Analysis
-
max time kernel
136s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2023 06:18
Behavioral task
behavioral1
Sample
NEAS.9fea6ec3d434a41e312eba4efa232740.exe
Resource
win7-20231023-en
General
-
Target
NEAS.9fea6ec3d434a41e312eba4efa232740.exe
-
Size
80KB
-
MD5
9fea6ec3d434a41e312eba4efa232740
-
SHA1
41360ae5d2393719e78c38674cc07993e1c53484
-
SHA256
4466b8453e9c1325a915d0de60f79850630e97ba5ef93ecb0863e1daa488f62e
-
SHA512
d7e54072aa6d567b202403207490b30aafe3214d25f6e613b695865b8f4e6d0031bdec4ff0cf84379d4cfefee12e581343c4abdea9fc34583589151b76988149
-
SSDEEP
1536:FvQBeOGtrYS3srx93UBWfwC6Ggnouy87mSSDLum+WV9iOQeWPCyOzxoi0ELGewuV:FhOmTsF93UYfwC6GIout7DSHt+S9Ie51
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4080-7-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3932-9-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2892-15-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2336-22-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2108-31-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3900-39-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4232-47-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3852-37-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3844-52-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5032-57-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2476-67-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4700-72-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4716-80-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4456-93-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3544-101-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1576-106-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3580-114-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1916-111-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3908-125-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2896-123-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1164-133-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3460-143-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2244-148-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2828-158-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2576-165-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3036-154-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4088-183-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4272-189-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/524-193-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4444-198-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4960-208-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/468-211-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4332-214-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1792-217-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4760-252-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4344-262-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3928-270-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3548-280-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4476-290-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2176-300-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2132-307-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4572-314-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/116-325-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2684-351-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1544-360-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2304-362-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/828-382-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1576-389-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2308-406-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4740-430-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1992-451-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4396-463-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2916-480-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1592-525-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4748-556-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4396-589-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5012-644-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1488-711-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/312-746-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2656-786-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/228-945-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1812-952-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2672-957-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
Malware Backdoor - Berbew 64 IoCs
Berbew is a malware infection classified as a 'backdoor' Trojan. This malicious program's primary function is to cause chain infections - it can download/install additional malware such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/4080-0-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/memory/4080-7-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e48-4.dat family_berbew behavioral2/memory/3932-9-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e49-10.dat family_berbew behavioral2/files/0x0006000000022e49-11.dat family_berbew behavioral2/files/0x0006000000022e48-3.dat family_berbew behavioral2/memory/3932-5-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4b-12.dat family_berbew behavioral2/files/0x0006000000022e4b-14.dat family_berbew behavioral2/files/0x0006000000022e4b-16.dat family_berbew behavioral2/memory/2336-17-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/memory/2892-15-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4c-20.dat family_berbew behavioral2/memory/2336-22-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4c-21.dat family_berbew behavioral2/files/0x0006000000022e4d-25.dat family_berbew behavioral2/files/0x0006000000022e4d-27.dat family_berbew behavioral2/files/0x0006000000022e4e-30.dat family_berbew behavioral2/memory/2108-31-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e4e-32.dat family_berbew behavioral2/files/0x0006000000022e4f-36.dat family_berbew behavioral2/files/0x0006000000022e4f-35.dat family_berbew behavioral2/memory/3900-39-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e50-42.dat family_berbew behavioral2/files/0x0006000000022e51-48.dat family_berbew behavioral2/memory/4232-47-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e50-41.dat family_berbew behavioral2/memory/3852-37-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e51-49.dat family_berbew behavioral2/memory/3844-52-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e52-53.dat family_berbew behavioral2/files/0x0006000000022e52-54.dat family_berbew behavioral2/memory/5032-57-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e53-59.dat family_berbew behavioral2/files/0x0006000000022e53-58.dat family_berbew behavioral2/memory/2476-67-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0007000000022e45-64.dat family_berbew behavioral2/files/0x0006000000022e54-70.dat family_berbew behavioral2/memory/4700-72-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e54-69.dat family_berbew behavioral2/files/0x0006000000022e55-74.dat family_berbew behavioral2/files/0x0006000000022e55-75.dat family_berbew behavioral2/files/0x0007000000022e45-62.dat family_berbew behavioral2/files/0x0006000000022e56-81.dat family_berbew behavioral2/memory/4716-80-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e56-79.dat family_berbew behavioral2/files/0x0006000000022e57-85.dat family_berbew behavioral2/files/0x0006000000022e57-86.dat family_berbew behavioral2/files/0x0006000000022e58-90.dat family_berbew behavioral2/memory/4456-93-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e59-96.dat family_berbew behavioral2/files/0x0006000000022e58-89.dat family_berbew behavioral2/files/0x0006000000022e59-97.dat family_berbew behavioral2/files/0x0006000000022e5a-100.dat family_berbew behavioral2/memory/3544-101-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e5a-102.dat family_berbew behavioral2/files/0x0006000000022e5b-105.dat family_berbew behavioral2/memory/1576-106-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew behavioral2/files/0x0006000000022e5b-107.dat family_berbew behavioral2/files/0x0006000000022e5d-110.dat family_berbew behavioral2/files/0x0006000000022e5d-112.dat family_berbew behavioral2/files/0x0006000000022e5e-116.dat family_berbew behavioral2/memory/3580-114-0x0000000000400000-0x0000000000437000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3932 631x875.exe 2892 x8m51jh.exe 2336 j713fu.exe 4788 t2aa3.exe 2108 8mckk.exe 3852 1se737.exe 3900 sutiaee.exe 4232 11w95.exe 3844 h3755c.exe 5032 025bh.exe 1356 4p0h025.exe 2476 r0g76c1.exe 4700 3q9cl6c.exe 4716 km6qiqi.exe 4912 elqgx.exe 3364 t8j76cr.exe 4456 qml8h5.exe 3544 t1331.exe 1576 7t1st.exe 1916 2bvkq.exe 3580 75gk1k.exe 2896 07rb667.exe 3908 b4osf3.exe 1164 5f754o.exe 3756 52iko37.exe 3460 gm14wmw.exe 2244 2sqaco1.exe 3036 jcpjd2.exe 2828 l0n54m5.exe 2576 t552d.exe 4432 sx62a.exe 4076 d8p56q7.exe 1128 f51537.exe 3568 oc73331.exe 4088 l72ch.exe 4272 ei59319.exe 524 1391392.exe 4444 q67gb7g.exe 4148 f0u96us.exe 5096 09cn18w.exe 4960 843q55e.exe 468 m371771.exe 4332 3ll0oa.exe 1792 79e01.exe 3900 tbvb8.exe 1928 cwm2i3i.exe 2144 poci3rs.exe 3324 f18x1.exe 4256 28l7o1.exe 1140 iw5595.exe 4020 vx9h7.exe 1880 oi2p85.exe 4316 s1q47k.exe 3180 01di37.exe 812 sqe9e9.exe 4760 ksoggk.exe 4104 f98w74.exe 1508 ux77319.exe 4344 6977771.exe 4768 85ojm.exe 3928 59mam30.exe 3028 99oqw1q.exe 3548 8m19q.exe 628 td81m1.exe -
resource yara_rule behavioral2/memory/4080-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4080-7-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e48-4.dat upx behavioral2/memory/3932-9-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e49-10.dat upx behavioral2/files/0x0006000000022e49-11.dat upx behavioral2/files/0x0006000000022e48-3.dat upx behavioral2/memory/3932-5-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e4b-12.dat upx behavioral2/files/0x0006000000022e4b-14.dat upx behavioral2/files/0x0006000000022e4b-16.dat upx behavioral2/memory/2336-17-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2892-15-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e4c-20.dat upx behavioral2/memory/2336-22-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e4c-21.dat upx behavioral2/files/0x0006000000022e4d-25.dat upx behavioral2/files/0x0006000000022e4d-27.dat upx behavioral2/files/0x0006000000022e4e-30.dat upx behavioral2/memory/2108-31-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e4e-32.dat upx behavioral2/files/0x0006000000022e4f-36.dat upx behavioral2/files/0x0006000000022e4f-35.dat upx behavioral2/memory/3900-39-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e50-42.dat upx behavioral2/files/0x0006000000022e51-48.dat upx behavioral2/memory/4232-47-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e50-41.dat upx behavioral2/memory/3852-37-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e51-49.dat upx behavioral2/memory/3844-52-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e52-53.dat upx behavioral2/files/0x0006000000022e52-54.dat upx behavioral2/memory/5032-57-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e53-59.dat upx behavioral2/files/0x0006000000022e53-58.dat upx behavioral2/memory/2476-67-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000022e45-64.dat upx behavioral2/files/0x0006000000022e54-70.dat upx behavioral2/memory/4700-72-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e54-69.dat upx behavioral2/files/0x0006000000022e55-74.dat upx behavioral2/files/0x0006000000022e55-75.dat upx behavioral2/files/0x0007000000022e45-62.dat upx behavioral2/files/0x0006000000022e56-81.dat upx behavioral2/memory/4716-80-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e56-79.dat upx behavioral2/files/0x0006000000022e57-85.dat upx behavioral2/files/0x0006000000022e57-86.dat upx behavioral2/files/0x0006000000022e58-90.dat upx behavioral2/memory/4456-93-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e59-96.dat upx behavioral2/files/0x0006000000022e58-89.dat upx behavioral2/files/0x0006000000022e59-97.dat upx behavioral2/files/0x0006000000022e5a-100.dat upx behavioral2/memory/3544-101-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e5a-102.dat upx behavioral2/files/0x0006000000022e5b-105.dat upx behavioral2/memory/1576-106-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0006000000022e5b-107.dat upx behavioral2/files/0x0006000000022e5d-110.dat upx behavioral2/files/0x0006000000022e5d-112.dat upx behavioral2/files/0x0006000000022e5e-116.dat upx behavioral2/memory/3580-114-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4080 wrote to memory of 3932 4080 NEAS.9fea6ec3d434a41e312eba4efa232740.exe 88 PID 4080 wrote to memory of 3932 4080 NEAS.9fea6ec3d434a41e312eba4efa232740.exe 88 PID 4080 wrote to memory of 3932 4080 NEAS.9fea6ec3d434a41e312eba4efa232740.exe 88 PID 3932 wrote to memory of 2892 3932 631x875.exe 89 PID 3932 wrote to memory of 2892 3932 631x875.exe 89 PID 3932 wrote to memory of 2892 3932 631x875.exe 89 PID 2892 wrote to memory of 2336 2892 x8m51jh.exe 90 PID 2892 wrote to memory of 2336 2892 x8m51jh.exe 90 PID 2892 wrote to memory of 2336 2892 x8m51jh.exe 90 PID 2336 wrote to memory of 4788 2336 j713fu.exe 91 PID 2336 wrote to memory of 4788 2336 j713fu.exe 91 PID 2336 wrote to memory of 4788 2336 j713fu.exe 91 PID 4788 wrote to memory of 2108 4788 t2aa3.exe 92 PID 4788 wrote to memory of 2108 4788 t2aa3.exe 92 PID 4788 wrote to memory of 2108 4788 t2aa3.exe 92 PID 2108 wrote to memory of 3852 2108 8mckk.exe 93 PID 2108 wrote to memory of 3852 2108 8mckk.exe 93 PID 2108 wrote to memory of 3852 2108 8mckk.exe 93 PID 3852 wrote to memory of 3900 3852 1se737.exe 94 PID 3852 wrote to memory of 3900 3852 1se737.exe 94 PID 3852 wrote to memory of 3900 3852 1se737.exe 94 PID 3900 wrote to memory of 4232 3900 sutiaee.exe 95 PID 3900 wrote to memory of 4232 3900 sutiaee.exe 95 PID 3900 wrote to memory of 4232 3900 sutiaee.exe 95 PID 4232 wrote to memory of 3844 4232 11w95.exe 96 PID 4232 wrote to memory of 3844 4232 11w95.exe 96 PID 4232 wrote to memory of 3844 4232 11w95.exe 96 PID 3844 wrote to memory of 5032 3844 h3755c.exe 97 PID 3844 wrote to memory of 5032 3844 h3755c.exe 97 PID 3844 wrote to memory of 5032 3844 h3755c.exe 97 PID 5032 wrote to memory of 1356 5032 025bh.exe 98 PID 5032 wrote to memory of 1356 5032 025bh.exe 98 PID 5032 wrote to memory of 1356 5032 025bh.exe 98 PID 1356 wrote to memory of 2476 1356 4p0h025.exe 99 PID 1356 wrote to memory of 2476 1356 4p0h025.exe 99 PID 1356 wrote to memory of 2476 1356 4p0h025.exe 99 PID 2476 wrote to memory of 4700 2476 r0g76c1.exe 100 PID 2476 wrote to memory of 4700 2476 r0g76c1.exe 100 PID 2476 wrote to memory of 4700 2476 r0g76c1.exe 100 PID 4700 wrote to memory of 4716 4700 3q9cl6c.exe 101 PID 4700 wrote to memory of 4716 4700 3q9cl6c.exe 101 PID 4700 wrote to memory of 4716 4700 3q9cl6c.exe 101 PID 4716 wrote to memory of 4912 4716 km6qiqi.exe 102 PID 4716 wrote to memory of 4912 4716 km6qiqi.exe 102 PID 4716 wrote to memory of 4912 4716 km6qiqi.exe 102 PID 4912 wrote to memory of 3364 4912 elqgx.exe 103 PID 4912 wrote to memory of 3364 4912 elqgx.exe 103 PID 4912 wrote to memory of 3364 4912 elqgx.exe 103 PID 3364 wrote to memory of 4456 3364 t8j76cr.exe 104 PID 3364 wrote to memory of 4456 3364 t8j76cr.exe 104 PID 3364 wrote to memory of 4456 3364 t8j76cr.exe 104 PID 4456 wrote to memory of 3544 4456 qml8h5.exe 105 PID 4456 wrote to memory of 3544 4456 qml8h5.exe 105 PID 4456 wrote to memory of 3544 4456 qml8h5.exe 105 PID 3544 wrote to memory of 1576 3544 t1331.exe 107 PID 3544 wrote to memory of 1576 3544 t1331.exe 107 PID 3544 wrote to memory of 1576 3544 t1331.exe 107 PID 1576 wrote to memory of 1916 1576 7t1st.exe 108 PID 1576 wrote to memory of 1916 1576 7t1st.exe 108 PID 1576 wrote to memory of 1916 1576 7t1st.exe 108 PID 1916 wrote to memory of 3580 1916 2bvkq.exe 109 PID 1916 wrote to memory of 3580 1916 2bvkq.exe 109 PID 1916 wrote to memory of 3580 1916 2bvkq.exe 109 PID 3580 wrote to memory of 2896 3580 75gk1k.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9fea6ec3d434a41e312eba4efa232740.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9fea6ec3d434a41e312eba4efa232740.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\631x875.exec:\631x875.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\x8m51jh.exec:\x8m51jh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\j713fu.exec:\j713fu.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\t2aa3.exec:\t2aa3.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\8mckk.exec:\8mckk.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\1se737.exec:\1se737.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\sutiaee.exec:\sutiaee.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\11w95.exec:\11w95.