Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2023, 21:13
Behavioral task
behavioral1
Sample
NEAS.0d2f3f1fcbf02d37ce64d33f5b883ac0.exe
Resource
win7-20231020-en
General
-
Target
NEAS.0d2f3f1fcbf02d37ce64d33f5b883ac0.exe
-
Size
139KB
-
MD5
0d2f3f1fcbf02d37ce64d33f5b883ac0
-
SHA1
164acdff04fb37e58199b7d21f860c96d87c5a73
-
SHA256
9f219f878235543570578059cb5f40441f0ac64a5590eb99a12167178cf61991
-
SHA512
e219285e78be41b9bab2f00d1c2763a5116ee37e76c5b3788d2ff9400daab454a3d121c3b3cf4081c8c420c55a932f0a52b3aaed20c0d3f5b5bf1bb60269edbf
-
SSDEEP
3072:EhOmTsF93UYfwC6GIoutcEDjmDH6lPqZD2N/67ZWRZWZ1AgkniERT:Ecm4FmowdHoScQmL6l6O/8WOWiERT
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3820-2-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/444-11-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1884-15-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3556-23-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/920-28-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3348-32-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1576-41-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4460-38-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4300-49-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1832-57-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2760-65-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2672-68-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1956-73-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2484-85-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3476-92-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1116-100-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3456-104-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3168-117-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/404-131-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5056-141-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1772-145-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4272-154-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2660-158-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4340-164-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2560-180-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1416-183-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1856-199-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4260-206-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2140-224-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1796-227-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1852-230-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2160-232-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/792-249-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1300-261-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1124-268-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4896-275-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1452-279-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4960-296-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1968-298-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1708-309-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3316-312-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4032-315-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3564-330-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/8-344-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/532-352-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2856-379-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1308-389-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4064-395-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1996-403-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2248-433-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1660-438-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/904-464-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3616-498-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/988-511-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1612-553-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2088-559-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2804-670-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2224-769-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1948-793-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3836-848-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2444-852-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4476-1080-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1844-1092-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4420-1258-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0009000000022d10-4.dat family_berbew behavioral2/files/0x0009000000022d10-5.dat family_berbew behavioral2/files/0x0008000000022d37-10.dat family_berbew behavioral2/files/0x0008000000022d37-12.dat family_berbew behavioral2/files/0x0007000000022d38-14.dat family_berbew behavioral2/files/0x0007000000022d38-17.dat family_berbew behavioral2/files/0x0007000000022d38-19.dat family_berbew behavioral2/files/0x0008000000022d1a-22.dat family_berbew behavioral2/files/0x0008000000022d1a-24.dat family_berbew behavioral2/files/0x0008000000022df1-27.dat family_berbew behavioral2/files/0x0008000000022df1-29.dat family_berbew behavioral2/files/0x0008000000022d1d-34.dat family_berbew behavioral2/files/0x0008000000022d1d-33.dat family_berbew behavioral2/files/0x0008000000022d40-39.dat family_berbew behavioral2/files/0x0007000000022dfd-45.dat family_berbew behavioral2/files/0x0007000000022dfd-44.dat family_berbew behavioral2/files/0x0008000000022d40-37.dat family_berbew behavioral2/files/0x0007000000022e00-48.dat family_berbew behavioral2/files/0x0007000000022e00-50.dat family_berbew behavioral2/files/0x0007000000022e02-53.dat family_berbew behavioral2/files/0x0006000000022e0c-60.dat family_berbew behavioral2/files/0x0007000000022e02-54.dat family_berbew behavioral2/files/0x0006000000022e0c-61.dat family_berbew behavioral2/files/0x0006000000022e0e-66.dat family_berbew behavioral2/files/0x0006000000022e0e-64.dat family_berbew behavioral2/files/0x0006000000022e0f-70.dat family_berbew behavioral2/files/0x0006000000022e0f-72.dat family_berbew behavioral2/files/0x0006000000022e10-77.dat family_berbew behavioral2/files/0x0006000000022e10-79.dat family_berbew behavioral2/files/0x0006000000022e13-84.dat family_berbew behavioral2/files/0x0006000000022e13-82.dat family_berbew behavioral2/files/0x0006000000022e15-90.dat family_berbew behavioral2/files/0x0006000000022e15-88.dat family_berbew behavioral2/files/0x0008000000022e11-94.dat family_berbew behavioral2/files/0x0008000000022e11-96.dat family_berbew behavioral2/files/0x0006000000022e1b-99.dat family_berbew behavioral2/files/0x0006000000022e1b-101.dat family_berbew behavioral2/files/0x0006000000022e1c-105.dat family_berbew behavioral2/files/0x0006000000022e1c-106.dat family_berbew behavioral2/files/0x0006000000022e1d-111.dat family_berbew behavioral2/files/0x0006000000022e1d-109.dat family_berbew behavioral2/files/0x0006000000022e1f-116.dat family_berbew behavioral2/files/0x0006000000022e1f-114.dat family_berbew behavioral2/files/0x0006000000022e24-122.dat family_berbew behavioral2/files/0x0006000000022e24-121.dat family_berbew behavioral2/files/0x0006000000022e26-125.dat family_berbew behavioral2/files/0x0006000000022e26-126.dat family_berbew behavioral2/files/0x0006000000022e29-132.dat family_berbew behavioral2/files/0x0006000000022e29-133.dat family_berbew behavioral2/files/0x0007000000022e20-136.dat family_berbew behavioral2/files/0x0007000000022e20-138.dat family_berbew behavioral2/files/0x0008000000022e22-143.dat family_berbew behavioral2/files/0x0008000000022e22-142.dat family_berbew behavioral2/files/0x0008000000022e23-147.dat family_berbew behavioral2/files/0x0008000000022e23-149.dat family_berbew behavioral2/files/0x0008000000022e25-152.dat family_berbew behavioral2/files/0x0008000000022e25-153.dat family_berbew behavioral2/files/0x0009000000022e28-157.dat family_berbew behavioral2/files/0x0009000000022e28-159.dat family_berbew behavioral2/files/0x0008000000022e2a-162.dat family_berbew behavioral2/files/0x0006000000022e2b-169.dat family_berbew behavioral2/files/0x0006000000022e2b-168.dat family_berbew behavioral2/files/0x0008000000022e2a-163.dat family_berbew behavioral2/files/0x0006000000022e2c-172.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 444 m53xg29.exe 1884 690dlx3.exe 3556 86lbs.exe 920 on8sego.exe 3348 pnn7wuq.exe 4460 85ln7m.exe 1576 7k3c9.exe 4300 0mo60.exe 2140 593765.exe 1832 t30p3.exe 2760 55k1ax1.exe 2672 j8ew1.exe 1956 d115hag.exe 3956 v54qq.exe 2484 xe3779.exe 3476 d05799b.exe 1116 v94d3k.exe 3456 c0273ip.exe 2676 892h1se.exe 3488 n596c3.exe 3168 657f5.exe 3660 vnowpr.exe 404 83f29.exe 2392 4ltu2t.exe 5056 ug5375.exe 1772 qq0k9.exe 4272 kqa65x6.exe 2660 w4g4884.exe 4340 e80dc5.exe 2068 rtoci.exe 648 02471.exe 4252 557px6.exe 2560 7q0dcha.exe 1416 w2v95.exe 3216 v6e4m.exe 1460 961lahc.exe 2368 t3k16.exe 868 6ij5gc.exe 1856 37o5j.exe 2372 c0c43bq.exe 4260 lb3q1.exe 2592 71q23.exe 3160 003175.exe 3480 cwas1.exe 4588 9261w3.exe 2276 hd2xl7.exe 2140 8ho3eee.exe 1796 93rnqx.exe 1852 518hsw.exe 2160 vfj82.exe 1548 0u3s3u9.exe 4872 c198lnw.exe 5024 99usm44.exe 3536 i97gi.exe 792 39h5k.exe 3956 acaw2d1.exe 2248 cod713.exe 4820 8t6wdr.exe 1300 fi3m7.exe 3476 2c5o37.exe 1124 9894j7u.exe 3084 3jjk3q.exe 4896 sk6j9w.exe 1452 qu52p1.exe -
resource yara_rule behavioral2/memory/3820-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3820-2-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0009000000022d10-4.dat upx behavioral2/files/0x0009000000022d10-5.dat upx behavioral2/files/0x0008000000022d37-10.dat upx behavioral2/files/0x0008000000022d37-12.dat upx behavioral2/memory/444-11-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1884-15-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000022d38-14.dat upx behavioral2/files/0x0007000000022d38-17.dat upx behavioral2/files/0x0007000000022d38-19.dat upx behavioral2/files/0x0008000000022d1a-22.dat upx behavioral2/files/0x0008000000022d1a-24.dat upx behavioral2/memory/3556-23-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/920-28-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000022df1-27.dat upx behavioral2/files/0x0008000000022df1-29.dat upx behavioral2/memory/3348-32-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000022d1d-34.dat upx behavioral2/files/0x0008000000022d1d-33.dat upx behavioral2/files/0x0008000000022d40-39.dat upx behavioral2/memory/1576-41-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000022dfd-45.dat upx behavioral2/files/0x0007000000022dfd-44.dat upx behavioral2/memory/4460-38-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000022d40-37.dat upx behavioral2/files/0x0007000000022e00-48.dat upx behavioral2/memory/4300-49-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000022e00-50.dat upx behavioral2/files/0x0007000000022e02-53.dat upx behavioral2/memory/1832-57-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000022e0c-60.dat upx behavioral2/files/0x0007000000022e02-54.dat upx behavioral2/files/0x0006000000022e0c-61.dat upx behavioral2/memory/2760-65-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000022e0e-66.dat upx behavioral2/memory/2672-68-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000022e0e-64.dat upx behavioral2/files/0x0006000000022e0f-70.dat upx behavioral2/memory/1956-73-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000022e0f-72.dat upx behavioral2/files/0x0006000000022e10-77.dat upx behavioral2/files/0x0006000000022e10-79.dat upx behavioral2/files/0x0006000000022e13-84.dat upx behavioral2/files/0x0006000000022e13-82.dat upx behavioral2/memory/2484-85-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000022e15-90.dat upx behavioral2/files/0x0006000000022e15-88.dat upx behavioral2/memory/3476-92-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000022e11-94.dat upx behavioral2/files/0x0008000000022e11-96.dat upx behavioral2/files/0x0006000000022e1b-99.dat upx behavioral2/memory/1116-100-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000022e1b-101.dat upx behavioral2/files/0x0006000000022e1c-105.dat upx behavioral2/memory/3456-104-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000022e1c-106.dat upx behavioral2/files/0x0006000000022e1d-111.dat upx behavioral2/files/0x0006000000022e1d-109.dat upx behavioral2/files/0x0006000000022e1f-116.dat upx behavioral2/files/0x0006000000022e1f-114.dat upx behavioral2/memory/3168-117-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000022e24-122.dat upx behavioral2/files/0x0006000000022e24-121.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3820 wrote to memory of 444 3820 NEAS.0d2f3f1fcbf02d37ce64d33f5b883ac0.exe 88 PID 3820 wrote to memory of 444 3820 NEAS.0d2f3f1fcbf02d37ce64d33f5b883ac0.exe 88 PID 3820 wrote to memory of 444 3820 NEAS.0d2f3f1fcbf02d37ce64d33f5b883ac0.exe 88 PID 444 wrote to memory of 1884 444 m53xg29.exe 89 PID 444 wrote to memory of 1884 444 m53xg29.exe 89 PID 444 wrote to memory of 1884 444 m53xg29.exe 89 PID 1884 wrote to memory of 3556 1884 690dlx3.exe 90 PID 1884 wrote to memory of 3556 1884 690dlx3.exe 90 PID 1884 wrote to memory of 3556 1884 690dlx3.exe 90 PID 3556 wrote to memory of 920 3556 86lbs.exe 91 PID 3556 wrote to memory of 920 3556 86lbs.exe 91 PID 3556 wrote to memory of 920 3556 86lbs.exe 91 PID 920 wrote to memory of 3348 920 on8sego.exe 92 PID 920 wrote to memory of 3348 920 on8sego.exe 92 PID 920 wrote to memory of 3348 920 on8sego.exe 92 PID 3348 wrote to memory of 4460 3348 pnn7wuq.exe 93 PID 3348 wrote to memory of 4460 3348 pnn7wuq.exe 93 PID 3348 wrote to memory of 4460 3348 pnn7wuq.exe 93 PID 4460 wrote to memory of 1576 4460 85ln7m.exe 94 PID 4460 wrote to memory of 1576 4460 85ln7m.exe 94 PID 4460 wrote to memory of 1576 4460 85ln7m.exe 94 PID 1576 wrote to memory of 4300 1576 7k3c9.exe 95 PID 1576 wrote to memory of 4300 1576 7k3c9.exe 95 PID 1576 wrote to memory of 4300 1576 7k3c9.exe 95 PID 4300 wrote to memory of 2140 4300 0mo60.exe 96 PID 4300 wrote to memory of 2140 4300 0mo60.exe 96 PID 4300 wrote to memory of 2140 4300 0mo60.exe 96 PID 2140 wrote to memory of 1832 2140 593765.exe 97 PID 2140 wrote to memory of 1832 2140 593765.exe 97 PID 2140 wrote to memory of 1832 2140 593765.exe 97 PID 1832 wrote to memory of 2760 1832 t30p3.exe 98 PID 1832 wrote to memory of 2760 1832 t30p3.exe 98 PID 1832 wrote to memory of 2760 1832 t30p3.exe 98 PID 2760 wrote to memory of 2672 2760 55k1ax1.exe 99 PID 2760 wrote to memory of 2672 2760 55k1ax1.exe 99 PID 2760 wrote to memory of 2672 2760 55k1ax1.exe 99 PID 2672 wrote to memory of 1956 2672 j8ew1.exe 100 PID 2672 wrote to memory of 1956 2672 j8ew1.exe 100 PID 2672 wrote to memory of 1956 2672 j8ew1.exe 100 PID 1956 wrote to memory of 3956 1956 d115hag.exe 101 PID 1956 wrote to memory of 3956 1956 d115hag.exe 101 PID 1956 wrote to memory of 3956 1956 d115hag.exe 101 PID 3956 wrote to memory of 2484 3956 v54qq.exe 104 PID 3956 wrote to memory of 2484 3956 v54qq.exe 104 PID 3956 wrote to memory of 2484 3956 v54qq.exe 104 PID 2484 wrote to memory of 3476 2484 xe3779.exe 105 PID 2484 wrote to memory of 3476 2484 xe3779.exe 105 PID 2484 wrote to memory of 3476 2484 xe3779.exe 105 PID 3476 wrote to memory of 1116 3476 d05799b.exe 106 PID 3476 wrote to memory of 1116 3476 d05799b.exe 106 PID 3476 wrote to memory of 1116 3476 d05799b.exe 106 PID 1116 wrote to memory of 3456 1116 v94d3k.exe 107 PID 1116 wrote to memory of 3456 1116 v94d3k.exe 107 PID 1116 wrote to memory of 3456 1116 v94d3k.exe 107 PID 3456 wrote to memory of 2676 3456 c0273ip.exe 108 PID 3456 wrote to memory of 2676 3456 c0273ip.exe 108 PID 3456 wrote to memory of 2676 3456 c0273ip.exe 108 PID 2676 wrote to memory of 3488 2676 892h1se.exe 110 PID 2676 wrote to memory of 3488 2676 892h1se.exe 110 PID 2676 wrote to memory of 3488 2676 892h1se.exe 110 PID 3488 wrote to memory of 3168 3488 n596c3.exe 111 PID 3488 wrote to memory of 3168 3488 n596c3.exe 111 PID 3488 wrote to memory of 3168 3488 n596c3.exe 111 PID 3168 wrote to memory of 3660 3168 657f5.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0d2f3f1fcbf02d37ce64d33f5b883ac0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0d2f3f1fcbf02d37ce64d33f5b883ac0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\m53xg29.exec:\m53xg29.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\690dlx3.exec:\690dlx3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\86lbs.exec:\86lbs.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\on8sego.exec:\on8sego.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\pnn7wuq.exec:\pnn7wuq.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\85ln7m.exec:\85ln7m.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\7k3c9.exec:\7k3c9.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\0mo60.exec:\0mo60.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\593765.exec:\593765.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\t30p3.exec:\t30p3.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\55k1ax1.exec:\55k1ax1.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\j8ew1.exec:\j8ew1.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\d115hag.exec:\d115hag.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\v54qq.exec:\v54qq.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\xe3779.exec:\xe3779.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\d05799b.exec:\d05799b.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\v94d3k.exec:\v94d3k.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\c0273ip.exec:\c0273ip.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\892h1se.exec:\892h1se.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\n596c3.exec:\n596c3.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\657f5.exec:\657f5.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\vnowpr.exec:\vnowpr.exe23⤵
- Executes dropped EXE
PID:3660 -
\??\c:\83f29.exec:\83f29.exe24⤵
- Executes dropped EXE
PID:404 -
\??\c:\4ltu2t.exec:\4ltu2t.exe25⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ug5375.exec:\ug5375.exe26⤵
- Executes dropped EXE
PID:5056 -
\??\c:\qq0k9.exec:\qq0k9.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\kqa65x6.exec:\kqa65x6.exe28⤵
- Executes dropped EXE
PID:4272 -
\??\c:\w4g4884.exec:\w4g4884.exe29⤵
- Executes dropped EXE
PID:2660 -
\??\c:\e80dc5.exec:\e80dc5.exe30⤵
- Executes dropped EXE
PID:4340 -
\??\c:\rtoci.exec:\rtoci.exe31⤵
- Executes dropped EXE
PID:2068 -
\??\c:\02471.exec:\02471.exe32⤵
- Executes dropped EXE
PID:648 -
\??\c:\557px6.exec:\557px6.exe33⤵
- Executes dropped EXE
PID:4252 -
\??\c:\7q0dcha.exec:\7q0dcha.exe34⤵
- Executes dropped EXE
PID:2560 -
\??\c:\w2v95.exec:\w2v95.exe35⤵
- Executes dropped EXE
PID:1416 -
\??\c:\v6e4m.exec:\v6e4m.exe36⤵
- Executes dropped EXE
PID:3216 -
\??\c:\961lahc.exec:\961lahc.exe37⤵
- Executes dropped EXE
PID:1460 -
\??\c:\t3k16.exec:\t3k16.exe38⤵
- Executes dropped EXE
PID:2368 -
\??\c:\6ij5gc.exec:\6ij5gc.exe39⤵
- Executes dropped EXE
PID:868 -
\??\c:\37o5j.exec:\37o5j.exe40⤵
- Executes dropped EXE
PID:1856 -
\??\c:\c0c43bq.exec:\c0c43bq.exe41⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lb3q1.exec:\lb3q1.exe42⤵
- Executes dropped EXE
PID:4260 -
\??\c:\71q23.exec:\71q23.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\003175.exec:\003175.exe44⤵
- Executes dropped EXE
PID:3160 -
\??\c:\cwas1.exec:\cwas1.exe45⤵
- Executes dropped EXE
PID:3480 -
\??\c:\9261w3.exec:\9261w3.exe46⤵
- Executes dropped EXE
PID:4588 -
\??\c:\hd2xl7.exec:\hd2xl7.exe47⤵
- Executes dropped EXE
PID:2276 -
\??\c:\8ho3eee.exec:\8ho3eee.exe48⤵
- Executes dropped EXE
PID:2140 -
\??\c:\93rnqx.exec:\93rnqx.exe49⤵
- Executes dropped EXE
PID:1796 -
\??\c:\518hsw.exec:\518hsw.exe50⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vfj82.exec:\vfj82.exe51⤵
- Executes dropped EXE
PID:2160 -
\??\c:\0u3s3u9.exec:\0u3s3u9.exe52⤵
- Executes dropped EXE
PID:1548 -
\??\c:\c198lnw.exec:\c198lnw.exe53⤵
- Executes dropped EXE
PID:4872 -
\??\c:\99usm44.exec:\99usm44.exe54⤵
- Executes dropped EXE
PID:5024 -
\??\c:\i97gi.exec:\i97gi.exe55⤵
- Executes dropped EXE
PID:3536 -
\??\c:\39h5k.exec:\39h5k.exe56⤵
- Executes dropped EXE
PID:792 -
\??\c:\acaw2d1.exec:\acaw2d1.exe57⤵
- Executes dropped EXE
PID:3956 -
\??\c:\cod713.exec:\cod713.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\8t6wdr.exec:\8t6wdr.exe59⤵
- Executes dropped EXE
PID:4820 -
\??\c:\fi3m7.exec:\fi3m7.exe60⤵
- Executes dropped EXE
PID:1300 -
\??\c:\2c5o37.exec:\2c5o37.exe61⤵
- Executes dropped EXE
PID:3476 -
\??\c:\9894j7u.exec:\9894j7u.exe62⤵
- Executes dropped EXE
PID:1124 -
\??\c:\3jjk3q.exec:\3jjk3q.exe63⤵
- Executes dropped EXE
PID:3084 -
\??\c:\sk6j9w.exec:\sk6j9w.exe64⤵
- Executes dropped EXE
PID:4896 -
\??\c:\qu52p1.exec:\qu52p1.exe65⤵
- Executes dropped EXE
PID:1452 -
\??\c:\go34e.exec:\go34e.exe66⤵PID:4700
-
\??\c:\2176xa8.exec:\2176xa8.exe67⤵PID:2676
-
\??\c:\r5cks.exec:\r5cks.exe68⤵PID:1512
-
\??\c:\eo987wj.exec:\eo987wj.exe69⤵PID:2136
-
\??\c:\r58eh.exec:\r58eh.exe70⤵PID:4960
-
\??\c:\n9cao9.exec:\n9cao9.exe71⤵PID:1968
-
\??\c:\kav5w.exec:\kav5w.exe72⤵PID:3068
-
\??\c:\95r39f7.exec:\95r39f7.exe73⤵PID:1708
-
\??\c:\8961k.exec:\8961k.exe74⤵PID:4032
-
\??\c:\63rr2.exec:\63rr2.exe75⤵PID:3316
-
\??\c:\40nr2b6.exec:\40nr2b6.exe76⤵PID:3576
-
\??\c:\2imskme.exec:\2imskme.exe77⤵PID:116
-
\??\c:\t779m3.exec:\t779m3.exe78⤵PID:3836
-
\??\c:\4accsaq.exec:\4accsaq.exe79⤵PID:3564
-
\??\c:\03h3c3.exec:\03h3c3.exe80⤵PID:4448
-
\??\c:\2u3p2.exec:\2u3p2.exe81⤵PID:5104
-
\??\c:\m9o32x.exec:\m9o32x.exe82⤵PID:852
-
\??\c:\33f6tt.exec:\33f6tt.exe83⤵PID:3328
-
\??\c:\c5fv86.exec:\c5fv86.exe84⤵PID:8
-
\??\c:\7j3h0c.exec:\7j3h0c.exe85⤵PID:2264
-
\??\c:\s3xdk.exec:\s3xdk.exe86⤵PID:532
-
\??\c:\7kgif.exec:\7kgif.exe87⤵PID:2364
-
\??\c:\1n7wj0.exec:\1n7wj0.exe88⤵PID:1400
-
\??\c:\ao353.exec:\ao353.exe89⤵PID:2768
-
\??\c:\43e27j.exec:\43e27j.exe90⤵PID:3844
-
\??\c:\78e82.exec:\78e82.exe91⤵PID:1884
-
\??\c:\3im2w2.exec:\3im2w2.exe92⤵PID:2120
-
\??\c:\i7c8u5e.exec:\i7c8u5e.exe93⤵PID:3356
-
\??\c:\0l08h.exec:\0l08h.exe94⤵PID:2856
-
\??\c:\q41u8.exec:\q41u8.exe95⤵PID:3520
-
\??\c:\0nge19n.exec:\0nge19n.exe96⤵PID:3080
-
\??\c:\m91w5p.exec:\m91w5p.exe97⤵PID:5076
-
\??\c:\6isbe27.exec:\6isbe27.exe98⤵PID:1308
-
\??\c:\j6e4i.exec:\j6e4i.exe99⤵PID:4064
-
\??\c:\06p2p41.exec:\06p2p41.exe100⤵PID:1704
-
\??\c:\5cn0q.exec:\5cn0q.exe101⤵PID:2276
-
\??\c:\3f459xu.exec:\3f459xu.exe102⤵PID:1996
-
\??\c:\85fb553.exec:\85fb553.exe103⤵PID:4196
-
\??\c:\8246p3.exec:\8246p3.exe104⤵PID:1176
-
\??\c:\loa2069.exec:\loa2069.exe105⤵PID:4864
-
\??\c:\71m32.exec:\71m32.exe106⤵PID:2900
-
\??\c:\0o820o.exec:\0o820o.exe107⤵PID:4872
-
\??\c:\1u52s.exec:\1u52s.exe108⤵PID:1016
-
\??\c:\6b519.exec:\6b519.exe109⤵PID:2360
-
\??\c:\4gp129.exec:\4gp129.exe110⤵PID:792
-
\??\c:\69ip085.exec:\69ip085.exe111⤵PID:4936
-
\??\c:\66n94.exec:\66n94.exe112⤵PID:2248
-
\??\c:\kq29ko9.exec:\kq29ko9.exe113⤵PID:1660
-
\??\c:\lu8pj.exec:\lu8pj.exe114⤵PID:2296
-
\??\c:\ax0cfg.exec:\ax0cfg.exe115⤵PID:3476
-
\??\c:\mbo60.exec:\mbo60.exe116⤵PID:4904
-
\??\c:\2q9up.exec:\2q9up.exe117⤵PID:3084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\545bh19.exec:\545bh19.exe64⤵PID:4508
-
\??\c:\67j3w.exec:\67j3w.exe65⤵PID:1876
-
\??\c:\4o0mp.exec:\4o0mp.exe66⤵PID:1680
-
\??\c:\6dms87.exec:\6dms87.exe67⤵PID:5020
-
\??\c:\27sg58k.exec:\27sg58k.exe68⤵PID:904
-
\??\c:\va9v92.exec:\va9v92.exe69⤵PID:3660
-
\??\c:\4or9977.exec:\4or9977.exe70⤵PID:3900
-
\??\c:\iqikw.exec:\iqikw.exe71⤵PID:4724
-
\??\c:\jqn1sok.exec:\jqn1sok.exe72⤵PID:3432
-
\??\c:\hf9ae.exec:\hf9ae.exe73⤵PID:4656
-
\??\c:\uup49t.exec:\uup49t.exe74⤵PID:1592
-
\??\c:\3r1d222.exec:\3r1d222.exe75⤵PID:628
-
\??\c:\b1ksw5.exec:\b1ksw5.exe76⤵PID:4856
-
\??\c:\422jq8.exec:\422jq8.exe77⤵PID:1644
-
\??\c:\g64r98.exec:\g64r98.exe78⤵PID:3616
-
\??\c:\91at509.exec:\91at509.exe79⤵PID:4924
-
\??\c:\33ed9o8.exec:\33ed9o8.exe80⤵PID:4272
-
\??\c:\b029cw.exec:\b029cw.exe81⤵PID:408
-
\??\c:\30h043.exec:\30h043.exe82⤵PID:2552
-
\??\c:\7w53c1.exec:\7w53c1.exe83⤵PID:988
-
\??\c:\893h8u.exec:\893h8u.exe84⤵PID:3568
-
\??\c:\f3cr2kb.exec:\f3cr2kb.exe85⤵PID:2068
-
\??\c:\kc1m1.exec:\kc1m1.exe86⤵PID:3856
-
\??\c:\2uj8m.exec:\2uj8m.exe87⤵PID:4956
-
\??\c:\594wr2g.exec:\594wr2g.exe88⤵PID:3028
-
\??\c:\33j5et.exec:\33j5et.exe89⤵PID:2168
-
\??\c:\fv428.exec:\fv428.exe90⤵PID:3472
-
\??\c:\58rv22.exec:\58rv22.exe91⤵PID:5044
-
\??\c:\4f5u5e.exec:\4f5u5e.exe92⤵PID:4368
-
\??\c:\39c4g.exec:\39c4g.exe93⤵PID:3932
-
\??\c:\2g39gb.exec:\2g39gb.exe94⤵PID:1528
-
\??\c:\w4434.exec:\w4434.exe95⤵PID:376
-
\??\c:\1450a7s.exec:\1450a7s.exe96⤵PID:2856
-
\??\c:\8m10mx2.exec:\8m10mx2.exe97⤵PID:1612
-
\??\c:\0s5gw5e.exec:\0s5gw5e.exe98⤵PID:2088
-
\??\c:\2d8e1.exec:\2d8e1.exe99⤵PID:4148
-
\??\c:\9f83tk.exec:\9f83tk.exe100⤵PID:2704
-
\??\c:\43l7s.exec:\43l7s.exe101⤵PID:4064
-
\??\c:\lmimb2.exec:\lmimb2.exe102⤵PID:5108
-
\??\c:\be54w30.exec:\be54w30.exe103⤵PID:1736
-
\??\c:\355k7d5.exec:\355k7d5.exe104⤵PID:1064
-
\??\c:\wrima.exec:\wrima.exe105⤵PID:3668
-
\??\c:\94h395t.exec:\94h395t.exe106⤵PID:2160
-
\??\c:\3p0i4l.exec:\3p0i4l.exe107⤵PID:4664
-
\??\c:\lveki.exec:\lveki.exe108⤵PID:1464
-
\??\c:\265b8p6.exec:\265b8p6.exe109⤵PID:2224
-
\??\c:\19b7r2.exec:\19b7r2.exe110⤵PID:1572
-
\??\c:\7j395.exec:\7j395.exe111⤵PID:388
-
\??\c:\2wpsx2.exec:\2wpsx2.exe112⤵PID:3504
-
\??\c:\3q0l9se.exec:\3q0l9se.exe113⤵PID:3956
-
\??\c:\v4ggako.exec:\v4ggako.exe114⤵PID:4756
-
\??\c:\gp7ql8.exec:\gp7ql8.exe115⤵PID:752
-
\??\c:\5vntj59.exec:\5vntj59.exe116⤵PID:3456
-
\??\c:\q58n30r.exec:\q58n30r.exe117⤵PID:4584
-
\??\c:\72cja1.exec:\72cja1.exe118⤵PID:1928
-
\??\c:\8unc1.exec:\8unc1.exe119⤵PID:1868
-
\??\c:\21r9w15.exec:\21r9w15.exe120⤵PID:4212
-
\??\c:\05qx5.exec:\05qx5.exe121⤵PID:956
-
\??\c:\n0os3.exec:\n0os3.exe122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-