mimikatz | edcf2a3035f9c7ffd8628a6e2f5481f2a774224f8bbcc160018e5688ed7bba4f

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Size 7.8MB
Sample260824-len5saem7t
SHA256 edcf2a3035f9c7ffd8628a6e2f5481f2a774224f8bbcc160018e5688ed7bba4f
MD5 6d13556fb4c33633703cd83505f99ab0
SHA1 ba147af04310ce0e25eb9c7fdeeacdf75a2ace51
SHA512 34f7c75bb49c159ce5705231a230465a79cb7b5523e3963ad17ce61f93b90fdc2b323408ac1b9821a87a47402c831ee9082511c910347a891031950fdb1cd90b
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T13086F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution mimikatz installer

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral2/memory/4184-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/memory/4184-2-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/files/0x000d00000001c3fb-3.dat	mimikatz
behavioral2/memory/5624-5-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4184-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/memory/4184-2-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/files/0x000d00000001c3fb-3.dat	UPX
behavioral2/memory/5624-5-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
5624	ihergiy.exe
4856	ihergiy.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	9	117.50.22.22	1216	nslookup.exe
Destination IP	60	117.50.11.11	5352	nslookup.exe
Destination IP	61	117.50.11.11	5352	nslookup.exe
Destination IP	79	117.50.22.22	4332	nslookup.exe
Destination IP	106	208.67.220.220	612	nslookup.exe
Destination IP	118	208.67.222.222	5712	nslookup.exe
Destination IP	123	208.67.220.220	2544	nslookup.exe
Destination IP	45	117.50.22.22	4776	nslookup.exe
Destination IP	48	208.67.222.222	2252	nslookup.exe
Destination IP	16	208.67.220.220	5912	nslookup.exe
Destination IP	43	117.50.11.11	1676	nslookup.exe
Destination IP	44	117.50.11.11	1676	nslookup.exe
Destination IP	49	208.67.222.222	2252	nslookup.exe
Destination IP	63	117.50.22.22	6064	nslookup.exe
Destination IP	68	208.67.220.220	2948	nslookup.exe
Destination IP	35	208.67.220.220	4508	nslookup.exe
Destination IP	50	208.67.222.222	2252	nslookup.exe
Destination IP	113	117.50.11.11	5092	nslookup.exe
Destination IP	7	117.50.11.11	4900	nslookup.exe
Destination IP	31	208.67.222.222	5620	nslookup.exe
Destination IP	33	208.67.222.222	5620	nslookup.exe
Destination IP	100	117.50.22.22	4300	nslookup.exe
Destination IP	101	208.67.222.222	4196	nslookup.exe
Destination IP	10	117.50.22.22	1216	nslookup.exe
Destination IP	12	208.67.222.222	3720	nslookup.exe
Destination IP	95	117.50.11.11	2760	nslookup.exe
Destination IP	121	208.67.220.220	2544	nslookup.exe
Destination IP	8	117.50.11.11	4900	nslookup.exe
Destination IP	15	208.67.220.220	5912	nslookup.exe
Destination IP	64	117.50.22.22	6064	nslookup.exe
Destination IP	70	208.67.220.220	2948	nslookup.exe
Destination IP	77	117.50.11.11	796	nslookup.exe
Destination IP	86	208.67.220.220	4392	nslookup.exe
Destination IP	96	117.50.11.11	2760	nslookup.exe
Destination IP	97	117.50.11.11	2760	nslookup.exe
Destination IP	102	208.67.222.222	4196	nslookup.exe
Destination IP	115	117.50.22.22	5056	nslookup.exe
Destination IP	140	208.67.222.222	3296	nslookup.exe
Destination IP	141	208.67.222.222	4856	ihergiy.exe
Destination IP	143	208.67.220.220	5352	nslookup.exe
Destination IP	29	117.50.22.22	1228	nslookup.exe
Destination IP	99	117.50.22.22	4300	nslookup.exe
Destination IP	120	208.67.222.222	5712	nslookup.exe
Destination IP	11	117.50.22.22	1216	nslookup.exe
Destination IP	27	117.50.11.11	1200	nslookup.exe
Destination IP	30	117.50.22.22	1228	nslookup.exe
Destination IP	32	208.67.222.222	5620	nslookup.exe
Destination IP	52	208.67.220.220	4712	nslookup.exe
Destination IP	88	208.67.220.220	4392	nslookup.exe
Destination IP	105	208.67.220.220	612	nslookup.exe
Destination IP	114	117.50.11.11	5092	nslookup.exe
Destination IP	17	208.67.220.220	5912	nslookup.exe
Destination IP	65	208.67.222.222	5448	nslookup.exe
Destination IP	116	117.50.22.22	5056	nslookup.exe
Destination IP	136	117.50.22.22	4856	ihergiy.exe
Destination IP	28	117.50.22.22	1228	nslookup.exe
Destination IP	36	208.67.220.220	4508	nslookup.exe
Destination IP	87	208.67.220.220	4392	nslookup.exe
Destination IP	103	208.67.222.222	4196	nslookup.exe
Destination IP	119	208.67.222.222	5712	nslookup.exe
Destination IP	133	117.50.11.11	4856	ihergiy.exe
Destination IP	47	117.50.22.22	4776	nslookup.exe
Destination IP	13	208.67.222.222	3720	nslookup.exe
Destination IP	14	208.67.222.222	3720	nslookup.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ihergiy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	ihergiy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	ihergiy.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ihergiy.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\egnggerg\ihergiy.exe	2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
File opened for modification	C:\Windows\egnggerg\ihergiy.exe	2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe

Executes a command shell one-liner 1 TTPs 52 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4144	cmd.exe
6128	cmd.exe
5464	cmd.exe
924	cmd.exe
5572	cmd.exe
3556	cmd.exe
3368	cmd.exe
5368	cmd.exe
1084	cmd.exe
1648	cmd.exe
4508	cmd.exe
5836	cmd.exe
2912	cmd.exe
3048	cmd.exe
2580	cmd.exe
2328	cmd.exe
700	cmd.exe
1396	cmd.exe
1276	cmd.exe
1340	cmd.exe
1384	cmd.exe
5556	cmd.exe
1320	cmd.exe
3104	cmd.exe
4528	cmd.exe
4396	cmd.exe
752	cmd.exe
5884	cmd.exe
5964	cmd.exe
2832	cmd.exe
5568	cmd.exe
1572	cmd.exe
2944	cmd.exe
1428	cmd.exe
1692	cmd.exe
1928	cmd.exe
3328	cmd.exe
4136	cmd.exe
3604	cmd.exe
4436	cmd.exe
5960	cmd.exe
5312	cmd.exe
3836	cmd.exe
5784	cmd.exe
2492	cmd.exe
5468	cmd.exe
4796	cmd.exe
5156	cmd.exe
2092	cmd.exe
4636	cmd.exe
4664	cmd.exe
2208	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4396	cmd.exe
2136	PING.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c3fb-3.dat	nsis_installer_2

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ihergiy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ihergiy.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ihergiy.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ihergiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ihergiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ihergiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ihergiy.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ihergiy.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2136	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4184	2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Token: SeDebugPrivilege	5624	ihergiy.exe
Token: SeDebugPrivilege	4856	ihergiy.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4184	2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
5624	ihergiy.exe
4856	ihergiy.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4396	4184	2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe	89
PID 4396 wrote to memory of 2136	4396	cmd.exe	91
PID 4396 wrote to memory of 5624	4396	cmd.exe	92
PID 4856 wrote to memory of 752	4856	ihergiy.exe	94
PID 752 wrote to memory of 5280	752	cmd.exe	96
PID 4856 wrote to memory of 4136	4856	ihergiy.exe	97
PID 4136 wrote to memory of 3516	4136	cmd.exe	99
PID 4856 wrote to memory of 5156	4856	ihergiy.exe	100
PID 5156 wrote to memory of 4900	5156	cmd.exe	102
PID 4856 wrote to memory of 1428	4856	ihergiy.exe	103
PID 1428 wrote to memory of 1216	1428	cmd.exe	105
PID 4856 wrote to memory of 5836	4856	ihergiy.exe	106
PID 5836 wrote to memory of 3720	5836	cmd.exe	108
PID 4856 wrote to memory of 2092	4856	ihergiy.exe	109
PID 2092 wrote to memory of 5912	2092	cmd.exe	111
PID 4856 wrote to memory of 924	4856	ihergiy.exe	112
PID 924 wrote to memory of 5100	924	cmd.exe	114
PID 4856 wrote to memory of 1692	4856	ihergiy.exe	116
PID 1692 wrote to memory of 4248	1692	cmd.exe	118
PID 4856 wrote to memory of 1340	4856	ihergiy.exe	119
PID 1340 wrote to memory of 1200	1340	cmd.exe	121
PID 4856 wrote to memory of 2912	4856	ihergiy.exe	122
PID 2912 wrote to memory of 1228	2912	cmd.exe	124
PID 4856 wrote to memory of 1384	4856	ihergiy.exe	125
PID 1384 wrote to memory of 5620	1384	cmd.exe	127
PID 4856 wrote to memory of 1928	4856	ihergiy.exe	128
PID 1928 wrote to memory of 4508	1928	cmd.exe	130
PID 4856 wrote to memory of 5556	4856	ihergiy.exe	131
PID 5556 wrote to memory of 5644	5556	cmd.exe	133
PID 4856 wrote to memory of 3048	4856	ihergiy.exe	134
PID 3048 wrote to memory of 4792	3048	cmd.exe	136
PID 4856 wrote to memory of 2580	4856	ihergiy.exe	137
PID 2580 wrote to memory of 1676	2580	cmd.exe	139
PID 4856 wrote to memory of 5572	4856	ihergiy.exe	140
PID 5572 wrote to memory of 4776	5572	cmd.exe	142
PID 4856 wrote to memory of 4636	4856	ihergiy.exe	143
PID 4636 wrote to memory of 2252	4636	cmd.exe	145
PID 4856 wrote to memory of 5884	4856	ihergiy.exe	146
PID 5884 wrote to memory of 4712	5884	cmd.exe	148
PID 4856 wrote to memory of 3604	4856	ihergiy.exe	149
PID 3604 wrote to memory of 5928	3604	cmd.exe	151
PID 4856 wrote to memory of 2328	4856	ihergiy.exe	152
PID 2328 wrote to memory of 5360	2328	cmd.exe	154
PID 4856 wrote to memory of 3836	4856	ihergiy.exe	155
PID 3836 wrote to memory of 5352	3836	cmd.exe	157
PID 4856 wrote to memory of 3556	4856	ihergiy.exe	159
PID 3556 wrote to memory of 6064	3556	cmd.exe	161
PID 4856 wrote to memory of 5784	4856	ihergiy.exe	162
PID 5784 wrote to memory of 5448	5784	cmd.exe	164
PID 4856 wrote to memory of 2492	4856	ihergiy.exe	165
PID 2492 wrote to memory of 2948	2492	cmd.exe	167
PID 4856 wrote to memory of 700	4856	ihergiy.exe	168
PID 700 wrote to memory of 5820	700	cmd.exe	170
PID 4856 wrote to memory of 1320	4856	ihergiy.exe	171
PID 1320 wrote to memory of 4784	1320	cmd.exe	173
PID 4856 wrote to memory of 4664	4856	ihergiy.exe	174
PID 4664 wrote to memory of 796	4664	cmd.exe	176
PID 4856 wrote to memory of 3368	4856	ihergiy.exe	177
PID 3368 wrote to memory of 4332	3368	cmd.exe	179
PID 4856 wrote to memory of 2208	4856	ihergiy.exe	180
PID 2208 wrote to memory of 1520	2208	cmd.exe	182
PID 4856 wrote to memory of 5964	4856	ihergiy.exe	183
PID 5964 wrote to memory of 4392	5964	cmd.exe	185
PID 4856 wrote to memory of 5368	4856	ihergiy.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_6d13556fb4c33633703cd83505f99ab0_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\egnggerg\ihergiy.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2136
- - C:\Windows\egnggerg\ihergiy.exe
    C:\Windows\egnggerg\ihergiy.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5624

C:\Windows\egnggerg\ihergiy.exe
C:\Windows\egnggerg\ihergiy.exe
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
    3⤵
    PID:5280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
    3⤵
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:1216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:3720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5912
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
    3⤵
    PID:5100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
    3⤵
    PID:5644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
    3⤵
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:1676
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:4776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:6064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:2948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
    3⤵
    PID:5820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3368
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:4332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5964
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4392
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5368
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1084
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
    3⤵
    PID:3516
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3328
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2832
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  PID:4144
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  PID:6128
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  PID:5468
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  PID:5464
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4436
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1648
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  PID:5960
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:5712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  PID:4508
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2544
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1396
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5312
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3680
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4796
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.11.11
    3⤵
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1276
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.22.22
    3⤵
    PID:5816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5568
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:3296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3104
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4528
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1572
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 1.1.1.1
    3⤵
    PID:5688
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2944
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.11.11
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ihergiy.exe

Path C:\Windows\egnggerg\ihergiy.exe
Size 7.9MB
SHA256 3c4aeb8302053b280d38ac46164f55e983d4a6e3f76f08da8f16bd676774b72c
MD5 2a56ed5c6884ad4bcc752b63680774e6
SHA1 9f8ca5e647a48ee9475ef66f33073ca21d75ca81
SHA512 24f7be8982f09e72061d8a3f1e573f56087469999c5d28736fa25f32546473b2fc7646e8e503883d56601f4cb1c1aa6137f899a059249b72f10847ecf461cd99
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T1B486F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4184-0-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/4184-2-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/5624-5-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads