⤵
- Executes dropped EXE
-
\??\c:\ttthnt.exec:\ttthnt.exe60⤵
- Executes dropped EXE
-
\??\c:\pvjvd.exec:\pvjvd.exe61⤵
- Executes dropped EXE
-
\??\c:\vvjdv.exec:\vvjdv.exe62⤵
- Executes dropped EXE
-
\??\c:\ttnthh.exec:\ttnthh.exe63⤵
- Executes dropped EXE
-
\??\c:\vjvvd.exec:\vjvvd.exe64⤵
- Executes dropped EXE
-
\??\c:\tbtbbh.exec:\tbtbbh.exe65⤵
- Executes dropped EXE
-
\??\c:\nhtthh.exec:\nhtthh.exe66⤵
-
\??\c:\vvpdd.exec:\vvpdd.exe67⤵
-
\??\c:\htnhht.exec:\htnhht.exe68⤵
-
\??\c:\pvjpv.exec:\pvjpv.exe69⤵
-
\??\c:\nthnbh.exec:\nthnbh.exe70⤵
-
\??\c:\vpdvd.exec:\vpdvd.exe71⤵
-
\??\c:\rrlxxfl.exec:\rrlxxfl.exe72⤵
-
\??\c:\pvpjj.exec:\pvpjj.exe73⤵
-
\??\c:\7xlrlfx.exec:\7xlrlfx.exe74⤵
-
\??\c:\tbntbh.exec:\tbntbh.exe75⤵
-
\??\c:\djvjd.exec:\djvjd.exe76⤵
-
\??\c:\lrrfxfr.exec:\lrrfxfr.exe77⤵
-
\??\c:\5nnhhb.exec:\5nnhhb.exe78⤵
-
\??\c:\pppvj.exec:\pppvj.exe79⤵
-
\??\c:\rlfllxl.exec:\rlfllxl.exe80⤵
-
\??\c:\lfxlxlx.exec:\lfxlxlx.exe81⤵
-
\??\c:\jjdjv.exec:\jjdjv.exe82⤵
-
\??\c:\lrxrrlf.exec:\lrxrrlf.exe83⤵
-
\??\c:\fxrfffx.exec:\fxrfffx.exe84⤵
-
\??\c:\nnnbnt.exec:\nnnbnt.exe85⤵
-
\??\c:\pppvp.exec:\pppvp.exe86⤵
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe87⤵
-
\??\c:\7hbntb.exec:\7hbntb.exe88⤵
-
\??\c:\nhnbht.exec:\nhnbht.exe89⤵
-
\??\c:\vvpdv.exec:\vvpdv.exe90⤵
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe91⤵
-
\??\c:\thnbth.exec:\thnbth.exe92⤵
-
\??\c:\vvjjv.exec:\vvjjv.exe93⤵
-
\??\c:\3rlrxxl.exec:\3rlrxxl.exe94⤵
-
\??\c:\rrrxrlr.exec:\rrrxrlr.exe95⤵
-
\??\c:\hnhnhb.exec:\hnhnhb.exe96⤵
-
\??\c:\dpjvj.exec:\dpjvj.exe97⤵
-
\??\c:\lxrfrxr.exec:\lxrfrxr.exe98⤵
-
\??\c:\tbbnhn.exec:\tbbnhn.exe99⤵
-
\??\c:\pdppv.exec:\pdppv.exe100⤵
-
\??\c:\3jdvp.exec:\3jdvp.exe101⤵
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe102⤵
-
\??\c:\nttttn.exec:\nttttn.exe103⤵
-
\??\c:\9dpjv.exec:\9dpjv.exe104⤵
-
\??\c:\3flffxx.exec:\3flffxx.exe105⤵
-
\??\c:\frffxfx.exec:\frffxfx.exe106⤵
-
\??\c:\ntnnth.exec:\ntnnth.exe107⤵
-
\??\c:\djdjd.exec:\djdjd.exe108⤵
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe109⤵
-
\??\c:\ffxlllr.exec:\ffxlllr.exe110⤵
-
\??\c:\tbhhhh.exec:\tbhhhh.exe111⤵
-
\??\c:\vvpvd.exec:\vvpvd.exe112⤵
-
\??\c:\pvpjp.exec:\pvpjp.exe113⤵
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe114⤵
-
\??\c:\nnhnth.exec:\nnhnth.exe115⤵
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe116⤵
-
\??\c:\3hhbbh.exec:\3hhbbh.exe117⤵
-
\??\c:\pvjjp.exec:\pvjjp.exe118⤵
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe119⤵
-
\??\c:\nbthnt.exec:\nbthnt.exe120⤵
-
\??\c:\djpdd.exec:\djpdd.exe121⤵
-
\??\c:\vdvjd.exec:\vdvjd.exe122⤵
-
\??\c:\ttnttb.exec:\ttnttb.exe123⤵
-
\??\c:\pjpdv.exec:\pjpdv.exe124⤵
-
\??\c:\vvdvj.exec:\vvdvj.exe125⤵
-
\??\c:\xrlxfrx.exec:\xrlxfrx.exe126⤵
-
\??\c:\nntttn.exec:\nntttn.exe127⤵
-
\??\c:\jjjjj.exec:\jjjjj.exe128⤵
-
\??\c:\vpjpv.exec:\vpjpv.exe129⤵
-
\??\c:\rxxrlxx.exec:\rxxrlxx.exe130⤵
-
\??\c:\thtnbb.exec:\thtnbb.exe131⤵
-
\??\c:\ddvpd.exec:\ddvpd.exe132⤵
-
\??\c:\dpddj.exec:\dpddj.exe133⤵
-
\??\c:\rlfrlxf.exec:\rlfrlxf.exe134⤵
-
\??\c:\tbbntb.exec:\tbbntb.exe135⤵
-
\??\c:\vdjpv.exec:\vdjpv.exe136⤵
-
\??\c:\lllfxxl.exec:\lllfxxl.exe137⤵
-
\??\c:\xfxfxlx.exec:\xfxfxlx.exe138⤵
-
\??\c:\hhntnb.exec:\hhntnb.exe139⤵
-
\??\c:\xxrxrrl.exec:\xxrxrrl.exe140⤵
-
\??\c:\flflxfr.exec:\flflxfr.exe141⤵
-
\??\c:\hbtbnt.exec:\hbtbnt.exe142⤵
-
\??\c:\vjddp.exec:\vjddp.exe143⤵
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe144⤵
-
\??\c:\rrrxlrl.exec:\rrrxlrl.exe145⤵
-
\??\c:\hhnbnt.exec:\hhnbnt.exe146⤵
-
\??\c:\vpddv.exec:\vpddv.exe147⤵
-
\??\c:\3rxrrrf.exec:\3rxrrrf.exe148⤵
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe149⤵
-
\??\c:\bnhnbb.exec:\bnhnbb.exe150⤵
-
\??\c:\vjdpv.exec:\vjdpv.exe151⤵
-
\??\c:\lrxfrxf.exec:\lrxfrxf.exe152⤵
-
\??\c:\llxrllf.exec:\llxrllf.exe153⤵
-
\??\c:\bhhnbh.exec:\bhhnbh.exe154⤵
-
\??\c:\djjdp.exec:\djjdp.exe155⤵
-
\??\c:\pdvpv.exec:\pdvpv.exe156⤵
-
\??\c:\flfxrrl.exec:\flfxrrl.exe157⤵
-
\??\c:\bbbttb.exec:\bbbttb.exe158⤵
-
\??\c:\9vvdv.exec:\9vvdv.exe159⤵
-
\??\c:\dddjv.exec:\dddjv.exe160⤵
-
\??\c:\lxllrfl.exec:\lxllrfl.exe161⤵
-
\??\c:\bhbtth.exec:\bhbtth.exe162⤵
-
\??\c:\hbhnbh.exec:\hbhnbh.exe163⤵
-
\??\c:\dppvj.exec:\dppvj.exe164⤵
-
\??\c:\xxrrllf.exec:\xxrrllf.exe165⤵
-
\??\c:\llflrxl.exec:\llflrxl.exe166⤵
-
\??\c:\ttttth.exec:\ttttth.exe167⤵
-
\??\c:\vjddv.exec:\vjddv.exe168⤵
-
\??\c:\rflxxfr.exec:\rflxxfr.exe169⤵
-
\??\c:\lrxxxrx.exec:\lrxxxrx.exe170⤵
-
\??\c:\vvvjj.exec:\vvvjj.exe171⤵
-
\??\c:\1vvpd.exec:\1vvpd.exe172⤵
-
\??\c:\rrxfrxx.exec:\rrxfrxx.exe173⤵
-
\??\c:\bbtntb.exec:\bbtntb.exe174⤵
-
\??\c:\tthnnh.exec:\tthnnh.exe175⤵
-
\??\c:\ppdjd.exec:\ppdjd.exe176⤵
-
\??\c:\llxlflf.exec:\llxlflf.exe177⤵
-
\??\c:\rrrrxfx.exec:\rrrrxfx.exe178⤵
-
\??\c:\3ttbnt.exec:\3ttbnt.exe179⤵
-
\??\c:\bhbhnt.exec:\bhbhnt.exe180⤵
-
\??\c:\dvjjv.exec:\dvjjv.exe181⤵
-
\??\c:\1lflflx.exec:\1lflflx.exe182⤵
-
\??\c:\xfxfxlx.exec:\xfxfxlx.exe183⤵
-
\??\c:\nnhthn.exec:\nnhthn.exe184⤵
-
\??\c:\jpdpv.exec:\jpdpv.exe185⤵
-
\??\c:\5fxrlll.exec:\5fxrlll.exe186⤵
-
\??\c:\5xlllrf.exec:\5xlllrf.exe187⤵
-
\??\c:\tbttnt.exec:\tbttnt.exe188⤵
-
\??\c:\hhbhbb.exec:\hhbhbb.exe189⤵
-
\??\c:\djdvp.exec:\djdvp.exe190⤵
-
\??\c:\ddvdp.exec:\ddvdp.exe191⤵
-
\??\c:\1lxxfrf.exec:\1lxxfrf.exe192⤵
-
\??\c:\hnbnhh.exec:\hnbnhh.exe193⤵
-
\??\c:\3btthn.exec:\3btthn.exe194⤵
-
\??\c:\jpjdp.exec:\jpjdp.exe195⤵
-
\??\c:\vddpj.exec:\vddpj.exe196⤵
-
\??\c:\rxxrrll.exec:\rxxrrll.exe197⤵
-
\??\c:\bnhhtb.exec:\bnhhtb.exe198⤵
-
\??\c:\9pjvd.exec:\9pjvd.exe199⤵
-
\??\c:\dddpp.exec:\dddpp.exe200⤵
-
\??\c:\frlfxfx.exec:\frlfxfx.exe201⤵
-
\??\c:\tbtbbh.exec:\tbtbbh.exe202⤵
-
\??\c:\pppvj.exec:\pppvj.exe203⤵
-
\??\c:\jdjpp.exec:\jdjpp.exe204⤵
-
\??\c:\5xllfrx.exec:\5xllfrx.exe205⤵
-
\??\c:\lrrfflf.exec:\lrrfflf.exe206⤵
-
\??\c:\bhbthn.exec:\bhbthn.exe207⤵
-
\??\c:\pppdp.exec:\pppdp.exe208⤵
-
\??\c:\jppdv.exec:\jppdv.exe209⤵
-
\??\c:\1rlxfrl.exec:\1rlxfrl.exe210⤵
-
\??\c:\hhnhtb.exec:\hhnhtb.exe211⤵
-
\??\c:\ddpvj.exec:\ddpvj.exe212⤵
-
\??\c:\lxfrllr.exec:\lxfrllr.exe213⤵
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe214⤵
-
\??\c:\ttnbtb.exec:\ttnbtb.exe215⤵
-
\??\c:\ddpvd.exec:\ddpvd.exe216⤵
-
\??\c:\dpvdj.exec:\dpvdj.exe217⤵
-
\??\c:\9lrfrfr.exec:\9lrfrfr.exe218⤵
-
\??\c:\bbbthn.exec:\bbbthn.exe219⤵
-
\??\c:\nnbnnt.exec:\nnbnnt.exe220⤵
-
\??\c:\9jjjd.exec:\9jjjd.exe221⤵
-
\??\c:\7rxrrlx.exec:\7rxrrlx.exe222⤵
-
\??\c:\lfxxfrf.exec:\lfxxfrf.exe223⤵
-
\??\c:\nnnhbh.exec:\nnnhbh.exe224⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe225⤵
-
\??\c:\5xrrlxx.exec:\5xrrlxx.exe226⤵
-
\??\c:\xxxrxlx.exec:\xxxrxlx.exe227⤵
-
\??\c:\bbtbnh.exec:\bbtbnh.exe228⤵
-
\??\c:\vvpjp.exec:\vvpjp.exe229⤵
-
\??\c:\xxrxxfl.exec:\xxrxxfl.exe230⤵
-
\??\c:\rffflrr.exec:\rffflrr.exe231⤵
-
\??\c:\7tthth.exec:\7tthth.exe232⤵
-
\??\c:\pvpvv.exec:\pvpvv.exe233⤵
-
\??\c:\jvvvv.exec:\jvvvv.exe234⤵
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe235⤵
-
\??\c:\1thnbh.exec:\1thnbh.exe236⤵
-
\??\c:\ttnhtt.exec:\ttnhtt.exe237⤵
-
\??\c:\vpvdv.exec:\vpvdv.exe238⤵
-
\??\c:\xxrrlfx.exec:\xxrrlfx.exe239⤵
-
\??\c:\ntnnth.exec:\ntnnth.exe240⤵
-
\??\c:\thnhhb.exec:\thnhhb.exe241⤵