mimikatz | d980b2f9fbe7d26650de3047276ec863a78bab31dcf1b8da1fecd3cef93a726f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Size 9.0MB
Sample260929-151ntsvgla
SHA256 d980b2f9fbe7d26650de3047276ec863a78bab31dcf1b8da1fecd3cef93a726f
MD5 750ae382ba38a19c62108d0e356511bc
SHA1 8bbb9999700269caac455d4713cb89f2870b893d
SHA512 f7ba20e269d394c41a765c4fc60dc3a7fdf1a868b46391637e93b563de7e2adf7156718c3c5d191db7a7e5196929d9161bcb64aeab7f8606cebdb2872af5ad58
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T146A6F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution mimikatz installer

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral1/memory/5720-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral1/memory/5720-4-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral1/files/0x00080000000245a3-6.dat	mimikatz
behavioral1/memory/5048-8-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/5720-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral1/memory/5720-4-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral1/files/0x00080000000245a3-6.dat	UPX
behavioral1/memory/5048-8-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
5048	nbgqbud.exe
5960	nbgqbud.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	76	117.50.11.11	4368	nslookup.exe
Destination IP	80	117.50.22.22	3908	nslookup.exe
Destination IP	164	208.67.222.222	4368	nslookup.exe
Destination IP	193	208.67.222.222	5960	nbgqbud.exe
Destination IP	209	117.50.22.22	3968	nslookup.exe
Destination IP	215	208.67.220.220	4276	nslookup.exe
Destination IP	63	117.50.22.22	2700	nslookup.exe
Destination IP	83	208.67.222.222	4068	nslookup.exe
Destination IP	96	117.50.22.22	928	nslookup.exe
Destination IP	125	208.67.222.222	1084	nslookup.exe
Destination IP	155	117.50.11.11	408	nslookup.exe
Destination IP	179	117.50.11.11	5396	nslookup.exe
Destination IP	218	185.121.177.177	856	nslookup.exe
Destination IP	93	117.50.11.11	2088	nslookup.exe
Destination IP	94	117.50.11.11	2088	nslookup.exe
Destination IP	100	208.67.222.222	1232	nslookup.exe
Destination IP	139	117.50.22.22	4528	nslookup.exe
Destination IP	147	208.67.220.220	5896	nslookup.exe
Destination IP	81	208.67.222.222	4068	nslookup.exe
Destination IP	32	117.50.22.22	5180	nslookup.exe
Destination IP	68	208.67.220.220	5196	nslookup.exe
Destination IP	127	208.67.222.222	1084	nslookup.exe
Destination IP	137	117.50.11.11	4792	nslookup.exe
Destination IP	154	117.50.11.11	408	nslookup.exe
Destination IP	207	117.50.11.11	1496	nslookup.exe
Destination IP	43	208.67.222.222	1136	nslookup.exe
Destination IP	58	117.50.11.11	3504	nslookup.exe
Destination IP	113	117.50.11.11	5560	nslookup.exe
Destination IP	145	208.67.220.220	5896	nslookup.exe
Destination IP	84	208.67.220.220	5672	nslookup.exe
Destination IP	99	208.67.222.222	1232	nslookup.exe
Destination IP	101	208.67.220.220	3988	nslookup.exe
Destination IP	102	208.67.220.220	3988	nslookup.exe
Destination IP	158	117.50.22.22	5356	nslookup.exe
Destination IP	169	208.67.220.220	3668	nslookup.exe
Destination IP	192	208.67.222.222	4308	nslookup.exe
Destination IP	214	208.67.220.220	4276	nslookup.exe
Destination IP	12	117.50.11.11	1280	nslookup.exe
Destination IP	85	208.67.220.220	5672	nslookup.exe
Destination IP	98	208.67.222.222	1232	nslookup.exe
Destination IP	129	208.67.220.220	3764	nslookup.exe
Destination IP	181	117.50.22.22	3996	nslookup.exe
Destination IP	217	185.121.177.177	856	nslookup.exe
Destination IP	49	208.67.220.220	2120	nslookup.exe
Destination IP	66	208.67.222.222	4040	nslookup.exe
Destination IP	82	208.67.222.222	4068	nslookup.exe
Destination IP	86	208.67.220.220	5672	nslookup.exe
Destination IP	165	208.67.222.222	4368	nslookup.exe
Destination IP	180	117.50.11.11	5960	nbgqbud.exe
Destination IP	28	117.50.11.11	1280	nslookup.exe
Destination IP	44	208.67.222.222	1136	nslookup.exe
Destination IP	45	208.67.222.222	1136	nslookup.exe
Destination IP	195	208.67.220.220	6088	nslookup.exe
Destination IP	213	208.67.222.222	2308	nslookup.exe
Destination IP	216	208.67.220.220	4276	nslookup.exe
Destination IP	31	117.50.22.22	5180	nslookup.exe
Destination IP	60	117.50.22.22	2700	nslookup.exe
Destination IP	64	208.67.222.222	4040	nslookup.exe
Destination IP	77	117.50.11.11	4368	nslookup.exe
Destination IP	130	208.67.220.220	3764	nslookup.exe
Destination IP	141	117.50.22.22	4528	nslookup.exe
Destination IP	157	117.50.11.11	408	nslookup.exe
Destination IP	48	208.67.220.220	2120	nslookup.exe
Destination IP	79	117.50.22.22	3908	nslookup.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	nbgqbud.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	nbgqbud.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	nbgqbud.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	nbgqbud.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\isrbqgaw\nbgqbud.exe	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
File created	C:\Windows\isrbqgaw\nbgqbud.exe	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe

Executes a command shell one-liner 1 TTPs 56 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4140	cmd.exe
2416	cmd.exe
4536	cmd.exe
4464	cmd.exe
1532	cmd.exe
1800	cmd.exe
3396	cmd.exe
2912	cmd.exe
4044	cmd.exe
5848	cmd.exe
3768	cmd.exe
4780	cmd.exe
2272	cmd.exe
4052	cmd.exe
960	cmd.exe
6064	cmd.exe
3248	cmd.exe
3372	cmd.exe
1612	cmd.exe
4204	cmd.exe
1176	cmd.exe
212	cmd.exe
1092	cmd.exe
4552	cmd.exe
2164	cmd.exe
2904	cmd.exe
5920	cmd.exe
4604	cmd.exe
3400	cmd.exe
5656	cmd.exe
6124	cmd.exe
3388	cmd.exe
980	cmd.exe
4568	cmd.exe
6036	cmd.exe
6116	cmd.exe
2716	cmd.exe
2128	cmd.exe
1652	cmd.exe
416	cmd.exe
5916	cmd.exe
4236	cmd.exe
5812	cmd.exe
5160	cmd.exe
240	cmd.exe
2388	cmd.exe
4012	cmd.exe
684	cmd.exe
1972	cmd.exe
3896	cmd.exe
4844	cmd.exe
4156	cmd.exe
6080	cmd.exe
984	cmd.exe
3520	cmd.exe
2240	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nbgqbud.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nbgqbud.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nbgqbud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
512	PING.EXE
2128	cmd.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x00080000000245a3-6.dat	nsis_installer_2

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	nbgqbud.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	nbgqbud.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	nbgqbud.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	nbgqbud.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	nbgqbud.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	nbgqbud.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	nbgqbud.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	nbgqbud.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
512	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5720	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5720	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Token: SeDebugPrivilege	5048	nbgqbud.exe
Token: SeDebugPrivilege	5960	nbgqbud.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5720	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
5048	nbgqbud.exe
5960	nbgqbud.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5720 wrote to memory of 2128	5720	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe	84
PID 2128 wrote to memory of 512	2128	cmd.exe	86
PID 2128 wrote to memory of 5048	2128	cmd.exe	93
PID 5960 wrote to memory of 6124	5960	nbgqbud.exe	95
PID 6124 wrote to memory of 5264	6124	cmd.exe	98
PID 5960 wrote to memory of 5920	5960	nbgqbud.exe	101
PID 5920 wrote to memory of 1972	5920	cmd.exe	103
PID 5960 wrote to memory of 2272	5960	nbgqbud.exe	107
PID 2272 wrote to memory of 1280	2272	cmd.exe	109
PID 5960 wrote to memory of 4052	5960	nbgqbud.exe	113
PID 4052 wrote to memory of 5180	4052	cmd.exe	115
PID 5960 wrote to memory of 240	5960	nbgqbud.exe	118
PID 240 wrote to memory of 1136	240	cmd.exe	120
PID 5960 wrote to memory of 1532	5960	nbgqbud.exe	121
PID 1532 wrote to memory of 2120	1532	cmd.exe	123
PID 5960 wrote to memory of 2388	5960	nbgqbud.exe	124
PID 2388 wrote to memory of 6108	2388	cmd.exe	126
PID 5960 wrote to memory of 3520	5960	nbgqbud.exe	127
PID 3520 wrote to memory of 3968	3520	cmd.exe	129
PID 5960 wrote to memory of 1652	5960	nbgqbud.exe	132
PID 1652 wrote to memory of 3504	1652	cmd.exe	134
PID 5960 wrote to memory of 960	5960	nbgqbud.exe	136
PID 960 wrote to memory of 2700	960	cmd.exe	138
PID 5960 wrote to memory of 416	5960	nbgqbud.exe	139
PID 416 wrote to memory of 4040	416	cmd.exe	141
PID 5960 wrote to memory of 1800	5960	nbgqbud.exe	142
PID 1800 wrote to memory of 5196	1800	cmd.exe	144
PID 5960 wrote to memory of 984	5960	nbgqbud.exe	145
PID 984 wrote to memory of 2640	984	cmd.exe	147
PID 5960 wrote to memory of 2240	5960	nbgqbud.exe	148
PID 2240 wrote to memory of 4232	2240	cmd.exe	150
PID 5960 wrote to memory of 3388	5960	nbgqbud.exe	151
PID 3388 wrote to memory of 4368	3388	cmd.exe	153
PID 5960 wrote to memory of 6064	5960	nbgqbud.exe	154
PID 6064 wrote to memory of 3908	6064	cmd.exe	156
PID 5960 wrote to memory of 980	5960	nbgqbud.exe	157
PID 980 wrote to memory of 4068	980	cmd.exe	159
PID 5960 wrote to memory of 4604	5960	nbgqbud.exe	160
PID 4604 wrote to memory of 5672	4604	cmd.exe	162
PID 5960 wrote to memory of 4140	5960	nbgqbud.exe	163
PID 4140 wrote to memory of 2144	4140	cmd.exe	165
PID 5960 wrote to memory of 2416	5960	nbgqbud.exe	166
PID 2416 wrote to memory of 4788	2416	cmd.exe	168
PID 5960 wrote to memory of 1176	5960	nbgqbud.exe	169
PID 1176 wrote to memory of 2088	1176	cmd.exe	171
PID 5960 wrote to memory of 3400	5960	nbgqbud.exe	172
PID 3400 wrote to memory of 928	3400	cmd.exe	174
PID 5960 wrote to memory of 4012	5960	nbgqbud.exe	175
PID 4012 wrote to memory of 1232	4012	cmd.exe	177
PID 5960 wrote to memory of 6080	5960	nbgqbud.exe	178
PID 6080 wrote to memory of 3988	6080	cmd.exe	180
PID 5960 wrote to memory of 2904	5960	nbgqbud.exe	181
PID 2904 wrote to memory of 2780	2904	cmd.exe	183
PID 5960 wrote to memory of 684	5960	nbgqbud.exe	184
PID 684 wrote to memory of 3332	684	cmd.exe	186
PID 5960 wrote to memory of 1972	5960	nbgqbud.exe	187
PID 1972 wrote to memory of 5560	1972	cmd.exe	189
PID 5960 wrote to memory of 3896	5960	nbgqbud.exe	192
PID 3896 wrote to memory of 5168	3896	cmd.exe	194
PID 5960 wrote to memory of 4568	5960	nbgqbud.exe	195
PID 4568 wrote to memory of 1084	4568	cmd.exe	197
PID 5960 wrote to memory of 212	5960	nbgqbud.exe	198
PID 212 wrote to memory of 3764	212	cmd.exe	200
PID 5960 wrote to memory of 1092	5960	nbgqbud.exe	202

C:\Users\Admin\AppData\Local\Temp\2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5720
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\isrbqgaw\nbgqbud.exe
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:512
- - C:\Windows\isrbqgaw\nbgqbud.exe
    C:\Windows\isrbqgaw\nbgqbud.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5048

C:\Windows\isrbqgaw\nbgqbud.exe
C:\Windows\isrbqgaw\nbgqbud.exe
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
    3⤵
    PID:5264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
    3⤵
    PID:1972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2120
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6108
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4040
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:5196
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6064
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:4068
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:5672
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
    3⤵
    PID:2144
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
    3⤵
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:928
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4012
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:1232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
    3⤵
    PID:3332
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:5560
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
    3⤵
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1084
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1092
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3376
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  PID:6036
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  PID:4536
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  PID:3396
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4844
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2912
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  PID:3248
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 8.8.8.8
    3⤵
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  PID:3372
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  PID:5916
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:408
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  PID:1612
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:5356
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4236
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  PID:4156
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3668
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  PID:4464
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4204
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5812
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:5396
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4044
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:3996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5656
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6116
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:6088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  PID:5160
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 8.8.8.8
    3⤵
    PID:1384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  PID:4552
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:664
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2716
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1496
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  PID:5848
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3768
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:2308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2164
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 185.121.177.177
  2⤵
  - Executes a command shell one-liner
  PID:4780
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 185.121.177.177
    3⤵
    - Unexpected DNS network traffic destination
    PID:856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nbgqbud.exe

Path C:\Windows\isrbqgaw\nbgqbud.exe
Size 9.1MB
SHA256 a93f54354f87655d38c25dd5af665d73e821fb305c47596f378a6ba1cdd685f7
MD5 4e8e5a000c6cceea6a1da52c5c8390fe
SHA1 c79764aa1034227467ff5bfb27e8b4307b5d6cbf
SHA512 875ab615a8189ebbae4c7e6669eec4b0683054992e4b5a5eb7e5f8fb6ab7c9827dc67975e57cd027c6a7579a1d45075c7d6cc434cdca9a95999f2963bc165a11
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T15AA6F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5048-8-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/5720-0-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/5720-4-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads