mimikatz | 006c766cb0561eadd9ef677b94adc73e7ea507364187855dacdc19cd45ca9840

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_81adbe9680444a2acc00fc4b11eb1900_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Size 7.7MB
Sample260601-evfp1scs51
SHA256 006c766cb0561eadd9ef677b94adc73e7ea507364187855dacdc19cd45ca9840
MD5 81adbe9680444a2acc00fc4b11eb1900
SHA1 bee1ba99b52c174d2749581c4e695bea8e8a39c4
SHA512 4ab5c47ad0842474a40ac65a2b208b21d72cd63f93167f55bdd5f1009bdafbf54c8b7782d2641873ee23f9408b6e8e4ffe564e498f6bc85e370aad9afb62024d
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T1E286F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery mimikatz installer

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral2/memory/2704-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/memory/2704-4-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/files/0x002500000002b3c5-6.dat	mimikatz
behavioral2/memory/1200-8-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2704-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/memory/2704-4-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/files/0x002500000002b3c5-6.dat	UPX
behavioral2/memory/1200-8-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
1200	ailiutz.exe
572	ailiutz.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	138	208.67.220.220	572	ailiutz.exe
Destination IP	14	208.67.222.222	4620	nslookup.exe
Destination IP	25	117.50.11.11	3336	nslookup.exe
Destination IP	68	208.67.220.220	2180	nslookup.exe
Destination IP	150	117.50.22.22	3344	nslookup.exe
Destination IP	151	117.50.22.22	3344	nslookup.exe
Destination IP	8	117.50.11.11	3236	nslookup.exe
Destination IP	27	117.50.22.22	2244	nslookup.exe
Destination IP	45	117.50.22.22	4056	nslookup.exe
Destination IP	47	208.67.222.222	2800	nslookup.exe
Destination IP	49	208.67.220.220	1404	nslookup.exe
Destination IP	97	208.67.220.220	240	nslookup.exe
Destination IP	152	208.67.222.222	1632	nslookup.exe
Destination IP	168	13.239.157.177	4172	nslookup.exe
Destination IP	51	208.67.220.220	1404	nslookup.exe
Destination IP	83	208.67.220.220	3824	nslookup.exe
Destination IP	105	117.50.11.11	1568	nslookup.exe
Destination IP	106	117.50.11.11	1568	nslookup.exe
Destination IP	127	117.50.22.22	4196	nslookup.exe
Destination IP	154	208.67.222.222	1632	nslookup.exe
Destination IP	157	208.67.220.220	3548	nslookup.exe
Destination IP	162	169.239.202.202	1832	nslookup.exe
Destination IP	10	117.50.22.22	4180	nslookup.exe
Destination IP	11	117.50.22.22	4180	nslookup.exe
Destination IP	44	117.50.22.22	4056	nslookup.exe
Destination IP	58	117.50.11.11	776	nslookup.exe
Destination IP	84	208.67.220.220	3824	nslookup.exe
Destination IP	110	208.67.222.222	3608	nslookup.exe
Destination IP	112	208.67.222.222	3608	nslookup.exe
Destination IP	128	117.50.22.22	572	ailiutz.exe
Destination IP	7	117.50.11.11	3236	nslookup.exe
Destination IP	16	208.67.220.220	4924	nslookup.exe
Destination IP	29	208.67.222.222	760	nslookup.exe
Destination IP	59	117.50.11.11	776	nslookup.exe
Destination IP	80	208.67.222.222	3128	nslookup.exe
Destination IP	109	117.50.22.22	4276	nslookup.exe
Destination IP	125	117.50.11.11	4856	nslookup.exe
Destination IP	156	208.67.220.220	3548	nslookup.exe
Destination IP	12	208.67.222.222	4620	nslookup.exe
Destination IP	32	208.67.220.220	4904	nslookup.exe
Destination IP	33	208.67.220.220	4904	nslookup.exe
Destination IP	42	117.50.11.11	2368	nslookup.exe
Destination IP	43	117.50.22.22	4056	nslookup.exe
Destination IP	126	117.50.11.11	572	ailiutz.exe
Destination IP	153	208.67.222.222	1632	nslookup.exe
Destination IP	159	185.121.177.177	4168	nslookup.exe
Destination IP	17	208.67.220.220	4924	nslookup.exe
Destination IP	78	117.50.22.22	3256	nslookup.exe
Destination IP	82	208.67.222.222	3128	nslookup.exe
Destination IP	107	117.50.22.22	4276	nslookup.exe
Destination IP	114	208.67.220.220	2284	nslookup.exe
Destination IP	115	208.67.220.220	2284	nslookup.exe
Destination IP	31	208.67.222.222	760	nslookup.exe
Destination IP	66	208.67.220.220	2180	nslookup.exe
Destination IP	85	208.67.220.220	3824	nslookup.exe
Destination IP	98	208.67.220.220	240	nslookup.exe
Destination IP	134	208.67.222.222	572	ailiutz.exe
Destination IP	148	117.50.11.11	4620	nslookup.exe
Destination IP	160	185.121.177.177	4168	nslookup.exe
Destination IP	163	169.239.202.202	1832	nslookup.exe
Destination IP	9	117.50.22.22	4180	nslookup.exe
Destination IP	15	208.67.220.220	4924	nslookup.exe
Destination IP	61	117.50.22.22	2144	nslookup.exe
Destination IP	90	117.50.11.11	1724	nslookup.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	ailiutz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ailiutz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ailiutz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	ailiutz.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ekcurlcu\ailiutz.exe	2026-06-01_81adbe9680444a2acc00fc4b11eb1900_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
File created	C:\Windows\ekcurlcu\ailiutz.exe	2026-06-01_81adbe9680444a2acc00fc4b11eb1900_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ailiutz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3920	cmd.exe
820	PING.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x002500000002b3c5-6.dat	nsis_installer_2

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ailiutz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ailiutz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ailiutz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ailiutz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ailiutz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ailiutz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ailiutz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ailiutz.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
820	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2704	2026-06-01_81adbe9680444a2acc00fc4b11eb1900_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	2026-06-01_81adbe9680444a2acc00fc4b11eb1900_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Token: SeDebugPrivilege	1200	ailiutz.exe
Token: SeDebugPrivilege	572	ailiutz.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2704	2026-06-01_81adbe9680444a2acc00fc4b11eb1900_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
1200	ailiutz.exe
572	ailiutz.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 3920	2704	2026-06-01_81adbe9680444a2acc00fc4b11eb1900_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe	80
PID 3920 wrote to memory of 820	3920	cmd.exe	82
PID 3920 wrote to memory of 1200	3920	cmd.exe	83
PID 572 wrote to memory of 900	572	ailiutz.exe	85
PID 900 wrote to memory of 1172	900	cmd.exe	87
PID 572 wrote to memory of 1240	572	ailiutz.exe	88
PID 1240 wrote to memory of 464	1240	cmd.exe	90
PID 572 wrote to memory of 3312	572	ailiutz.exe	91
PID 3312 wrote to memory of 3236	3312	cmd.exe	93
PID 572 wrote to memory of 3368	572	ailiutz.exe	94
PID 3368 wrote to memory of 4180	3368	cmd.exe	96
PID 572 wrote to memory of 4052	572	ailiutz.exe	97
PID 4052 wrote to memory of 4620	4052	cmd.exe	99
PID 572 wrote to memory of 3928	572	ailiutz.exe	100
PID 3928 wrote to memory of 4924	3928	cmd.exe	102
PID 572 wrote to memory of 3000	572	ailiutz.exe	103
PID 3000 wrote to memory of 840	3000	cmd.exe	105
PID 572 wrote to memory of 1820	572	ailiutz.exe	106
PID 1820 wrote to memory of 3144	1820	cmd.exe	108
PID 572 wrote to memory of 352	572	ailiutz.exe	109
PID 352 wrote to memory of 3336	352	cmd.exe	111
PID 572 wrote to memory of 3932	572	ailiutz.exe	112
PID 3932 wrote to memory of 2244	3932	cmd.exe	114
PID 572 wrote to memory of 2500	572	ailiutz.exe	115
PID 2500 wrote to memory of 760	2500	cmd.exe	117
PID 572 wrote to memory of 2980	572	ailiutz.exe	118
PID 2980 wrote to memory of 4904	2980	cmd.exe	120
PID 572 wrote to memory of 236	572	ailiutz.exe	121
PID 236 wrote to memory of 804	236	cmd.exe	123
PID 572 wrote to memory of 784	572	ailiutz.exe	124
PID 784 wrote to memory of 1832	784	cmd.exe	126
PID 572 wrote to memory of 4680	572	ailiutz.exe	127
PID 4680 wrote to memory of 2368	4680	cmd.exe	129
PID 572 wrote to memory of 2608	572	ailiutz.exe	130
PID 2608 wrote to memory of 4056	2608	cmd.exe	132
PID 572 wrote to memory of 3248	572	ailiutz.exe	133
PID 3248 wrote to memory of 2800	3248	cmd.exe	135
PID 572 wrote to memory of 2584	572	ailiutz.exe	136
PID 2584 wrote to memory of 1404	2584	cmd.exe	138
PID 572 wrote to memory of 4068	572	ailiutz.exe	139
PID 4068 wrote to memory of 460	4068	cmd.exe	141
PID 572 wrote to memory of 1792	572	ailiutz.exe	142
PID 1792 wrote to memory of 1824	1792	cmd.exe	144
PID 572 wrote to memory of 3356	572	ailiutz.exe	145
PID 3356 wrote to memory of 776	3356	cmd.exe	147
PID 572 wrote to memory of 2992	572	ailiutz.exe	148
PID 2992 wrote to memory of 2144	2992	cmd.exe	150
PID 572 wrote to memory of 4824	572	ailiutz.exe	151
PID 4824 wrote to memory of 1868	4824	cmd.exe	153
PID 572 wrote to memory of 2288	572	ailiutz.exe	154
PID 2288 wrote to memory of 2180	2288	cmd.exe	156
PID 572 wrote to memory of 3112	572	ailiutz.exe	157
PID 3112 wrote to memory of 4996	3112	cmd.exe	159
PID 572 wrote to memory of 1468	572	ailiutz.exe	160
PID 1468 wrote to memory of 1200	1468	cmd.exe	162
PID 572 wrote to memory of 1132	572	ailiutz.exe	163
PID 1132 wrote to memory of 4988	1132	cmd.exe	165
PID 572 wrote to memory of 4332	572	ailiutz.exe	166
PID 4332 wrote to memory of 3256	4332	cmd.exe	168
PID 572 wrote to memory of 3284	572	ailiutz.exe	169
PID 3284 wrote to memory of 3128	3284	cmd.exe	171
PID 572 wrote to memory of 3172	572	ailiutz.exe	172
PID 3172 wrote to memory of 3824	3172	cmd.exe	174
PID 572 wrote to memory of 996	572	ailiutz.exe	175

C:\Users\Admin\AppData\Local\Temp\2026-06-01_81adbe9680444a2acc00fc4b11eb1900_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_81adbe9680444a2acc00fc4b11eb1900_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ekcurlcu\ailiutz.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:820
- - C:\Windows\ekcurlcu\ailiutz.exe
    C:\Windows\ekcurlcu\ailiutz.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1200

C:\Windows\ekcurlcu\ailiutz.exe
C:\Windows\ekcurlcu\ailiutz.exe
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
    3⤵
    PID:1172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:3336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
    3⤵
    PID:1868
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
    3⤵
    PID:4996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
    3⤵
    PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:3256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:3128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:996
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4292
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
  2⤵
  PID:3336
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2244
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
  2⤵
  PID:760
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3120
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 8.8.8.8
    3⤵
    PID:560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 1.1.1.1
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 1.1.1.1
    3⤵
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.11.11
  2⤵
  PID:1160
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.22.22
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1264
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:3608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.220.220
  2⤵
  PID:3188
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4144
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2544
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.11.11
  2⤵
  PID:2904
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:968
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.222.222
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.222.222
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.220.220
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.220.220
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 8.8.8.8
  2⤵
  PID:764
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 8.8.8.8
    3⤵
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1776
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1272
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.22.22
  2⤵
  PID:4496
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  PID:576
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:1632
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2156
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:3548
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 185.121.177.177
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 185.121.177.177
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 169.239.202.202
  2⤵
  PID:912
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 169.239.202.202
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1832
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 5.132.191.104
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2416
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 5.132.191.104
    3⤵
    PID:1372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 13.239.157.177
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2948
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 13.239.157.177
    3⤵
    - Unexpected DNS network traffic destination
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 207.148.83.241
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1592
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 207.148.83.241
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2340
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 165.227.40.43
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 165.227.40.43
    3⤵
    PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ailiutz.exe

Path C:\Windows\ekcurlcu\ailiutz.exe
Size 7.8MB
SHA256 f9acd96682ce721df6cfa415266bf63d68a93033c9816b0366d17e894eb180f0
MD5 572cf7dabaa7b1bd5cb14d86b1c9b9c6
SHA1 73716c04d2a5be7f54cb3d99ec19884340b5bdac
SHA512 b9ec3bbfa02bcdc623dbd5d378e535911b6563fce8c149168f817e30d7859652136fec6c4638948d3cb9d3394861eb47aba1f995d6e5a9f283ece9514d24172b
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T13986F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-8-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/2704-0-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/2704-4-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads