mimikatz | ccca3c0c04a9c11c3be6ac77ca48f9d63fb63918821ff9e8dd2f89b2a952bd37

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_2e15b18494866cd8a3f271059e85e33c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Size 7.9MB
Sample260702-2xdd1acz2q
SHA256 ccca3c0c04a9c11c3be6ac77ca48f9d63fb63918821ff9e8dd2f89b2a952bd37
MD5 2e15b18494866cd8a3f271059e85e33c
SHA1 7801136cc3b1d849211c72395be88a4246cc1c3f
SHA512 dd0f1381a209b7f15ef2b15c128955d8d54bb05c6e5c221bb31142f5fb80f6086af0d3930ce0b6514bf0413a7a8be05844c9546bcf91e5e17b3a6a01fdc0505e
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T10186F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery mimikatz installer

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral2/memory/2296-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/memory/2296-2-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/files/0x000e00000001c4f8-3.dat	mimikatz
behavioral2/memory/4148-5-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2296-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/memory/2296-2-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/files/0x000e00000001c4f8-3.dat	UPX
behavioral2/memory/4148-5-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
4148	bklhetn.exe
576	bklhetn.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	34	208.67.220.220	1328	nslookup.exe
Destination IP	96	117.50.22.22	2764	nslookup.exe
Destination IP	175	165.227.40.43	1840	nslookup.exe
Destination IP	43	117.50.22.22	256	nslookup.exe
Destination IP	156	208.67.222.222	5896	nslookup.exe
Destination IP	164	169.239.202.202	4092	nslookup.exe
Destination IP	177	142.4.204.111	5764	nslookup.exe
Destination IP	99	208.67.222.222	992	nslookup.exe
Destination IP	30	208.67.222.222	2644	nslookup.exe
Destination IP	100	208.67.220.220	6124	nslookup.exe
Destination IP	109	117.50.11.11	4564	nslookup.exe
Destination IP	150	117.50.11.11	5280	nslookup.exe
Destination IP	163	169.239.202.202	4092	nslookup.exe
Destination IP	171	207.148.83.241	5960	nslookup.exe
Destination IP	162	185.121.177.177	4688	nslookup.exe
Destination IP	33	208.67.220.220	1328	nslookup.exe
Destination IP	46	208.67.222.222	2936	nslookup.exe
Destination IP	51	208.67.220.220	6132	nslookup.exe
Destination IP	62	117.50.22.22	4784	nslookup.exe
Destination IP	79	117.50.22.22	3328	nslookup.exe
Destination IP	80	208.67.222.222	620	nslookup.exe
Destination IP	113	117.50.22.22	5296	nslookup.exe
Destination IP	92	117.50.11.11	1460	nslookup.exe
Destination IP	31	208.67.222.222	2644	nslookup.exe
Destination IP	32	208.67.220.220	1328	nslookup.exe
Destination IP	47	208.67.222.222	2936	nslookup.exe
Destination IP	154	208.67.222.222	5896	nslookup.exe
Destination IP	26	117.50.22.22	4216	nslookup.exe
Destination IP	129	117.50.11.11	5324	nslookup.exe
Destination IP	137	208.67.222.222	3244	nslookup.exe
Destination IP	155	208.67.222.222	5896	nslookup.exe
Destination IP	168	13.239.157.177	4108	nslookup.exe
Destination IP	11	117.50.22.22	5976	nslookup.exe
Destination IP	61	117.50.22.22	4784	nslookup.exe
Destination IP	75	117.50.11.11	1696	nslookup.exe
Destination IP	94	117.50.22.22	2764	nslookup.exe
Destination IP	101	208.67.220.220	6124	nslookup.exe
Destination IP	161	185.121.177.177	4688	nslookup.exe
Destination IP	10	117.50.22.22	5976	nslookup.exe
Destination IP	28	117.50.22.22	4216	nslookup.exe
Destination IP	59	117.50.11.11	1544	nslookup.exe
Destination IP	130	117.50.11.11	576	bklhetn.exe
Destination IP	152	117.50.22.22	3728	nslookup.exe
Destination IP	178	142.4.204.111	5764	nslookup.exe
Destination IP	95	117.50.22.22	2764	nslookup.exe
Destination IP	102	208.67.220.220	6124	nslookup.exe
Destination IP	78	117.50.22.22	3328	nslookup.exe
Destination IP	149	117.50.11.11	5280	nslookup.exe
Destination IP	174	165.227.40.43	1840	nslookup.exe
Destination IP	45	117.50.22.22	256	nslookup.exe
Destination IP	50	208.67.220.220	6132	nslookup.exe
Destination IP	83	208.67.220.220	3260	nslookup.exe
Destination IP	76	117.50.11.11	1696	nslookup.exe
Destination IP	140	208.67.220.220	4676	nslookup.exe
Destination IP	8	117.50.11.11	2100	nslookup.exe
Destination IP	66	208.67.220.220	4252	nslookup.exe
Destination IP	77	117.50.22.22	3328	nslookup.exe
Destination IP	82	208.67.222.222	620	nslookup.exe
Destination IP	98	208.67.222.222	992	nslookup.exe
Destination IP	117	208.67.220.220	3344	nslookup.exe
Destination IP	173	207.148.83.241	5960	nslookup.exe
Destination IP	176	165.227.40.43	1840	nslookup.exe
Destination IP	14	208.67.222.222	6000	nslookup.exe
Destination IP	60	117.50.22.22	4784	nslookup.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	bklhetn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	bklhetn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	bklhetn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	bklhetn.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\gqbeilpi\bklhetn.exe	2026-07-02_2e15b18494866cd8a3f271059e85e33c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
File created	C:\Windows\gqbeilpi\bklhetn.exe	2026-07-02_2e15b18494866cd8a3f271059e85e33c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bklhetn.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1784	cmd.exe
5184	PING.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x000e00000001c4f8-3.dat	nsis_installer_2

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	bklhetn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	bklhetn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	bklhetn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	bklhetn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	bklhetn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	bklhetn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	bklhetn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	bklhetn.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5184	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2296	2026-07-02_2e15b18494866cd8a3f271059e85e33c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	2026-07-02_2e15b18494866cd8a3f271059e85e33c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Token: SeDebugPrivilege	4148	bklhetn.exe
Token: SeDebugPrivilege	576	bklhetn.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2296	2026-07-02_2e15b18494866cd8a3f271059e85e33c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
4148	bklhetn.exe
576	bklhetn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1784	2296	2026-07-02_2e15b18494866cd8a3f271059e85e33c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe	88
PID 1784 wrote to memory of 5184	1784	cmd.exe	90
PID 1784 wrote to memory of 4148	1784	cmd.exe	91
PID 576 wrote to memory of 5592	576	bklhetn.exe	93
PID 5592 wrote to memory of 5520	5592	cmd.exe	95
PID 576 wrote to memory of 5712	576	bklhetn.exe	96
PID 5712 wrote to memory of 3932	5712	cmd.exe	98
PID 576 wrote to memory of 5000	576	bklhetn.exe	99
PID 5000 wrote to memory of 2100	5000	cmd.exe	101
PID 576 wrote to memory of 956	576	bklhetn.exe	102
PID 956 wrote to memory of 5976	956	cmd.exe	104
PID 576 wrote to memory of 3440	576	bklhetn.exe	105
PID 3440 wrote to memory of 6000	3440	cmd.exe	107
PID 576 wrote to memory of 4736	576	bklhetn.exe	108
PID 4736 wrote to memory of 3428	4736	cmd.exe	110
PID 576 wrote to memory of 5692	576	bklhetn.exe	111
PID 5692 wrote to memory of 2652	5692	cmd.exe	113
PID 576 wrote to memory of 1964	576	bklhetn.exe	114
PID 1964 wrote to memory of 2716	1964	cmd.exe	116
PID 576 wrote to memory of 1852	576	bklhetn.exe	117
PID 1852 wrote to memory of 1268	1852	cmd.exe	119
PID 576 wrote to memory of 3016	576	bklhetn.exe	120
PID 3016 wrote to memory of 4216	3016	cmd.exe	122
PID 576 wrote to memory of 2732	576	bklhetn.exe	123
PID 2732 wrote to memory of 2644	2732	cmd.exe	125
PID 576 wrote to memory of 3512	576	bklhetn.exe	126
PID 3512 wrote to memory of 1328	3512	cmd.exe	128
PID 576 wrote to memory of 4392	576	bklhetn.exe	129
PID 4392 wrote to memory of 6104	4392	cmd.exe	131
PID 576 wrote to memory of 3208	576	bklhetn.exe	132
PID 3208 wrote to memory of 3468	3208	cmd.exe	134
PID 576 wrote to memory of 1908	576	bklhetn.exe	135
PID 1908 wrote to memory of 4596	1908	cmd.exe	137
PID 576 wrote to memory of 4500	576	bklhetn.exe	138
PID 4500 wrote to memory of 256	4500	cmd.exe	140
PID 576 wrote to memory of 1680	576	bklhetn.exe	141
PID 1680 wrote to memory of 2936	1680	cmd.exe	143
PID 576 wrote to memory of 1076	576	bklhetn.exe	144
PID 1076 wrote to memory of 6132	1076	cmd.exe	146
PID 576 wrote to memory of 2300	576	bklhetn.exe	147
PID 2300 wrote to memory of 3392	2300	cmd.exe	149
PID 576 wrote to memory of 1432	576	bklhetn.exe	150
PID 1432 wrote to memory of 3828	1432	cmd.exe	152
PID 576 wrote to memory of 1472	576	bklhetn.exe	153
PID 1472 wrote to memory of 1544	1472	cmd.exe	155
PID 576 wrote to memory of 436	576	bklhetn.exe	156
PID 436 wrote to memory of 4784	436	cmd.exe	158
PID 576 wrote to memory of 3636	576	bklhetn.exe	159
PID 3636 wrote to memory of 560	3636	cmd.exe	161
PID 576 wrote to memory of 5460	576	bklhetn.exe	162
PID 5460 wrote to memory of 4252	5460	cmd.exe	164
PID 576 wrote to memory of 1364	576	bklhetn.exe	165
PID 1364 wrote to memory of 3980	1364	cmd.exe	167
PID 576 wrote to memory of 4412	576	bklhetn.exe	168
PID 4412 wrote to memory of 3652	4412	cmd.exe	170
PID 576 wrote to memory of 4876	576	bklhetn.exe	171
PID 4876 wrote to memory of 1696	4876	cmd.exe	173
PID 576 wrote to memory of 1408	576	bklhetn.exe	174
PID 1408 wrote to memory of 3328	1408	cmd.exe	176
PID 576 wrote to memory of 2072	576	bklhetn.exe	177
PID 2072 wrote to memory of 620	2072	cmd.exe	179
PID 576 wrote to memory of 4568	576	bklhetn.exe	180
PID 4568 wrote to memory of 3260	4568	cmd.exe	182
PID 576 wrote to memory of 5948	576	bklhetn.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-07-02_2e15b18494866cd8a3f271059e85e33c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_2e15b18494866cd8a3f271059e85e33c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\gqbeilpi\bklhetn.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5184
- - C:\Windows\gqbeilpi\bklhetn.exe
    C:\Windows\gqbeilpi\bklhetn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4148

C:\Windows\gqbeilpi\bklhetn.exe
C:\Windows\gqbeilpi\bklhetn.exe
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5592
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
    3⤵
    PID:5520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3932
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:5976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
    3⤵
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
    3⤵
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1964
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
    3⤵
    PID:1268
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
    3⤵
    PID:3468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
    3⤵
    PID:4596
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:6132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
    3⤵
    - System Location Discovery: System Language Discovery
    PID:560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3652
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5948
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
    3⤵
    PID:1144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
  2⤵
  PID:3172
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1160
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5472
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3152
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
  2⤵
  PID:5828
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:6124
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 8.8.8.8
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 8.8.8.8
    3⤵
    PID:2452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2080
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 1.1.1.1
    3⤵
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.11.11
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.22.22
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2060
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.222.222
    3⤵
    PID:4228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.220.220
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5528
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 8.8.8.8
    3⤵
    PID:4280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 1.1.1.1
  2⤵
  PID:2100
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 1.1.1.1
    3⤵
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.11.11
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5792
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.22.22
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2520
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.220.220
  2⤵
  PID:2616
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1708
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 8.8.8.8
    3⤵
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1544
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.11.11
  2⤵
  PID:6004
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4772
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.222.222
  2⤵
  PID:1276
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.220.220
  2⤵
  PID:5020
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.220.220
    3⤵
    PID:5888
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 185.121.177.177
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5972
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 185.121.177.177
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 169.239.202.202
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2016
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 169.239.202.202
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 5.132.191.104
  2⤵
  PID:4548
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 5.132.191.104
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 13.239.157.177
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2208
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 13.239.157.177
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 207.148.83.241
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 207.148.83.241
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 165.227.40.43
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3812
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 165.227.40.43
    3⤵
    - Unexpected DNS network traffic destination
    PID:1840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 142.4.204.111
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 142.4.204.111
    3⤵
    - Unexpected DNS network traffic destination
    PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bklhetn.exe

Path C:\Windows\gqbeilpi\bklhetn.exe
Size 7.9MB
SHA256 60056649a90d12b047e578329db0bc76a035814e087c5b0218a4c22e92fd3d26
MD5 e82bb2abbe00ed1bfe5f0bf2d0cf659c
SHA1 0e7eb5433956a2c0817404d9e0a87d11e554fba8
SHA512 1a731dd038ff881a908b7ac3009d82e3806c06c505c632452714cc33d536a47120aaee7f1c80ffd001f52518ed6c4018392b3886a2fd6613f89b2870883d1743
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T1E986F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2296-0-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/2296-2-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/4148-5-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads