Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26/05/2024, 05:57
Static task
static1
Behavioral task
behavioral1
Sample
77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe
Resource
win10v2004-20240226-en
General
-
Target
77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe
-
Size
629KB
-
MD5
77076524991a132b4d23bb7e83a9edb0
-
SHA1
f8439a70ac3b851a5e67da4b91ca28ec5abc879c
-
SHA256
8999ee0edae430356495baac9163eca6583f679a709179c45688a8e69d319324
-
SHA512
a97809ef692471182abb85963b7822750015f024603520bc36fc1bb4fa7fa3a9eceb5253859594184b51817e93df91654aac55a912de56a7bd08fb7b0c79542a
-
SSDEEP
6144:j4sZBOZdjEYTPXMhaMP/kFTA7OA/BOZdjEYF:jnANL8oq/kFTsOxNF
Malware Config
Signatures
-
Drops file in Drivers directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\system32\drivers\etc\hosts jxmktrq.exe File opened for modification C:\Windows\system32\drivers\etc\hosts bbbtesy.exe File opened for modification C:\Windows\system32\drivers\etc\hosts jrdom.exe File opened for modification C:\Windows\system32\drivers\etc\hosts aaxwqmj.exe -
Deletes itself 1 IoCs
pid Process 2604 jxmktrq.exe -
Executes dropped EXE 64 IoCs
pid Process 2604 jxmktrq.exe 2304 bbbtesy.exe 2620 jrdom.exe 1596 bbbtesy.exe 2764 bbbtesy.exe 1524 bbbtesy.exe 1564 bbbtesy.exe 2148 bbbtesy.exe 2176 bbbtesy.exe 636 bbbtesy.exe 752 bbbtesy.exe 2112 bbbtesy.exe 1860 bbbtesy.exe 2040 bbbtesy.exe 2708 bbbtesy.exe 1156 bbbtesy.exe 2004 bbbtesy.exe 1684 bbbtesy.exe 2960 bbbtesy.exe 2836 bbbtesy.exe 2940 bbbtesy.exe 2844 bbbtesy.exe 1404 bbbtesy.exe 1292 bbbtesy.exe 1928 bbbtesy.exe 1972 bbbtesy.exe 2248 bbbtesy.exe 540 bbbtesy.exe 1952 bbbtesy.exe 2196 bbbtesy.exe 2224 bbbtesy.exe 1552 bbbtesy.exe 1392 bbbtesy.exe 1960 bbbtesy.exe 856 bbbtesy.exe 2644 bbbtesy.exe 1720 bbbtesy.exe 1092 bbbtesy.exe 1692 bbbtesy.exe 2432 bbbtesy.exe 2272 bbbtesy.exe 2316 bbbtesy.exe 1844 bbbtesy.exe 1456 bbbtesy.exe 1264 bbbtesy.exe 1880 bbbtesy.exe 1268 bbbtesy.exe 1520 bbbtesy.exe 936 bbbtesy.exe 1012 bbbtesy.exe 1704 bbbtesy.exe 1660 bbbtesy.exe 2240 bbbtesy.exe 1004 bbbtesy.exe 880 bbbtesy.exe 1936 bbbtesy.exe 2280 bbbtesy.exe 1576 bbbtesy.exe 2076 bbbtesy.exe 1980 bbbtesy.exe 1708 bbbtesy.exe 560 bbbtesy.exe 1608 bbbtesy.exe 2244 bbbtesy.exe -
Loads dropped DLL 64 IoCs
pid Process 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 1596 bbbtesy.exe 1596 bbbtesy.exe -
Adds Run key to start application 2 TTPs 18 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jxmktrq = "c:\\windows\\system\\jxmktrq.exe" 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jxmktrq = "c:\\windows\\system\\jxmktrq.exe" jxmktrq.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrdom = "c:\\windows\\jrdom.exe" bbbtesy.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\aaxwqmj = "c:\\windows\\system32\\aaxwqmj.exe" aaxwqmj.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\bbbtesy = "c:\\windows\\system32\\bbbtesy.exe" 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\bbbtesy = "c:\\windows\\system32\\bbbtesy.exe" bbbtesy.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\aaxwqmj = "c:\\windows\\system32\\aaxwqmj.exe" jrdom.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jxmktrq = "c:\\windows\\system\\jxmktrq.exe" aaxwqmj.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrdom = "c:\\windows\\jrdom.exe" 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\bbbtesy = "c:\\windows\\system32\\bbbtesy.exe" jxmktrq.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jxmktrq = "c:\\windows\\system\\jxmktrq.exe" jrdom.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\bbbtesy = "c:\\windows\\system32\\bbbtesy.exe" jrdom.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\aaxwqmj = "c:\\windows\\system32\\aaxwqmj.exe" jxmktrq.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\aaxwqmj = "c:\\windows\\system32\\aaxwqmj.exe" bbbtesy.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrdom = "c:\\windows\\jrdom.exe" jxmktrq.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jxmktrq = "c:\\windows\\system\\jxmktrq.exe" bbbtesy.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrdom = "c:\\windows\\jrdom.exe" jrdom.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\jrdom = "c:\\windows\\jrdom.exe" aaxwqmj.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\bbrbuekd.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\xvraoc.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\aaxwqmj.exe bbbtesy.exe File opened for modification C:\Windows\SysWOW64\hkmitcnl.exe bbbtesy.exe File opened for modification C:\Windows\SysWOW64\jinnnqg.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\zfgkmt.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\bbrbuekd.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\xitutb.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\vxos.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\tuyxs.exe bbbtesy.exe File opened for modification C:\Windows\SysWOW64\hllxvex.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\vxos.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\tuyxs.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\hllxvex.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\xitutb.exe bbbtesy.exe File opened for modification C:\Windows\SysWOW64\tuyxs.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\xvraoc.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\legh.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\jinnnqg.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\bbrbuekd.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\xvraoc.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\aaxwqmj.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\tuyxs.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\rfzbkued.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\legh.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\hkmitcnl.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\hllxvex.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\hkmitcnl.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\jinnnqg.exe bbbtesy.exe File opened for modification C:\Windows\SysWOW64\legh.exe bbbtesy.exe File opened for modification C:\Windows\SysWOW64\cgzobkz.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\rfzbkued.exe jrdom.exe File opened for modification \??\c:\windows\SysWOW64\bbbtesy.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\zfgkmt.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\xitutb.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\xvraoc.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File created \??\c:\windows\SysWOW64\bbbtesy.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\xitutb.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\rfzbkued.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\bbrbuekd.exe bbbtesy.exe File opened for modification \??\c:\windows\SysWOW64\aaxwqmj.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\bbrbuekd.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\vxos.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\bbbtesy.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\aaxwqmj.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\rfzbkued.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\legh.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\hkmitcnl.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\zfgkmt.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\aaxwqmj.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\tuyxs.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\hkmitcnl.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\zfgkmt.exe bbbtesy.exe File opened for modification C:\Windows\SysWOW64\xitutb.exe jrdom.exe File opened for modification C:\Windows\SysWOW64\vxos.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\jinnnqg.exe jxmktrq.exe File opened for modification C:\windows\SysWOW64\bbbtesy.exe bbbtesy.exe File created \??\c:\windows\SysWOW64\aaxwqmj.exe jrdom.exe File opened for modification C:\windows\SysWOW64\aaxwqmj.exe aaxwqmj.exe File opened for modification \??\c:\windows\syswow64\bbbtesy.exe aaxwqmj.exe File opened for modification C:\Windows\SysWOW64\cgzobkz.exe 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\xvraoc.exe bbbtesy.exe File opened for modification C:\Windows\SysWOW64\legh.exe jxmktrq.exe File opened for modification C:\Windows\SysWOW64\hllxvex.exe bbbtesy.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\fzzfvszyjczc jrdom.exe File opened for modification C:\Windows\system\gxveczjczc aaxwqmj.exe File opened for modification C:\Windows\system\lcaozaijczc aaxwqmj.exe File opened for modification C:\Windows\system\cww.rtifjczc jxmktrq.exe File opened for modification C:\Windows\system\ap.korvjczc bbbtesy.exe File opened for modification C:\Windows\bamyqvbvjczc jrdom.exe File opened for modification C:\Windows\system\uwoqlrajczc aaxwqmj.exe File opened for modification C:\Windows\system\lqcygwzjczc aaxwqmj.exe File opened for modification C:\Windows\system\gmykmkjczc jxmktrq.exe File opened for modification C:\Windows\wscnjczc jrdom.exe File opened for modification C:\Windows\system\nluqgtujczc aaxwqmj.exe File opened for modification C:\Windows\system\wq.rn.djczc bbbtesy.exe File opened for modification C:\Windows\system\pqzcfjczc bbbtesy.exe File opened for modification C:\Windows\dtg.ejczc jrdom.exe File opened for modification C:\Windows\system\nkdemjczc 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\system\lwkpq.jczc jxmktrq.exe File opened for modification C:\Windows\system\pnahgdijczc jxmktrq.exe File opened for modification C:\Windows\system\onddwjczc jxmktrq.exe File opened for modification C:\Windows\system\faiekigjczc jxmktrq.exe File opened for modification C:\Windows\system\vl.ljczc jxmktrq.exe File opened for modification C:\Windows\system\swy.hhxjczc bbbtesy.exe File opened for modification C:\Windows\system\sls.ifxsjczc jxmktrq.exe File opened for modification C:\Windows\system\kgrfqmsjczc bbbtesy.exe File opened for modification C:\Windows\system\oimwrgytjczc aaxwqmj.exe File opened for modification C:\Windows\system\hpgnylvcjczc jxmktrq.exe File opened for modification C:\Windows\system\ig.hghmzjczc jxmktrq.exe File opened for modification C:\Windows\system\rnbxbetbjczc jxmktrq.exe File opened for modification C:\Windows\system\vbeosbrjczc 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\system\wgzyvdtjczc bbbtesy.exe File opened for modification C:\Windows\system\fdwsevjczc jxmktrq.exe File opened for modification C:\Windows\system\olmrnjczc bbbtesy.exe File opened for modification C:\Windows\piyfitfjczc jrdom.exe File opened for modification C:\Windows\system\qbsuefkbjczc 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\system\fhurltijczc 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\system\cxiwkyjczc 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\tozgfcijczc jrdom.exe File opened for modification C:\Windows\system\xqrfq.hjczc bbbtesy.exe File opened for modification C:\Windows\system\dmvmoqvjczc bbbtesy.exe File opened for modification C:\Windows\system\itsxgbbxjczc bbbtesy.exe File opened for modification C:\Windows\system\gxihle.jczc 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe File opened for modification C:\Windows\wxiitcxmjczc jrdom.exe File opened for modification C:\Windows\hosilvijczc jrdom.exe File opened for modification C:\Windows\system\mazmbjczc jxmktrq.exe File opened for modification C:\Windows\mb.syejczc jrdom.exe File opened for modification C:\Windows\system\cfhzt.brjczc aaxwqmj.exe File opened for modification C:\Windows\.lgmsdmjczc jrdom.exe File opened for modification C:\Windows\system\tlpojczc jxmktrq.exe File opened for modification C:\Windows\system\snwdjczc bbbtesy.exe File opened for modification C:\Windows\system\fnfiijczc bbbtesy.exe File opened for modification C:\Windows\system\sfmajczc aaxwqmj.exe File opened for modification C:\Windows\system\c.fojczc jxmktrq.exe File opened for modification C:\Windows\system\.olnzjczc jxmktrq.exe File opened for modification C:\Windows\system\ihxxjczc bbbtesy.exe File opened for modification C:\Windows\system\aplelbjczc jxmktrq.exe File opened for modification C:\Windows\system\utvnwamcjczc bbbtesy.exe File opened for modification C:\Windows\system\bzxfzggjczc jxmktrq.exe File opened for modification C:\Windows\system\ybcocyyfjczc jxmktrq.exe File opened for modification C:\Windows\vflljczc jrdom.exe File opened for modification C:\Windows\system\hefzcusqjczc jxmktrq.exe File opened for modification C:\Windows\system\sonmjczc jxmktrq.exe File opened for modification C:\Windows\system\eccdxhjczc aaxwqmj.exe File opened for modification C:\Windows\system\vmxmpxjczc bbbtesy.exe File opened for modification C:\Windows\system\zmbwgogsjczc bbbtesy.exe File opened for modification C:\Windows\zabpjczc jrdom.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 2604 jxmktrq.exe 2304 bbbtesy.exe 2620 jrdom.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 1596 bbbtesy.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 1596 bbbtesy.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2604 jxmktrq.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 2620 jrdom.exe 1596 bbbtesy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2604 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 28 PID 2976 wrote to memory of 2604 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 28 PID 2976 wrote to memory of 2604 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 28 PID 2976 wrote to memory of 2604 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 28 PID 2976 wrote to memory of 2304 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 29 PID 2976 wrote to memory of 2304 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 29 PID 2976 wrote to memory of 2304 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 29 PID 2976 wrote to memory of 2304 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 29 PID 2976 wrote to memory of 2620 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 30 PID 2976 wrote to memory of 2620 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 30 PID 2976 wrote to memory of 2620 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 30 PID 2976 wrote to memory of 2620 2976 77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe 30 PID 2604 wrote to memory of 1596 2604 jxmktrq.exe 31 PID 2604 wrote to memory of 1596 2604 jxmktrq.exe 31 PID 2604 wrote to memory of 1596 2604 jxmktrq.exe 31 PID 2604 wrote to memory of 1596 2604 jxmktrq.exe 31 PID 1596 wrote to memory of 2764 1596 bbbtesy.exe 32 PID 1596 wrote to memory of 2764 1596 bbbtesy.exe 32 PID 1596 wrote to memory of 2764 1596 bbbtesy.exe 32 PID 1596 wrote to memory of 2764 1596 bbbtesy.exe 32 PID 2620 wrote to memory of 1524 2620 jrdom.exe 33 PID 2620 wrote to memory of 1524 2620 jrdom.exe 33 PID 2620 wrote to memory of 1524 2620 jrdom.exe 33 PID 2620 wrote to memory of 1524 2620 jrdom.exe 33 PID 2604 wrote to memory of 1564 2604 jxmktrq.exe 34 PID 2604 wrote to memory of 1564 2604 jxmktrq.exe 34 PID 2604 wrote to memory of 1564 2604 jxmktrq.exe 34 PID 2604 wrote to memory of 1564 2604 jxmktrq.exe 34 PID 1596 wrote to memory of 2148 1596 bbbtesy.exe 35 PID 1596 wrote to memory of 2148 1596 bbbtesy.exe 35 PID 1596 wrote to memory of 2148 1596 bbbtesy.exe 35 PID 1596 wrote to memory of 2148 1596 bbbtesy.exe 35 PID 2620 wrote to memory of 2176 2620 jrdom.exe 36 PID 2620 wrote to memory of 2176 2620 jrdom.exe 36 PID 2620 wrote to memory of 2176 2620 jrdom.exe 36 PID 2620 wrote to memory of 2176 2620 jrdom.exe 36 PID 2604 wrote to memory of 636 2604 jxmktrq.exe 37 PID 2604 wrote to memory of 636 2604 jxmktrq.exe 37 PID 2604 wrote to memory of 636 2604 jxmktrq.exe 37 PID 2604 wrote to memory of 636 2604 jxmktrq.exe 37 PID 2620 wrote to memory of 752 2620 jrdom.exe 38 PID 2620 wrote to memory of 752 2620 jrdom.exe 38 PID 2620 wrote to memory of 752 2620 jrdom.exe 38 PID 2620 wrote to memory of 752 2620 jrdom.exe 38 PID 1596 wrote to memory of 2112 1596 bbbtesy.exe 39 PID 1596 wrote to memory of 2112 1596 bbbtesy.exe 39 PID 1596 wrote to memory of 2112 1596 bbbtesy.exe 39 PID 1596 wrote to memory of 2112 1596 bbbtesy.exe 39 PID 2604 wrote to memory of 1860 2604 jxmktrq.exe 40 PID 2604 wrote to memory of 1860 2604 jxmktrq.exe 40 PID 2604 wrote to memory of 1860 2604 jxmktrq.exe 40 PID 2604 wrote to memory of 1860 2604 jxmktrq.exe 40 PID 2620 wrote to memory of 2040 2620 jrdom.exe 41 PID 2620 wrote to memory of 2040 2620 jrdom.exe 41 PID 2620 wrote to memory of 2040 2620 jrdom.exe 41 PID 2620 wrote to memory of 2040 2620 jrdom.exe 41 PID 1596 wrote to memory of 2708 1596 bbbtesy.exe 42 PID 1596 wrote to memory of 2708 1596 bbbtesy.exe 42 PID 1596 wrote to memory of 2708 1596 bbbtesy.exe 42 PID 1596 wrote to memory of 2708 1596 bbbtesy.exe 42 PID 2604 wrote to memory of 1156 2604 jxmktrq.exe 43 PID 2604 wrote to memory of 1156 2604 jxmktrq.exe 43 PID 2604 wrote to memory of 1156 2604 jxmktrq.exe 43 PID 2604 wrote to memory of 1156 2604 jxmktrq.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\windows\system\jxmktrq.exe"C:\windows\system\jxmktrq.exe" "C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe"2⤵
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2764
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2148
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2112
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2708
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1684
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2940
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1292
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2248
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2196
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1392
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2644
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1692
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2316
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1264
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1520
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1704
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1004
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:2280
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1980
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵
- Executes dropped EXE
PID:1608
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1948
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1636
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1512
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1932
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:2560
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:2876
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:2464
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:2652
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:2820
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:2648
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1944
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:3032
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1624
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1516
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:2168
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:2160
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:532
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:576
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1604
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:2824
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1172
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"4⤵PID:1684
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe" "C:\windows\SysWOW64\bbbtesy.exe"4⤵
- Drops file in System32 directory
PID:3016
-
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1564
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:636
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1860
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1156
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2960
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2844
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1928
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:540
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2224
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1960
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1720
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2432
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1844
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1880
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:936
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1660
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:880
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1576
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1708
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2244
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:3012
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:1896
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2540
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:3020
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2684
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2612
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2716
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2492
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2628
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2380
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2528
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:860
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:1580
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2764
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:1644
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2184
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:1328
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:552
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:680
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:668
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2040
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2812
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:2256
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:1052
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:1776
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:3068
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:2316
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:1228
-
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe" "C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2304
-
-
C:\windows\jrdom.exe"C:\windows\jrdom.exe" "C:\Users\Admin\AppData\Local\Temp\77076524991a132b4d23bb7e83a9edb0_NeikiAnalytics.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1524
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2176
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:752
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2040
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2004
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2836
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1404
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1972
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1952
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1552
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:856
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1092
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2272
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1456
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1268
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1012
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2240
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:1936
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:2076
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵
- Executes dropped EXE
PID:560
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:616
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2904
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:1632
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:3024
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2600
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2720
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2580
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2572
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2480
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2512
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2728
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:1236
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2784
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:768
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:1564
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:996
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2148
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:844
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:780
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2252
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2000
-
-
C:\windows\SysWOW64\bbbtesy.exe"C:\windows\system32\bbbtesy.exe"3⤵PID:2012
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:2220 -
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"4⤵PID:1112
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"4⤵PID:1716
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"4⤵PID:1076
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"4⤵PID:2328
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"4⤵PID:1460
-
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:1396
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:2692
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:1152
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:2284
-
-
C:\windows\SysWOW64\aaxwqmj.exe"C:\windows\system32\aaxwqmj.exe"3⤵PID:1444
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824KB
MD5df4c3258b1787546a9caa598b9fe740f
SHA143525098551d4d601e423ef6cbc4abb2e9053adf
SHA256eb700b9142395565f60da84af4289b713e30f90c760e1d4f689cdcc358963fd6
SHA51219e06487a6a7b188af9aab91d8f90bda949f133282c50edaff3afec305b6b45bb9958b31c2224ffd89c7c33edea68ca6626f62d444160b388f05a71e45109c08
-
Filesize
629KB
MD577076524991a132b4d23bb7e83a9edb0
SHA1f8439a70ac3b851a5e67da4b91ca28ec5abc879c
SHA2568999ee0edae430356495baac9163eca6583f679a709179c45688a8e69d319324
SHA512a97809ef692471182abb85963b7822750015f024603520bc36fc1bb4fa7fa3a9eceb5253859594184b51817e93df91654aac55a912de56a7bd08fb7b0c79542a