Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04-06-2024 19:59
General
-
Target
d41eac03cf654c9e4657ad9fdc374fd0_NeikiAnalytics.exe
-
Size
448KB
-
MD5
d41eac03cf654c9e4657ad9fdc374fd0
-
SHA1
83a7997fdbeee20cb9991b0770d55539e04d374a
-
SHA256
02e383641d1bee1031cb12872c7fa9782b8de3bda07f2cfb1613aa19cadf046e
-
SHA512
98351697d45eba18bc12111f8c2f299e2d0e612ce85eba844a8392810ea24a4f9348adc5a769076ae604cdcedf7c1c8d13a14250ded528ea8650cc2ca20bd927
-
SSDEEP
6144:5QaQvgqRJLU/UkEjiPISUOgW9X+hOGzC/NM:5jQ1tkmZzcukG2/
Score
10/10
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 19 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Drops file in System32 directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d41eac03cf654c9e4657ad9fdc374fd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d41eac03cf654c9e4657ad9fdc374fd0_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OCAHWPM.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\OCAHWPM.exeC:\windows\OCAHWPM.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IYFQ.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\IYFQ.exeC:\windows\system32\IYFQ.exe5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VWU.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\VWU.exeC:\windows\system\VWU.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KRDVXI.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\KRDVXI.exeC:\windows\KRDVXI.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SEICHH.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\SEICHH.exeC:\windows\system32\SEICHH.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GST.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\GST.exeC:\windows\system32\GST.exe13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NIUU.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\NIUU.exeC:\windows\NIUU.exe15⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WLLQIAO.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\WLLQIAO.exeC:\windows\system\WLLQIAO.exe17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NTZNVRR.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\NTZNVRR.exeC:\windows\system\NTZNVRR.exe19⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZGGLAT.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\ZGGLAT.exeC:\windows\ZGGLAT.exe21⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DMQAQO.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\DMQAQO.exeC:\windows\system\DMQAQO.exe23⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CXBQZ.exe.bat" "24⤵
-
C:\windows\system\CXBQZ.exeC:\windows\system\CXBQZ.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNCQGQT.exe.bat" "26⤵
-
C:\windows\JNCQGQT.exeC:\windows\JNCQGQT.exe27⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OSMFWLO.exe.bat" "28⤵
-
C:\windows\SysWOW64\OSMFWLO.exeC:\windows\system32\OSMFWLO.exe29⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DINWVG.exe.bat" "30⤵
-
C:\windows\DINWVG.exeC:\windows\DINWVG.exe31⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ELESJQ.exe.bat" "32⤵
-
C:\windows\SysWOW64\ELESJQ.exeC:\windows\system32\ELESJQ.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NMG.exe.bat" "34⤵
-
C:\windows\NMG.exeC:\windows\NMG.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KMPIYRQ.exe.bat" "36⤵
-
C:\windows\SysWOW64\KMPIYRQ.exeC:\windows\system32\KMPIYRQ.exe37⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\RXFQQ.exe.bat" "38⤵
-
C:\windows\RXFQQ.exeC:\windows\RXFQQ.exe39⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JAI.exe.bat" "40⤵
-
C:\windows\SysWOW64\JAI.exeC:\windows\system32\JAI.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DSYXFAW.exe.bat" "42⤵
-
C:\windows\system\DSYXFAW.exeC:\windows\system\DSYXFAW.exe43⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SIZWM.exe.bat" "44⤵
-
C:\windows\SysWOW64\SIZWM.exeC:\windows\system32\SIZWM.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YEKPS.exe.bat" "46⤵
-
C:\windows\YEKPS.exeC:\windows\YEKPS.exe47⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZHOT.exe.bat" "48⤵
-
C:\windows\system\ZHOT.exeC:\windows\system\ZHOT.exe49⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMHIVDX.exe.bat" "50⤵
-
C:\windows\system\VMHIVDX.exeC:\windows\system\VMHIVDX.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LCIZUY.exe.bat" "52⤵
-
C:\windows\SysWOW64\LCIZUY.exeC:\windows\system32\LCIZUY.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EVPKLR.exe.bat" "54⤵
-
C:\windows\SysWOW64\EVPKLR.exeC:\windows\system32\EVPKLR.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYT.exe.bat" "56⤵
-
C:\windows\SysWOW64\XYT.exeC:\windows\system32\XYT.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\OYH.exe.bat" "58⤵
-
C:\windows\OYH.exeC:\windows\OYH.exe59⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JTMV.exe.bat" "60⤵
-
C:\windows\JTMV.exeC:\windows\JTMV.exe61⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PHLDSBL.exe.bat" "62⤵
-
C:\windows\PHLDSBL.exeC:\windows\PHLDSBL.exe63⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QKB.exe.bat" "64⤵
-
C:\windows\SysWOW64\QKB.exeC:\windows\system32\QKB.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VKJNQ.exe.bat" "66⤵
-
C:\windows\SysWOW64\VKJNQ.exeC:\windows\system32\VKJNQ.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LAKE.exe.bat" "68⤵
-
C:\windows\LAKE.exeC:\windows\LAKE.exe69⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WBZP.exe.bat" "70⤵
-
C:\windows\system\WBZP.exeC:\windows\system\WBZP.exe71⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XWDTLR.exe.bat" "72⤵
-
C:\windows\XWDTLR.exeC:\windows\XWDTLR.exe73⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMEK.exe.bat" "74⤵
-
C:\windows\SysWOW64\MMEK.exeC:\windows\system32\MMEK.exe75⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IRDPM.exe.bat" "76⤵
-
C:\windows\SysWOW64\IRDPM.exeC:\windows\system32\IRDPM.exe77⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CFIYXDB.exe.bat" "78⤵
-
C:\windows\system\CFIYXDB.exeC:\windows\system\CFIYXDB.exe79⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WSHWCF.exe.bat" "80⤵
-
C:\windows\SysWOW64\WSHWCF.exeC:\windows\system32\WSHWCF.exe81⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZICLKK.exe.bat" "82⤵
-
C:\windows\SysWOW64\ZICLKK.exeC:\windows\system32\ZICLKK.exe83⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TWH.exe.bat" "84⤵
-
C:\windows\SysWOW64\TWH.exeC:\windows\system32\TWH.exe85⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IRQYFX.exe.bat" "86⤵
-
C:\windows\system\IRQYFX.exeC:\windows\system\IRQYFX.exe87⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LZZVM.exe.bat" "88⤵
-
C:\windows\LZZVM.exeC:\windows\LZZVM.exe89⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CPYY.exe.bat" "90⤵
-
C:\windows\SysWOW64\CPYY.exeC:\windows\system32\CPYY.exe91⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KCLFJJ.exe.bat" "92⤵
-
C:\windows\SysWOW64\KCLFJJ.exeC:\windows\system32\KCLFJJ.exe93⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDNSMHS.exe.bat" "94⤵
-
C:\windows\system\BDNSMHS.exeC:\windows\system\BDNSMHS.exe95⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SLBPZXN.exe.bat" "96⤵
-
C:\windows\SysWOW64\SLBPZXN.exeC:\windows\system32\SLBPZXN.exe97⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CTDU.exe.bat" "98⤵
-
C:\windows\system\CTDU.exeC:\windows\system\CTDU.exe99⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\COTQRE.exe.bat" "100⤵
-
C:\windows\SysWOW64\COTQRE.exeC:\windows\system32\COTQRE.exe101⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XKY.exe.bat" "102⤵
-
C:\windows\system\XKY.exeC:\windows\system\XKY.exe103⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FPD.exe.bat" "104⤵
-
C:\windows\FPD.exeC:\windows\FPD.exe105⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RFJOY.exe.bat" "106⤵
-
C:\windows\system\RFJOY.exeC:\windows\system\RFJOY.exe107⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\OYTQ.exe.bat" "108⤵
-
C:\windows\system\OYTQ.exeC:\windows\system\OYTQ.exe109⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BICPQCB.exe.bat" "110⤵
-
C:\windows\SysWOW64\BICPQCB.exeC:\windows\system32\BICPQCB.exe111⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QYDGXX.exe.bat" "112⤵
-
C:\windows\system\QYDGXX.exeC:\windows\system\QYDGXX.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GOQ.exe.bat" "114⤵
-
C:\windows\GOQ.exeC:\windows\GOQ.exe115⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XXSD.exe.bat" "116⤵
-
C:\windows\XXSD.exeC:\windows\XXSD.exe117⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MNFVYRX.exe.bat" "118⤵
-
C:\windows\MNFVYRX.exeC:\windows\MNFVYRX.exe119⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NQJ.exe.bat" "120⤵
-
C:\windows\NQJ.exeC:\windows\NQJ.exe121⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VVW.exe.bat" "122⤵
-
C:\windows\VVW.exeC:\windows\VVW.exe123⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GOL.exe.bat" "124⤵
-
C:\windows\GOL.exeC:\windows\GOL.exe125⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MOT.exe.bat" "126⤵
-
C:\windows\SysWOW64\MOT.exeC:\windows\system32\MOT.exe127⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PWUSV.exe.bat" "128⤵
-
C:\windows\PWUSV.exeC:\windows\PWUSV.exe129⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PPCUB.exe.bat" "130⤵
-
C:\windows\SysWOW64\PPCUB.exeC:\windows\system32\PPCUB.exe131⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XUPAMF.exe.bat" "132⤵
-
C:\windows\SysWOW64\XUPAMF.exeC:\windows\system32\XUPAMF.exe133⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WFS.exe.bat" "134⤵
-
C:\windows\system\WFS.exeC:\windows\system\WFS.exe135⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVY.exe.bat" "136⤵
-
C:\windows\system\AVY.exeC:\windows\system\AVY.exe137⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AYCUM.exe.bat" "138⤵
-
C:\windows\AYCUM.exeC:\windows\AYCUM.exe139⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VMHDWT.exe.bat" "140⤵
-
C:\windows\SysWOW64\VMHDWT.exeC:\windows\system32\VMHDWT.exe141⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\VPL.exe.bat" "142⤵
-
C:\windows\SysWOW64\VPL.exeC:\windows\system32\VPL.exe143⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZXR.exe.bat" "144⤵
-
C:\windows\ZXR.exeC:\windows\ZXR.exe145⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZCS.exe.bat" "146⤵
-
C:\windows\SysWOW64\ZCS.exeC:\windows\system32\ZCS.exe147⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DSYWCH.exe.bat" "148⤵
-
C:\windows\SysWOW64\DSYWCH.exeC:\windows\system32\DSYWCH.exe149⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NQM.exe.bat" "150⤵
-
C:\windows\system\NQM.exeC:\windows\system\NQM.exe151⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZJHJ.exe.bat" "152⤵
-
C:\windows\ZJHJ.exeC:\windows\ZJHJ.exe153⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HOTP.exe.bat" "154⤵
-
C:\windows\HOTP.exeC:\windows\HOTP.exe155⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UZCO.exe.bat" "156⤵
-
C:\windows\SysWOW64\UZCO.exeC:\windows\system32\UZCO.exe157⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\SKNEZM.exe.bat" "158⤵
-
C:\windows\SysWOW64\SKNEZM.exeC:\windows\system32\SKNEZM.exe159⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PPK.exe.bat" "160⤵
-
C:\windows\system\PPK.exeC:\windows\system\PPK.exe161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KDPDQ.exe.bat" "162⤵
-
C:\windows\system\KDPDQ.exeC:\windows\system\KDPDQ.exe163⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XNTJVN.exe.bat" "164⤵
-
C:\windows\XNTJVN.exeC:\windows\XNTJVN.exe165⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NDSMH.exe.bat" "166⤵
-
C:\windows\SysWOW64\NDSMH.exeC:\windows\system32\NDSMH.exe167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IQXVJYZ.exe.bat" "168⤵
-
C:\windows\SysWOW64\IQXVJYZ.exeC:\windows\system32\IQXVJYZ.exe169⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BUOHO.exe.bat" "170⤵
-
C:\windows\SysWOW64\BUOHO.exeC:\windows\system32\BUOHO.exe171⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECVHAVE.exe.bat" "172⤵
-
C:\windows\ECVHAVE.exeC:\windows\ECVHAVE.exe173⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DMGXJB.exe.bat" "174⤵
-
C:\windows\DMGXJB.exeC:\windows\DMGXJB.exe175⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NKLRQJ.exe.bat" "176⤵
-
C:\windows\system\NKLRQJ.exeC:\windows\system\NKLRQJ.exe177⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PIR.exe.bat" "178⤵
-
C:\windows\SysWOW64\PIR.exeC:\windows\system32\PIR.exe179⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\QLDHLHL.exe.bat" "180⤵
-
C:\windows\SysWOW64\QLDHLHL.exeC:\windows\system32\QLDHLHL.exe181⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\PWGXLV.exe.bat" "182⤵
-
C:\windows\SysWOW64\PWGXLV.exeC:\windows\system32\PWGXLV.exe183⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\FMEAXH.exe.bat" "184⤵
-
C:\windows\FMEAXH.exeC:\windows\FMEAXH.exe185⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NZRHI.exe.bat" "186⤵
-
C:\windows\SysWOW64\NZRHI.exeC:\windows\system32\NZRHI.exe187⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RHY.exe.bat" "188⤵
-
C:\windows\system\RHY.exeC:\windows\system\RHY.exe189⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\AFS.exe.bat" "190⤵
-
C:\windows\SysWOW64\AFS.exeC:\windows\system32\AFS.exe191⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WLYNN.exe.bat" "192⤵
-
C:\windows\WLYNN.exeC:\windows\WLYNN.exe193⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TLAP.exe.bat" "194⤵
-
C:\windows\SysWOW64\TLAP.exeC:\windows\system32\TLAP.exe195⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWIR.exe.bat" "196⤵
-
C:\windows\system\TWIR.exeC:\windows\system\TWIR.exe197⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UZM.exe.bat" "198⤵
-
C:\windows\UZM.exeC:\windows\UZM.exe199⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\SKPCSQM.exe.bat" "200⤵
-
C:\windows\system\SKPCSQM.exeC:\windows\system\SKPCSQM.exe201⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ECENK.exe.bat" "202⤵
-
C:\windows\ECENK.exeC:\windows\ECENK.exe203⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CNHD.exe.bat" "204⤵
-
C:\windows\system\CNHD.exeC:\windows\system\CNHD.exe205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZSNAAG.exe.bat" "206⤵
-
C:\windows\ZSNAAG.exeC:\windows\ZSNAAG.exe207⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TGSKKGH.exe.bat" "208⤵
-
C:\windows\TGSKKGH.exeC:\windows\TGSKKGH.exe209⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VELEIV.exe.bat" "210⤵
-
C:\windows\VELEIV.exeC:\windows\VELEIV.exe211⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DWT.exe.bat" "212⤵
-
C:\windows\system\DWT.exeC:\windows\system\DWT.exe213⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IZXMBYY.exe.bat" "214⤵
-
C:\windows\system\IZXMBYY.exeC:\windows\system\IZXMBYY.exe215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JCBIGO.exe.bat" "216⤵
-
C:\windows\JCBIGO.exeC:\windows\JCBIGO.exe217⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FKVPS.exe.bat" "218⤵
-
C:\windows\system\FKVPS.exeC:\windows\system\FKVPS.exe219⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DACA.exe.bat" "220⤵
-
C:\windows\system\DACA.exeC:\windows\system\DACA.exe221⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RLLRKKF.exe.bat" "222⤵
-
C:\windows\SysWOW64\RLLRKKF.exeC:\windows\system32\RLLRKKF.exe223⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YGIDTL.exe.bat" "224⤵
-
C:\windows\SysWOW64\YGIDTL.exeC:\windows\system32\YGIDTL.exe225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBHM.exe.bat" "226⤵
-
C:\windows\EBHM.exeC:\windows\EBHM.exe227⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TWQQJAE.exe.bat" "228⤵
-
C:\windows\system\TWQQJAE.exeC:\windows\system\TWQQJAE.exe229⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BKDXUHZ.exe.bat" "230⤵
-
C:\windows\SysWOW64\BKDXUHZ.exeC:\windows\system32\BKDXUHZ.exe231⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\FSKF.exe.bat" "232⤵
-
C:\windows\system\FSKF.exeC:\windows\system\FSKF.exe233⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RVUKPE.exe.bat" "234⤵
-
C:\windows\SysWOW64\RVUKPE.exeC:\windows\system32\RVUKPE.exe235⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\BDWXTBA.exe.bat" "236⤵
-
C:\windows\system\BDWXTBA.exeC:\windows\system\BDWXTBA.exe237⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QYGCE.exe.bat" "238⤵
-
C:\windows\system\QYGCE.exeC:\windows\system\QYGCE.exe239⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QEGQFB.exe.bat" "240⤵