Analysis
- max time kernel
150s - max time network
125s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
10/05/2024, 05:38
Behavioral task
behavioral1
Sample
80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe
- Size 148KB
- Sample240510-gbt5eahd56
- SHA256 7d7965c7d41a259a4e50ca518be8a54e8c8b23f47fe1209b5064a57f2a4e8f6f
- MD5 80cdebd27ff716aa06cdb0356851b510
- SHA1 347d25a4e185da01ea7baf722c14f7201b072463
- SHA512 52cef3f076b36de130c246e7d88c1328492e2a877edfe6d0f353b0e14a58c096ad9b0d2040fcacd2a77783fdeccae5343db26a1cbf34711949dfa89f3a4a8ba8
- SSDEEP 3072:9D0nN7yeSWORQtkdJv5hMFULTvtcMk8Lyji8lkivl05K5i+ITqn:StyeSWORdJRG4GMkSQi8Tvl05K5DIen
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 11 IoCs
resource yara_rule behavioral1/files/0x000d000000014698-6.dat family_gh0strat behavioral1/files/0x00070000000155d4-48.dat family_gh0strat behavioral1/files/0x0006000000016d01-67.dat family_gh0strat behavioral1/files/0x0006000000016d24-89.dat family_gh0strat behavioral1/files/0x0006000000016d41-100.dat family_gh0strat behavioral1/files/0x0006000000016d55-109.dat family_gh0strat behavioral1/files/0x0011000000014e3d-124.dat family_gh0strat behavioral1/files/0x0006000000016e56-141.dat family_gh0strat behavioral1/files/0x0006000000017090-155.dat family_gh0strat behavioral1/files/0x00090000000155e2-62.dat family_gh0strat behavioral1/files/0x002b000000014c67-32.dat family_gh0strat - Modifies Installed Components in the registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{vsmynmds-kjkn-enfc-oedi-ulufqjkshsec}\ = "ϵͳÉèÖÃ" inrbvqwap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{zjnyzdil-dnjy-zmfc-qfyd-qqcypkvbvopm} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{rdjuqnza-w25m-5cu9-hh9l-pbwxjnaxsjge}\stubpath = "C:\\Windows\\System32\\inlsyremh.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ohiqfqcr-rxfi-xucm-vhry-vfrknpachxqv}\stubpath = "C:\\Windows\\System32\\inqvsejsy.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{egenfjjd-wger-syfg-wilo-omvifufsqaau}\stubpath = "C:\\Windows\\System32\\infovkwed.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{faddfzuq-ryey-rxfq-teiw-qvhcnyurnehe}\stubpath = "C:\\Windows\\System32\\injfiqaer.exe" inhpxhdgo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{o95qoek3-2wy8-qkjq-z0qv-l5ti1nu2cbsk}\stubpath = "C:\\Windows\\System32\\inewrcnnk.exe" insjarhdx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{rvnafazs-ynys-epyb-glxf-umqlgcloogmb}\stubpath = "C:\\Windows\\System32\\inqqspmro.exe" inxtemyti.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{l0n85354-clql-1431-7o71-flluak88m147}\ = "ϵͳÉèÖÃ" inczeboin.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{cgujpugg-dsin-hswo-nien-qiodrkhecvea}\stubpath = "C:\\Windows\\System32\\inthxpach.exe" inloiwrfv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{hrtbgped-ljhl-jjwl-khko-gxtmhwlxwrgw}\stubpath = "C:\\Windows\\System32\\inwanaevl.exe" inhlzrduq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{csfkzigk-iivk-ejgo-jntf-slgvkwvqfvqk} inivlaoql.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{h898y5p6-h1dv-gabi-5e2r-m2ueq9myvc59}\ = "ϵͳÉèÖÃ" inqlvmtik.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{96465idm-mk25-258p-2kgm-vbln258u31t5}\stubpath = "C:\\Windows\\System32\\intwamnoz.exe" inupeyqpk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{paeslefn-nuak-qouj-cfmu-juyezvkscouh}\stubpath = "C:\\Windows\\System32\\inomgbvam.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{zwhlzlty-fqxu-jkhl-tgjf-oosfuwieauhy}\ = "ϵͳÉèÖÃ" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{wixdsamx-mtxs-jsvn-iwpm-hmapfnbhmzho} inebmvqfa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{mfg11x55-434h-7jh8-4fb3-3nlg27wc8zr9}\ = "ϵͳÉèÖÃ" inqefczcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{paeslefn-nuak-qouj-cfmu-juyezvkscouh} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{wizdkhsv-ekru-jzzc-htpe-jskooeplawix}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{dtzogpae-lefn-nuak-qouj-cfmurjuyezvk}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{kg8fsq37-h3w4-jywk-4573-5g73n1u93431}\stubpath = "C:\\Windows\\System32\\inmeomnmv.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ejhnrmsl-dhoc-wejs-gwom-ozmmzoinknrx} inulkzdji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{opoaumpp-phgk-whlu-bgqj-flvrzvrlxuij} inhjvjvge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{q2zxoqwe-2dhv-pugb-xtqm-gzho8pchfbbk} inqmksego.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{kvpwqcmv-diua-xnrz-nyzd-lldnjyszmfcz}\stubpath = "C:\\Windows\\System32\\inwbpkebv.exe" inobhqwtt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1hzg904p-xqrs-c8yk-nws2-0s2qmnlyw95v}\stubpath = "C:\\Windows\\System32\\inqybiohu.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{rt2z081y-7z7b-9p7z-oify-jk20v9dv878l}\stubpath = "C:\\Windows\\System32\\inadsfdch.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{j100bi6p-7pl9-ii1l-6c38-95l03953391b}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{tcgpattf-saye-rsdb-orng-wheqmbggphll}\stubpath = "C:\\Windows\\System32\\invxpifca.exe" inpeyhpif.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{aunolpdx-njcs-wdjy-ibce-ldhhbiuecpbq}\stubpath = "C:\\Windows\\System32\\inbxsuoju.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{l3gb262b-30nb-2gig-vhnp-72032voaz7n4} injrhdzvq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{zjl92o4d-dv1m-d4x2-0s7j-82862n2p750l}\stubpath = "C:\\Windows\\System32\\inhomdgwi.exe" infxsuasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{tfh3f968-3n9r-f340-su3c-p0k0sco9q8a3} intvdfifr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{tfh3f968-3n9r-f340-su3c-p0k0sco9q8a3}\ = "ϵͳÉèÖÃ" intvdfifr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{yksxjepw-pgjg-rsfi-ennr-tvhdtgxccydp}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2j28u5ao-pe1g-1kvg-k37o-k0ncvx9aac0o}\ = "ϵͳÉèÖÃ" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{feysilir-ajhs-jsic-tcdt-ogpaeslefncn}\ = "ϵͳÉèÖÃ" inlmosntr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{slefncnu-koqo-jxcf-urju-ezvkscouhyam}\stubpath = "C:\\Windows\\System32\\inaspaeae.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{azenrrdz-lwcw-qbrf-mple-uyfcokdegenf}\stubpath = "C:\\Windows\\System32\\indardaop.exe" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{xc8y4033-77bt-56j6-lj6z-d5c15pn049ye} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{cxjtypxh-mpjs-vlng-njhl-vnbryagmiwgf}\ = "ϵͳÉèÖÃ" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{fm6n6dv3-i0mo-cxyk-bytk-f4gu3exkl3cg} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{igrnirzb-sbcs-nfod-kdem-mtqnpntiwzzb} intnjpska.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{0s7j0828-2n2p-50lj-nsnl-65369q93lhnn} injhiaohu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{x5l25d0m-efmd-c16v-q6yb-u1hzg904pmxq}\ = "ϵͳÉèÖÃ" invdmeyvk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{pgyyhfqm-weqy-wrab-rxme-cqjcdblalspm} inqjwwyse.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{rdzqlwcw-qbrf-mple-uyfc-kdegenfjjdkw} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9wb6wik2-ai09-z6q7-i2a7-bcjax6f3s3n3}\ = "ϵͳÉèÖÃ" inmbxasof.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{nvmhszws-mjnb-ilha-qubh-ykgacajbffgs}\ = "ϵͳÉèÖÃ" inyszetef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{chfbbkk2-bqse-aqdu-amjh-iwofgzmbneie}\stubpath = "C:\\Windows\\System32\\infgzdhop.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{cgkrfxzh-vkjz-pnrp-rlqn-umzndrgxmxry}\stubpath = "C:\\Windows\\System32\\inqzaupvo.exe" inaiqezai.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{rql7lxfm-cldv-sqkr-bnrd-ph7opdebbdxs} inmsuirlm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{uuyfcokd-genf-jdkw-erds-fgjwilosomvi} Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{gvzmk3ie-cnn8-95qo-k3c2-y8cqkjqfz0qv}\stubpath = "C:\\Windows\\System32\\inldtepix.exe" injyqkarh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{siliriaj-sojs-cytc-tzog-aeslefncnuak}\ = "ϵͳÉèÖÃ" incpcgxnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{fqrfaddf-uqwr-eypr-fqwt-iwiqvhcnyurn}\ = "ϵͳÉèÖÃ" innoaemue.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5njb00oq-8564-84ek-m84w-7x322y66as54} inzemdeup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{bkf9dl30-mx5l-5d0m-efmd-c16v6q6ybiu1}\stubpath = "C:\\Windows\\System32\\intrfzlnv.exe" inudcfuhf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{yoskozea-mmek-tngd-raze-rrdzqlwcwpqb} inoyokzfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{ehaowtbl-ugqx-ueqj-ozib-zwpdnusifgkf} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{csmltndv-kuin-rbqw-pdah-sgyinwlklsqo} inpbwqegf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{65kobgve-gree-dafx-ckuf-9sohcn4w78my}\stubpath = "C:\\Windows\\System32\\iniqgcwmo.exe" inaqceivb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{igrnirzb-sbcs-nfod-kdem-mtqnpntiwzzb}\ = "ϵͳÉèÖÃ" intnjpska.exe - Executes dropped EXE 64 IoCs
pid Process 2864 inwsdlxsh.exe 2616 indhxkwmb.exe 2672 inaphxbit.exe 1588 inyufnzuj.exe 2384 inxjymong.exe 2880 inortslka.exe 968 inatwyxqd.exe 1476 inwixlnmf.exe 2724 inlsmacbt.exe 2168 insezthji.exe 1536 inixpjqgj.exe 2352 inpleqlxa.exe 804 inpbwqegf.exe 940 inugvjlkd.exe 2304 inxiaqxbm.exe 2812 innqsrkjz.exe 528 intpaiupe.exe 1064 invrckwrg.exe 2160 incraptug.exe 1732 indwztgsi.exe 1616 incgzwjvl.exe 1952 inigtklnv.exe 1996 insohtodl.exe 1432 inuqbjvqf.exe 1680 inapnrseu.exe 3060 infudswxj.exe 1752 injmdckxk.exe 1720 innfvgrkz.exe 1704 inqcxrfhg.exe 1744 inbuxzyre.exe 2292 invhwkmle.exe 2996 inyjbrycn.exe 2808 indqsmlmh.exe 2428 injwnoaqy.exe 2776 innlypqcs.exe 2420 inpfzcyeq.exe 2984 incvyzsfr.exe 572 ineuxonvv.exe 592 injyqkarh.exe 968 inldtepix.exe 2540 inixomukg.exe 1072 inmkxopbr.exe 1948 insvxwpco.exe 2600 inbaqtkjr.exe 2332 indtwnmuu.exe 2240 inahuhbcs.exe 2244 inkzrlbas.exe 2572 inmeufqjy.exe 2460 inogwahsa.exe 1120 incrjzdkv.exe 3008 incsvmltt.exe 776 ingvnhoze.exe 676 inkbaivic.exe 2992 inefvmlzb.exe 1248 inpsutmlb.exe 1756 inyorihpp.exe 2008 inrlmbbts.exe 364 inpqffxwb.exe 1996 ingvzmksi.exe 1772 inyteppma.exe 1900 inbmkzbqa.exe 1728 inisglpjp.exe 904 inopeewva.exe 1720 infvypoww.exe - Loads dropped DLL 64 IoCs
pid Process 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe 2864 inwsdlxsh.exe 2864 inwsdlxsh.exe 2864 inwsdlxsh.exe 2864 inwsdlxsh.exe 2616 indhxkwmb.exe 2616 indhxkwmb.exe 2616 indhxkwmb.exe 2616 indhxkwmb.exe 2672 inaphxbit.exe 2672 inaphxbit.exe 2672 inaphxbit.exe 2672 inaphxbit.exe 1588 inyufnzuj.exe 1588 inyufnzuj.exe 1588 inyufnzuj.exe 1588 inyufnzuj.exe 2384 inxjymong.exe 2384 inxjymong.exe 2384 inxjymong.exe 2384 inxjymong.exe 2880 inortslka.exe 2880 inortslka.exe 2880 inortslka.exe 2880 inortslka.exe 968 inatwyxqd.exe 968 inatwyxqd.exe 968 inatwyxqd.exe 968 inatwyxqd.exe 1476 inwixlnmf.exe 1476 inwixlnmf.exe 1476 inwixlnmf.exe 1476 inwixlnmf.exe 2724 inlsmacbt.exe 2724 inlsmacbt.exe 2724 inlsmacbt.exe 2724 inlsmacbt.exe 2168 insezthji.exe 2168 insezthji.exe 2168 insezthji.exe 2168 insezthji.exe 1536 inixpjqgj.exe 1536 inixpjqgj.exe 1536 inixpjqgj.exe 1536 inixpjqgj.exe 2352 inpleqlxa.exe 2352 inpleqlxa.exe 2352 inpleqlxa.exe 2352 inpleqlxa.exe 804 inpbwqegf.exe 804 inpbwqegf.exe 804 inpbwqegf.exe 804 inpbwqegf.exe 940 inugvjlkd.exe 940 inugvjlkd.exe 940 inugvjlkd.exe 940 inugvjlkd.exe 2304 inxiaqxbm.exe 2304 inxiaqxbm.exe 2304 inxiaqxbm.exe 2304 inxiaqxbm.exe 2812 innqsrkjz.exe 2812 innqsrkjz.exe 2812 innqsrkjz.exe -
resource yara_rule behavioral1/memory/2904-0-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/files/0x000d000000014698-6.dat upx behavioral1/memory/2904-11-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2864-27-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/files/0x00070000000155d4-48.dat upx behavioral1/memory/2672-58-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/files/0x0006000000016d01-67.dat upx behavioral1/files/0x0006000000016d24-89.dat upx behavioral1/files/0x0006000000016d41-100.dat upx behavioral1/files/0x0006000000016d55-109.dat upx behavioral1/files/0x0011000000014e3d-124.dat upx behavioral1/files/0x0006000000016e56-141.dat upx behavioral1/files/0x0006000000017090-155.dat upx behavioral1/memory/1536-163-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1536-170-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2352-177-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/804-186-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2304-195-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2812-206-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2812-214-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/528-221-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2160-239-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1616-255-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1952-264-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1996-273-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1680-291-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/3060-301-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1720-318-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1744-336-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2996-353-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2428-369-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/676-515-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2808-361-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2292-344-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1704-327-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1752-309-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1432-282-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1952-259-0x0000000000020000-0x0000000000035000-memory.dmp upx behavioral1/memory/1732-246-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1064-230-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2304-205-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2304-196-0x0000000000020000-0x0000000000035000-memory.dmp upx behavioral1/memory/940-194-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2168-157-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2724-143-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1476-129-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/968-114-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2880-99-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/2384-87-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/memory/1588-72-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/files/0x00090000000155e2-62.dat upx behavioral1/memory/2672-49-0x0000000000020000-0x0000000000035000-memory.dmp upx behavioral1/memory/2616-44-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral1/files/0x002b000000014c67-32.dat upx behavioral1/memory/2616-28-0x0000000000400000-0x0000000000415000-memory.dmp upx - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\inqmmyfvv.exe Process not Found File opened for modification C:\Windows\SysWOW64\incvxxhec.exe_lang.ini inakrpgjz.exe File created C:\Windows\SysWOW64\inmkoozmm.exe_lang.ini invhyunli.exe File created C:\Windows\SysWOW64\innojeupa.exe inckukgvb.exe File opened for modification C:\Windows\SysWOW64\inknpnmhr.exe_lang.ini intfcjrzb.exe File created C:\Windows\SysWOW64\inibqostf.exe Process not Found File opened for modification C:\Windows\SysWOW64\indksorzj.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inwfcwnpq.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\insyjghrx.exe Process not Found File created C:\Windows\SysWOW64\inuqbjvqf.exe_lang.ini insohtodl.exe File created C:\Windows\SysWOW64\indeulkya.exe_lang.ini intcrvwiy.exe File opened for modification C:\Windows\SysWOW64\inzzjgeaz.exe_lang.ini innoqupvt.exe File created C:\Windows\SysWOW64\inenfzwlg.exe_lang.ini inqzaupvo.exe File created C:\Windows\SysWOW64\insuxuebv.exe inbskfogf.exe File opened for modification C:\Windows\SysWOW64\inxujybfr.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\innvfnjmu.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inxgusiod.exe_lang.ini invzesqzg.exe File created C:\Windows\SysWOW64\ingjahuhb.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inhmntxtf.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\ingmcckte.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inhgwhjlo.exe_lang.ini inkxmjgli.exe File created C:\Windows\SysWOW64\inghxondz.exe inenraymu.exe File opened for modification C:\Windows\SysWOW64\inlmjnubv.exe_lang.ini intfwsljg.exe File created C:\Windows\SysWOW64\indjhqbuu.exe Process not Found File opened for modification C:\Windows\SysWOW64\inortslka.exe_lang.ini inxjymong.exe File opened for modification C:\Windows\SysWOW64\incmrujul.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inswnxqdj.exe Process not Found File opened for modification C:\Windows\SysWOW64\innkyzbkq.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\ineguxzcg.exe_lang.ini injyixbhg.exe File created C:\Windows\SysWOW64\ingtgabri.exe inbbkvfva.exe File opened for modification C:\Windows\SysWOW64\inpatbkcw.exe_lang.ini innnpmjol.exe File opened for modification C:\Windows\SysWOW64\innhnzoqa.exe_lang.ini inzfhvydh.exe File opened for modification C:\Windows\SysWOW64\inpxucmtx.exe_lang.ini inckagkpg.exe File created C:\Windows\SysWOW64\inwpxhpfl.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\infkydrzj.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\indjvakex.exe_lang.ini inazpsjiq.exe File created C:\Windows\SysWOW64\inddyhqyz.exe Process not Found File created C:\Windows\SysWOW64\inthxflas.exe Process not Found File opened for modification C:\Windows\SysWOW64\inqxbfmkb.exe_lang.ini ingvetxyk.exe File created C:\Windows\SysWOW64\inmxiifwj.exe_lang.ini infdqdofu.exe File created C:\Windows\SysWOW64\inbqiycju.exe_lang.ini inshvhsxn.exe File created C:\Windows\SysWOW64\inkxncqsn.exe insywlfel.exe File created C:\Windows\SysWOW64\inkdxsoui.exe_lang.ini inkqsgpjk.exe File opened for modification C:\Windows\SysWOW64\inxjlticd.exe_lang.ini inqeglpsu.exe File created C:\Windows\SysWOW64\inooxsntm.exe inrcscxou.exe File created C:\Windows\SysWOW64\innycjqwp.exe Process not Found File created C:\Windows\SysWOW64\instzcdzl.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inkkoxbqs.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inipteugw.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inckjqhkt.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inwldhtuf.exe_lang.ini ineyhbpzk.exe File created C:\Windows\SysWOW64\inaazvenx.exe Process not Found File created C:\Windows\SysWOW64\invvhyucp.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\inonhsgot.exe_lang.ini Process not Found File opened for modification C:\Windows\SysWOW64\inqybiohu.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\incvxxhec.exe inakrpgjz.exe File opened for modification C:\Windows\SysWOW64\inwhxahtz.exe_lang.ini inilftocs.exe File created C:\Windows\SysWOW64\inuydrpyf.exe_lang.ini insuknjca.exe File created C:\Windows\SysWOW64\inmbpckft.exe invmsakfo.exe File created C:\Windows\SysWOW64\inhticvxx.exe inytomigo.exe File created C:\Windows\SysWOW64\innsieqyf.exe_lang.ini indltdckl.exe File created C:\Windows\SysWOW64\inlbjrbai.exe_lang.ini inpxucmtx.exe File created C:\Windows\SysWOW64\injgbtpfe.exe_lang.ini Process not Found File created C:\Windows\SysWOW64\indskelwb.exe_lang.ini injausioy.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe 2864 inwsdlxsh.exe 2616 indhxkwmb.exe 2672 inaphxbit.exe 1588 inyufnzuj.exe 2384 inxjymong.exe 2880 inortslka.exe 968 inatwyxqd.exe 1476 inwixlnmf.exe 2724 inlsmacbt.exe 2168 insezthji.exe 1536 inixpjqgj.exe 2352 inpleqlxa.exe 804 inpbwqegf.exe 940 inugvjlkd.exe 2304 inxiaqxbm.exe 2812 innqsrkjz.exe 528 intpaiupe.exe 1064 invrckwrg.exe 2160 incraptug.exe 1732 indwztgsi.exe 1616 incgzwjvl.exe 1952 inigtklnv.exe 1996 insohtodl.exe 1432 inuqbjvqf.exe 1680 inapnrseu.exe 3060 infudswxj.exe 1752 injmdckxk.exe 1720 innfvgrkz.exe 1704 inqcxrfhg.exe 1744 inbuxzyre.exe 2292 invhwkmle.exe 2996 inyjbrycn.exe 2808 indqsmlmh.exe 2428 injwnoaqy.exe 2776 innlypqcs.exe 2420 inpfzcyeq.exe 2984 incvyzsfr.exe 572 ineuxonvv.exe 592 injyqkarh.exe 968 inldtepix.exe 2540 inixomukg.exe 1072 inmkxopbr.exe 1948 insvxwpco.exe 2600 inbaqtkjr.exe 2332 indtwnmuu.exe 2240 inahuhbcs.exe 2244 inkzrlbas.exe 2572 inmeufqjy.exe 2460 inogwahsa.exe 1120 incrjzdkv.exe 3008 incsvmltt.exe 776 ingvnhoze.exe 676 inkbaivic.exe 2992 inefvmlzb.exe 1248 inpsutmlb.exe 1756 inyorihpp.exe 2008 inrlmbbts.exe 364 inpqffxwb.exe 1996 ingvzmksi.exe 1772 inyteppma.exe 1900 inbmkzbqa.exe 1728 inisglpjp.exe 904 inopeewva.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe Token: SeDebugPrivilege 2864 inwsdlxsh.exe Token: SeDebugPrivilege 2616 indhxkwmb.exe Token: SeDebugPrivilege 2672 inaphxbit.exe Token: SeDebugPrivilege 1588 inyufnzuj.exe Token: SeDebugPrivilege 2384 inxjymong.exe Token: SeDebugPrivilege 2880 inortslka.exe Token: SeDebugPrivilege 968 inatwyxqd.exe Token: SeDebugPrivilege 1476 inwixlnmf.exe Token: SeDebugPrivilege 2724 inlsmacbt.exe Token: SeDebugPrivilege 2168 insezthji.exe Token: SeDebugPrivilege 1536 inixpjqgj.exe Token: SeDebugPrivilege 2352 inpleqlxa.exe Token: SeDebugPrivilege 804 inpbwqegf.exe Token: SeDebugPrivilege 940 inugvjlkd.exe Token: SeDebugPrivilege 2304 inxiaqxbm.exe Token: SeDebugPrivilege 2812 innqsrkjz.exe Token: SeDebugPrivilege 528 intpaiupe.exe Token: SeDebugPrivilege 1064 invrckwrg.exe Token: SeDebugPrivilege 2160 incraptug.exe Token: SeDebugPrivilege 1732 indwztgsi.exe Token: SeDebugPrivilege 1616 incgzwjvl.exe Token: SeDebugPrivilege 1952 inigtklnv.exe Token: SeDebugPrivilege 1996 insohtodl.exe Token: SeDebugPrivilege 1432 inuqbjvqf.exe Token: SeDebugPrivilege 1680 inapnrseu.exe Token: SeDebugPrivilege 3060 infudswxj.exe Token: SeDebugPrivilege 1752 injmdckxk.exe Token: SeDebugPrivilege 1720 innfvgrkz.exe Token: SeDebugPrivilege 1704 inqcxrfhg.exe Token: SeDebugPrivilege 1744 inbuxzyre.exe Token: SeDebugPrivilege 2292 invhwkmle.exe Token: SeDebugPrivilege 2996 inyjbrycn.exe Token: SeDebugPrivilege 2808 indqsmlmh.exe Token: SeDebugPrivilege 2428 injwnoaqy.exe Token: SeDebugPrivilege 2776 innlypqcs.exe Token: SeDebugPrivilege 2420 inpfzcyeq.exe Token: SeDebugPrivilege 2984 incvyzsfr.exe Token: SeDebugPrivilege 572 ineuxonvv.exe Token: SeDebugPrivilege 592 injyqkarh.exe Token: SeDebugPrivilege 968 inldtepix.exe Token: SeDebugPrivilege 2540 inixomukg.exe Token: SeDebugPrivilege 1072 inmkxopbr.exe Token: SeDebugPrivilege 1948 insvxwpco.exe Token: SeDebugPrivilege 2600 inbaqtkjr.exe Token: SeDebugPrivilege 2332 indtwnmuu.exe Token: SeDebugPrivilege 2240 inahuhbcs.exe Token: SeDebugPrivilege 2244 inkzrlbas.exe Token: SeDebugPrivilege 2572 inmeufqjy.exe Token: SeDebugPrivilege 2460 inogwahsa.exe Token: SeDebugPrivilege 1120 incrjzdkv.exe Token: SeDebugPrivilege 3008 incsvmltt.exe Token: SeDebugPrivilege 776 ingvnhoze.exe Token: SeDebugPrivilege 676 inkbaivic.exe Token: SeDebugPrivilege 2992 inefvmlzb.exe Token: SeDebugPrivilege 1248 inpsutmlb.exe Token: SeDebugPrivilege 1756 inyorihpp.exe Token: SeDebugPrivilege 2008 inrlmbbts.exe Token: SeDebugPrivilege 364 inpqffxwb.exe Token: SeDebugPrivilege 1996 ingvzmksi.exe Token: SeDebugPrivilege 1772 inyteppma.exe Token: SeDebugPrivilege 1900 inbmkzbqa.exe Token: SeDebugPrivilege 1728 inisglpjp.exe Token: SeDebugPrivilege 904 inopeewva.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2864 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe 330 PID 2904 wrote to memory of 2864 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe 330 PID 2904 wrote to memory of 2864 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe 330 PID 2904 wrote to memory of 2864 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe 330 PID 2904 wrote to memory of 2864 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe 330 PID 2904 wrote to memory of 2864 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe 330 PID 2904 wrote to memory of 2864 2904 80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe 330 PID 2864 wrote to memory of 2616 2864 inwsdlxsh.exe 29 PID 2864 wrote to memory of 2616 2864 inwsdlxsh.exe 29 PID 2864 wrote to memory of 2616 2864 inwsdlxsh.exe 29 PID 2864 wrote to memory of 2616 2864 inwsdlxsh.exe 29 PID 2864 wrote to memory of 2616 2864 inwsdlxsh.exe 29 PID 2864 wrote to memory of 2616 2864 inwsdlxsh.exe 29 PID 2864 wrote to memory of 2616 2864 inwsdlxsh.exe 29 PID 2616 wrote to memory of 2672 2616 indhxkwmb.exe 30 PID 2616 wrote to memory of 2672 2616 indhxkwmb.exe 30 PID 2616 wrote to memory of 2672 2616 indhxkwmb.exe 30 PID 2616 wrote to memory of 2672 2616 indhxkwmb.exe 30 PID 2616 wrote to memory of 2672 2616 indhxkwmb.exe 30 PID 2616 wrote to memory of 2672 2616 indhxkwmb.exe 30 PID 2616 wrote to memory of 2672 2616 indhxkwmb.exe 30 PID 2672 wrote to memory of 1588 2672 inaphxbit.exe 31 PID 2672 wrote to memory of 1588 2672 inaphxbit.exe 31 PID 2672 wrote to memory of 1588 2672 inaphxbit.exe 31 PID 2672 wrote to memory of 1588 2672 inaphxbit.exe 31 PID 2672 wrote to memory of 1588 2672 inaphxbit.exe 31 PID 2672 wrote to memory of 1588 2672 inaphxbit.exe 31 PID 2672 wrote to memory of 1588 2672 inaphxbit.exe 31 PID 1588 wrote to memory of 2384 1588 inyufnzuj.exe 421 PID 1588 wrote to memory of 2384 1588 inyufnzuj.exe 421 PID 1588 wrote to memory of 2384 1588 inyufnzuj.exe 421 PID 1588 wrote to memory of 2384 1588 inyufnzuj.exe 421 PID 1588 wrote to memory of 2384 1588 inyufnzuj.exe 421 PID 1588 wrote to memory of 2384 1588 inyufnzuj.exe 421 PID 1588 wrote to memory of 2384 1588 inyufnzuj.exe 421 PID 2384 wrote to memory of 2880 2384 inxjymong.exe 33 PID 2384 wrote to memory of 2880 2384 inxjymong.exe 33 PID 2384 wrote to memory of 2880 2384 inxjymong.exe 33 PID 2384 wrote to memory of 2880 2384 inxjymong.exe 33 PID 2384 wrote to memory of 2880 2384 inxjymong.exe 33 PID 2384 wrote to memory of 2880 2384 inxjymong.exe 33 PID 2384 wrote to memory of 2880 2384 inxjymong.exe 33 PID 2880 wrote to memory of 968 2880 inortslka.exe 430 PID 2880 wrote to memory of 968 2880 inortslka.exe 430 PID 2880 wrote to memory of 968 2880 inortslka.exe 430 PID 2880 wrote to memory of 968 2880 inortslka.exe 430 PID 2880 wrote to memory of 968 2880 inortslka.exe 430 PID 2880 wrote to memory of 968 2880 inortslka.exe 430 PID 2880 wrote to memory of 968 2880 inortslka.exe 430 PID 968 wrote to memory of 1476 968 inatwyxqd.exe 35 PID 968 wrote to memory of 1476 968 inatwyxqd.exe 35 PID 968 wrote to memory of 1476 968 inatwyxqd.exe 35 PID 968 wrote to memory of 1476 968 inatwyxqd.exe 35 PID 968 wrote to memory of 1476 968 inatwyxqd.exe 35 PID 968 wrote to memory of 1476 968 inatwyxqd.exe 35 PID 968 wrote to memory of 1476 968 inatwyxqd.exe 35 PID 1476 wrote to memory of 2724 1476 inwixlnmf.exe 36 PID 1476 wrote to memory of 2724 1476 inwixlnmf.exe 36 PID 1476 wrote to memory of 2724 1476 inwixlnmf.exe 36 PID 1476 wrote to memory of 2724 1476 inwixlnmf.exe 36 PID 1476 wrote to memory of 2724 1476 inwixlnmf.exe 36 PID 1476 wrote to memory of 2724 1476 inwixlnmf.exe 36 PID 1476 wrote to memory of 2724 1476 inwixlnmf.exe 36 PID 2724 wrote to memory of 2168 2724 inlsmacbt.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\inwsdlxsh.exeC:\Windows\System32\inwsdlxsh.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\indhxkwmb.exeC:\Windows\System32\indhxkwmb.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\inaphxbit.exeC:\Windows\System32\inaphxbit.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\inyufnzuj.exeC:\Windows\System32\inyufnzuj.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\inxjymong.exeC:\Windows\System32\inxjymong.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\inortslka.exeC:\Windows\System32\inortslka.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\inatwyxqd.exeC:\Windows\System32\inatwyxqd.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\inwixlnmf.exeC:\Windows\System32\inwixlnmf.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\inlsmacbt.exeC:\Windows\System32\inlsmacbt.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\insezthji.exeC:\Windows\System32\insezthji.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Windows\SysWOW64\inixpjqgj.exeC:\Windows\System32\inixpjqgj.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536 -
C:\Windows\SysWOW64\inpleqlxa.exeC:\Windows\System32\inpleqlxa.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352 -
C:\Windows\SysWOW64\inpbwqegf.exeC:\Windows\System32\inpbwqegf.exe14⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:804 -
C:\Windows\SysWOW64\inugvjlkd.exeC:\Windows\System32\inugvjlkd.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940 -
C:\Windows\SysWOW64\inxiaqxbm.exeC:\Windows\System32\inxiaqxbm.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2304 -
C:\Windows\SysWOW64\innqsrkjz.exeC:\Windows\System32\innqsrkjz.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812 -
C:\Windows\SysWOW64\intpaiupe.exeC:\Windows\System32\intpaiupe.exe18⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:528 -
C:\Windows\SysWOW64\invrckwrg.exeC:\Windows\System32\invrckwrg.exe19⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064 -
C:\Windows\SysWOW64\incraptug.exeC:\Windows\System32\incraptug.exe20⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160 -
C:\Windows\SysWOW64\indwztgsi.exeC:\Windows\System32\indwztgsi.exe21⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732 -
C:\Windows\SysWOW64\incgzwjvl.exeC:\Windows\System32\incgzwjvl.exe22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616 -
