Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 20:56
General
-
Target
0dfe3d8158f64c497e62344493f2f6ae5a87be1a4ed09b477cc66e28f3d68246.exe
-
Size
282KB
-
MD5
1dddabcb33a8af52dbd5d14a31f8bfa0
-
SHA1
af44bc450e24fa311d34cf1016396e4da3987509
-
SHA256
0dfe3d8158f64c497e62344493f2f6ae5a87be1a4ed09b477cc66e28f3d68246
-
SHA512
f27c767a50c9629c4ef66e0a6a2e337a6b8d40503bd596ac4c1f83e4ae30774b23f00c5e4a57199c3b155d339b13caf8fcebe6cff469444600af84188b07cbf6
-
SSDEEP
6144:iXu/YXoz+PglGhhx9ebK7mOoS3C+kEjiPISUOgW9X+hOGzC/:GmYXoqPgl+9eaNv3C+kmZzcukG2/
Score
10/10
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 17 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Drops file in System32 directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dfe3d8158f64c497e62344493f2f6ae5a87be1a4ed09b477cc66e28f3d68246.exe"C:\Users\Admin\AppData\Local\Temp\0dfe3d8158f64c497e62344493f2f6ae5a87be1a4ed09b477cc66e28f3d68246.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\IBLL.exe.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\system\IBLL.exeC:\windows\system\IBLL.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZRSOL.exe.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\ZRSOL.exeC:\windows\ZRSOL.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MNKWV.exe.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\MNKWV.exeC:\windows\MNKWV.exe7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TIHI.exe.bat" "8⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\TIHI.exeC:\windows\system32\TIHI.exe9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RFBLS.exe.bat" "10⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\RFBLS.exeC:\windows\system32\RFBLS.exe11⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KAS.exe.bat" "12⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\KAS.exeC:\windows\KAS.exe13⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DTZ.exe.bat" "14⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\DTZ.exeC:\windows\DTZ.exe15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZJCPJUR.exe.bat" "16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV117⤵
-
C:\windows\SysWOW64\ZJCPJUR.exeC:\windows\system32\ZJCPJUR.exe17⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\TCJASVH.exe.bat" "18⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\TCJASVH.exeC:\windows\TCJASVH.exe19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LFNW.exe.bat" "20⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\LFNW.exeC:\windows\system32\LFNW.exe21⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DFPBJIL.exe.bat" "22⤵
- Suspicious use of WriteProcessMemory
-
C:\windows\DFPBJIL.exeC:\windows\DFPBJIL.exe23⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BVIEW.exe.bat" "24⤵
-
C:\windows\SysWOW64\BVIEW.exeC:\windows\system32\BVIEW.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QLJDDJI.exe.bat" "26⤵
-
C:\windows\system\QLJDDJI.exeC:\windows\system\QLJDDJI.exe27⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\PEMLLP.exe.bat" "28⤵
-
C:\windows\PEMLLP.exeC:\windows\PEMLLP.exe29⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CGUKAA.exe.bat" "30⤵
-
C:\windows\SysWOW64\CGUKAA.exeC:\windows\system32\CGUKAA.exe31⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XCZTCZO.exe.bat" "32⤵
-
C:\windows\XCZTCZO.exeC:\windows\XCZTCZO.exe33⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KZHFML.exe.bat" "34⤵
-
C:\windows\KZHFML.exeC:\windows\KZHFML.exe35⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\BNSXCIM.exe.bat" "36⤵
-
C:\windows\SysWOW64\BNSXCIM.exeC:\windows\system32\BNSXCIM.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KSWEEG.exe.bat" "38⤵
-
C:\windows\KSWEEG.exeC:\windows\KSWEEG.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CVOPIL.exe.bat" "40⤵
-
C:\windows\system\CVOPIL.exeC:\windows\system\CVOPIL.exe41⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NODA.exe.bat" "42⤵
-
C:\windows\system\NODA.exeC:\windows\system\NODA.exe43⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JZMR.exe.bat" "44⤵
-
C:\windows\JZMR.exeC:\windows\JZMR.exe45⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SZOESM.exe.bat" "46⤵
-
C:\windows\SZOESM.exeC:\windows\SZOESM.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HPPV.exe.bat" "48⤵
-
C:\windows\system\HPPV.exeC:\windows\system\HPPV.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\JNCQGQT.exe.bat" "50⤵
-
C:\windows\JNCQGQT.exeC:\windows\JNCQGQT.exe51⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GSA.exe.bat" "52⤵
-
C:\windows\GSA.exeC:\windows\GSA.exe53⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\HVQB.exe.bat" "54⤵
-
C:\windows\SysWOW64\HVQB.exeC:\windows\system32\HVQB.exe55⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\YWSOFGZ.exe.bat" "56⤵
-
C:\windows\YWSOFGZ.exeC:\windows\YWSOFGZ.exe57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ATGAU.exe.bat" "58⤵
-
C:\windows\SysWOW64\ATGAU.exeC:\windows\system32\ATGAU.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\GUNODJB.exe.bat" "60⤵
-
C:\windows\SysWOW64\GUNODJB.exeC:\windows\system32\GUNODJB.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VKONKE.exe.bat" "62⤵
-
C:\windows\system\VKONKE.exeC:\windows\system\VKONKE.exe63⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XHU.exe.bat" "64⤵
-
C:\windows\SysWOW64\XHU.exeC:\windows\system32\XHU.exe65⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\IAXA.exe.bat" "66⤵
-
C:\windows\SysWOW64\IAXA.exeC:\windows\system32\IAXA.exe67⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\SYDN.exe.bat" "68⤵
-
C:\windows\SYDN.exeC:\windows\SYDN.exe69⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WOJVTV.exe.bat" "70⤵
-
C:\windows\WOJVTV.exeC:\windows\WOJVTV.exe71⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XJN.exe.bat" "72⤵
-
C:\windows\system\XJN.exeC:\windows\system\XJN.exe73⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QMZUEBW.exe.bat" "74⤵
-
C:\windows\system\QMZUEBW.exeC:\windows\system\QMZUEBW.exe75⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VMHIVDX.exe.bat" "76⤵
-
C:\windows\system\VMHIVDX.exeC:\windows\system\VMHIVDX.exe77⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JPD.exe.bat" "78⤵
-
C:\windows\SysWOW64\JPD.exeC:\windows\system32\JPD.exe79⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UIGZ.exe.bat" "80⤵
-
C:\windows\UIGZ.exeC:\windows\UIGZ.exe81⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HSOYPMD.exe.bat" "82⤵
-
C:\windows\HSOYPMD.exeC:\windows\HSOYPMD.exe83⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CGGPY.exe.bat" "84⤵
-
C:\windows\system\CGGPY.exeC:\windows\system\CGGPY.exe85⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GWN.exe.bat" "86⤵
-
C:\windows\GWN.exeC:\windows\GWN.exe87⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\CEH.exe.bat" "88⤵
-
C:\windows\CEH.exeC:\windows\CEH.exe89⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WRMGP.exe.bat" "90⤵
-
C:\windows\WRMGP.exeC:\windows\WRMGP.exe91⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JCQN.exe.bat" "92⤵
-
C:\windows\system\JCQN.exeC:\windows\system\JCQN.exe93⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\RNZO.exe.bat" "94⤵
-
C:\windows\SysWOW64\RNZO.exeC:\windows\system32\RNZO.exe95⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PNGCRHP.exe.bat" "96⤵
-
C:\windows\system\PNGCRHP.exeC:\windows\system\PNGCRHP.exe97⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\CYC.exe.bat" "98⤵
-
C:\windows\system\CYC.exeC:\windows\system\CYC.exe99⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZVIYMIM.exe.bat" "100⤵
-
C:\windows\SysWOW64\ZVIYMIM.exeC:\windows\system32\ZVIYMIM.exe101⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EGE.exe.bat" "102⤵
-
C:\windows\EGE.exeC:\windows\EGE.exe103⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\DRPMZ.exe.bat" "104⤵
-
C:\windows\system\DRPMZ.exeC:\windows\system\DRPMZ.exe105⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PHVUM.exe.bat" "106⤵
-
C:\windows\system\PHVUM.exeC:\windows\system\PHVUM.exe107⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\YHYZPD.exe.bat" "108⤵
-
C:\windows\SysWOW64\YHYZPD.exeC:\windows\system32\YHYZPD.exe109⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZKONEFV.exe.bat" "110⤵
-
C:\windows\SysWOW64\ZKONEFV.exeC:\windows\system32\ZKONEFV.exe111⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\DSIDH.exe.bat" "112⤵
-
C:\windows\DSIDH.exeC:\windows\DSIDH.exe113⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZTKFLI.exe.bat" "114⤵
-
C:\windows\ZTKFLI.exeC:\windows\ZTKFLI.exe115⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QJRIWB.exe.bat" "116⤵
-
C:\windows\system\QJRIWB.exeC:\windows\system\QJRIWB.exe117⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZHLJIX.exe.bat" "118⤵
-
C:\windows\ZHLJIX.exeC:\windows\ZHLJIX.exe119⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\DXRR.exe.bat" "120⤵
-
C:\windows\SysWOW64\DXRR.exeC:\windows\system32\DXRR.exe121⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\NUX.exe.bat" "122⤵
-
C:\windows\SysWOW64\NUX.exeC:\windows\system32\NUX.exe123⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\WVZR.exe.bat" "124⤵
-
C:\windows\system\WVZR.exeC:\windows\system\WVZR.exe125⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\XYDMST.exe.bat" "126⤵
-
C:\windows\SysWOW64\XYDMST.exeC:\windows\system32\XYDMST.exe127⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\VJOCB.exe.bat" "128⤵
-
C:\windows\system\VJOCB.exeC:\windows\system\VJOCB.exe129⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KOLZIJW.exe.bat" "130⤵
-
C:\windows\SysWOW64\KOLZIJW.exeC:\windows\system32\KOLZIJW.exe131⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\EBQJ.exe.bat" "132⤵
-
C:\windows\EBQJ.exeC:\windows\EBQJ.exe133⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UWANDVU.exe.bat" "134⤵
-
C:\windows\system\UWANDVU.exeC:\windows\system\UWANDVU.exe135⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UZMR.exe.bat" "136⤵
-
C:\windows\SysWOW64\UZMR.exeC:\windows\system32\UZMR.exe137⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\NDPNWJF.exe.bat" "138⤵
-
C:\windows\system\NDPNWJF.exeC:\windows\system\NDPNWJF.exe139⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\EDE.exe.bat" "140⤵
-
C:\windows\system\EDE.exeC:\windows\system\EDE.exe141⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\GBXMHP.exe.bat" "142⤵
-
C:\windows\system\GBXMHP.exeC:\windows\system\GBXMHP.exe143⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CLFLVA.exe.bat" "144⤵
-
C:\windows\SysWOW64\CLFLVA.exeC:\windows\system32\CLFLVA.exe145⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JBG.exe.bat" "146⤵
-
C:\windows\system\JBG.exeC:\windows\system\JBG.exe147⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\MPLT.exe.bat" "148⤵
-
C:\windows\MPLT.exeC:\windows\MPLT.exe149⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\JPTHVPQ.exe.bat" "150⤵
-
C:\windows\system\JPTHVPQ.exeC:\windows\system\JPTHVPQ.exe151⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KSXDBF.exe.bat" "152⤵
-
C:\windows\SysWOW64\KSXDBF.exeC:\windows\system32\KSXDBF.exe153⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QNIEP.exe.bat" "154⤵
-
C:\windows\system\QNIEP.exeC:\windows\system\QNIEP.exe155⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\CVP.exe.bat" "156⤵
-
C:\windows\SysWOW64\CVP.exeC:\windows\system32\CVP.exe157⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\VYBIGCX.exe.bat" "158⤵
-
C:\windows\VYBIGCX.exeC:\windows\VYBIGCX.exe159⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KOC.exe.bat" "160⤵
-
C:\windows\system\KOC.exeC:\windows\system\KOC.exe161⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MMHTUGD.exe.bat" "162⤵
-
C:\windows\SysWOW64\MMHTUGD.exeC:\windows\system32\MMHTUGD.exe163⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\HPQSJ.exe.bat" "164⤵
-
C:\windows\HPQSJ.exeC:\windows\HPQSJ.exe165⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\LFESV.exe.bat" "166⤵
-
C:\windows\SysWOW64\LFESV.exeC:\windows\system32\LFESV.exe167⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ZDE.exe.bat" "168⤵
-
C:\windows\SysWOW64\ZDE.exeC:\windows\system32\ZDE.exe169⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZGIHC.exe.bat" "170⤵
-
C:\windows\system\ZGIHC.exeC:\windows\system\ZGIHC.exe171⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\UTNRMCM.exe.bat" "172⤵
-
C:\windows\system\UTNRMCM.exeC:\windows\system\UTNRMCM.exe173⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JOWVX.exe.bat" "174⤵
-
C:\windows\SysWOW64\JOWVX.exeC:\windows\system32\JOWVX.exe175⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\EKBFIXJ.exe.bat" "176⤵
-
C:\windows\SysWOW64\EKBFIXJ.exeC:\windows\system32\EKBFIXJ.exe177⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TACEO.exe.bat" "178⤵
-
C:\windows\system\TACEO.exeC:\windows\system\TACEO.exe179⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\AVM.exe.bat" "180⤵
-
C:\windows\system\AVM.exeC:\windows\system\AVM.exe181⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\ZFWYI.exe.bat" "182⤵
-
C:\windows\system\ZFWYI.exeC:\windows\system\ZFWYI.exe183⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\KYRRQT.exe.bat" "184⤵
-
C:\windows\KYRRQT.exeC:\windows\KYRRQT.exe185⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\LBVNW.exe.bat" "186⤵
-
C:\windows\LBVNW.exeC:\windows\LBVNW.exe187⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\AWN.exe.bat" "188⤵
-
C:\windows\AWN.exeC:\windows\AWN.exe189⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\ICRGRCQ.exe.bat" "190⤵
-
C:\windows\SysWOW64\ICRGRCQ.exeC:\windows\system32\ICRGRCQ.exe191⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\RKTL.exe.bat" "192⤵
-
C:\windows\system\RKTL.exeC:\windows\system\RKTL.exe193⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\JKVQG.exe.bat" "194⤵
-
C:\windows\SysWOW64\JKVQG.exeC:\windows\system32\JKVQG.exe195⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WVEPU.exe.bat" "196⤵
-
C:\windows\SysWOW64\WVEPU.exeC:\windows\system32\WVEPU.exe197⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TAKMC.exe.bat" "198⤵
-
C:\windows\SysWOW64\TAKMC.exeC:\windows\system32\TAKMC.exe199⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ARL.exe.bat" "200⤵
-
C:\windows\ARL.exeC:\windows\ARL.exe201⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\KOQXQV.exe.bat" "202⤵
-
C:\windows\system\KOQXQV.exeC:\windows\system\KOQXQV.exe203⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\QPY.exe.bat" "204⤵
-
C:\windows\system\QPY.exeC:\windows\system\QPY.exe205⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\WKXMDS.exe.bat" "206⤵
-
C:\windows\SysWOW64\WKXMDS.exeC:\windows\system32\WKXMDS.exe207⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\UAQP.exe.bat" "208⤵
-
C:\windows\UAQP.exeC:\windows\UAQP.exe209⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\MVOHZ.exe.bat" "210⤵
-
C:\windows\SysWOW64\MVOHZ.exeC:\windows\system32\MVOHZ.exe211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\WDWYHTR.exe.bat" "212⤵
-
C:\windows\WDWYHTR.exeC:\windows\WDWYHTR.exe213⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\OLYDLQ.exe.bat" "214⤵
-
C:\windows\SysWOW64\OLYDLQ.exeC:\windows\system32\OLYDLQ.exe215⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\HEFO.exe.bat" "216⤵
-
C:\windows\system\HEFO.exeC:\windows\system\HEFO.exe217⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\UPWM.exe.bat" "218⤵
-
C:\windows\SysWOW64\UPWM.exeC:\windows\system32\UPWM.exe219⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\NKAIWS.exe.bat" "220⤵
-
C:\windows\NKAIWS.exeC:\windows\NKAIWS.exe221⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\XHFCD.exe.bat" "222⤵
-
C:\windows\XHFCD.exeC:\windows\XHFCD.exe223⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\GQHHHY.exe.bat" "224⤵
-
C:\windows\GQHHHY.exeC:\windows\GQHHHY.exe225⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\XQWFTPM.exe.bat" "226⤵
-
C:\windows\system\XQWFTPM.exeC:\windows\system\XQWFTPM.exe227⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\PYYSX.exe.bat" "228⤵
-
C:\windows\system\PYYSX.exeC:\windows\system\PYYSX.exe229⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\TGESJEC.exe.bat" "230⤵
-
C:\windows\SysWOW64\TGESJEC.exeC:\windows\system32\TGESJEC.exe231⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system32\KPTXWVF.exe.bat" "232⤵
-
C:\windows\SysWOW64\KPTXWVF.exeC:\windows\system32\KPTXWVF.exe233⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZFUPCR.exe.bat" "234⤵
-
C:\windows\ZFUPCR.exeC:\windows\ZFUPCR.exe235⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\USZ.exe.bat" "236⤵
-
C:\windows\USZ.exeC:\windows\USZ.exe237⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\system\TDBOV.exe.bat" "238⤵
-
C:\windows\system\TDBOV.exeC:\windows\system\TDBOV.exe239⤵
- Checks computer location settings
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows\ZDJCEZG.exe.bat" "240⤵
-
C:\windows\ZDJCEZG.exeC:\windows\ZDJCEZG.exe241⤵
- Drops file in Windows directory