blackmoon | ac442c0b864c77d7929629c87ac0527a7111b9a779d0600fe1224348100731e1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Size 9.6MB
Sample260415-fbkejaez2q
SHA256 ac442c0b864c77d7929629c87ac0527a7111b9a779d0600fe1224348100731e1
MD5 9b23fb4d8a8e5c56b0daf9a08e3ef6e8
SHA1 3d235440547f4d4bd7acdd72aedb9c166a184da4
SHA512 aaf52bda4f1843d827a96e9a3a40b3ca7857a95e3ac00a41296c589635f0f606d5e6d814116ed317058688cfcc1134c71fa40eebd84088f2dd5fbf21ca7fd414
SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
TLSH
T1FDA6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery blackmoon mimikatz installer trojan upx

Malware Config

Signatures

Family: Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon
Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detect Blackmoon payload 5 IoCs

resource	yara_rule
behavioral1/memory/3084-0-0x0000000000400000-0x0000000000CEB000-memory.dmp	family_blackmoon
behavioral1/memory/3084-4-0x0000000000400000-0x0000000000CEB000-memory.dmp	family_blackmoon
behavioral1/files/0x00080000000242e3-7.dat	family_blackmoon
behavioral1/memory/4820-9-0x0000000000400000-0x0000000000CEB000-memory.dmp	family_blackmoon
behavioral1/memory/3792-21-0x0000000000400000-0x0000000000466000-memory.dmp	family_blackmoon

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral1/memory/3084-0-0x0000000000400000-0x0000000000CEB000-memory.dmp	mimikatz
behavioral1/memory/3084-4-0x0000000000400000-0x0000000000CEB000-memory.dmp	mimikatz
behavioral1/files/0x00080000000242e3-7.dat	mimikatz
behavioral1/memory/4820-9-0x0000000000400000-0x0000000000CEB000-memory.dmp	mimikatz

Custom signature

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral1/memory/3084-0-0x0000000000400000-0x0000000000CEB000-memory.dmp	UPX
behavioral1/memory/3084-4-0x0000000000400000-0x0000000000CEB000-memory.dmp	UPX
behavioral1/files/0x00080000000242e3-7.dat	UPX
behavioral1/memory/4820-9-0x0000000000400000-0x0000000000CEB000-memory.dmp	UPX
behavioral1/files/0x000800000001e120-17.dat	UPX
behavioral1/memory/3792-18-0x0000000000400000-0x0000000000466000-memory.dmp	UPX
behavioral1/memory/3792-21-0x0000000000400000-0x0000000000466000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	lmcepqq.exe

Executes dropped EXE 3 IoCs

pid	Process
4820	lmcepqq.exe
4860	lmcepqq.exe
3792	ivfcyggvsstuuvp574.exe

Unexpected DNS network traffic destination 60 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	63	51.75.173.177	2008	nslookup.exe
Destination IP	67	79.124.7.81	3260	nslookup.exe
Destination IP	71	5.132.191.104	2836	nslookup.exe
Destination IP	26	163.172.168.171	4100	nslookup.exe
Destination IP	61	51.75.173.177	2008	nslookup.exe
Destination IP	30	94.103.153.176	2648	nslookup.exe
Destination IP	43	51.77.227.84	4088	nslookup.exe
Destination IP	87	142.4.204.111	1932	nslookup.exe
Destination IP	90	142.4.205.47	3208	nslookup.exe
Destination IP	92	198.100.148.224	928	nslookup.exe
Destination IP	49	188.226.146.136	1576	nslookup.exe
Destination IP	78	207.148.83.241	3536	nslookup.exe
Destination IP	80	207.148.83.241	3536	nslookup.exe
Destination IP	108	185.84.81.194	3916	nslookup.exe
Destination IP	18	161.97.219.84	1328	nslookup.exe
Destination IP	36	207.192.71.13	3532	nslookup.exe
Destination IP	89	142.4.205.47	3208	nslookup.exe
Destination IP	17	161.97.219.84	1328	nslookup.exe
Destination IP	23	163.172.168.171	4100	nslookup.exe
Destination IP	66	79.124.7.81	3260	nslookup.exe
Destination IP	19	161.97.219.84	1328	nslookup.exe
Destination IP	37	178.63.116.152	960	nslookup.exe
Destination IP	88	142.4.204.111	1932	nslookup.exe
Destination IP	96	159.203.38.175	3328	nslookup.exe
Destination IP	65	79.124.7.81	3260	nslookup.exe
Destination IP	104	66.70.228.164	4332	nslookup.exe
Destination IP	106	51.254.25.115	4804	nslookup.exe
Destination IP	76	13.239.157.177	768	nslookup.exe
Destination IP	77	13.239.157.177	768	nslookup.exe
Destination IP	84	142.4.204.111	1932	nslookup.exe
Destination IP	93	198.100.148.224	928	nslookup.exe
Destination IP	50	188.226.146.136	1576	nslookup.exe
Destination IP	91	142.4.205.47	3208	nslookup.exe
Destination IP	101	159.203.38.175	3328	nslookup.exe
Destination IP	38	178.63.116.152	960	nslookup.exe
Destination IP	39	178.63.116.152	960	nslookup.exe
Destination IP	40	51.77.227.84	4088	nslookup.exe
Destination IP	64	51.75.173.177	2008	nslookup.exe
Destination IP	81	165.227.40.43	5036	nslookup.exe
Destination IP	83	165.227.40.43	5036	nslookup.exe
Destination IP	95	159.203.38.175	3328	nslookup.exe
Destination IP	105	51.254.25.115	4804	nslookup.exe
Destination IP	34	207.192.71.13	3532	nslookup.exe
Destination IP	69	144.76.103.143	436	nslookup.exe
Destination IP	70	144.76.103.143	436	nslookup.exe
Destination IP	32	94.103.153.176	2648	nslookup.exe
Destination IP	33	94.103.153.176	2648	nslookup.exe
Destination IP	35	207.192.71.13	3532	nslookup.exe
Destination IP	51	188.226.146.136	1576	nslookup.exe
Destination IP	82	165.227.40.43	5036	nslookup.exe
Destination IP	68	144.76.103.143	436	nslookup.exe
Destination IP	72	5.132.191.104	2836	nslookup.exe
Destination IP	73	13.239.157.177	768	nslookup.exe
Destination IP	103	66.70.228.164	4332	nslookup.exe
Destination IP	41	51.77.227.84	4088	nslookup.exe
Destination IP	79	207.148.83.241	3536	nslookup.exe
Destination IP	102	66.70.228.164	4332	nslookup.exe
Destination IP	107	51.254.25.115	4804	nslookup.exe
Destination IP	27	163.172.168.171	4100	nslookup.exe
Destination IP	94	198.100.148.224	928	nslookup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001e120-17.dat	upx
behavioral1/memory/3792-18-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/3792-21-0x0000000000400000-0x0000000000466000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\ezzpukhh\lmcepqq.exe	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
File opened for modification	C:\Windows\ezzpukhh\lmcepqq.exe	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
File created	C:\Windows\ezzpukhh\ivfcyggvsstuuvp574.exe	lmcepqq.exe

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lmcepqq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lmcepqq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4704	cmd.exe
768	PING.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x00080000000242e3-7.dat	nsis_installer_2

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
768	PING.EXE

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe
3792	ivfcyggvsstuuvp574.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3084	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Token: SeDebugPrivilege	4820	lmcepqq.exe
Token: SeDebugPrivilege	4860	lmcepqq.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3084	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
4820	lmcepqq.exe
4860	lmcepqq.exe
3792	ivfcyggvsstuuvp574.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 4704	3084	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe	84
PID 4704 wrote to memory of 768	4704	cmd.exe	86
PID 4704 wrote to memory of 4820	4704	cmd.exe	89
PID 4860 wrote to memory of 3792	4860	lmcepqq.exe	91
PID 4860 wrote to memory of 3832	4860	lmcepqq.exe	93
PID 3832 wrote to memory of 1328	3832	cmd.exe	96
PID 4860 wrote to memory of 3132	4860	lmcepqq.exe	100
PID 3132 wrote to memory of 4100	3132	cmd.exe	102
PID 4860 wrote to memory of 208	4860	lmcepqq.exe	104
PID 208 wrote to memory of 2648	208	cmd.exe	106
PID 4860 wrote to memory of 5080	4860	lmcepqq.exe	107
PID 5080 wrote to memory of 3532	5080	cmd.exe	109
PID 4860 wrote to memory of 1468	4860	lmcepqq.exe	110
PID 1468 wrote to memory of 960	1468	cmd.exe	112
PID 4860 wrote to memory of 1908	4860	lmcepqq.exe	113
PID 1908 wrote to memory of 4088	1908	cmd.exe	115
PID 4860 wrote to memory of 2896	4860	lmcepqq.exe	116
PID 2896 wrote to memory of 1576	2896	cmd.exe	118
PID 4860 wrote to memory of 4320	4860	lmcepqq.exe	119
PID 4320 wrote to memory of 2008	4320	cmd.exe	121
PID 4860 wrote to memory of 4372	4860	lmcepqq.exe	123
PID 4372 wrote to memory of 3260	4372	cmd.exe	125
PID 4860 wrote to memory of 4164	4860	lmcepqq.exe	126
PID 4164 wrote to memory of 436	4164	cmd.exe	128
PID 4860 wrote to memory of 700	4860	lmcepqq.exe	129
PID 700 wrote to memory of 2836	700	cmd.exe	131
PID 4860 wrote to memory of 3880	4860	lmcepqq.exe	132
PID 3880 wrote to memory of 768	3880	cmd.exe	134
PID 4860 wrote to memory of 4456	4860	lmcepqq.exe	135
PID 4456 wrote to memory of 3536	4456	cmd.exe	137
PID 4860 wrote to memory of 3720	4860	lmcepqq.exe	138
PID 3720 wrote to memory of 5036	3720	cmd.exe	140
PID 4860 wrote to memory of 4092	4860	lmcepqq.exe	141
PID 4092 wrote to memory of 1932	4092	cmd.exe	143
PID 4860 wrote to memory of 3620	4860	lmcepqq.exe	144
PID 3620 wrote to memory of 3208	3620	cmd.exe	146
PID 4860 wrote to memory of 2376	4860	lmcepqq.exe	147
PID 2376 wrote to memory of 928	2376	cmd.exe	149
PID 4860 wrote to memory of 4420	4860	lmcepqq.exe	150
PID 4420 wrote to memory of 3328	4420	cmd.exe	152
PID 4860 wrote to memory of 1520	4860	lmcepqq.exe	153
PID 1520 wrote to memory of 4332	1520	cmd.exe	155
PID 4860 wrote to memory of 2440	4860	lmcepqq.exe	156
PID 2440 wrote to memory of 4804	2440	cmd.exe	158
PID 4860 wrote to memory of 904	4860	lmcepqq.exe	159
PID 904 wrote to memory of 3916	904	cmd.exe	161

C:\Users\Admin\AppData\Local\Temp\2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ezzpukhh\lmcepqq.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:768
- - C:\Windows\ezzpukhh\lmcepqq.exe
    C:\Windows\ezzpukhh\lmcepqq.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4820

C:\Windows\ezzpukhh\lmcepqq.exe
C:\Windows\ezzpukhh\lmcepqq.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\ezzpukhh\ivfcyggvsstuuvp574.exe
  C:\Windows\ezzpukhh\ivfcyggvsstuuvp574.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 161.97.219.84
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 161.97.219.84
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 163.172.168.171
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 163.172.168.171
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 94.103.153.176
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 94.103.153.176
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 207.192.71.13
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 207.192.71.13
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 178.63.116.152
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 178.63.116.152
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 51.77.227.84
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 51.77.227.84
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 188.226.146.136
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 188.226.146.136
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 51.75.173.177
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 51.75.173.177
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 79.124.7.81
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 79.124.7.81
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 144.76.103.143
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 144.76.103.143
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 5.132.191.104
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 5.132.191.104
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 13.239.157.177
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 13.239.157.177
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 207.148.83.241
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 207.148.83.241
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3536
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 165.227.40.43
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 165.227.40.43
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 142.4.204.111
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 142.4.204.111
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 142.4.205.47
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 142.4.205.47
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3208
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 198.100.148.224
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 198.100.148.224
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 159.203.38.175
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 159.203.38.175
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 66.70.228.164
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 66.70.228.164
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 51.254.25.115
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 51.254.25.115
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 185.84.81.194
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 185.84.81.194
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ivfcyggvsstuuvp574.exe

Path C:\Windows\ezzpukhh\ivfcyggvsstuuvp574.exe
Size 69KB
SHA256 875abc09f1abc43dfcc8a9c2a5e541c9a8bcaf33a4e8faa20c58947f8c8b56fa
MD5 8a761ad0a469caa921b8a1bdb989b9d1
SHA1 4584c31d116e15f402cc17122edd304eb6c95b2e
SHA512 d2e541a9a245ea883b54e06583c5db4532e042e333f633e9dc20a1fd5d8d11c46a283274bcde0f972234a63f95e518a27da50f34a1899d88a398bbeb76cb371f
SSDEEP 1536:7tIzh1n7bEn4yT4R9879VRcDTVGI2j0+Ke3tTip:hmh1n7b24RmJzA2j0A3tTi
TLSH
T1C563021612F7B4F8D5BB0573CFC540D3A186F22FD4C613EE9BC66D2A3D119A8A6A1074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmcepqq.exe

Path C:\Windows\ezzpukhh\lmcepqq.exe
Size 9.7MB
SHA256 905a1b6930ca6bab6209b67a2518e905bfdfe1cdeb6716d03b33e1e58a1c0dde
MD5 5c39e763981ad8f318daa991c5c412d7
SHA1 f1ae969708e1f8b755e88fc6aeec3eff0bb89572
SHA512 deb7e97e472dd5b81174b86d6aebfcfe1fee7b412ad4a690733ca148641186e55ad708d892808cc1a1abf0484b95f26f31a25f52f10125ce39e2578f721061a2
SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
TLSH
T1DFA6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3084-0-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/3084-4-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/3084-5-0x0000000002A40000-0x0000000002AC7000-memory.dmp

Download

memory/3792-18-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/3792-20-0x0000000000D20000-0x0000000000D49000-memory.dmp

Download

memory/3792-21-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/4820-9-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/4820-15-0x0000000002950000-0x00000000029D7000-memory.dmp

Download