mimikatz | 87181855813627344ca0ac67c10dca6a04d436b62d2b915450964a7fa98b3dc1

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Size 8.3MB
Sample260710-ft47naex2w
SHA256 87181855813627344ca0ac67c10dca6a04d436b62d2b915450964a7fa98b3dc1
MD5 9928c9f752e3a5b3d3a8065be4bf0e0c
SHA1 35a5cd1198bd889be1b2003a1c0611ddaf7acec2
SHA512 140fb8827d4c5a0e956198f3316ee5c862fb0904feadcdc2653a93e01c1896a2287c51e4a6bc6e6ce6f480b5f12cd3b97a273124d15bee67cf672d306ad2a98d
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T18F96F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery mimikatz installer

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral2/memory/4360-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/memory/4360-2-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/files/0x000e00000001c3da-3.dat	mimikatz
behavioral2/memory/4644-5-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4360-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/memory/4360-2-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/files/0x000e00000001c3da-3.dat	UPX
behavioral2/memory/4644-5-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
4644	qaruuze.exe
4580	qaruuze.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	7	117.50.11.11	5712	nslookup.exe
Destination IP	14	208.67.222.222	2848	nslookup.exe
Destination IP	24	117.50.11.11	5276	nslookup.exe
Destination IP	78	117.50.11.11	1012	nslookup.exe
Destination IP	96	117.50.11.11	4660	nslookup.exe
Destination IP	122	208.67.220.220	4776	nslookup.exe
Destination IP	135	117.50.22.22	2884	nslookup.exe
Destination IP	157	117.50.22.22	4180	nslookup.exe
Destination IP	29	117.50.22.22	3288	nslookup.exe
Destination IP	115	117.50.11.11	2876	nslookup.exe
Destination IP	159	208.67.222.222	2988	nslookup.exe
Destination IP	164	208.67.220.220	3696	nslookup.exe
Destination IP	167	185.121.177.177	1900	nslookup.exe
Destination IP	45	117.50.11.11	1444	nslookup.exe
Destination IP	113	117.50.11.11	2876	nslookup.exe
Destination IP	166	185.121.177.177	1900	nslookup.exe
Destination IP	8	117.50.11.11	5712	nslookup.exe
Destination IP	10	117.50.22.22	5584	nslookup.exe
Destination IP	15	208.67.220.220	1836	nslookup.exe
Destination IP	64	117.50.22.22	4504	nslookup.exe
Destination IP	69	208.67.220.220	1764	nslookup.exe
Destination IP	80	117.50.22.22	3320	nslookup.exe
Destination IP	84	208.67.222.222	4876	nslookup.exe
Destination IP	99	117.50.22.22	5864	nslookup.exe
Destination IP	17	208.67.220.220	1836	nslookup.exe
Destination IP	36	208.67.220.220	5184	nslookup.exe
Destination IP	37	208.67.220.220	5184	nslookup.exe
Destination IP	87	208.67.220.220	3452	nslookup.exe
Destination IP	105	208.67.220.220	1104	nslookup.exe
Destination IP	117	117.50.22.22	716	nslookup.exe
Destination IP	133	117.50.11.11	5956	nslookup.exe
Destination IP	155	117.50.11.11	4504	nslookup.exe
Destination IP	52	208.67.220.220	4572	nslookup.exe
Destination IP	134	117.50.11.11	4580	qaruuze.exe
Destination IP	143	208.67.222.222	4580	qaruuze.exe
Destination IP	146	208.67.220.220	4580	qaruuze.exe
Destination IP	12	208.67.222.222	2848	nslookup.exe
Destination IP	114	117.50.11.11	2876	nslookup.exe
Destination IP	136	117.50.22.22	4580	qaruuze.exe
Destination IP	13	208.67.222.222	2848	nslookup.exe
Destination IP	25	117.50.11.11	5276	nslookup.exe
Destination IP	32	208.67.222.222	2884	nslookup.exe
Destination IP	65	117.50.22.22	4504	nslookup.exe
Destination IP	103	208.67.220.220	1104	nslookup.exe
Destination IP	118	117.50.22.22	716	nslookup.exe
Destination IP	119	208.67.222.222	4896	nslookup.exe
Destination IP	156	117.50.22.22	4180	nslookup.exe
Destination IP	66	208.67.222.222	4180	nslookup.exe
Destination IP	79	117.50.11.11	1012	nslookup.exe
Destination IP	95	117.50.11.11	4660	nslookup.exe
Destination IP	158	117.50.22.22	4180	nslookup.exe
Destination IP	163	208.67.220.220	3696	nslookup.exe
Destination IP	11	117.50.22.22	5584	nslookup.exe
Destination IP	145	208.67.220.220	4988	nslookup.exe
Destination IP	160	208.67.222.222	2988	nslookup.exe
Destination IP	161	208.67.222.222	2988	nslookup.exe
Destination IP	165	185.121.177.177	1900	nslookup.exe
Destination IP	169	169.239.202.202	4668	nslookup.exe
Destination IP	16	208.67.220.220	1836	nslookup.exe
Destination IP	61	117.50.11.11	1432	nslookup.exe
Destination IP	70	208.67.220.220	1764	nslookup.exe
Destination IP	81	117.50.22.22	3320	nslookup.exe
Destination IP	82	117.50.22.22	3320	nslookup.exe
Destination IP	101	208.67.222.222	4568	nslookup.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	qaruuze.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	qaruuze.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	qaruuze.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	qaruuze.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\bigusrbc\qaruuze.exe	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
File opened for modification	C:\Windows\bigusrbc\qaruuze.exe	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qaruuze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qaruuze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4308	cmd.exe
2280	PING.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x000e00000001c3da-3.dat	nsis_installer_2

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	qaruuze.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	qaruuze.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	qaruuze.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	qaruuze.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	qaruuze.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	qaruuze.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	qaruuze.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	qaruuze.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2280	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4360	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Token: SeDebugPrivilege	4644	qaruuze.exe
Token: SeDebugPrivilege	4580	qaruuze.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4360	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
4644	qaruuze.exe
4580	qaruuze.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4308	4360	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe	86
PID 4308 wrote to memory of 2280	4308	cmd.exe	88
PID 4308 wrote to memory of 4644	4308	cmd.exe	89
PID 4580 wrote to memory of 4684	4580	qaruuze.exe	91
PID 4684 wrote to memory of 3828	4684	cmd.exe	93
PID 4580 wrote to memory of 3372	4580	qaruuze.exe	94
PID 3372 wrote to memory of 3324	3372	cmd.exe	96
PID 4580 wrote to memory of 4880	4580	qaruuze.exe	97
PID 4880 wrote to memory of 5712	4880	cmd.exe	99
PID 4580 wrote to memory of 2512	4580	qaruuze.exe	100
PID 2512 wrote to memory of 5584	2512	cmd.exe	102
PID 4580 wrote to memory of 4936	4580	qaruuze.exe	103
PID 4936 wrote to memory of 2848	4936	cmd.exe	105
PID 4580 wrote to memory of 4600	4580	qaruuze.exe	106
PID 4600 wrote to memory of 1836	4600	cmd.exe	108
PID 4580 wrote to memory of 4356	4580	qaruuze.exe	109
PID 4356 wrote to memory of 3824	4356	cmd.exe	111
PID 4580 wrote to memory of 1328	4580	qaruuze.exe	112
PID 1328 wrote to memory of 2464	1328	cmd.exe	114
PID 4580 wrote to memory of 2332	4580	qaruuze.exe	115
PID 2332 wrote to memory of 5276	2332	cmd.exe	117
PID 4580 wrote to memory of 2456	4580	qaruuze.exe	118
PID 2456 wrote to memory of 3288	2456	cmd.exe	120
PID 4580 wrote to memory of 400	4580	qaruuze.exe	121
PID 400 wrote to memory of 2884	400	cmd.exe	123
PID 4580 wrote to memory of 3956	4580	qaruuze.exe	124
PID 3956 wrote to memory of 5184	3956	cmd.exe	126
PID 4580 wrote to memory of 5356	4580	qaruuze.exe	127
PID 5356 wrote to memory of 5640	5356	cmd.exe	129
PID 4580 wrote to memory of 6068	4580	qaruuze.exe	130
PID 6068 wrote to memory of 1408	6068	cmd.exe	132
PID 4580 wrote to memory of 3220	4580	qaruuze.exe	133
PID 3220 wrote to memory of 1444	3220	cmd.exe	135
PID 4580 wrote to memory of 872	4580	qaruuze.exe	136
PID 872 wrote to memory of 3744	872	cmd.exe	138
PID 4580 wrote to memory of 6016	4580	qaruuze.exe	139
PID 6016 wrote to memory of 1912	6016	cmd.exe	141
PID 4580 wrote to memory of 1676	4580	qaruuze.exe	142
PID 1676 wrote to memory of 4572	1676	cmd.exe	144
PID 4580 wrote to memory of 4444	4580	qaruuze.exe	145
PID 4444 wrote to memory of 4808	4444	cmd.exe	147
PID 4580 wrote to memory of 5308	4580	qaruuze.exe	148
PID 5308 wrote to memory of 1324	5308	cmd.exe	150
PID 4580 wrote to memory of 3352	4580	qaruuze.exe	151
PID 3352 wrote to memory of 1432	3352	cmd.exe	153
PID 4580 wrote to memory of 1520	4580	qaruuze.exe	154
PID 1520 wrote to memory of 4504	1520	cmd.exe	156
PID 4580 wrote to memory of 1788	4580	qaruuze.exe	157
PID 1788 wrote to memory of 4180	1788	cmd.exe	159
PID 4580 wrote to memory of 4872	4580	qaruuze.exe	160
PID 4872 wrote to memory of 1764	4872	cmd.exe	162
PID 4580 wrote to memory of 436	4580	qaruuze.exe	163
PID 436 wrote to memory of 4564	436	cmd.exe	165
PID 4580 wrote to memory of 4384	4580	qaruuze.exe	166
PID 4384 wrote to memory of 1996	4384	cmd.exe	168
PID 4580 wrote to memory of 5756	4580	qaruuze.exe	169
PID 5756 wrote to memory of 1012	5756	cmd.exe	171
PID 4580 wrote to memory of 5424	4580	qaruuze.exe	172
PID 5424 wrote to memory of 3320	5424	cmd.exe	174
PID 4580 wrote to memory of 4832	4580	qaruuze.exe	175
PID 4832 wrote to memory of 4876	4832	cmd.exe	177
PID 4580 wrote to memory of 6128	4580	qaruuze.exe	178
PID 6128 wrote to memory of 3452	6128	cmd.exe	180
PID 4580 wrote to memory of 5740	4580	qaruuze.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\bigusrbc\qaruuze.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2280
- - C:\Windows\bigusrbc\qaruuze.exe
    C:\Windows\bigusrbc\qaruuze.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4644

C:\Windows\bigusrbc\qaruuze.exe
C:\Windows\bigusrbc\qaruuze.exe
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:2848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
    3⤵
    PID:2464
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5184
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
    3⤵
    PID:5640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
    3⤵
    PID:1408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:872
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
    3⤵
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
    3⤵
    PID:1912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:4572
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
    3⤵
    PID:4808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
    3⤵
    PID:1324
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:1432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
    3⤵
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5756
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1012
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:3320
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3452
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5740
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
    3⤵
    PID:6104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5484
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
    3⤵
    PID:2696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
  2⤵
  PID:5136
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
  2⤵
  PID:3784
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5864
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  PID:616
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1500
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:1104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 8.8.8.8
  2⤵
  PID:5596
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 8.8.8.8
    3⤵
    PID:2836
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 1.1.1.1
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 1.1.1.1
    3⤵
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3168
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2216
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4932
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5052
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:4776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4284
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3196
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.11.11
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:5956
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:248
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.222.222
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.222.222
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4640
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3548
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2192
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3660
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:476
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.222.222
  2⤵
  PID:5404
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.220.220
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:3696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 185.121.177.177
  2⤵
  PID:5856
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 185.121.177.177
    3⤵
    - Unexpected DNS network traffic destination
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 169.239.202.202
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 169.239.202.202
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qaruuze.exe

Path C:\Windows\bigusrbc\qaruuze.exe
Size 8.3MB
SHA256 5b46ebad515f94e78008a8dadf7c50d63f76ed7afa967beffa6a11b7f3930de9
MD5 ed4f9e10debd3f6094d5483c3fc976a0
SHA1 dbfc9f6537d5664cb380cccbdb5a764cb14e0b44
SHA512 2c8cbc81c923d3263dbfca24d785fe220a919e9d8cb868159e35ae1f8882ac7339eedb22e6130e207bded958e009550fafec7ccfbadde2bccb42d52c8e8be815
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T14896F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4360-0-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/4360-2-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/4644-5-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads