Analysis
- max time kernel
150s - max time network
160s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 22:22
Behavioral task
behavioral1
Sample
2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
19 signatures
150 seconds
General
- Target 2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
- Size 9.7MB
- Sample260419-1962eaaz2k
- SHA256 f3bf36fd8c4a85b33b8a8dbf769dae3301d82ca1bfe26283ae33d429d6cfd983
- MD5 75f69b7f70129fdf1375e4fc62950ce5
- SHA1 6ac8958e17399467ec341a1ef55c3e0379f3fc23
- SHA512 4c716e4eab63bda6ea49d1e340d132c65699fdb39f39182d78ced2ed425946bfb3e0351530b9158f22fb8b6198d95b91f5f661f912dbc3ecd683ede8523391b4
- SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
- TLSH T1D3A6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Detect Blackmoon payload 5 IoCs
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x0000000000CEB000-memory.dmp family_blackmoon behavioral2/memory/4356-4-0x0000000000400000-0x0000000000CEB000-memory.dmp family_blackmoon behavioral2/files/0x001a00000002b4c1-6.dat family_blackmoon behavioral2/memory/5716-8-0x0000000000400000-0x0000000000CEB000-memory.dmp family_blackmoon behavioral2/memory/4692-17-0x0000000000400000-0x0000000000466000-memory.dmp family_blackmoon - mimikatz is an open source tool to dump credentials on Windows 4 IoCs
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x0000000000CEB000-memory.dmp mimikatz behavioral2/memory/4356-4-0x0000000000400000-0x0000000000CEB000-memory.dmp mimikatz behavioral2/files/0x001a00000002b4c1-6.dat mimikatz behavioral2/memory/5716-8-0x0000000000400000-0x0000000000CEB000-memory.dmp mimikatz - Custom signatureUPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x0000000000CEB000-memory.dmp UPX behavioral2/memory/4356-4-0x0000000000400000-0x0000000000CEB000-memory.dmp UPX behavioral2/files/0x001a00000002b4c1-6.dat UPX behavioral2/memory/5716-8-0x0000000000400000-0x0000000000CEB000-memory.dmp UPX behavioral2/files/0x001b00000002b4c2-14.dat UPX behavioral2/memory/4692-15-0x0000000000400000-0x0000000000466000-memory.dmp UPX behavioral2/memory/4692-17-0x0000000000400000-0x0000000000466000-memory.dmp UPX - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts uprkgnl.exe - Executes dropped EXE 3 IoCs
pid Process 5716 uprkgnl.exe 6040 uprkgnl.exe 4692 kwllqtngabuvkdl21728.exe - Unexpected DNS network traffic destination 62 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 24 188.226.146.136 4940 nslookup.exe Destination IP 38 13.239.157.177 3036 nslookup.exe Destination IP 43 207.148.83.241 2964 nslookup.exe Destination IP 53 198.100.148.224 5564 nslookup.exe Destination IP 30 79.124.7.81 692 nslookup.exe Destination IP 6 163.172.168.171 3660 nslookup.exe Destination IP 22 188.226.146.136 4940 nslookup.exe Destination IP 65 185.84.81.194 3820 nslookup.exe Destination IP 28 51.75.173.177 1672 nslookup.exe Destination IP 41 207.148.83.241 2964 nslookup.exe Destination IP 48 142.4.204.111 6036 nslookup.exe Destination IP 55 198.100.148.224 5564 nslookup.exe Destination IP 57 159.203.38.175 5292 nslookup.exe Destination IP 67 185.84.81.194 3820 nslookup.exe Destination IP 4 161.97.219.84 4072 nslookup.exe Destination IP 34 144.76.103.143 6024 nslookup.exe Destination IP 45 165.227.40.43 1688 nslookup.exe Destination IP 64 51.254.25.115 3492 nslookup.exe Destination IP 7 163.172.168.171 3660 nslookup.exe Destination IP 10 94.103.153.176 5252 nslookup.exe Destination IP 29 79.124.7.81 692 nslookup.exe Destination IP 9 94.103.153.176 5252 nslookup.exe Destination IP 18 178.63.116.152 2300 nslookup.exe Destination IP 37 5.132.191.104 4416 nslookup.exe Destination IP 15 207.192.71.13 3112 nslookup.exe Destination IP 39 13.239.157.177 3036 nslookup.exe Destination IP 51 142.4.205.47 5240 nslookup.exe Destination IP 60 66.70.228.164 2780 nslookup.exe Destination IP 66 185.84.81.194 3820 nslookup.exe Destination IP 11 94.103.153.176 5252 nslookup.exe Destination IP 17 178.63.116.152 2300 nslookup.exe Destination IP 20 51.77.227.84 3912 nslookup.exe Destination IP 21 51.77.227.84 3912 nslookup.exe Destination IP 59 66.70.228.164 2780 nslookup.exe Destination IP 32 144.76.103.143 6024 nslookup.exe Destination IP 36 5.132.191.104 4416 nslookup.exe Destination IP 42 207.148.83.241 2964 nslookup.exe Destination IP 40 13.239.157.177 3036 nslookup.exe Destination IP 47 142.4.204.111 6036 nslookup.exe Destination IP 61 66.70.228.164 2780 nslookup.exe Destination IP 63 51.254.25.115 3492 nslookup.exe Destination IP 3 161.97.219.84 4072 nslookup.exe Destination IP 8 163.172.168.171 3660 nslookup.exe Destination IP 26 51.75.173.177 1672 nslookup.exe Destination IP 31 79.124.7.81 692 nslookup.exe Destination IP 49 142.4.204.111 6036 nslookup.exe Destination IP 52 142.4.205.47 5240 nslookup.exe Destination IP 54 198.100.148.224 5564 nslookup.exe Destination IP 56 159.203.38.175 5292 nslookup.exe Destination IP 2 161.97.219.84 4072 nslookup.exe Destination IP 13 207.192.71.13 3112 nslookup.exe Destination IP 58 159.203.38.175 5292 nslookup.exe Destination IP 12 207.192.71.13 3112 nslookup.exe Destination IP 16 178.63.116.152 2300 nslookup.exe Destination IP 19 51.77.227.84 3912 nslookup.exe Destination IP 27 51.75.173.177 1672 nslookup.exe Destination IP 50 142.4.205.47 5240 nslookup.exe Destination IP 62 51.254.25.115 3492 nslookup.exe Destination IP 33 144.76.103.143 6024 nslookup.exe Destination IP 44 165.227.40.43 1688 nslookup.exe Destination IP 46 165.227.40.43 1688 nslookup.exe Destination IP 23 188.226.146.136 4940 nslookup.exe -
resource yara_rule behavioral2/files/0x001b00000002b4c2-14.dat upx behavioral2/memory/4692-15-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/memory/4692-17-0x0000000000400000-0x0000000000466000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\tymiuafy\uprkgnl.exe 2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe File created C:\Windows\tymiuafy\kwllqtngabuvkdl21728.exe uprkgnl.exe File created C:\Windows\tymiuafy\uprkgnl.exe 2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe - System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uprkgnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uprkgnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3340 cmd.exe 3372 PING.EXE - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x001a00000002b4c1-6.dat nsis_installer_2 - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3372 PING.EXE - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe 4692 kwllqtngabuvkdl21728.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4356 2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4356 2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe Token: SeDebugPrivilege 5716 uprkgnl.exe Token: SeDebugPrivilege 6040 uprkgnl.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4356 2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe 5716 uprkgnl.exe 6040 uprkgnl.exe 4692 kwllqtngabuvkdl21728.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 4356 wrote to memory of 3340 4356 2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe 79 PID 3340 wrote to memory of 3372 3340 cmd.exe 81 PID 3340 wrote to memory of 5716 3340 cmd.exe 82 PID 6040 wrote to memory of 4692 6040 uprkgnl.exe 84 PID 6040 wrote to memory of 3952 6040 uprkgnl.exe 85 PID 3952 wrote to memory of 4072 3952 cmd.exe 87 PID 6040 wrote to memory of 2172 6040 uprkgnl.exe 88 PID 2172 wrote to memory of 3660 2172 cmd.exe 90 PID 6040 wrote to memory of 2600 6040 uprkgnl.exe 91 PID 2600 wrote to memory of 5252 2600 cmd.exe 93 PID 6040 wrote to memory of 1120 6040 uprkgnl.exe 94 PID 1120 wrote to memory of 3112 1120 cmd.exe 96 PID 6040 wrote to memory of 5536 6040 uprkgnl.exe 97 PID 5536 wrote to memory of 2300 5536 cmd.exe 99 PID 6040 wrote to memory of 6072 6040 uprkgnl.exe 100 PID 6072 wrote to memory of 3912 6072 cmd.exe 102 PID 6040 wrote to memory of 1092 6040 uprkgnl.exe 103 PID 1092 wrote to memory of 4940 1092 cmd.exe 105 PID 6040 wrote to memory of 3664 6040 uprkgnl.exe 106 PID 3664 wrote to memory of 1672 3664 cmd.exe 108 PID 6040 wrote to memory of 2824 6040 uprkgnl.exe 109 PID 2824 wrote to memory of 692 2824 cmd.exe 111 PID 6040 wrote to memory of 3416 6040 uprkgnl.exe 112 PID 3416 wrote to memory of 6024 3416 cmd.exe 114 PID 6040 wrote to memory of 4036 6040 uprkgnl.exe 115 PID 4036 wrote to memory of 4416 4036 cmd.exe 117 PID 6040 wrote to memory of 400 6040 uprkgnl.exe 118 PID 400 wrote to memory of 3036 400 cmd.exe 120 PID 6040 wrote to memory of 2416 6040 uprkgnl.exe 121 PID 2416 wrote to memory of 2964 2416 cmd.exe 123 PID 6040 wrote to memory of 4968 6040 uprkgnl.exe 124 PID 4968 wrote to memory of 1688 4968 cmd.exe 126 PID 6040 wrote to memory of 6112 6040 uprkgnl.exe 127 PID 6112 wrote to memory of 6036 6112 cmd.exe 129 PID 6040 wrote to memory of 2168 6040 uprkgnl.exe 130 PID 2168 wrote to memory of 5240 2168 cmd.exe 132 PID 6040 wrote to memory of 3596 6040 uprkgnl.exe 133 PID 3596 wrote to memory of 5564 3596 cmd.exe 135 PID 6040 wrote to memory of 2204 6040 uprkgnl.exe 136 PID 2204 wrote to memory of 5292 2204 cmd.exe 138 PID 6040 wrote to memory of 2552 6040 uprkgnl.exe 139 PID 2552 wrote to memory of 2780 2552 cmd.exe 141 PID 6040 wrote to memory of 5436 6040 uprkgnl.exe 142 PID 5436 wrote to memory of 3492 5436 cmd.exe 144 PID 6040 wrote to memory of 332 6040 uprkgnl.exe 145 PID 332 wrote to memory of 3820 332 cmd.exe 147
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_75f69b7f70129fdf1375e4fc62950ce5_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\tymiuafy\uprkgnl.exe2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3372
-
-
C:\Windows\tymiuafy\uprkgnl.exeC:\Windows\tymiuafy\uprkgnl.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5716
-
-
-
C:\Windows\tymiuafy\uprkgnl.exeC:\Windows\tymiuafy\uprkgnl.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\tymiuafy\kwllqtngabuvkdl21728.exeC:\Windows\tymiuafy\kwllqtngabuvkdl21728.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4692
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 161.97.219.842⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 161.97.219.843⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:4072
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 163.172.168.1712⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 163.172.168.1713⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3660
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 94.103.153.1762⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 94.103.153.1763⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:5252
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 207.192.71.132⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 207.192.71.133⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3112
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 178.63.116.1522⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5536 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 178.63.116.1523⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:2300
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 51.77.227.842⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 51.77.227.843⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3912
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 188.226.146.1362⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 188.226.146.1363⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:4940
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 51.75.173.1772⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 51.75.173.1773⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:1672
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 79.124.7.812⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 79.124.7.813⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:692
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 144.76.103.1432⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 144.76.103.1433⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:6024
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 5.132.191.1042⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 5.132.191.1043⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:4416
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 13.239.157.1772⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 13.239.157.1773⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3036
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 207.148.83.2412⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 207.148.83.2413⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:2964
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 165.227.40.432⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 165.227.40.433⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:1688
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 142.4.204.1112⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6112 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 142.4.204.1113⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:6036
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 142.4.205.472⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 142.4.205.473⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:5240
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 198.100.148.2242⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 198.100.148.2243⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:5564
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 159.203.38.1752⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 159.203.38.1753⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:5292
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 66.70.228.1642⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 66.70.228.1643⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:2780
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 51.254.25.1152⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5436 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 51.254.25.1153⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3492
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 185.84.81.1942⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 185.84.81.1943⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3820
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\tymiuafy\kwllqtngabuvkdl21728.exe
- Size 69KB
- SHA256 875abc09f1abc43dfcc8a9c2a5e541c9a8bcaf33a4e8faa20c58947f8c8b56fa
- MD5 8a761ad0a469caa921b8a1bdb989b9d1
- SHA1 4584c31d116e15f402cc17122edd304eb6c95b2e
- SHA512 d2e541a9a245ea883b54e06583c5db4532e042e333f633e9dc20a1fd5d8d11c46a283274bcde0f972234a63f95e518a27da50f34a1899d88a398bbeb76cb371f
- SSDEEP 1536:7tIzh1n7bEn4yT4R9879VRcDTVGI2j0+Ke3tTip:hmh1n7b24RmJzA2j0A3tTi
- TLSH T1C563021612F7B4F8D5BB0573CFC540D3A186F22FD4C613EE9BC66D2A3D119A8A6A1074
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\tymiuafy\uprkgnl.exe
- Size 9.8MB
- SHA256 fa3b6371e42fdd88ba6bbc48a288584e213a3edac4b6a08ac3cd0cb9624d105c
- MD5 20128f247323abb83f4f2289683a9fa5
- SHA1 4d94d506817f185793dc88e48cec938cb40641b1
- SHA512 bfb619de14f810ddd1d39a0a6c7d85eb1b4ea8ec098aa0fdf41fc6a07ae3e66861cbc145fa800150aa896cd47332fa886c3476c9691aab7a2e3a2efd9fbc8beb
- SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
- TLSH T11EA6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
- MD5 SHA1 SHA512 SSDEEP TLSH