mimikatz | dc98e4298092c14f23bb07a8eaddb31636abd962ec90436690f1fff8b2ee25b7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe
Size

13.1MB
MD5

bab9a6a875d20d398228fbd76967f394
SHA1

e7cc797edfa873e210990375325a9998b00299b1
SHA256

dc98e4298092c14f23bb07a8eaddb31636abd962ec90436690f1fff8b2ee25b7
SHA512

c70fa8d47e482823c903bcff6058ae0f19224de85eb05b9260a67bcffbb174b338cffd1b26633792c577c7d643b8a3b2e2809e1edc8b640e3d13834aeecf1073
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

mwebabk.exe

description	pid	Process	procid_target
PID 4712 created 2164	4712	mwebabk.exe	38

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (30669) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/4776-182-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-187-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-205-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-218-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-227-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-234-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-246-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-254-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-263-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-372-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-373-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig
behavioral2/memory/4776-375-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1428-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/1428-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/files/0x0008000000023cac-6.dat	mimikatz
behavioral2/memory/4300-138-0x00007FF64E8F0000-0x00007FF64E9DE000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

Processes:

mwebabk.exewpcap.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	mwebabk.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	mwebabk.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

mwebabk.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exe

pid	Process
2296	netsh.exe
3376	netsh.exe

Executes dropped EXE 26 IoCs

Processes:

mwebabk.exemwebabk.exewpcap.exeenbltlpnr.exevfshost.exetzntbfcjz.exexohudmc.exeyqiwma.execllalu.exetzntbfcjz.exemwebabk.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exeqnbbltzyb.exemwebabk.exe

pid	Process
2420	mwebabk.exe
4712	mwebabk.exe
1828	wpcap.exe
2208	enbltlpnr.exe
4300	vfshost.exe
2920	tzntbfcjz.exe
3176	xohudmc.exe
2740	yqiwma.exe
4776	cllalu.exe
2812	tzntbfcjz.exe
1532	mwebabk.exe
396	tzntbfcjz.exe
2304	tzntbfcjz.exe
5016	tzntbfcjz.exe
3488	tzntbfcjz.exe
1404	tzntbfcjz.exe
4280	tzntbfcjz.exe
4160	tzntbfcjz.exe
4580	tzntbfcjz.exe
2560	tzntbfcjz.exe
4460	tzntbfcjz.exe
1588	tzntbfcjz.exe
1740	tzntbfcjz.exe
2956	tzntbfcjz.exe
2028	qnbbltzyb.exe
5860	mwebabk.exe

Loads dropped DLL 12 IoCs

Processes:

wpcap.exeenbltlpnr.exe

pid	Process
1828	wpcap.exe
1828	wpcap.exe
1828	wpcap.exe
1828	wpcap.exe
1828	wpcap.exe
1828	wpcap.exe
1828	wpcap.exe
1828	wpcap.exe
1828	wpcap.exe
2208	enbltlpnr.exe
2208	enbltlpnr.exe
2208	enbltlpnr.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
43	ifconfig.me
44	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

Processes:

wpcap.exemwebabk.exexohudmc.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mwebabk.exe
File created	C:\Windows\SysWOW64\yqiwma.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\yqiwma.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	mwebabk.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	mwebabk.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023cf0-134.dat	upx
behavioral2/memory/4300-135-0x00007FF64E8F0000-0x00007FF64E9DE000-memory.dmp	upx
behavioral2/memory/4300-138-0x00007FF64E8F0000-0x00007FF64E9DE000-memory.dmp	upx
behavioral2/files/0x0007000000023cfb-143.dat	upx
behavioral2/memory/2920-145-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/2920-160-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/files/0x0007000000023cf8-164.dat	upx
behavioral2/memory/4776-165-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/2812-172-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/396-180-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/4776-182-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/2304-185-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/4776-187-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/5016-191-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/3488-195-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/1404-199-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/4280-203-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/4776-205-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/4160-208-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/4580-212-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/2560-216-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/4776-218-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/4460-221-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/1588-225-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/4776-227-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/1740-230-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/2956-233-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp	upx
behavioral2/memory/4776-234-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/4776-246-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/4776-254-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/4776-263-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/4776-372-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/4776-373-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx
behavioral2/memory/4776-375-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

mwebabk.exe2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exeqnbbltzyb.execmd.exe

description	ioc	Process
File created	C:\Windows\vtecbbeeu\UnattendGC\docmicfg.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\docmicfg.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\schoedcl.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\AppCapture64.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\Corporate\mimidrv.sys	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\tucl-1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\svschost.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\trfo-2.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\zlib1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\Shellcode.ini	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\mwebabk.exe	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\ssleay32.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\trch-1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\vimpcsvc.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\Corporate\vfshost.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\Packet.dll	mwebabk.exe
File opened for modification	C:\Windows\vtecbbeeu\vltbqcbqt\Packet.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\posh-0.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\tibe-2.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\qnbbltzyb.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\ucl.dll	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\docmicfg.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\svschost.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\spoolsrv.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\schoedcl.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\spoolsrv.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\vimpcsvc.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\svschost.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\cnli-1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\docmicfg.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\schoedcl.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\Corporate\mimilib.dll	mwebabk.exe
File opened for modification	C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt	qnbbltzyb.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\libeay32.dll	mwebabk.exe
File created	C:\Windows\ime\mwebabk.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\ip.txt	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\coli-0.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\libxml2.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\svschost.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\schoedcl.xml	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\svschost.xml	mwebabk.exe
File opened for modification	C:\Windows\vtecbbeeu\Corporate\log.txt	cmd.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\exma-1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\xdvl-0.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\spoolsrv.exe	mwebabk.exe
File created	C:\Windows\izvjmbrb\docmicfg.xml	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\vimpcsvc.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\mwebabk.exe	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\crli-0.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\scan.bat	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\vimpcsvc.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\spoolsrv.xml	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\schoedcl.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\upbdrjv\swrpwe.exe	mwebabk.exe
File created	C:\Windows\izvjmbrb\vimpcsvc.xml	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\spoolsrv.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\AppCapture32.dll	mwebabk.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid	Process
1484	sc.exe
3124	sc.exe
2860	sc.exe
2252	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

mwebabk.execacls.execmd.exenet1.execmd.execacls.exePING.EXEcacls.execacls.exenetsh.execmd.exenetsh.exenetsh.execmd.execmd.execmd.execmd.exenet.exenet.execmd.exenetsh.execmd.execmd.exenet.execmd.exenetsh.exenet.exenet1.execmd.execmd.exenet1.exesc.execacls.execmd.exenet.exenetsh.execmd.exesc.execacls.exeqnbbltzyb.execmd.exenet.exenet.exenet.exenetsh.execmd.exesc.exe2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exewpcap.exenet1.exenet1.exeschtasks.exenetsh.exenetsh.exexohudmc.exeyqiwma.execmd.execmd.exenetsh.exeschtasks.execmd.exemwebabk.exenetsh.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mwebabk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnbbltzyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yqiwma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mwebabk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXE

pid	Process
4408	cmd.exe
3756	PING.EXE

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
behavioral2/files/0x0008000000023cac-6.dat	nsis_installer_2
behavioral2/files/0x0007000000023cb3-14.dat	nsis_installer_1
behavioral2/files/0x0007000000023cb3-14.dat	nsis_installer_2

Modifies data under HKEY_USERS 39 IoCs

Processes:

tzntbfcjz.exemwebabk.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mwebabk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mwebabk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mwebabk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mwebabk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mwebabk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mwebabk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe

Modifies registry class 14 IoCs

Processes:

mwebabk.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	mwebabk.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
3756	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
2920	schtasks.exe
2028	schtasks.exe
4004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

mwebabk.exe

pid	Process
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid	Process
660
660
660
660
660
660
660
660
660
660
660
660
660
660
660

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe

pid	Process
1428	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exemwebabk.exemwebabk.exevfshost.exetzntbfcjz.execllalu.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exetzntbfcjz.exe

description	pid	Process
Token: SeDebugPrivilege	1428	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	2420	mwebabk.exe
Token: SeDebugPrivilege	4712	mwebabk.exe
Token: SeDebugPrivilege	4300	vfshost.exe
Token: SeDebugPrivilege	2920	tzntbfcjz.exe
Token: SeLockMemoryPrivilege	4776	cllalu.exe
Token: SeLockMemoryPrivilege	4776	cllalu.exe
Token: SeDebugPrivilege	2812	tzntbfcjz.exe
Token: SeDebugPrivilege	396	tzntbfcjz.exe
Token: SeDebugPrivilege	2304	tzntbfcjz.exe
Token: SeDebugPrivilege	5016	tzntbfcjz.exe
Token: SeDebugPrivilege	3488	tzntbfcjz.exe
Token: SeDebugPrivilege	1404	tzntbfcjz.exe
Token: SeDebugPrivilege	4280	tzntbfcjz.exe
Token: SeDebugPrivilege	4160	tzntbfcjz.exe
Token: SeDebugPrivilege	4580	tzntbfcjz.exe
Token: SeDebugPrivilege	2560	tzntbfcjz.exe
Token: SeDebugPrivilege	4460	tzntbfcjz.exe
Token: SeDebugPrivilege	1588	tzntbfcjz.exe
Token: SeDebugPrivilege	1740	tzntbfcjz.exe
Token: SeDebugPrivilege	2956	tzntbfcjz.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exemwebabk.exemwebabk.exexohudmc.exeyqiwma.exemwebabk.exemwebabk.exe

pid	Process
1428	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe
1428	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe
2420	mwebabk.exe
2420	mwebabk.exe
4712	mwebabk.exe
4712	mwebabk.exe
3176	xohudmc.exe
2740	yqiwma.exe
1532	mwebabk.exe
1532	mwebabk.exe
5860	mwebabk.exe
5860	mwebabk.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.execmd.exemwebabk.execmd.execmd.exewpcap.exenet.exenet.exenet.exe

description	pid	Process	procid_target
PID 1428 wrote to memory of 4408	1428	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe	84
PID 1428 wrote to memory of 4408	1428	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe	84
PID 1428 wrote to memory of 4408	1428	2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe	84
PID 4408 wrote to memory of 3756	4408	cmd.exe	87
PID 4408 wrote to memory of 3756	4408	cmd.exe	87
PID 4408 wrote to memory of 3756	4408	cmd.exe	87
PID 4408 wrote to memory of 2420	4408	cmd.exe	89
PID 4408 wrote to memory of 2420	4408	cmd.exe	89
PID 4408 wrote to memory of 2420	4408	cmd.exe	89
PID 4712 wrote to memory of 3068	4712	mwebabk.exe	91
PID 4712 wrote to memory of 3068	4712	mwebabk.exe	91
PID 4712 wrote to memory of 3068	4712	mwebabk.exe	91
PID 3068 wrote to memory of 3996	3068	cmd.exe	93
PID 3068 wrote to memory of 3996	3068	cmd.exe	93
PID 3068 wrote to memory of 3996	3068	cmd.exe	93
PID 3068 wrote to memory of 4612	3068	cmd.exe	94
PID 3068 wrote to memory of 4612	3068	cmd.exe	94
PID 3068 wrote to memory of 4612	3068	cmd.exe	94
PID 3068 wrote to memory of 2668	3068	cmd.exe	95
PID 3068 wrote to memory of 2668	3068	cmd.exe	95
PID 3068 wrote to memory of 2668	3068	cmd.exe	95
PID 3068 wrote to memory of 4604	3068	cmd.exe	96
PID 3068 wrote to memory of 4604	3068	cmd.exe	96
PID 3068 wrote to memory of 4604	3068	cmd.exe	96
PID 3068 wrote to memory of 1116	3068	cmd.exe	97
PID 3068 wrote to memory of 1116	3068	cmd.exe	97
PID 3068 wrote to memory of 1116	3068	cmd.exe	97
PID 3068 wrote to memory of 3596	3068	cmd.exe	98
PID 3068 wrote to memory of 3596	3068	cmd.exe	98
PID 3068 wrote to memory of 3596	3068	cmd.exe	98
PID 4712 wrote to memory of 5040	4712	mwebabk.exe	99
PID 4712 wrote to memory of 5040	4712	mwebabk.exe	99
PID 4712 wrote to memory of 5040	4712	mwebabk.exe	99
PID 4712 wrote to memory of 4732	4712	mwebabk.exe	101
PID 4712 wrote to memory of 4732	4712	mwebabk.exe	101
PID 4712 wrote to memory of 4732	4712	mwebabk.exe	101
PID 4712 wrote to memory of 2988	4712	mwebabk.exe	103
PID 4712 wrote to memory of 2988	4712	mwebabk.exe	103
PID 4712 wrote to memory of 2988	4712	mwebabk.exe	103
PID 4712 wrote to memory of 2700	4712	mwebabk.exe	105
PID 4712 wrote to memory of 2700	4712	mwebabk.exe	105
PID 4712 wrote to memory of 2700	4712	mwebabk.exe	105
PID 2700 wrote to memory of 1828	2700	cmd.exe	107
PID 2700 wrote to memory of 1828	2700	cmd.exe	107
PID 2700 wrote to memory of 1828	2700	cmd.exe	107
PID 1828 wrote to memory of 3668	1828	wpcap.exe	108
PID 1828 wrote to memory of 3668	1828	wpcap.exe	108
PID 1828 wrote to memory of 3668	1828	wpcap.exe	108
PID 3668 wrote to memory of 1608	3668	net.exe	110
PID 3668 wrote to memory of 1608	3668	net.exe	110
PID 3668 wrote to memory of 1608	3668	net.exe	110
PID 1828 wrote to memory of 444	1828	wpcap.exe	111
PID 1828 wrote to memory of 444	1828	wpcap.exe	111
PID 1828 wrote to memory of 444	1828	wpcap.exe	111
PID 444 wrote to memory of 1592	444	net.exe	113
PID 444 wrote to memory of 1592	444	net.exe	113
PID 444 wrote to memory of 1592	444	net.exe	113
PID 1828 wrote to memory of 4848	1828	wpcap.exe	114
PID 1828 wrote to memory of 4848	1828	wpcap.exe	114
PID 1828 wrote to memory of 4848	1828	wpcap.exe	114
PID 4848 wrote to memory of 2628	4848	net.exe	116
PID 4848 wrote to memory of 2628	4848	net.exe	116
PID 4848 wrote to memory of 2628	4848	net.exe	116
PID 1828 wrote to memory of 1360	1828	wpcap.exe	117

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2164
- C:\Windows\TEMP\heglkltzt\cllalu.exe
  "C:\Windows\TEMP\heglkltzt\cllalu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4776

C:\Users\Admin\AppData\Local\Temp\2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-11_bab9a6a875d20d398228fbd76967f394_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\izvjmbrb\mwebabk.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3756
- - C:\Windows\izvjmbrb\mwebabk.exe
    C:\Windows\izvjmbrb\mwebabk.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2420

C:\Windows\izvjmbrb\mwebabk.exe
C:\Windows\izvjmbrb\mwebabk.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1116
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3596
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5040
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4732
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe
    C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3668
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:444
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:1592
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2628
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1360
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:2608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3204
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3840
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2292
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:3080
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1380
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:3608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\vtecbbeeu\vltbqcbqt\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2180
- - C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe
    C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\vtecbbeeu\vltbqcbqt\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\vtecbbeeu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\vtecbbeeu\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:832
- - C:\Windows\vtecbbeeu\Corporate\vfshost.exe
    C:\Windows\vtecbbeeu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bkvcanvad" /ru system /tr "cmd /c C:\Windows\ime\mwebabk.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bkvcanvad" /ru system /tr "cmd /c C:\Windows\ime\mwebabk.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "wcbaitbbb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "wcbaitbbb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "gwenlyqcd" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F"
  2⤵
  PID:4344
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "gwenlyqcd" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2920
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4384
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4228
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4012
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4412
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1300
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4764
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:424
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:880
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1312
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1740
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3212
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3576
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:536
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      PID:1828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3632
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:3608
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3376
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1080
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3616
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:4344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:2104
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2468
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:752
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3396
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2860
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 788 C:\Windows\TEMP\vtecbbeeu\788.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3176
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 64 C:\Windows\TEMP\vtecbbeeu\64.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 2164 C:\Windows\TEMP\vtecbbeeu\2164.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 2660 C:\Windows\TEMP\vtecbbeeu\2660.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 2768 C:\Windows\TEMP\vtecbbeeu\2768.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5016
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 2884 C:\Windows\TEMP\vtecbbeeu\2884.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 1060 C:\Windows\TEMP\vtecbbeeu\1060.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 3740 C:\Windows\TEMP\vtecbbeeu\3740.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4280
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 3832 C:\Windows\TEMP\vtecbbeeu\3832.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 3896 C:\Windows\TEMP\vtecbbeeu\3896.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 3988 C:\Windows\TEMP\vtecbbeeu\3988.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 4888 C:\Windows\TEMP\vtecbbeeu\4888.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 1348 C:\Windows\TEMP\vtecbbeeu\1348.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 5064 C:\Windows\TEMP\vtecbbeeu\5064.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 2336 C:\Windows\TEMP\vtecbbeeu\2336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\vtecbbeeu\vltbqcbqt\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3124
- - C:\Windows\vtecbbeeu\vltbqcbqt\qnbbltzyb.exe
    qnbbltzyb.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5688
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3168
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4516
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:212

C:\Windows\SysWOW64\yqiwma.exe
C:\Windows\SysWOW64\yqiwma.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4580

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F
1⤵
PID:932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1936
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F
  2⤵
  PID:996

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\mwebabk.exe
1⤵
PID:1592
- C:\Windows\ime\mwebabk.exe
  C:\Windows\ime\mwebabk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1532

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F
1⤵
PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3920
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F
  2⤵
  PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:3844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5684

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F
1⤵
PID:5616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5560
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F
  2⤵
  PID:5836

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\mwebabk.exe
1⤵
PID:5928
- C:\Windows\ime\mwebabk.exe
  C:\Windows\ime\mwebabk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5860

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F
1⤵
PID:5936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:6100
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F
  2⤵
  PID:5980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\heglkltzt\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\vtecbbeeu\1060.dmp

Filesize
822KB

MD5
3a54d718a2853b211277a91541ce2a95

SHA1
90d22a8037ef13583ffba7f6a4725ff2b029e9ad

SHA256
c766fc7ee4e9087c11dc5a52cda1b4e9fca8272e95bb9155c416b012ef599ee7

SHA512
5d3b7c289055b4b7dabde2d7c74f700f1f97e35439affe8d8ab08f52bc27bc23b7f52bd2ffdd0a962f1bf1ba20a800dcf87b7c8f8d750afcad187b468490827e

Download Submit
C:\Windows\TEMP\vtecbbeeu\1348.dmp

Filesize
25.7MB

MD5
f3528af778bb3c993e8be48b9ccf5169

SHA1
4df8b8646a58adaa6562479fe03f4b0297f45c50

SHA256
f8f95f411db7972a5b85e29334c12f06b99df493260913aa2bbb84c4f545a4b0

SHA512
f1161fbd4e4ba6901bd9d620f1e43c0290cbd6dcb9f5dbe038c5e25c720f0714186e5730151dc8cea8a15f47de95a5c093536d968a13794cfcead459405b35ba

Download Submit
C:\Windows\TEMP\vtecbbeeu\2164.dmp

Filesize
4.2MB

MD5
4a2c5aed2f6b079b44cd6f132ab100ea

SHA1
35edd100f769249cdf727ff19293f4014d2020c3

SHA256
20182c7fe50b36e674b1d8764bf06cb3036609d7d8343469ad74634f5a4ffb8b

SHA512
7402e9e9d3be69e2e5caca92cc64557d9dbfe251fc52d320e2b907859ee3e9cf11fc3840ddc32b938f999530fae7b4d391092454a486492c60e631942abed8fe

Download Submit
C:\Windows\TEMP\vtecbbeeu\2660.dmp

Filesize
3.8MB

MD5
6ab74767e1b761dd5abb60b06e52ac35

SHA1
e6efda3184bad23d53c648f7fa565f883674d94e

SHA256
6a39ae47a9501f794afc42737b0fb382317cd94bbbb695dc826cdfb3a4e2e790

SHA512
92696f8840f45d84d519332c20c9da7e3d74cc50143615b4850ea73a2da3783ba57ce1d580fb50575e173689e7e6fbaf9cfed25f0d6ca3bba9c985e2c3cefd74

Download Submit
C:\Windows\TEMP\vtecbbeeu\2768.dmp

Filesize
7.5MB

MD5
7bfb05f330ee675498c7788faf33e811

SHA1
eff9889d9503a404fde3b33bccf457ffad65e5ee

SHA256
5c2566f7efdfffb6da113ec0056c610a7f3f51fc92c079dc762f930c068155b7

SHA512
eefb4ac18fa1baa465caa5dfe684bd67f6b47418bd32c111dae7da43eb4133f0258923474ccc869da6c98f175a66c654aff17524dda54a710a19ec3424af6bbd

Download Submit
C:\Windows\TEMP\vtecbbeeu\2884.dmp

Filesize
3.0MB

MD5
6e02bf9152d902f9a3bbd03753cfd0ce

SHA1
668137dd4be138f35b1b2a8e594e4aeb94934b03

SHA256
08fc109a2be065a819420cce633222ed658eb674044ec6649637e9545c18b777

SHA512
5fb23b21f61df1ec4baebe97dae1886cf7b536d6b40bc6d5d894196ba21c743562bd6cfdc972ff5e6ad9fa9ce98bf22575875be0d417de489a409d248fab3a7a

Download Submit
C:\Windows\TEMP\vtecbbeeu\3740.dmp

Filesize
3.0MB

MD5
d3c7294dd3fd8d7a9b197e5d02c7c861

SHA1
627d1a004edee8c1e8f72326ce97ed5d9709de95

SHA256
cf93831b8879786d779a627a775c7166c5f9ee7995d7da5ff3449273857fb177

SHA512
a28f532d17ac37dd72306cf3815136d330339288660c1ebbed9c7b35c221ed896541983f9fb63392e0dc6b6a52511424cc4b8109744ce5fb757e3f161a37d10d

Download Submit
C:\Windows\TEMP\vtecbbeeu\3832.dmp

Filesize
20.0MB

MD5
a3e6a7edb52e776493553c9e61a1e92f

SHA1
9b657c4209dd57da455d9359832e3a6c952699d2

SHA256
367993167085e660471730527f9bb961a3dba8006f0f85d91866fbb6e848800e

SHA512
843507271b8a3061d3541abaa588db40acf992b3a1fff801dab3943e783872eae2921257e8d957602e4b16c390137961931f437596234db302cc4d5472c804c7

Download Submit
C:\Windows\TEMP\vtecbbeeu\3896.dmp

Filesize
5.0MB

MD5
d9eb95eb28b5401038517bf4b429110c

SHA1
6d3cf31288e87a05a1c736c7265ccaa9fc962816

SHA256
eb55772ec2add8333195b439b202141887eba94dc34d516cd32d53a73ec7201d

SHA512
7c7875aafa42589cbfdcb84eb894f5bf089b2c2fab526c639b5d4c2db0815ea99ae296375b604955f2f536e92ab1c713f2822754ebd13911058fd1cf1fa40595

Download Submit
C:\Windows\TEMP\vtecbbeeu\3988.dmp

Filesize
43.9MB

MD5
88ec3a94252584ec406861bef621cd68

SHA1
1edece20ea2539cb3e61098b5b15195e67d44150

SHA256
bb54315a35c17dfb5eb9b607636eda846b2f28e046ecc4de83612c54a4ecce7a

SHA512
1b2e8607cc7d78366f82177b2c64be8796781846c30389330da86de525eb4b55d45f0153b613fa3f5a57469bc4de53fb1145f650e5ea3543cbfa4a75037c0c4e

Download Submit
C:\Windows\TEMP\vtecbbeeu\4888.dmp

Filesize
1.2MB

MD5
cb1e03019fe856a0a4e0aede9aa07c4f

SHA1
2d65af3732e00eb642e87617367431e4e084a304

SHA256
d359cca94931f6b121eb73470b2474f6bb05557a14e65c62aba53aa2bf4b502f

SHA512
8df47633b2899d4e1087c9c74da7b0b0b4179fc7ac8214e14d58926a1002d1a39adc87805eee74dc45e515708d6651d465bc27f34842c29bb1c98ead89f65f1d

Download Submit
C:\Windows\TEMP\vtecbbeeu\5064.dmp

Filesize
8.5MB

MD5
7c8c199ee590ef307ce61ee9956a0f0d

SHA1
5d53dd7a40f1dd568aef5b54183232a5e9e4ed45

SHA256
6f3af28d86209d1265bc02ac0de02fdbaee11a282a19198327cd00793cae80db

SHA512
2a1e765d8bc7c31b3f8b2c8b2b807884779e9ef3e3432a7aa117c4edb4e40290a26ba501be06e9fc2a604b89c82823ec1aced223416eaf58be47a884439d911e

Download Submit
C:\Windows\TEMP\vtecbbeeu\64.dmp

Filesize
33.6MB

MD5
cef0c77ad6e12db5ce8cbf67f891f04d

SHA1
572cdbf6be9af7d330f136163d3ddde175adc79a

SHA256
0d14036cd0440b11bd84dedcd92f6f561575217c476da008a0b81e87b3f1cae7

SHA512
59c363651b27ddf823ec89023c5d2fb7802fe7eadda0f1a052d1541143739dd01c4992f2f267ddb630133238de4ddf45287019d4a2342225d7fe1ade2a596dfc

Download Submit
C:\Windows\TEMP\vtecbbeeu\788.dmp

Filesize
1019KB

MD5
78fe283f3614c3f6ab9e055a2efeb468

SHA1
9605949c2a165471dfdba54f36ee1152b4cd683d

SHA256
d1471a48d8269586f9de00c1f33149ea2693c1c4d85f2c6666dbab89d63ba6b0

SHA512
34bd77e129c74745acde88aae52ac4c6f8e541ff1b2b2cf453d37471db9de4c12fe45030fa7b17c14b09b2e031d758474c3e292f12d6267781dff66d1b757115

Download Submit
C:\Windows\Temp\heglkltzt\cllalu.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsdF35B.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsdF35B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\vtecbbeeu\tzntbfcjz.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\izvjmbrb\mwebabk.exe

Filesize
13.2MB

MD5
1adce437dd394c0a17bacce1a675fd7d

SHA1
88156257eead63b4d18047d53b70957d636dc618

SHA256
772a0b571a6d842829da12184fa71ef0dd71f9dcbf4cb8f533aa6f23bc98956a

SHA512
070d3df1a1bd70617ce46d97502c2c8e5f8df6e8669222ad437810ded94f203d22a2eaa823833c5abaaae76b49e1f5b7b9bd4ff3bae9e41fba8c523bdbdc8dbc

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\vtecbbeeu\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
648B

MD5
e2c2a947cd6f62c0839925538f6d5e19

SHA1
1291abf00f485e8bfb436f20528e7377ce4caa36

SHA256
cb135de9fab122d91274ac814ae59e7d9d49be4f74216d58a71ee1b56d790e6f

SHA512
6d20b90b883dc4984946668361563552c380f5422c3eb536f2a945bd61531c8881beea140469dedc75312d9f590f37e4825ee6eddf781289e9b809c0af929c53

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
1KB

MD5
28a110a254eb8c0e9e7fc6d40ae67828

SHA1
44c76993744aa74bf2786577428b49781aebae14

SHA256
f5c2acb7bf8c347857ec9ce04ba41b91df616f1f3dca16b37d052178d4b8b195

SHA512
ee36080243f55e4d8c0381331275a744b7911c7d360332c82bbbe231313e9c535b2555be9087c139cce9b3b764252d73ce8d0d671870a70f756a791c3a6c1af1

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
1KB

MD5
3e6164e099d46ceab62378633982c4a3

SHA1
f6180cd499189b8d6a5e0529e65cacd769dd1f8f

SHA256
a770d65d60ab6c035c8bd3ecb48745b9d17a60521ac60039a01ef774ccfbb3fa

SHA512
ae636a602b4dd656357ccc441b634507b127cd5da49a700e444fdee0405a79a39d520b75bc6f2a5b02ffe5c0d80322c47811e7cea10cc0293b3c7f8d977f4839

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/396-180-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/1404-199-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/1428-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/1428-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/1588-225-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/1740-230-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/2028-244-0x0000000000AD0000-0x0000000000AE2000-memory.dmp

Filesize
72KB

Download
memory/2208-78-0x0000000001720000-0x000000000176C000-memory.dmp

Filesize
304KB

Download
memory/2304-185-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/2560-216-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/2812-172-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/2920-160-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/2920-145-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/2956-233-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/3176-148-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3176-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3488-195-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/4160-208-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/4280-203-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/4300-135-0x00007FF64E8F0000-0x00007FF64E9DE000-memory.dmp

Filesize
952KB

Download
memory/4300-138-0x00007FF64E8F0000-0x00007FF64E9DE000-memory.dmp

Filesize
952KB

Download
memory/4460-221-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/4580-212-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download
memory/4776-165-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-254-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-168-0x000001FDE62E0000-0x000001FDE62F0000-memory.dmp

Filesize
64KB

Download
memory/4776-182-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-234-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-187-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-246-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-227-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-263-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-218-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-375-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-205-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-372-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/4776-373-0x00007FF7782A0000-0x00007FF7783C0000-memory.dmp

Filesize
1.1MB

Download
memory/5016-191-0x00007FF6D4B80000-0x00007FF6D4BDB000-memory.dmp

Filesize
364KB

Download