blackmoon | ac442c0b864c77d7929629c87ac0527a7111b9a779d0600fe1224348100731e1

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Size 9.6MB
Sample260415-fbkejaez2q
SHA256 ac442c0b864c77d7929629c87ac0527a7111b9a779d0600fe1224348100731e1
MD5 9b23fb4d8a8e5c56b0daf9a08e3ef6e8
SHA1 3d235440547f4d4bd7acdd72aedb9c166a184da4
SHA512 aaf52bda4f1843d827a96e9a3a40b3ca7857a95e3ac00a41296c589635f0f606d5e6d814116ed317058688cfcc1134c71fa40eebd84088f2dd5fbf21ca7fd414
SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
TLSH
T1FDA6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery blackmoon mimikatz installer trojan upx

Malware Config

Signatures

Family: Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon
Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detect Blackmoon payload 5 IoCs

resource	yara_rule
behavioral2/memory/644-0-0x0000000000400000-0x0000000000CEB000-memory.dmp	family_blackmoon
behavioral2/memory/644-4-0x0000000000400000-0x0000000000CEB000-memory.dmp	family_blackmoon
behavioral2/files/0x002000000002b2db-6.dat	family_blackmoon
behavioral2/memory/692-8-0x0000000000400000-0x0000000000CEB000-memory.dmp	family_blackmoon
behavioral2/memory/3944-18-0x0000000000400000-0x0000000000466000-memory.dmp	family_blackmoon

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral2/memory/644-0-0x0000000000400000-0x0000000000CEB000-memory.dmp	mimikatz
behavioral2/memory/644-4-0x0000000000400000-0x0000000000CEB000-memory.dmp	mimikatz
behavioral2/files/0x002000000002b2db-6.dat	mimikatz
behavioral2/memory/692-8-0x0000000000400000-0x0000000000CEB000-memory.dmp	mimikatz

Custom signature

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral2/memory/644-0-0x0000000000400000-0x0000000000CEB000-memory.dmp	UPX
behavioral2/memory/644-4-0x0000000000400000-0x0000000000CEB000-memory.dmp	UPX
behavioral2/files/0x002000000002b2db-6.dat	UPX
behavioral2/memory/692-8-0x0000000000400000-0x0000000000CEB000-memory.dmp	UPX
behavioral2/files/0x001b00000002b450-14.dat	UPX
behavioral2/memory/3944-16-0x0000000000400000-0x0000000000466000-memory.dmp	UPX
behavioral2/memory/3944-18-0x0000000000400000-0x0000000000466000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ecazenq.exe

Executes dropped EXE 3 IoCs

pid	Process
692	ecazenq.exe
2388	ecazenq.exe
3944	prgvpxqrzgddehp31203.exe

Unexpected DNS network traffic destination 60 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	15	207.192.71.13	4364	nslookup.exe
Destination IP	22	188.226.146.136	1420	nslookup.exe
Destination IP	28	51.75.173.177	4160	nslookup.exe
Destination IP	55	198.100.148.224	3288	nslookup.exe
Destination IP	26	51.75.173.177	4160	nslookup.exe
Destination IP	29	79.124.7.81	3704	nslookup.exe
Destination IP	31	79.124.7.81	3704	nslookup.exe
Destination IP	62	51.254.25.115	4684	nslookup.exe
Destination IP	46	165.227.40.43	3024	nslookup.exe
Destination IP	61	66.70.228.164	3164	nslookup.exe
Destination IP	2	161.97.219.84	2096	nslookup.exe
Destination IP	42	207.148.83.241	2592	nslookup.exe
Destination IP	54	198.100.148.224	3288	nslookup.exe
Destination IP	18	178.63.116.152	4120	nslookup.exe
Destination IP	20	51.77.227.84	3780	nslookup.exe
Destination IP	34	144.76.103.143	5012	nslookup.exe
Destination IP	41	207.148.83.241	2592	nslookup.exe
Destination IP	59	66.70.228.164	3164	nslookup.exe
Destination IP	60	66.70.228.164	3164	nslookup.exe
Destination IP	4	161.97.219.84	2096	nslookup.exe
Destination IP	9	94.103.153.176	3360	nslookup.exe
Destination IP	45	165.227.40.43	3024	nslookup.exe
Destination IP	49	142.4.204.111	2924	nslookup.exe
Destination IP	57	159.203.38.175	4240	nslookup.exe
Destination IP	58	159.203.38.175	4240	nslookup.exe
Destination IP	19	51.77.227.84	3780	nslookup.exe
Destination IP	30	79.124.7.81	3704	nslookup.exe
Destination IP	36	5.132.191.104	232	nslookup.exe
Destination IP	38	13.239.157.177	1116	nslookup.exe
Destination IP	11	94.103.153.176	3360	nslookup.exe
Destination IP	21	51.77.227.84	3780	nslookup.exe
Destination IP	63	51.254.25.115	4684	nslookup.exe
Destination IP	17	178.63.116.152	4120	nslookup.exe
Destination IP	37	5.132.191.104	232	nslookup.exe
Destination IP	53	198.100.148.224	3288	nslookup.exe
Destination IP	48	142.4.204.111	2924	nslookup.exe
Destination IP	16	178.63.116.152	4120	nslookup.exe
Destination IP	66	185.84.81.194	3732	nslookup.exe
Destination IP	3	161.97.219.84	2096	nslookup.exe
Destination IP	6	163.172.168.171	3416	nslookup.exe
Destination IP	7	163.172.168.171	3416	nslookup.exe
Destination IP	8	163.172.168.171	3416	nslookup.exe
Destination IP	10	94.103.153.176	3360	nslookup.exe
Destination IP	24	188.226.146.136	1420	nslookup.exe
Destination IP	27	51.75.173.177	4160	nslookup.exe
Destination IP	32	144.76.103.143	5012	nslookup.exe
Destination IP	23	188.226.146.136	1420	nslookup.exe
Destination IP	39	13.239.157.177	1116	nslookup.exe
Destination IP	44	165.227.40.43	3024	nslookup.exe
Destination IP	64	51.254.25.115	4684	nslookup.exe
Destination IP	51	142.4.205.47	3976	nslookup.exe
Destination IP	52	142.4.205.47	3976	nslookup.exe
Destination IP	12	207.192.71.13	4364	nslookup.exe
Destination IP	43	207.148.83.241	2592	nslookup.exe
Destination IP	47	142.4.204.111	2924	nslookup.exe
Destination IP	50	142.4.205.47	3976	nslookup.exe
Destination IP	14	207.192.71.13	4364	nslookup.exe
Destination IP	33	144.76.103.143	5012	nslookup.exe
Destination IP	40	13.239.157.177	1116	nslookup.exe
Destination IP	56	159.203.38.175	4240	nslookup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001b00000002b450-14.dat	upx
behavioral2/memory/3944-16-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral2/memory/3944-18-0x0000000000400000-0x0000000000466000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\uehygdit\ecazenq.exe	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
File created	C:\Windows\uehygdit\prgvpxqrzgddehp31203.exe	ecazenq.exe
File created	C:\Windows\uehygdit\ecazenq.exe	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecazenq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecazenq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5064	cmd.exe
1656	PING.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x002000000002b2db-6.dat	nsis_installer_2

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1656	PING.EXE

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe
3944	prgvpxqrzgddehp31203.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
644	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Token: SeDebugPrivilege	692	ecazenq.exe
Token: SeDebugPrivilege	2388	ecazenq.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
644	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
692	ecazenq.exe
2388	ecazenq.exe
3944	prgvpxqrzgddehp31203.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 5064	644	2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe	79
PID 5064 wrote to memory of 1656	5064	cmd.exe	81
PID 5064 wrote to memory of 692	5064	cmd.exe	82
PID 2388 wrote to memory of 3944	2388	ecazenq.exe	84
PID 2388 wrote to memory of 2812	2388	ecazenq.exe	85
PID 2812 wrote to memory of 2096	2812	cmd.exe	87
PID 2388 wrote to memory of 2444	2388	ecazenq.exe	88
PID 2444 wrote to memory of 3416	2444	cmd.exe	90
PID 2388 wrote to memory of 4576	2388	ecazenq.exe	91
PID 4576 wrote to memory of 3360	4576	cmd.exe	93
PID 2388 wrote to memory of 3980	2388	ecazenq.exe	94
PID 3980 wrote to memory of 4364	3980	cmd.exe	96
PID 2388 wrote to memory of 4324	2388	ecazenq.exe	97
PID 4324 wrote to memory of 4120	4324	cmd.exe	99
PID 2388 wrote to memory of 2100	2388	ecazenq.exe	100
PID 2100 wrote to memory of 3780	2100	cmd.exe	102
PID 2388 wrote to memory of 3952	2388	ecazenq.exe	103
PID 3952 wrote to memory of 1420	3952	cmd.exe	105
PID 2388 wrote to memory of 4340	2388	ecazenq.exe	106
PID 4340 wrote to memory of 4160	4340	cmd.exe	108
PID 2388 wrote to memory of 3612	2388	ecazenq.exe	109
PID 3612 wrote to memory of 3704	3612	cmd.exe	111
PID 2388 wrote to memory of 756	2388	ecazenq.exe	112
PID 756 wrote to memory of 5012	756	cmd.exe	114
PID 2388 wrote to memory of 4196	2388	ecazenq.exe	115
PID 4196 wrote to memory of 232	4196	cmd.exe	117
PID 2388 wrote to memory of 1592	2388	ecazenq.exe	118
PID 1592 wrote to memory of 1116	1592	cmd.exe	120
PID 2388 wrote to memory of 4620	2388	ecazenq.exe	121
PID 4620 wrote to memory of 2592	4620	cmd.exe	123
PID 2388 wrote to memory of 2120	2388	ecazenq.exe	124
PID 2120 wrote to memory of 3024	2120	cmd.exe	126
PID 2388 wrote to memory of 3644	2388	ecazenq.exe	127
PID 3644 wrote to memory of 2924	3644	cmd.exe	129
PID 2388 wrote to memory of 588	2388	ecazenq.exe	130
PID 588 wrote to memory of 3976	588	cmd.exe	132
PID 2388 wrote to memory of 2440	2388	ecazenq.exe	133
PID 2440 wrote to memory of 3288	2440	cmd.exe	135
PID 2388 wrote to memory of 4752	2388	ecazenq.exe	136
PID 4752 wrote to memory of 4240	4752	cmd.exe	138
PID 2388 wrote to memory of 4380	2388	ecazenq.exe	139
PID 4380 wrote to memory of 3164	4380	cmd.exe	141
PID 2388 wrote to memory of 2780	2388	ecazenq.exe	142
PID 2780 wrote to memory of 4684	2780	cmd.exe	144
PID 2388 wrote to memory of 3400	2388	ecazenq.exe	145
PID 3400 wrote to memory of 3732	3400	cmd.exe	147