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\h3755c.exec:\h3755c.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\025bh.exec:\025bh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\4p0h025.exec:\4p0h025.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\r0g76c1.exec:\r0g76c1.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\3q9cl6c.exec:\3q9cl6c.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\km6qiqi.exec:\km6qiqi.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\elqgx.exec:\elqgx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\t8j76cr.exec:\t8j76cr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\qml8h5.exec:\qml8h5.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\t1331.exec:\t1331.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\7t1st.exec:\7t1st.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\2bvkq.exec:\2bvkq.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\75gk1k.exec:\75gk1k.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\07rb667.exec:\07rb667.exe23⤵
- Executes dropped EXE
PID:2896 -
\??\c:\b4osf3.exec:\b4osf3.exe24⤵
- Executes dropped EXE
PID:3908 -
\??\c:\5f754o.exec:\5f754o.exe25⤵
- Executes dropped EXE
PID:1164 -
\??\c:\52iko37.exec:\52iko37.exe26⤵
- Executes dropped EXE
PID:3756 -
\??\c:\gm14wmw.exec:\gm14wmw.exe27⤵
- Executes dropped EXE
PID:3460 -
\??\c:\2sqaco1.exec:\2sqaco1.exe28⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jcpjd2.exec:\jcpjd2.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\l0n54m5.exec:\l0n54m5.exe30⤵
- Executes dropped EXE
PID:2828 -
\??\c:\t552d.exec:\t552d.exe31⤵
- Executes dropped EXE
PID:2576
-
-
-
\??\c:\0567x1.exec:\0567x1.exe30⤵PID:4736
-
\??\c:\ddboc0m.exec:\ddboc0m.exe31⤵PID:1076
-
\??\c:\655555g.exec:\655555g.exe32⤵PID:4248
-
\??\c:\3oieu.exec:\3oieu.exe33⤵PID:3924
-
\??\c:\6q70w38.exec:\6q70w38.exe34⤵PID:2888
-
\??\c:\91wfu4.exec:\91wfu4.exe35⤵PID:4264
-
\??\c:\maaes.exec:\maaes.exe36⤵PID:4432
-
\??\c:\461ns4m.exec:\461ns4m.exe37⤵PID:4748
-
\??\c:\08cgmeu.exec:\08cgmeu.exe38⤵PID:4176
-
\??\c:\6p0n4.exec:\6p0n4.exe39⤵PID:4168
-
\??\c:\652t2.exec:\652t2.exe40⤵PID:1512
-
\??\c:\v2akmes.exec:\v2akmes.exe41⤵PID:2992
-
\??\c:\x33wt1m.exec:\x33wt1m.exe42⤵PID:516
-
\??\c:\u2e70.exec:\u2e70.exe43⤵PID:2108
-
\??\c:\25w7w50.exec:\25w7w50.exe44⤵PID:512
-
\??\c:\n689g.exec:\n689g.exe45⤵PID:2484
-
\??\c:\497cj8.exec:\497cj8.exe46⤵PID:228
-
\??\c:\5475975.exec:\5475975.exe47⤵PID:2240
-
\??\c:\7ce25b8.exec:\7ce25b8.exe48⤵PID:1812
-
\??\c:\gm8p7d.exec:\gm8p7d.exe49⤵PID:2672
-
\??\c:\ddxo0.exec:\ddxo0.exe50⤵PID:4220
-
\??\c:\4f159.exec:\4f159.exe51⤵PID:4440
-
\??\c:\316o55.exec:\316o55.exe52⤵PID:3824
-
\??\c:\194i45.exec:\194i45.exe53⤵PID:3976
-
\??\c:\5ps47v.exec:\5ps47v.exe54⤵PID:4316
-
\??\c:\ov70w.exec:\ov70w.exe55⤵PID:3808
-
\??\c:\4v17sh.exec:\4v17sh.exe56⤵PID:4104
-
\??\c:\b5t579a.exec:\b5t579a.exe57⤵PID:3588
-
\??\c:\csv5wi.exec:\csv5wi.exe58⤵PID:1176
-
\??\c:\va53737.exec:\va53737.exe59⤵PID:1988
-
\??\c:\kc795.exec:\kc795.exe60⤵PID:1388
-
\??\c:\96575mk.exec:\96575mk.exe61⤵PID:3572
-
\??\c:\ua76i.exec:\ua76i.exe62⤵PID:1460
-
\??\c:\kk70t.exec:\kk70t.exe63⤵PID:2716
-
\??\c:\im1117q.exec:\im1117q.exe64⤵PID:392
-
\??\c:\lj0ew.exec:\lj0ew.exe65⤵PID:3036
-
\??\c:\e538q.exec:\e538q.exe66⤵PID:4480
-
\??\c:\uov13.exec:\uov13.exe67⤵PID:2412
-
\??\c:\124b57.exec:\124b57.exe68⤵PID:1616
-
\??\c:\xkh50a.exec:\xkh50a.exe69⤵PID:1128
-
\??\c:\13ngp99.exec:\13ngp99.exe70⤵PID:2176
-
\??\c:\g69v5.exec:\g69v5.exe71⤵PID:2480
-
\??\c:\2iai38.exec:\2iai38.exe72⤵PID:4088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\ai195.exec:\ai195.exe51⤵PID:848
-
\??\c:\kqe7qn.exec:\kqe7qn.exe52⤵PID:1212
-
\??\c:\ue1aun.exec:\ue1aun.exe53⤵PID:4828
-
\??\c:\77geeu.exec:\77geeu.exe54⤵PID:3976
-
\??\c:\43mse.exec:\43mse.exe55⤵PID:4104
-
\??\c:\138j2r.exec:\138j2r.exe56⤵PID:1424
-
\??\c:\xu91ei1.exec:\xu91ei1.exe57⤵PID:4768
-
\??\c:\27sr3q3.exec:\27sr3q3.exe58⤵PID:552
-
\??\c:\x65n8r.exec:\x65n8r.exe59⤵PID:2768
-
\??\c:\9r6h0x.exec:\9r6h0x.exe60⤵PID:3908
-
\??\c:\on52w5.exec:\on52w5.exe61⤵PID:2224
-
\??\c:\7dm74.exec:\7dm74.exe62⤵PID:4848
-
\??\c:\4g3751.exec:\4g3751.exe63⤵PID:2216
-
\??\c:\x12r98.exec:\x12r98.exe64⤵PID:3036
-
\??\c:\hp59595.exec:\hp59595.exe65⤵PID:5016
-
\??\c:\n8h0h8r.exec:\n8h0h8r.exe66⤵PID:1860
-
\??\c:\x70g3s.exec:\x70g3s.exe67⤵PID:692
-
\??\c:\qqmos73.exec:\qqmos73.exe68⤵PID:4080
-
\??\c:\as5531.exec:\as5531.exe69⤵PID:2888
-
\??\c:\94x7muw.exec:\94x7muw.exe70⤵PID:4432
-
\??\c:\37egq.exec:\37egq.exe71⤵PID:2480
-
\??\c:\25mdom.exec:\25mdom.exe72⤵PID:4908
-
\??\c:\kcc7gv5.exec:\kcc7gv5.exe73⤵PID:2288
-
\??\c:\sc56m56.exec:\sc56m56.exe74⤵PID:3252
-
\??\c:\p74u35.exec:\p74u35.exe75⤵PID:2780
-
\??\c:\p59gq99.exec:\p59gq99.exe76⤵PID:2552
-
\??\c:\c0an10m.exec:\c0an10m.exe77⤵PID:3676
-
\??\c:\71995uj.exec:\71995uj.exe78⤵PID:220
-
\??\c:\1j9217.exec:\1j9217.exe79⤵PID:1320
-
\??\c:\g2u9o.exec:\g2u9o.exe80⤵PID:3816
-
\??\c:\3394kn7.exec:\3394kn7.exe81⤵PID:228
-
\??\c:\374ij.exec:\374ij.exe82⤵PID:1392
-
\??\c:\ms36a.exec:\ms36a.exe83⤵PID:4680
-
\??\c:\qe11qr7.exec:\qe11qr7.exe84⤵PID:4112
-
\??\c:\ftj8h2q.exec:\ftj8h2q.exe85⤵PID:2876
-
\??\c:\heu54.exec:\heu54.exe86⤵PID:3388
-
\??\c:\815dl.exec:\815dl.exe87⤵PID:2672
-
\??\c:\3gdpa.exec:\3gdpa.exe88⤵PID:4204
-
\??\c:\5241bd6.exec:\5241bd6.exe89⤵PID:4704
-
\??\c:\9275i.exec:\9275i.exe90⤵PID:848
-
\??\c:\ms941.exec:\ms941.exe91⤵PID:3824
-
\??\c:\217wooc.exec:\217wooc.exe92⤵PID:4760
-
\??\c:\4n5139r.exec:\4n5139r.exe93⤵PID:2724
-
\??\c:\qicq15.exec:\qicq15.exe94⤵PID:1364
-
\??\c:\42oesi.exec:\42oesi.exe95⤵PID:2896
-
\??\c:\e18t4.exec:\e18t4.exe96⤵PID:2212
-
\??\c:\36w1f99.exec:\36w1f99.exe97⤵PID:1388
-
\??\c:\woiuko.exec:\woiuko.exe98⤵PID:1372
-
\??\c:\km8c5wx.exec:\km8c5wx.exe99⤵PID:3908
-
\??\c:\331wm1.exec:\331wm1.exe100⤵PID:1600
-
\??\c:\g1ur1.exec:\g1ur1.exe101⤵PID:392
-
\??\c:\oex0c.exec:\oex0c.exe102⤵PID:808
-
\??\c:\wk5311.exec:\wk5311.exe103⤵PID:2216
-
\??\c:\8gsf9.exec:\8gsf9.exe104⤵PID:2076
-
\??\c:\0n2o997.exec:\0n2o997.exe105⤵PID:4056
-
\??\c:\2n1gh3.exec:\2n1gh3.exe106⤵PID:2412
-
\??\c:\kd98ge.exec:\kd98ge.exe107⤵PID:3872
-
\??\c:\333399m.exec:\333399m.exe108⤵PID:1856
-
\??\c:\ss37919.exec:\ss37919.exe109⤵PID:4276
-
\??\c:\rk999.exec:\rk999.exe110⤵PID:4088
-
\??\c:\cd75ab.exec:\cd75ab.exe111⤵PID:1368
-
\??\c:\2n9is.exec:\2n9is.exe112⤵PID:4896
-
\??\c:\uo817.exec:\uo817.exe113⤵PID:1652
-
\??\c:\uv199.exec:\uv199.exe114⤵PID:1340
-
\??\c:\0k94u.exec:\0k94u.exe115⤵PID:3236
-
\??\c:\god37.exec:\god37.exe116⤵PID:3040
-
\??\c:\5n78gh3.exec:\5n78gh3.exe117⤵PID:1804
-
\??\c:\vb90sj7.exec:\vb90sj7.exe118⤵PID:4396
-
\??\c:\h5qq10.exec:\h5qq10.exe119⤵PID:3460
-
\??\c:\l1o77a.exec:\l1o77a.exe120⤵PID:2816
-
\??\c:\gc937.exec:\gc937.exe121⤵PID:1928
-
\??\c:\ne4w8.exec:\ne4w8.exe122⤵PID:3488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-