C:\Windows\SysWOW64\inigtklnv.exeC:\Windows\System32\inigtklnv.exe23⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952 -
C:\Windows\SysWOW64\insohtodl.exeC:\Windows\System32\insohtodl.exe24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996 -
C:\Windows\SysWOW64\inuqbjvqf.exeC:\Windows\System32\inuqbjvqf.exe25⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432 -
C:\Windows\SysWOW64\inapnrseu.exeC:\Windows\System32\inapnrseu.exe26⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Windows\SysWOW64\infudswxj.exeC:\Windows\System32\infudswxj.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3060 -
C:\Windows\SysWOW64\injmdckxk.exeC:\Windows\System32\injmdckxk.exe28⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Windows\SysWOW64\innfvgrkz.exeC:\Windows\System32\innfvgrkz.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Windows\SysWOW64\inqcxrfhg.exeC:\Windows\System32\inqcxrfhg.exe30⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1704 -
C:\Windows\SysWOW64\inbuxzyre.exeC:\Windows\System32\inbuxzyre.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Windows\SysWOW64\invhwkmle.exeC:\Windows\System32\invhwkmle.exe32⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292 -
C:\Windows\SysWOW64\inyjbrycn.exeC:\Windows\System32\inyjbrycn.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Windows\SysWOW64\indqsmlmh.exeC:\Windows\System32\indqsmlmh.exe34⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Windows\SysWOW64\injwnoaqy.exeC:\Windows\System32\injwnoaqy.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428 -
C:\Windows\SysWOW64\innlypqcs.exeC:\Windows\System32\innlypqcs.exe36⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776 -
C:\Windows\SysWOW64\inpfzcyeq.exeC:\Windows\System32\inpfzcyeq.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420 -
C:\Windows\SysWOW64\incvyzsfr.exeC:\Windows\System32\incvyzsfr.exe38⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984 -
C:\Windows\SysWOW64\ineuxonvv.exeC:\Windows\System32\ineuxonvv.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572 -
C:\Windows\SysWOW64\injyqkarh.exeC:\Windows\System32\injyqkarh.exe40⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:592 -
C:\Windows\SysWOW64\inldtepix.exeC:\Windows\System32\inldtepix.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968 -
C:\Windows\SysWOW64\inixomukg.exeC:\Windows\System32\inixomukg.exe42⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540 -
C:\Windows\SysWOW64\inmkxopbr.exeC:\Windows\System32\inmkxopbr.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1072 -
C:\Windows\SysWOW64\insvxwpco.exeC:\Windows\System32\insvxwpco.exe44⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948 -
C:\Windows\SysWOW64\inbaqtkjr.exeC:\Windows\System32\inbaqtkjr.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600 -
C:\Windows\SysWOW64\indtwnmuu.exeC:\Windows\System32\indtwnmuu.exe46⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332 -
C:\Windows\SysWOW64\inahuhbcs.exeC:\Windows\System32\inahuhbcs.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2240 -
C:\Windows\SysWOW64\inkzrlbas.exeC:\Windows\System32\inkzrlbas.exe48⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244 -
C:\Windows\SysWOW64\inmeufqjy.exeC:\Windows\System32\inmeufqjy.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Windows\SysWOW64\inogwahsa.exeC:\Windows\System32\inogwahsa.exe50⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2460 -
C:\Windows\SysWOW64\incrjzdkv.exeC:\Windows\System32\incrjzdkv.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120 -
C:\Windows\SysWOW64\incsvmltt.exeC:\Windows\System32\incsvmltt.exe52⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008 -
C:\Windows\SysWOW64\ingvnhoze.exeC:\Windows\System32\ingvnhoze.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:776 -
C:\Windows\SysWOW64\inkbaivic.exeC:\Windows\System32\inkbaivic.exe54⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:676 -
C:\Windows\SysWOW64\inefvmlzb.exeC:\Windows\System32\inefvmlzb.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2992 -
C:\Windows\SysWOW64\inpsutmlb.exeC:\Windows\System32\inpsutmlb.exe56⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Windows\SysWOW64\inyorihpp.exeC:\Windows\System32\inyorihpp.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756 -
C:\Windows\SysWOW64\inrlmbbts.exeC:\Windows\System32\inrlmbbts.exe58⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2008 -
C:\Windows\SysWOW64\inpqffxwb.exeC:\Windows\System32\inpqffxwb.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:364 -
C:\Windows\SysWOW64\ingvzmksi.exeC:\Windows\System32\ingvzmksi.exe60⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996 -
C:\Windows\SysWOW64\inyteppma.exeC:\Windows\System32\inyteppma.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1772 -
C:\Windows\SysWOW64\inbmkzbqa.exeC:\Windows\System32\inbmkzbqa.exe62⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Windows\SysWOW64\inisglpjp.exeC:\Windows\System32\inisglpjp.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728 -
C:\Windows\SysWOW64\inopeewva.exeC:\Windows\System32\inopeewva.exe64⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904 -
C:\Windows\SysWOW64\infvypoww.exeC:\Windows\System32\infvypoww.exe65⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\inilcbjwj.exeC:\Windows\System32\inilcbjwj.exe66⤵PID:2096
-
C:\Windows\SysWOW64\inhwnltjf.exeC:\Windows\System32\inhwnltjf.exe67⤵PID:1744
-
C:\Windows\SysWOW64\inljyapnv.exeC:\Windows\System32\inljyapnv.exe68⤵PID:2960
-
C:\Windows\SysWOW64\inadbobmd.exeC:\Windows\System32\inadbobmd.exe69⤵PID:2592
-
C:\Windows\SysWOW64\inetlfmxc.exeC:\Windows\System32\inetlfmxc.exe70⤵PID:2684
-
C:\Windows\SysWOW64\inhfsfaqh.exeC:\Windows\System32\inhfsfaqh.exe71⤵PID:1592
-
C:\Windows\SysWOW64\indtkzjxv.exeC:\Windows\System32\indtkzjxv.exe72⤵PID:580
-
C:\Windows\SysWOW64\inxtleici.exeC:\Windows\System32\inxtleici.exe73⤵PID:1644
-
C:\Windows\SysWOW64\invuwaxma.exeC:\Windows\System32\invuwaxma.exe74⤵PID:2872
-
C:\Windows\SysWOW64\ineybxzdp.exeC:\Windows\System32\ineybxzdp.exe75⤵PID:2192
-
C:\Windows\SysWOW64\inqgdzfrf.exeC:\Windows\System32\inqgdzfrf.exe76⤵PID:884
-
C:\Windows\SysWOW64\infhthtec.exeC:\Windows\System32\infhthtec.exe77⤵PID:2596
-
C:\Windows\SysWOW64\inaikwkwh.exeC:\Windows\System32\inaikwkwh.exe78⤵PID:1388
-
C:\Windows\SysWOW64\incsnrmiw.exeC:\Windows\System32\incsnrmiw.exe79⤵PID:2764
-
C:\Windows\SysWOW64\ingtvpopk.exeC:\Windows\System32\ingtvpopk.exe80⤵PID:2204
-
C:\Windows\SysWOW64\inaivxrqr.exeC:\Windows\System32\inaivxrqr.exe81⤵PID:2036
-
C:\Windows\SysWOW64\ineqbmfxl.exeC:\Windows\System32\ineqbmfxl.exe82⤵PID:1156
-
C:\Windows\SysWOW64\innoddvuk.exeC:\Windows\System32\innoddvuk.exe83⤵PID:1976
-
C:\Windows\SysWOW64\inmawkptn.exeC:\Windows\System32\inmawkptn.exe84⤵PID:1100
-
C:\Windows\SysWOW64\inrjcgagg.exeC:\Windows\System32\inrjcgagg.exe85⤵PID:2244
-
C:\Windows\SysWOW64\intsuvkkg.exeC:\Windows\System32\intsuvkkg.exe86⤵PID:2972
-
C:\Windows\SysWOW64\inoavpdfe.exeC:\Windows\System32\inoavpdfe.exe87⤵PID:3016
-
C:\Windows\SysWOW64\inowmiavg.exeC:\Windows\System32\inowmiavg.exe88⤵PID:596
-
C:\Windows\SysWOW64\inomzqrdt.exeC:\Windows\System32\inomzqrdt.exe89⤵PID:2152
-
C:\Windows\SysWOW64\infumgnyd.exeC:\Windows\System32\infumgnyd.exe90⤵PID:1724
-
C:\Windows\SysWOW64\inwhpwale.exeC:\Windows\System32\inwhpwale.exe91⤵PID:1836
-
C:\Windows\SysWOW64\ingvetxyk.exeC:\Windows\System32\ingvetxyk.exe92⤵
- Drops file in System32 directory
PID:1216 -
C:\Windows\SysWOW64\inqxbfmkb.exeC:\Windows\System32\inqxbfmkb.exe93⤵PID:1672
-
C:\Windows\SysWOW64\inutvwllh.exeC:\Windows\System32\inutvwllh.exe94⤵PID:708
-
C:\Windows\SysWOW64\inscqyokc.exeC:\Windows\System32\inscqyokc.exe95⤵PID:2184
-
C:\Windows\SysWOW64\inckxztas.exeC:\Windows\System32\inckxztas.exe96⤵PID:2076
-
C:\Windows\SysWOW64\inhegsgsd.exeC:\Windows\System32\inhegsgsd.exe97⤵PID:2448
-
C:\Windows\SysWOW64\intetdxsy.exeC:\Windows\System32\intetdxsy.exe98⤵PID:612
-
C:\Windows\SysWOW64\inpkfxleq.exeC:\Windows\System32\inpkfxleq.exe99⤵PID:1992
-
C:\Windows\SysWOW64\inirmhzng.exeC:\Windows\System32\inirmhzng.exe100⤵PID:2176
-
C:\Windows\SysWOW64\inqzfhsqg.exeC:\Windows\System32\inqzfhsqg.exe101⤵PID:2552
-
C:\Windows\SysWOW64\inrbrocsh.exeC:\Windows\System32\inrbrocsh.exe102⤵PID:2116
-
C:\Windows\SysWOW64\inbjwysrs.exeC:\Windows\System32\inbjwysrs.exe103⤵PID:904
-
C:\Windows\SysWOW64\inrcangym.exeC:\Windows\System32\inrcangym.exe104⤵PID:2644
-
C:\Windows\SysWOW64\intcrvwiy.exeC:\Windows\System32\intcrvwiy.exe105⤵
- Drops file in System32 directory
PID:2144 -
C:\Windows\SysWOW64\indeulkya.exeC:\Windows\System32\indeulkya.exe106⤵PID:2388
-
C:\Windows\SysWOW64\inxsdoolp.exeC:\Windows\System32\inxsdoolp.exe107⤵PID:2360
-
C:\Windows\SysWOW64\inxnqhgoo.exeC:\Windows\System32\inxnqhgoo.exe108⤵PID:2436
-
C:\Windows\SysWOW64\inrdysgih.exeC:\Windows\System32\inrdysgih.exe109⤵PID:2684
-
C:\Windows\SysWOW64\inbohznex.exeC:\Windows\System32\inbohznex.exe110⤵PID:2368
-
C:\Windows\SysWOW64\inbfyviuk.exeC:\Windows\System32\inbfyviuk.exe111⤵PID:2536
-
C:\Windows\SysWOW64\injlxlxig.exeC:\Windows\System32\injlxlxig.exe112⤵PID:2416
-
C:\Windows\SysWOW64\inrfpuysy.exeC:\Windows\System32\inrfpuysy.exe113⤵PID:1472
-
C:\Windows\SysWOW64\inmibthrw.exeC:\Windows\System32\inmibthrw.exe114⤵PID:2232
-
C:\Windows\SysWOW64\injausioy.exeC:\Windows\System32\injausioy.exe115⤵
- Drops file in System32 directory
PID:2560 -
C:\Windows\SysWOW64\indskelwb.exeC:\Windows\System32\indskelwb.exe116⤵PID:1840
-
C:\Windows\SysWOW64\ingerepgv.exeC:\Windows\System32\ingerepgv.exe117⤵PID:1904
-
C:\Windows\SysWOW64\injyiwuqi.exeC:\Windows\System32\injyiwuqi.exe118⤵PID:2764
-
C:\Windows\SysWOW64\inwskdhbh.exeC:\Windows\System32\inwskdhbh.exe119⤵PID:1656
-
C:\Windows\SysWOW64\inyegrpfl.exeC:\Windows\System32\inyegrpfl.exe120⤵PID:1972
-
C:\Windows\SysWOW64\infvqbbup.exeC:\Windows\System32\infvqbbup.exe121⤵PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-