C:\Users\Admin\AppData\Local\Temp\2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_9b23fb4d8a8e5c56b0daf9a08e3ef6e8_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\uehygdit\ecazenq.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1656
- - C:\Windows\uehygdit\ecazenq.exe
    C:\Windows\uehygdit\ecazenq.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:692

C:\Windows\uehygdit\ecazenq.exe
C:\Windows\uehygdit\ecazenq.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\uehygdit\prgvpxqrzgddehp31203.exe
  C:\Windows\uehygdit\prgvpxqrzgddehp31203.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 161.97.219.84
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 161.97.219.84
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2096
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 163.172.168.171
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 163.172.168.171
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 94.103.153.176
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 94.103.153.176
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 207.192.71.13
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 207.192.71.13
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 178.63.116.152
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 178.63.116.152
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 51.77.227.84
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 51.77.227.84
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 188.226.146.136
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 188.226.146.136
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 51.75.173.177
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 51.75.173.177
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 79.124.7.81
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 79.124.7.81
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 144.76.103.143
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:756
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 144.76.103.143
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 5.132.191.104
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 5.132.191.104
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 13.239.157.177
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 13.239.157.177
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 207.148.83.241
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 207.148.83.241
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 165.227.40.43
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 165.227.40.43
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 142.4.204.111
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 142.4.204.111
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 142.4.205.47
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 142.4.205.47
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 198.100.148.224
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 198.100.148.224
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 159.203.38.175
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 159.203.38.175
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 66.70.228.164
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 66.70.228.164
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 51.254.25.115
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 51.254.25.115
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4684
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 185.84.81.194
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 185.84.81.194
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ecazenq.exe

Path C:\Windows\uehygdit\ecazenq.exe
Size 9.7MB
SHA256 cc90afb63883e8edb7b93d207f1864ee3c45bc0b2f2e5f9700f383dd195e951b
MD5 271de60398128a9b92de417afc1c1ba6
SHA1 4210f9d215dd479e9921b82c1ebbd7aadae58d2b
SHA512 cfb2dcd1e0636c413b9789788d047e045670638cb01d0914929bdbf37ba227e25e5d131f0730f4edb79484485ba15f998cd1db5a5de24b059489a6c5842180cf
SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
TLSH
T1CAA6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prgvpxqrzgddehp31203.exe

Path C:\Windows\uehygdit\prgvpxqrzgddehp31203.exe
Size 69KB
SHA256 875abc09f1abc43dfcc8a9c2a5e541c9a8bcaf33a4e8faa20c58947f8c8b56fa
MD5 8a761ad0a469caa921b8a1bdb989b9d1
SHA1 4584c31d116e15f402cc17122edd304eb6c95b2e
SHA512 d2e541a9a245ea883b54e06583c5db4532e042e333f633e9dc20a1fd5d8d11c46a283274bcde0f972234a63f95e518a27da50f34a1899d88a398bbeb76cb371f
SSDEEP 1536:7tIzh1n7bEn4yT4R9879VRcDTVGI2j0+Ke3tTip:hmh1n7b24RmJzA2j0A3tTi
TLSH
T1C563021612F7B4F8D5BB0573CFC540D3A186F22FD4C613EE9BC66D2A3D119A8A6A1074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-0-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/644-4-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/692-8-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/2388-19-0x0000000000F50000-0x0000000000F58000-memory.dmp

Download

memory/3944-16-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/3944-18-0x0000000000400000-0x0000000000466000-memory.dmp

Download