Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 11:57
Behavioral task
behavioral1
Sample
2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
- Size 9.7MB
- Sample260910-n4yrmabp71
- SHA256 f0c7b3b431e5a1a4d4abeb49a4f323c06fdcaee65fb5cec3a129a10fc313d32a
- MD5 b1340ce996cccb0ed3542863cbee4d5a
- SHA1 dc92eea906cdebe5485b0680c2571dedcaa37f6d
- SHA512 a3875b83d68e242a3e1bf8511c89530ac8c0300ba55c44d40d3372e690a2c05163141376b7be6a235490c20586316eb0b88aa03a37bc11c571619466680439c7
- SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
- TLSH T1BEA6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- mimikatz is an open source tool to dump credentials on Windows 4 IoCs
resource yara_rule behavioral2/memory/4720-0-0x0000000000400000-0x0000000000CEB000-memory.dmp mimikatz behavioral2/memory/4720-2-0x0000000000400000-0x0000000000CEB000-memory.dmp mimikatz behavioral2/files/0x000e00000001c4c5-3.dat mimikatz behavioral2/memory/4104-5-0x0000000000400000-0x0000000000CEB000-memory.dmp mimikatz - UPX dump on OEP (original entry point) 7 IoCs
resource yara_rule behavioral2/memory/4720-0-0x0000000000400000-0x0000000000CEB000-memory.dmp UPX behavioral2/memory/4720-2-0x0000000000400000-0x0000000000CEB000-memory.dmp UPX behavioral2/files/0x000e00000001c4c5-3.dat UPX behavioral2/memory/4104-5-0x0000000000400000-0x0000000000CEB000-memory.dmp UPX behavioral2/memory/5872-13-0x0000000000400000-0x0000000000466000-memory.dmp UPX behavioral2/files/0x001f00000001c3b5-14.dat UPX behavioral2/memory/5872-16-0x0000000000400000-0x0000000000466000-memory.dmp UPX - Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts yrbetci.exe - Executes dropped EXE 3 IoCs
pid Process 4104 yrbetci.exe 4832 yrbetci.exe 5872 rnwadaioskcewnd12670.exe - Unexpected DNS network traffic destination 62 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 9 163.172.168.171 3844 nslookup.exe Destination IP 28 51.75.173.177 5376 nslookup.exe Destination IP 31 79.124.7.81 5948 nslookup.exe Destination IP 43 165.227.40.43 1860 nslookup.exe Destination IP 46 142.4.204.111 2796 nslookup.exe Destination IP 54 159.203.38.175 5548 nslookup.exe Destination IP 55 159.203.38.175 5548 nslookup.exe Destination IP 34 5.132.191.104 4448 nslookup.exe Destination IP 59 66.70.228.164 4500 nslookup.exe Destination IP 29 79.124.7.81 5948 nslookup.exe Destination IP 7 163.172.168.171 3844 nslookup.exe Destination IP 22 188.226.146.136 6044 nslookup.exe Destination IP 24 188.226.146.136 6044 nslookup.exe Destination IP 27 51.75.173.177 5376 nslookup.exe Destination IP 33 144.76.103.143 4332 nslookup.exe Destination IP 35 5.132.191.104 4448 nslookup.exe Destination IP 51 198.100.148.224 3068 nslookup.exe Destination IP 40 207.148.83.241 6004 nslookup.exe Destination IP 64 185.84.81.194 2580 nslookup.exe Destination IP 17 178.63.116.152 2428 nslookup.exe Destination IP 2 161.97.219.84 2420 nslookup.exe Destination IP 36 13.239.157.177 1988 nslookup.exe Destination IP 47 142.4.204.111 2796 nslookup.exe Destination IP 49 142.4.205.47 2728 nslookup.exe Destination IP 61 51.254.25.115 1488 nslookup.exe Destination IP 3 161.97.219.84 2420 nslookup.exe Destination IP 19 51.77.227.84 3424 nslookup.exe Destination IP 38 13.239.157.177 1988 nslookup.exe Destination IP 44 165.227.40.43 1860 nslookup.exe Destination IP 10 94.103.153.176 256 nslookup.exe Destination IP 8 163.172.168.171 3844 nslookup.exe Destination IP 11 94.103.153.176 256 nslookup.exe Destination IP 15 207.192.71.13 4592 nslookup.exe Destination IP 23 188.226.146.136 6044 nslookup.exe Destination IP 53 198.100.148.224 3068 nslookup.exe Destination IP 56 159.203.38.175 5548 nslookup.exe Destination IP 57 66.70.228.164 4500 nslookup.exe Destination IP 13 207.192.71.13 4592 nslookup.exe Destination IP 32 144.76.103.143 4332 nslookup.exe Destination IP 60 51.254.25.115 1488 nslookup.exe Destination IP 62 51.254.25.115 1488 nslookup.exe Destination IP 20 51.77.227.84 3424 nslookup.exe Destination IP 26 51.75.173.177 5376 nslookup.exe Destination IP 50 142.4.205.47 2728 nslookup.exe Destination IP 65 185.84.81.194 2580 nslookup.exe Destination IP 12 94.103.153.176 256 nslookup.exe Destination IP 14 207.192.71.13 4592 nslookup.exe Destination IP 39 207.148.83.241 6004 nslookup.exe Destination IP 58 66.70.228.164 4500 nslookup.exe Destination IP 18 178.63.116.152 2428 nslookup.exe Destination IP 37 13.239.157.177 1988 nslookup.exe Destination IP 16 178.63.116.152 2428 nslookup.exe Destination IP 42 165.227.40.43 1860 nslookup.exe Destination IP 66 89.40.116.230 3088 nslookup.exe Destination IP 45 142.4.204.111 2796 nslookup.exe Destination IP 48 142.4.205.47 2728 nslookup.exe Destination IP 30 79.124.7.81 5948 nslookup.exe Destination IP 21 51.77.227.84 3424 nslookup.exe Destination IP 41 207.148.83.241 6004 nslookup.exe Destination IP 4 161.97.219.84 2420 nslookup.exe Destination IP 52 198.100.148.224 3068 nslookup.exe Destination IP 63 185.84.81.194 2580 nslookup.exe -
resource yara_rule behavioral2/memory/5872-13-0x0000000000400000-0x0000000000466000-memory.dmp upx behavioral2/files/0x001f00000001c3b5-14.dat upx behavioral2/memory/5872-16-0x0000000000400000-0x0000000000466000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\nmzbqgki\yrbetci.exe 2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe File opened for modification C:\Windows\nmzbqgki\yrbetci.exe 2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe File created C:\Windows\nmzbqgki\rnwadaioskcewnd12670.exe yrbetci.exe - Executes a command shell one-liner 1 TTPs 23 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2156 cmd.exe 5024 cmd.exe 4988 cmd.exe 6008 cmd.exe 4912 cmd.exe 4312 cmd.exe 1952 cmd.exe 4324 cmd.exe 2144 cmd.exe 5624 cmd.exe 4632 cmd.exe 3308 cmd.exe 964 cmd.exe 296 cmd.exe 5660 cmd.exe 4936 cmd.exe 1896 cmd.exe 1608 cmd.exe 4860 cmd.exe 2876 cmd.exe 6136 cmd.exe 4488 cmd.exe 5752 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 49 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yrbetci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yrbetci.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nslookup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4912 cmd.exe 1528 PING.EXE - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c4c5-3.dat nsis_installer_2 - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1528 PING.EXE - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe 5872 rnwadaioskcewnd12670.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 4720 2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4720 2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe Token: SeDebugPrivilege 4104 yrbetci.exe Token: SeDebugPrivilege 4832 yrbetci.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4720 2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe 4104 yrbetci.exe 4832 yrbetci.exe 5872 rnwadaioskcewnd12670.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4720 wrote to memory of 4912 4720 2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe 89 PID 4912 wrote to memory of 1528 4912 cmd.exe 91 PID 4912 wrote to memory of 4104 4912 cmd.exe 92 PID 4832 wrote to memory of 5872 4832 yrbetci.exe 94 PID 4832 wrote to memory of 4312 4832 yrbetci.exe 95 PID 4312 wrote to memory of 2420 4312 cmd.exe 97 PID 4832 wrote to memory of 964 4832 yrbetci.exe 98 PID 964 wrote to memory of 3844 964 cmd.exe 100 PID 4832 wrote to memory of 296 4832 yrbetci.exe 102 PID 296 wrote to memory of 256 296 cmd.exe 104 PID 4832 wrote to memory of 1952 4832 yrbetci.exe 105 PID 1952 wrote to memory of 4592 1952 cmd.exe 107 PID 4832 wrote to memory of 5660 4832 yrbetci.exe 108 PID 5660 wrote to memory of 2428 5660 cmd.exe 110 PID 4832 wrote to memory of 4936 4832 yrbetci.exe 111 PID 4936 wrote to memory of 3424 4936 cmd.exe 113 PID 4832 wrote to memory of 4860 4832 yrbetci.exe 114 PID 4860 wrote to memory of 6044 4860 cmd.exe 116 PID 4832 wrote to memory of 4324 4832 yrbetci.exe 117 PID 4324 wrote to memory of 5376 4324 cmd.exe 119 PID 4832 wrote to memory of 2876 4832 yrbetci.exe 120 PID 2876 wrote to memory of 5948 2876 cmd.exe 122 PID 4832 wrote to memory of 6136 4832 yrbetci.exe 123 PID 6136 wrote to memory of 4332 6136 cmd.exe 125 PID 4832 wrote to memory of 4488 4832 yrbetci.exe 126 PID 4488 wrote to memory of 4448 4488 cmd.exe 128 PID 4832 wrote to memory of 1896 4832 yrbetci.exe 129 PID 1896 wrote to memory of 1988 1896 cmd.exe 131 PID 4832 wrote to memory of 5752 4832 yrbetci.exe 132 PID 5752 wrote to memory of 6004 5752 cmd.exe 134 PID 4832 wrote to memory of 2144 4832 yrbetci.exe 135 PID 2144 wrote to memory of 1860 2144 cmd.exe 137 PID 4832 wrote to memory of 5624 4832 yrbetci.exe 138 PID 5624 wrote to memory of 2796 5624 cmd.exe 140 PID 4832 wrote to memory of 2156 4832 yrbetci.exe 141 PID 2156 wrote to memory of 2728 2156 cmd.exe 143 PID 4832 wrote to memory of 5024 4832 yrbetci.exe 144 PID 5024 wrote to memory of 3068 5024 cmd.exe 146 PID 4832 wrote to memory of 1608 4832 yrbetci.exe 147 PID 1608 wrote to memory of 5548 1608 cmd.exe 149 PID 4832 wrote to memory of 4988 4832 yrbetci.exe 150 PID 4988 wrote to memory of 4500 4988 cmd.exe 152 PID 4832 wrote to memory of 4632 4832 yrbetci.exe 153 PID 4632 wrote to memory of 1488 4632 cmd.exe 155 PID 4832 wrote to memory of 6008 4832 yrbetci.exe 156 PID 6008 wrote to memory of 2580 6008 cmd.exe 158 PID 4832 wrote to memory of 3308 4832 yrbetci.exe 159 PID 3308 wrote to memory of 3088 3308 cmd.exe 161
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_b1340ce996cccb0ed3542863cbee4d5a_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\nmzbqgki\yrbetci.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1528
-
-
C:\Windows\nmzbqgki\yrbetci.exeC:\Windows\nmzbqgki\yrbetci.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4104
-
-
-
C:\Windows\nmzbqgki\yrbetci.exeC:\Windows\nmzbqgki\yrbetci.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\nmzbqgki\rnwadaioskcewnd12670.exeC:\Windows\nmzbqgki\rnwadaioskcewnd12670.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5872
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 161.97.219.842⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 161.97.219.843⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:2420
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 163.172.168.1712⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 163.172.168.1713⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3844
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 94.103.153.1762⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:296 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 94.103.153.1763⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:256
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 207.192.71.132⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 207.192.71.133⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:4592
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 178.63.116.1522⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5660 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 178.63.116.1523⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:2428
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 51.77.227.842⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 51.77.227.843⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3424
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 188.226.146.1362⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 188.226.146.1363⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:6044
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 51.75.173.1772⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 51.75.173.1773⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:5376
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 79.124.7.812⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 79.124.7.813⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:5948
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 144.76.103.1432⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6136 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 144.76.103.1433⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:4332
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 5.132.191.1042⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 5.132.191.1043⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:4448
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 13.239.157.1772⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 13.239.157.1773⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 207.148.83.2412⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 207.148.83.2413⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:6004
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 165.227.40.432⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 165.227.40.433⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:1860
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 142.4.204.1112⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5624 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 142.4.204.1113⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:2796
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 142.4.205.472⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 142.4.205.473⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 198.100.148.2242⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 198.100.148.2243⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3068
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 159.203.38.1752⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 159.203.38.1753⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:5548
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 66.70.228.1642⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 66.70.228.1643⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:4500
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 51.254.25.1152⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 51.254.25.1153⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:1488
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 185.84.81.1942⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 185.84.81.1943⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:2580
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c nslookup -qt=A amxread.lib 89.40.116.2302⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Windows\SysWOW64\nslookup.exenslookup -qt=A amxread.lib 89.40.116.2303⤵
- Unexpected DNS network traffic destination
- System Location Discovery: System Language Discovery
PID:3088
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\nmzbqgki\rnwadaioskcewnd12670.exe
- Size 69KB
- SHA256 875abc09f1abc43dfcc8a9c2a5e541c9a8bcaf33a4e8faa20c58947f8c8b56fa
- MD5 8a761ad0a469caa921b8a1bdb989b9d1
- SHA1 4584c31d116e15f402cc17122edd304eb6c95b2e
- SHA512 d2e541a9a245ea883b54e06583c5db4532e042e333f633e9dc20a1fd5d8d11c46a283274bcde0f972234a63f95e518a27da50f34a1899d88a398bbeb76cb371f
- SSDEEP 1536:7tIzh1n7bEn4yT4R9879VRcDTVGI2j0+Ke3tTip:hmh1n7b24RmJzA2j0A3tTi
- TLSH T1C563021612F7B4F8D5BB0573CFC540D3A186F22FD4C613EE9BC66D2A3D119A8A6A1074
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\nmzbqgki\yrbetci.exe
- Size 9.8MB
- SHA256 5b23839bf8d35430e76390eb49b693ce8375d0df6c0a757dfe2b3e75f2a74907
- MD5 e472c98b608b138322e81ae3ea7db99c
- SHA1 c16a0a4429879b92b159658098bf3090a9608d41
- SHA512 61a9196870055e78f4b7793e30b54141226609a2dc3f7f84f48b1c2772751e7490c165d5695ab1467d3e5fa12460ae384e74577b6c8bf4a5e2882113df5dc334
- SSDEEP 196608:9EaOk2c1uwl1CPwDv3uFhi43v13uFnCPws8S/VW08Sr8lQeY3YKmknGzwHIPHd9H:95nEwl1CPwDv3uFY43v13uFnCPwa/VWH
- TLSH T1D9A6E06025925C56D88142B8C6B3CFBB367E3AA143E6BB477B56B5704E356C03DE830B
- MD5 SHA1 SHA512 SSDEEP TLSH