Analysis
-
max time kernel
152s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
01/10/2023, 13:42
Behavioral task
behavioral1
Sample
d3557d117f370c036a0d7077fd5b05f4_JC.exe
Resource
win7-20230831-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
d3557d117f370c036a0d7077fd5b05f4_JC.exe
Resource
win10v2004-20230915-en
5 signatures
150 seconds
General
-
Target
d3557d117f370c036a0d7077fd5b05f4_JC.exe
-
Size
60KB
-
MD5
d3557d117f370c036a0d7077fd5b05f4
-
SHA1
6920be03da740a9cff1f974552ca7496c162634b
-
SHA256
9768b6f246789c699eb41016446c4ef1350c080661b68d359a18b2a234dcdbe1
-
SHA512
f5b4f7050f6877f4579cab8f1446897be7ff8f630800271f385002e2eaae33347922654e7fca67ad937b870578d425d1944a9416a59f5d48c5c09d768df58758
-
SSDEEP
768:jMcnFXakkGtWrA9HOdTaXXA+uYx7IXd562Re9tW5q:jMMkGUA5OdTaXX176BZq
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2044 skybot.exe 2620 skybot.exe 2792 skybot.exe 3064 skybot.exe 3060 skybot.exe 2552 skybot.exe 2680 skybot.exe 2516 skybot.exe 2560 skybot.exe 2128 skybot.exe 2988 skybot.exe 2984 skybot.exe 2136 skybot.exe 2832 skybot.exe 1936 skybot.exe 1160 skybot.exe 2828 skybot.exe 2820 skybot.exe 752 skybot.exe 1496 skybot.exe 1688 skybot.exe 2916 skybot.exe 1272 skybot.exe 1592 skybot.exe 2300 skybot.exe 2464 skybot.exe 1332 skybot.exe 1328 skybot.exe 2108 skybot.exe 2244 skybot.exe 2472 skybot.exe 1276 skybot.exe 2084 skybot.exe 2216 skybot.exe 1796 skybot.exe 1784 skybot.exe 1088 skybot.exe 1080 skybot.exe 1140 skybot.exe 1912 skybot.exe 2060 skybot.exe 1564 skybot.exe 804 skybot.exe 744 skybot.exe 1952 skybot.exe 2416 skybot.exe 892 skybot.exe 716 skybot.exe 1560 skybot.exe 1892 skybot.exe 1376 skybot.exe 2124 skybot.exe 2040 skybot.exe 3056 skybot.exe 1312 skybot.exe 1820 skybot.exe 1068 skybot.exe 1968 skybot.exe 1608 skybot.exe 1584 skybot.exe 2364 skybot.exe 2624 skybot.exe 2608 skybot.exe 3068 skybot.exe -
Loads dropped DLL 64 IoCs
pid Process 2208 d3557d117f370c036a0d7077fd5b05f4_JC.exe 2208 d3557d117f370c036a0d7077fd5b05f4_JC.exe 2044 skybot.exe 2044 skybot.exe 2620 skybot.exe 2620 skybot.exe 2792 skybot.exe 2792 skybot.exe 3064 skybot.exe 3064 skybot.exe 3060 skybot.exe 3060 skybot.exe 2552 skybot.exe 2552 skybot.exe 2680 skybot.exe 2680 skybot.exe 2516 skybot.exe 2516 skybot.exe 2560 skybot.exe 2560 skybot.exe 2128 skybot.exe 2128 skybot.exe 2988 skybot.exe 2988 skybot.exe 2984 skybot.exe 2984 skybot.exe 2136 skybot.exe 2136 skybot.exe 2832 skybot.exe 2832 skybot.exe 1936 skybot.exe 1936 skybot.exe 1160 skybot.exe 1160 skybot.exe 2828 skybot.exe 2828 skybot.exe 2820 skybot.exe 2820 skybot.exe 752 skybot.exe 752 skybot.exe 1496 skybot.exe 1496 skybot.exe 1688 skybot.exe 1688 skybot.exe 2916 skybot.exe 2916 skybot.exe 1272 skybot.exe 1272 skybot.exe 1592 skybot.exe 1592 skybot.exe 2300 skybot.exe 2300 skybot.exe 2464 skybot.exe 2464 skybot.exe 1332 skybot.exe 1332 skybot.exe 1328 skybot.exe 1328 skybot.exe 2108 skybot.exe 2108 skybot.exe 2244 skybot.exe 2244 skybot.exe 2472 skybot.exe 2472 skybot.exe -
resource yara_rule behavioral1/memory/2208-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2208-5-0x0000000000220000-0x0000000000230000-memory.dmp upx behavioral1/files/0x0009000000012021-4.dat upx behavioral1/files/0x0009000000012021-14.dat upx behavioral1/memory/2620-19-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-22.dat upx behavioral1/files/0x0009000000012021-21.dat upx behavioral1/memory/2620-24-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2620-23-0x0000000000320000-0x0000000000330000-memory.dmp upx behavioral1/files/0x0009000000012021-26.dat upx behavioral1/files/0x0009000000012021-29.dat upx behavioral1/memory/2792-28-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-27.dat upx behavioral1/files/0x0009000000012021-20.dat upx behavioral1/memory/2044-15-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-13.dat upx behavioral1/files/0x0009000000012021-18.dat upx behavioral1/files/0x0009000000012021-17.dat upx behavioral1/files/0x0009000000012021-16.dat upx behavioral1/memory/2208-11-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-8.dat upx behavioral1/files/0x0009000000012021-7.dat upx behavioral1/files/0x0009000000012021-30.dat upx behavioral1/files/0x0009000000012021-31.dat upx behavioral1/files/0x0009000000012021-36.dat upx behavioral1/memory/3060-34-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-37.dat upx behavioral1/files/0x0009000000012021-33.dat upx behavioral1/memory/3064-32-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-35.dat upx behavioral1/memory/3060-40-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2552-39-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-42.dat upx behavioral1/files/0x0009000000012021-41.dat upx behavioral1/memory/2680-45-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-52.dat upx behavioral1/files/0x0009000000012021-51.dat upx behavioral1/memory/2516-50-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-53.dat upx behavioral1/files/0x0009000000012021-49.dat upx behavioral1/files/0x0009000000012021-44.dat upx behavioral1/memory/2552-43-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-48.dat upx behavioral1/files/0x0009000000012021-47.dat upx behavioral1/files/0x0009000000012021-46.dat upx behavioral1/memory/2560-54-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-56.dat upx behavioral1/files/0x0009000000012021-55.dat upx behavioral1/files/0x0009000000012021-57.dat upx behavioral1/files/0x0009000000012021-58.dat upx behavioral1/memory/2128-59-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-61.dat upx behavioral1/files/0x0009000000012021-63.dat upx behavioral1/memory/2984-66-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-67.dat upx behavioral1/files/0x0009000000012021-65.dat upx behavioral1/memory/2988-64-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-62.dat upx behavioral1/memory/2128-60-0x00000000002B0000-0x00000000002C0000-memory.dmp upx behavioral1/files/0x0009000000012021-68.dat upx behavioral1/memory/2984-69-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000012021-70.dat upx behavioral1/files/0x0009000000012021-71.dat upx behavioral1/memory/2136-73-0x0000000000400000-0x0000000000410000-memory.dmp upx -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "\\skybot.exe" skybot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS SYSTEM = "skybot.exe" skybot.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe Process not Found File created C:\Windows\SysWOW64\skybot.exe Process not Found File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe Process not Found File created C:\Windows\SysWOW64\skybot.exe Process not Found File created C:\Windows\SysWOW64\skybot.exe Process not Found File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe Process not Found File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe Process not Found File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe Process not Found File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe File created C:\Windows\SysWOW64\skybot.exe skybot.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2044 2208 d3557d117f370c036a0d7077fd5b05f4_JC.exe 28 PID 2208 wrote to memory of 2044 2208 d3557d117f370c036a0d7077fd5b05f4_JC.exe 28 PID 2208 wrote to memory of 2044 2208 d3557d117f370c036a0d7077fd5b05f4_JC.exe 28 PID 2208 wrote to memory of 2044 2208 d3557d117f370c036a0d7077fd5b05f4_JC.exe 28 PID 2044 wrote to memory of 2620 2044 skybot.exe 31 PID 2044 wrote to memory of 2620 2044 skybot.exe 31 PID 2044 wrote to memory of 2620 2044 skybot.exe 31 PID 2044 wrote to memory of 2620 2044 skybot.exe 31 PID 2620 wrote to memory of 2792 2620 skybot.exe 30 PID 2620 wrote to memory of 2792 2620 skybot.exe 30 PID 2620 wrote to memory of 2792 2620 skybot.exe 30 PID 2620 wrote to memory of 2792 2620 skybot.exe 30 PID 2792 wrote to memory of 3064 2792 skybot.exe 29 PID 2792 wrote to memory of 3064 2792 skybot.exe 29 PID 2792 wrote to memory of 3064 2792 skybot.exe 29 PID 2792 wrote to memory of 3064 2792 skybot.exe 29 PID 3064 wrote to memory of 3060 3064 skybot.exe 32 PID 3064 wrote to memory of 3060 3064 skybot.exe 32 PID 3064 wrote to memory of 3060 3064 skybot.exe 32 PID 3064 wrote to memory of 3060 3064 skybot.exe 32 PID 3060 wrote to memory of 2552 3060 skybot.exe 33 PID 3060 wrote to memory of 2552 3060 skybot.exe 33 PID 3060 wrote to memory of 2552 3060 skybot.exe 33 PID 3060 wrote to memory of 2552 3060 skybot.exe 33 PID 2552 wrote to memory of 2680 2552 skybot.exe 34 PID 2552 wrote to memory of 2680 2552 skybot.exe 34 PID 2552 wrote to memory of 2680 2552 skybot.exe 34 PID 2552 wrote to memory of 2680 2552 skybot.exe 34 PID 2680 wrote to memory of 2516 2680 skybot.exe 37 PID 2680 wrote to memory of 2516 2680 skybot.exe 37 PID 2680 wrote to memory of 2516 2680 skybot.exe 37 PID 2680 wrote to memory of 2516 2680 skybot.exe 37 PID 2516 wrote to memory of 2560 2516 skybot.exe 36 PID 2516 wrote to memory of 2560 2516 skybot.exe 36 PID 2516 wrote to memory of 2560 2516 skybot.exe 36 PID 2516 wrote to memory of 2560 2516 skybot.exe 36 PID 2560 wrote to memory of 2128 2560 skybot.exe 35 PID 2560 wrote to memory of 2128 2560 skybot.exe 35 PID 2560 wrote to memory of 2128 2560 skybot.exe 35 PID 2560 wrote to memory of 2128 2560 skybot.exe 35 PID 2128 wrote to memory of 2988 2128 skybot.exe 38 PID 2128 wrote to memory of 2988 2128 skybot.exe 38 PID 2128 wrote to memory of 2988 2128 skybot.exe 38 PID 2128 wrote to memory of 2988 2128 skybot.exe 38 PID 2988 wrote to memory of 2984 2988 skybot.exe 39 PID 2988 wrote to memory of 2984 2988 skybot.exe 39 PID 2988 wrote to memory of 2984 2988 skybot.exe 39 PID 2988 wrote to memory of 2984 2988 skybot.exe 39 PID 2984 wrote to memory of 2136 2984 skybot.exe 40 PID 2984 wrote to memory of 2136 2984 skybot.exe 40 PID 2984 wrote to memory of 2136 2984 skybot.exe 40 PID 2984 wrote to memory of 2136 2984 skybot.exe 40 PID 2136 wrote to memory of 2832 2136 skybot.exe 41 PID 2136 wrote to memory of 2832 2136 skybot.exe 41 PID 2136 wrote to memory of 2832 2136 skybot.exe 41 PID 2136 wrote to memory of 2832 2136 skybot.exe 41 PID 2832 wrote to memory of 1936 2832 skybot.exe 42 PID 2832 wrote to memory of 1936 2832 skybot.exe 42 PID 2832 wrote to memory of 1936 2832 skybot.exe 42 PID 2832 wrote to memory of 1936 2832 skybot.exe 42 PID 1936 wrote to memory of 1160 1936 skybot.exe 43 PID 1936 wrote to memory of 1160 1936 skybot.exe 43 PID 1936 wrote to memory of 1160 1936 skybot.exe 43 PID 1936 wrote to memory of 1160 1936 skybot.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3557d117f370c036a0d7077fd5b05f4_JC.exe"C:\Users\Admin\AppData\Local\Temp\d3557d117f370c036a0d7077fd5b05f4_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2516
-
-
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2792
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:1160 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:2820 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:752 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244
-
-
-
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵
- Executes dropped EXE
PID:1276 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵
- Executes dropped EXE
PID:2084 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe4⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe5⤵
- Executes dropped EXE
PID:1796 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe6⤵
- Executes dropped EXE
PID:1784 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe7⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe8⤵
- Executes dropped EXE
PID:1080 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe9⤵
- Executes dropped EXE
PID:1140 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe10⤵
- Executes dropped EXE
PID:1912 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe11⤵
- Executes dropped EXE
PID:2060 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe12⤵
- Executes dropped EXE
PID:1564 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe13⤵
- Executes dropped EXE
- Adds Run key to start application
PID:804 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe14⤵
- Executes dropped EXE
PID:744 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe15⤵
- Executes dropped EXE
PID:1952 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe16⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2416 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe17⤵
- Executes dropped EXE
- Adds Run key to start application
PID:892 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe18⤵
- Executes dropped EXE
PID:716 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe19⤵
- Executes dropped EXE
PID:1560 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe20⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe21⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1376 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe22⤵
- Executes dropped EXE
PID:2124 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe23⤵
- Executes dropped EXE
PID:2040 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe24⤵
- Executes dropped EXE
PID:3056 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe25⤵
- Executes dropped EXE
PID:1312 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe26⤵
- Executes dropped EXE
PID:1820 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe27⤵
- Executes dropped EXE
PID:1068 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe28⤵
- Executes dropped EXE
PID:1968 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe29⤵
- Executes dropped EXE
PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵
- Executes dropped EXE
PID:1584 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2364 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵
- Executes dropped EXE
PID:2624 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe4⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe5⤵
- Executes dropped EXE
PID:3068 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe6⤵PID:2852
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe7⤵
- Drops file in System32 directory
PID:2648 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe8⤵PID:2288
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe9⤵
- Drops file in System32 directory
PID:2544 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe10⤵PID:2788
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe11⤵
- Adds Run key to start application
PID:2812 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe12⤵PID:2684
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe13⤵PID:2528
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe14⤵PID:2536
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe15⤵PID:1692
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe16⤵PID:2144
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe17⤵PID:1860
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe18⤵PID:2996
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe19⤵
- Drops file in System32 directory
PID:2968 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe20⤵
- Drops file in System32 directory
PID:3016 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe21⤵PID:2756
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe22⤵PID:2912
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe23⤵
- Drops file in System32 directory
PID:2872 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe24⤵
- Drops file in System32 directory
PID:556 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe25⤵PID:1936
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe26⤵PID:2748
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe27⤵PID:2868
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe28⤵
- Drops file in System32 directory
PID:2836 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe29⤵PID:692
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe30⤵
- Drops file in System32 directory
PID:772 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe31⤵PID:748
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe32⤵PID:1256
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe33⤵PID:1476
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe34⤵PID:1688
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe35⤵PID:564
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe36⤵PID:1744
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe37⤵PID:1012
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe38⤵
- Drops file in System32 directory
PID:1660 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe39⤵PID:1764
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe40⤵PID:1732
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe41⤵PID:2704
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe42⤵
- Adds Run key to start application
PID:1328 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe43⤵PID:1904
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe44⤵PID:2280
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe45⤵PID:2096
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe46⤵PID:2084
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe47⤵PID:2104
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe48⤵PID:1920
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe49⤵PID:2088
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe50⤵PID:980
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe51⤵PID:2384
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe52⤵PID:1136
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe53⤵PID:1140
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe54⤵
- Drops file in System32 directory
PID:2072 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe55⤵PID:1384
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe56⤵
- Drops file in System32 directory
PID:1972 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe57⤵PID:2420
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe58⤵PID:2284
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe59⤵PID:1816
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe60⤵PID:1932
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe61⤵PID:860
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe62⤵PID:1372
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe63⤵PID:1700
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe64⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:544 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe65⤵PID:2432
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe66⤵PID:1756
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe67⤵PID:2444
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe68⤵
- Drops file in System32 directory
PID:2040 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe69⤵PID:2600
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe70⤵PID:2252
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe71⤵PID:836
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe72⤵PID:2860
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe73⤵PID:2224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵PID:2036
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵PID:2044
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵
- Drops file in System32 directory
PID:2008 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe4⤵
- Drops file in System32 directory
PID:2776 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe5⤵
- Drops file in System32 directory
PID:2620 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe6⤵PID:2080
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe7⤵PID:2848
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe8⤵PID:2772
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe9⤵PID:2640
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe10⤵PID:2344
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe11⤵PID:2932
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe12⤵PID:2352
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe13⤵PID:2552
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe14⤵PID:2628
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe15⤵PID:2512
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe16⤵PID:2516
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe17⤵PID:2196
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe18⤵
- Adds Run key to start application
PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵PID:2400
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵PID:3012
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵PID:2736
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe4⤵PID:2976
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe5⤵PID:3032
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe6⤵PID:2864
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe7⤵
- Adds Run key to start application
PID:2756 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe8⤵PID:2752
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe9⤵PID:2744
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe10⤵PID:2616
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe11⤵PID:2816
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe12⤵PID:2732
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe13⤵PID:2828
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe14⤵PID:1164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe1⤵PID:1104
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe2⤵PID:1484
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe3⤵
- Drops file in System32 directory
PID:748 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe4⤵PID:976
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe5⤵PID:2712
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe6⤵PID:2916
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe7⤵PID:1272
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe8⤵PID:1016
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe9⤵
- Adds Run key to start application
PID:1012 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe10⤵PID:1660
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe11⤵PID:1764
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe12⤵PID:1332
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe13⤵PID:2476
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe14⤵PID:1776
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe15⤵PID:2220
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe16⤵PID:1056
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe17⤵
- Drops file in System32 directory
PID:1532 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe18⤵PID:2096
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe19⤵PID:1804
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe20⤵PID:2104
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe21⤵PID:1920
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe22⤵PID:2088
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe23⤵PID:440
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe24⤵
- Drops file in System32 directory
PID:2448 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe25⤵PID:1544
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe26⤵PID:1912
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe27⤵PID:272
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe28⤵PID:2488
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe29⤵PID:1236
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe30⤵PID:1952
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe31⤵PID:1948
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe32⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1928 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe33⤵PID:2416
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe34⤵
- Adds Run key to start application
PID:1668 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe35⤵
- Drops file in System32 directory
PID:2020 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe36⤵PID:2596
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe37⤵PID:1892
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe38⤵
- Adds Run key to start application
PID:1652 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe39⤵PID:552
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe40⤵PID:1748
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe41⤵PID:1076
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe42⤵PID:1512
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe43⤵PID:3056
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe44⤵PID:2252
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe45⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:836 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe46⤵PID:1612
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe47⤵PID:2208
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe48⤵PID:2360
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe49⤵PID:1584
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe50⤵PID:1176
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe51⤵
- Drops file in System32 directory
PID:1380 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe52⤵PID:2624
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe53⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe36⤵PID:756
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe37⤵
- Adds Run key to start application
PID:544 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe38⤵PID:1472
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe39⤵PID:108
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe40⤵PID:876
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe41⤵PID:868
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe42⤵PID:2112
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe43⤵PID:1336
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe44⤵
- Adds Run key to start application
PID:2860 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe45⤵PID:836
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe46⤵PID:1616
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe47⤵PID:1648
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe48⤵PID:2044
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe49⤵PID:2776
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe50⤵PID:1072
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe51⤵PID:2624
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe52⤵PID:2920
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe53⤵PID:2640
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe54⤵PID:2676
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe55⤵PID:2344
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe56⤵PID:1632
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe57⤵PID:1380
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe58⤵PID:2656
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe59⤵PID:2532
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe60⤵PID:2552
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe61⤵PID:2652
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe62⤵PID:2540
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe63⤵PID:2636
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe64⤵PID:2568
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe65⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:2560 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe66⤵PID:2128
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe67⤵
- Adds Run key to start application
PID:2308 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe68⤵PID:2996
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe69⤵PID:2984
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe70⤵PID:3028
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe71⤵PID:2864
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe72⤵PID:1696
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe73⤵PID:2840
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe74⤵PID:556
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe75⤵PID:2824
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe76⤵PID:2816
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe77⤵PID:3048
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe78⤵
- Drops file in System32 directory
PID:1160 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe79⤵PID:2836
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe80⤵PID:692
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe81⤵PID:1480
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe82⤵PID:3016
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe83⤵PID:748
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe84⤵PID:1688
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe85⤵PID:976
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe86⤵PID:1740
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe87⤵PID:872
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe88⤵PID:1676
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe89⤵PID:2236
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe90⤵PID:2056
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe91⤵PID:2108
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe92⤵PID:2304
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe93⤵PID:2708
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe94⤵PID:2260
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe95⤵PID:2244
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe96⤵
- Adds Run key to start application
PID:1276 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe97⤵PID:628
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe98⤵PID:1532
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe99⤵
- Adds Run key to start application
PID:2084 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe100⤵PID:2148
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe101⤵PID:1920
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe102⤵
- Drops file in System32 directory
PID:2012 -
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe103⤵PID:2484
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe104⤵PID:1548
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe105⤵PID:828
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe106⤵PID:1912
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe107⤵PID:440
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe108⤵PID:1340
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe109⤵PID:1236
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe110⤵PID:1476
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe111⤵PID:1496
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe112⤵PID:1972
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe113⤵PID:2420
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe114⤵PID:1928
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe115⤵PID:860
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe116⤵PID:892
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe117⤵PID:1560
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe118⤵PID:1132
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe119⤵PID:1700
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe120⤵PID:2432
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe121⤵PID:2124
-
C:\Windows\SysWOW64\skybot.exeC:\Windows\system32\skybot.exe122⤵PID:1472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-