blackmoon | f3bf36fd8c4a85b33b8a8dbf769dae3301d82ca1bfe26283ae33d429d6cfd983

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Size 9.7MB
Sample260419-1962eaaz2k
SHA256 f3bf36fd8c4a85b33b8a8dbf769dae3301d82ca1bfe26283ae33d429d6cfd983
MD5 75f69b7f70129fdf1375e4fc62950ce5
SHA1 6ac8958e17399467ec341a1ef55c3e0379f3fc23
SHA512 4c716e4eab63bda6ea49d1e340d132c65699fdb39f39182d78ced2ed425946bfb3e0351530b9158f22fb8b6198d95b91f5f661f912dbc3ecd683ede8523391b4
SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
TLSH
T1D3A6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker discovery blackmoon mimikatz installer trojan upx

Malware Config

Signatures

Family: Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon
Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detect Blackmoon payload 6 IoCs

resource	yara_rule
behavioral1/memory/5648-0-0x0000000000400000-0x0000000000CEB000-memory.dmp	family_blackmoon
behavioral1/memory/5648-4-0x0000000000400000-0x0000000000CEB000-memory.dmp	family_blackmoon
behavioral1/files/0x0008000000024406-6.dat	family_blackmoon
behavioral1/memory/3804-8-0x0000000000400000-0x0000000000CEB000-memory.dmp	family_blackmoon
behavioral1/memory/2172-16-0x0000000000400000-0x0000000000466000-memory.dmp	family_blackmoon
behavioral1/memory/2172-18-0x0000000000400000-0x0000000000466000-memory.dmp	family_blackmoon

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral1/memory/5648-0-0x0000000000400000-0x0000000000CEB000-memory.dmp	mimikatz
behavioral1/memory/5648-4-0x0000000000400000-0x0000000000CEB000-memory.dmp	mimikatz
behavioral1/files/0x0008000000024406-6.dat	mimikatz
behavioral1/memory/3804-8-0x0000000000400000-0x0000000000CEB000-memory.dmp	mimikatz

Custom signature

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral1/memory/5648-0-0x0000000000400000-0x0000000000CEB000-memory.dmp	UPX
behavioral1/memory/5648-4-0x0000000000400000-0x0000000000CEB000-memory.dmp	UPX
behavioral1/files/0x0008000000024406-6.dat	UPX
behavioral1/memory/3804-8-0x0000000000400000-0x0000000000CEB000-memory.dmp	UPX
behavioral1/files/0x0009000000024407-15.dat	UPX
behavioral1/memory/2172-16-0x0000000000400000-0x0000000000466000-memory.dmp	UPX
behavioral1/memory/2172-18-0x0000000000400000-0x0000000000466000-memory.dmp	UPX

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	iecrnqm.exe

Executes dropped EXE 3 IoCs

pid	Process
3804	iecrnqm.exe
5508	iecrnqm.exe
2172	hmlaplmbqjkleyy2801.exe

Unexpected DNS network traffic destination 60 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	63	51.75.173.177	5420	nslookup.exe
Destination IP	89	165.227.40.43	5052	nslookup.exe
Destination IP	35	163.172.168.171	1748	nslookup.exe
Destination IP	64	79.124.7.81	4508	nslookup.exe
Destination IP	80	5.132.191.104	4440	nslookup.exe
Destination IP	81	13.239.157.177	640	nslookup.exe
Destination IP	105	66.70.228.164	1100	nslookup.exe
Destination IP	11	161.97.219.84	4408	nslookup.exe
Destination IP	39	94.103.153.176	5464	nslookup.exe
Destination IP	43	94.103.153.176	5464	nslookup.exe
Destination IP	56	188.226.146.136	3828	nslookup.exe
Destination IP	98	142.4.205.47	1120	nslookup.exe
Destination IP	22	163.172.168.171	1748	nslookup.exe
Destination IP	53	51.77.227.84	2020	nslookup.exe
Destination IP	54	51.77.227.84	2020	nslookup.exe
Destination IP	62	51.75.173.177	5420	nslookup.exe
Destination IP	95	142.4.205.47	1120	nslookup.exe
Destination IP	50	178.63.116.152	1936	nslookup.exe
Destination IP	10	161.97.219.84	4408	nslookup.exe
Destination IP	67	144.76.103.143	3768	nslookup.exe
Destination IP	92	142.4.204.111	5060	nslookup.exe
Destination IP	100	198.100.148.224	4864	nslookup.exe
Destination IP	87	207.148.83.241	3428	nslookup.exe
Destination IP	97	142.4.205.47	1120	nslookup.exe
Destination IP	106	66.70.228.164	1100	nslookup.exe
Destination IP	52	51.77.227.84	2020	nslookup.exe
Destination IP	55	188.226.146.136	3828	nslookup.exe
Destination IP	79	5.132.191.104	4440	nslookup.exe
Destination IP	94	142.4.204.111	5060	nslookup.exe
Destination IP	107	66.70.228.164	1100	nslookup.exe
Destination IP	99	198.100.148.224	4864	nslookup.exe
Destination IP	102	159.203.38.175	5988	nslookup.exe
Destination IP	104	159.203.38.175	5988	nslookup.exe
Destination IP	40	94.103.153.176	5464	nslookup.exe
Destination IP	46	207.192.71.13	1492	nslookup.exe
Destination IP	65	79.124.7.81	4508	nslookup.exe
Destination IP	82	13.239.157.177	640	nslookup.exe
Destination IP	103	159.203.38.175	5988	nslookup.exe
Destination IP	66	79.124.7.81	4508	nslookup.exe
Destination IP	85	207.148.83.241	3428	nslookup.exe
Destination IP	110	51.254.25.115	696	nslookup.exe
Destination IP	111	185.84.81.194	1596	nslookup.exe
Destination IP	47	207.192.71.13	1492	nslookup.exe
Destination IP	48	207.192.71.13	1492	nslookup.exe
Destination IP	90	165.227.40.43	5052	nslookup.exe
Destination IP	101	198.100.148.224	4864	nslookup.exe
Destination IP	9	161.97.219.84	4408	nslookup.exe
Destination IP	71	144.76.103.143	3768	nslookup.exe
Destination IP	49	178.63.116.152	1936	nslookup.exe
Destination IP	68	144.76.103.143	3768	nslookup.exe
Destination IP	84	13.239.157.177	640	nslookup.exe
Destination IP	86	207.148.83.241	3428	nslookup.exe
Destination IP	88	165.227.40.43	5052	nslookup.exe
Destination IP	108	51.254.25.115	696	nslookup.exe
Destination IP	51	178.63.116.152	1936	nslookup.exe
Destination IP	57	188.226.146.136	3828	nslookup.exe
Destination IP	60	51.75.173.177	5420	nslookup.exe
Destination IP	91	142.4.204.111	5060	nslookup.exe
Destination IP	109	51.254.25.115	696	nslookup.exe
Destination IP	29	163.172.168.171	1748	nslookup.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000024407-15.dat	upx
behavioral1/memory/2172-16-0x0000000000400000-0x0000000000466000-memory.dmp	upx
behavioral1/memory/2172-18-0x0000000000400000-0x0000000000466000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\ybsvsner\iecrnqm.exe	2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
File opened for modification	C:\Windows\ybsvsner\iecrnqm.exe	2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
File created	C:\Windows\ybsvsner\hmlaplmbqjkleyy2801.exe	iecrnqm.exe

System Location Discovery: System Language Discovery 1 TTPs 47 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iecrnqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iecrnqm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4964	cmd.exe
5604	PING.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000024406-6.dat	nsis_installer_2

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5604	PING.EXE

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe
2172	hmlaplmbqjkleyy2801.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5648	2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5648	2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Token: SeDebugPrivilege	3804	iecrnqm.exe
Token: SeDebugPrivilege	5508	iecrnqm.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5648	2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
3804	iecrnqm.exe
5508	iecrnqm.exe
2172	hmlaplmbqjkleyy2801.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 4964	5648	2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe	85
PID 4964 wrote to memory of 5604	4964	cmd.exe	87
PID 4964 wrote to memory of 3804	4964	cmd.exe	89
PID 5508 wrote to memory of 2172	5508	iecrnqm.exe	91
PID 5508 wrote to memory of 2372	5508	iecrnqm.exe	93
PID 2372 wrote to memory of 4408	2372	cmd.exe	95
PID 5508 wrote to memory of 3560	5508	iecrnqm.exe	98
PID 3560 wrote to memory of 1748	3560	cmd.exe	100
PID 5508 wrote to memory of 4460	5508	iecrnqm.exe	110
PID 4460 wrote to memory of 5464	4460	cmd.exe	112
PID 5508 wrote to memory of 3048	5508	iecrnqm.exe	119
PID 3048 wrote to memory of 1492	3048	cmd.exe	121
PID 5508 wrote to memory of 2840	5508	iecrnqm.exe	122
PID 2840 wrote to memory of 1936	2840	cmd.exe	124
PID 5508 wrote to memory of 3520	5508	iecrnqm.exe	125
PID 3520 wrote to memory of 2020	3520	cmd.exe	127
PID 5508 wrote to memory of 5140	5508	iecrnqm.exe	128
PID 5140 wrote to memory of 3828	5140	cmd.exe	130
PID 5508 wrote to memory of 1980	5508	iecrnqm.exe	131
PID 1980 wrote to memory of 5420	1980	cmd.exe	133
PID 5508 wrote to memory of 3372	5508	iecrnqm.exe	134
PID 3372 wrote to memory of 4508	3372	cmd.exe	136
PID 5508 wrote to memory of 5332	5508	iecrnqm.exe	137
PID 5332 wrote to memory of 3768	5332	cmd.exe	139
PID 5508 wrote to memory of 912	5508	iecrnqm.exe	140
PID 912 wrote to memory of 4440	912	cmd.exe	142
PID 5508 wrote to memory of 2348	5508	iecrnqm.exe	143
PID 2348 wrote to memory of 640	2348	cmd.exe	145
PID 5508 wrote to memory of 5996	5508	iecrnqm.exe	146
PID 5996 wrote to memory of 3428	5996	cmd.exe	148
PID 5508 wrote to memory of 3176	5508	iecrnqm.exe	149
PID 3176 wrote to memory of 5052	3176	cmd.exe	151
PID 5508 wrote to memory of 5452	5508	iecrnqm.exe	152
PID 5452 wrote to memory of 5060	5452	cmd.exe	154
PID 5508 wrote to memory of 3388	5508	iecrnqm.exe	155
PID 3388 wrote to memory of 1120	3388	cmd.exe	157
PID 5508 wrote to memory of 5032	5508	iecrnqm.exe	160
PID 5032 wrote to memory of 4864	5032	cmd.exe	162
PID 5508 wrote to memory of 4744	5508	iecrnqm.exe	163
PID 4744 wrote to memory of 5988	4744	cmd.exe	165
PID 5508 wrote to memory of 4484	5508	iecrnqm.exe	166
PID 4484 wrote to memory of 1100	4484	cmd.exe	168
PID 5508 wrote to memory of 3804	5508	iecrnqm.exe	169
PID 3804 wrote to memory of 696	3804	cmd.exe	171
PID 5508 wrote to memory of 1220	5508	iecrnqm.exe	172
PID 1220 wrote to memory of 1596	1220	cmd.exe	174

C:\Users\Admin\AppData\Local\Temp\2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ybsvsner\iecrnqm.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5604
- - C:\Windows\ybsvsner\iecrnqm.exe
    C:\Windows\ybsvsner\iecrnqm.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3804

C:\Windows\ybsvsner\iecrnqm.exe
C:\Windows\ybsvsner\iecrnqm.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5508
- C:\Windows\ybsvsner\hmlaplmbqjkleyy2801.exe
  C:\Windows\ybsvsner\hmlaplmbqjkleyy2801.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 161.97.219.84
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 161.97.219.84
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 163.172.168.171
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 163.172.168.171
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 94.103.153.176
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 94.103.153.176
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 207.192.71.13
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 207.192.71.13
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 178.63.116.152
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 178.63.116.152
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 51.77.227.84
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 51.77.227.84
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 188.226.146.136
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5140
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 188.226.146.136
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 51.75.173.177
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 51.75.173.177
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 79.124.7.81
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 79.124.7.81
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 144.76.103.143
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 144.76.103.143
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 5.132.191.104
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 5.132.191.104
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 13.239.157.177
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 13.239.157.177
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 207.148.83.241
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 207.148.83.241
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 165.227.40.43
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 165.227.40.43
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 142.4.204.111
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 142.4.204.111
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 142.4.205.47
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 142.4.205.47
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 198.100.148.224
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 198.100.148.224
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 159.203.38.175
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 159.203.38.175
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 66.70.228.164
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 66.70.228.164
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 51.254.25.115
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 51.254.25.115
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A amxread.lib 185.84.81.194
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A amxread.lib 185.84.81.194
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hmlaplmbqjkleyy2801.exe

Path C:\Windows\ybsvsner\hmlaplmbqjkleyy2801.exe
Size 69KB
SHA256 875abc09f1abc43dfcc8a9c2a5e541c9a8bcaf33a4e8faa20c58947f8c8b56fa
MD5 8a761ad0a469caa921b8a1bdb989b9d1
SHA1 4584c31d116e15f402cc17122edd304eb6c95b2e
SHA512 d2e541a9a245ea883b54e06583c5db4532e042e333f633e9dc20a1fd5d8d11c46a283274bcde0f972234a63f95e518a27da50f34a1899d88a398bbeb76cb371f
SSDEEP 1536:7tIzh1n7bEn4yT4R9879VRcDTVGI2j0+Ke3tTip:hmh1n7b24RmJzA2j0A3tTi
TLSH
T1C563021612F7B4F8D5BB0573CFC540D3A186F22FD4C613EE9BC66D2A3D119A8A6A1074
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iecrnqm.exe

Path C:\Windows\ybsvsner\iecrnqm.exe
Size 9.8MB
SHA256 937ff63e6d507bc89f70fb870d37e7d35449ed2b5443bb188d4cef9d06705eac
MD5 52085e22e3ed7abe1f70f4fe82e55058
SHA1 ba3f44031a3f6ddfa8cd695363c250c5e5cd64f5
SHA512 99a34d148649ace36d4d0eab763d7d4339eb930c591b86d98726a93ce7385305bc110e5aa9f04ad7d2fe881d8d34e597866542983d5f056b215a44a44634a2ed
SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
TLSH
T195A6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2172-16-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/2172-18-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/3804-8-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/5508-19-0x0000000001720000-0x000000000179E000-memory.dmp

Download

memory/5648-0-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download

memory/5648-4-0x0000000000400000-0x0000000000CEB000-memory.dmp

Download