mimikatz | d980b2f9fbe7d26650de3047276ec863a78bab31dcf1b8da1fecd3cef93a726f

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/09/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Size 9.0MB
Sample260929-151ntsvgla
SHA256 d980b2f9fbe7d26650de3047276ec863a78bab31dcf1b8da1fecd3cef93a726f
MD5 750ae382ba38a19c62108d0e356511bc
SHA1 8bbb9999700269caac455d4713cb89f2870b893d
SHA512 f7ba20e269d394c41a765c4fc60dc3a7fdf1a868b46391637e93b563de7e2adf7156718c3c5d191db7a7e5196929d9161bcb64aeab7f8606cebdb2872af5ad58
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T146A6F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution mimikatz installer

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 4 IoCs

resource	yara_rule
behavioral2/memory/1864-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/memory/1864-2-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral2/files/0x000d00000001c590-3.dat	mimikatz
behavioral2/memory/3452-5-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1864-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/memory/1864-2-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral2/files/0x000d00000001c590-3.dat	UPX
behavioral2/memory/3452-5-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

pid	Process
3452	ullclgw.exe
6056	ullclgw.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	33	117.50.22.22	2900	nslookup.exe
Destination IP	50	117.50.11.11	4628	nslookup.exe
Destination IP	67	117.50.11.11	6036	nslookup.exe
Destination IP	71	208.67.222.222	1756	nslookup.exe
Destination IP	76	208.67.220.220	2056	nslookup.exe
Destination IP	137	117.50.11.11	6056	ullclgw.exe
Destination IP	161	208.67.222.222	2616	nslookup.exe
Destination IP	84	117.50.11.11	2052	nslookup.exe
Destination IP	107	208.67.222.222	5092	nslookup.exe
Destination IP	109	208.67.220.220	896	nslookup.exe
Destination IP	119	117.50.22.22	1904	nslookup.exe
Destination IP	123	208.67.222.222	5264	nslookup.exe
Destination IP	126	208.67.220.220	4856	nslookup.exe
Destination IP	165	208.67.220.220	5660	nslookup.exe
Destination IP	166	208.67.220.220	5660	nslookup.exe
Destination IP	56	208.67.222.222	5360	nslookup.exe
Destination IP	93	208.67.220.220	3796	nslookup.exe
Destination IP	124	208.67.222.222	5264	nslookup.exe
Destination IP	127	208.67.220.220	4856	nslookup.exe
Destination IP	162	208.67.222.222	2616	nslookup.exe
Destination IP	32	117.50.22.22	2900	nslookup.exe
Destination IP	117	117.50.11.11	5972	nslookup.exe
Destination IP	118	117.50.11.11	5972	nslookup.exe
Destination IP	52	117.50.22.22	880	nslookup.exe
Destination IP	53	117.50.22.22	880	nslookup.exe
Destination IP	22	208.67.220.220	5248	nslookup.exe
Destination IP	75	208.67.220.220	2056	nslookup.exe
Destination IP	91	208.67.220.220	3796	nslookup.exe
Destination IP	23	208.67.220.220	5248	nslookup.exe
Destination IP	37	208.67.222.222	1988	nslookup.exe
Destination IP	39	208.67.220.220	1716	nslookup.exe
Destination IP	55	208.67.222.222	5360	nslookup.exe
Destination IP	58	208.67.220.220	5156	nslookup.exe
Destination IP	110	208.67.220.220	896	nslookup.exe
Destination IP	120	117.50.22.22	1904	nslookup.exe
Destination IP	68	117.50.22.22	5172	nslookup.exe
Destination IP	69	117.50.22.22	5172	nslookup.exe
Destination IP	88	208.67.222.222	4284	nslookup.exe
Destination IP	139	117.50.22.22	6056	ullclgw.exe
Destination IP	158	117.50.22.22	3112	nslookup.exe
Destination IP	13	117.50.11.11	6080	nslookup.exe
Destination IP	20	208.67.222.222	6000	nslookup.exe
Destination IP	40	208.67.220.220	1716	nslookup.exe
Destination IP	83	117.50.11.11	2052	nslookup.exe
Destination IP	102	117.50.22.22	2160	nslookup.exe
Destination IP	14	117.50.11.11	6080	nslookup.exe
Destination IP	34	117.50.22.22	2900	nslookup.exe
Destination IP	90	208.67.222.222	4284	nslookup.exe
Destination IP	103	117.50.22.22	2160	nslookup.exe
Destination IP	136	117.50.11.11	2996	nslookup.exe
Destination IP	163	208.67.222.222	2616	nslookup.exe
Destination IP	15	117.50.22.22	4612	nslookup.exe
Destination IP	19	208.67.222.222	6000	nslookup.exe
Destination IP	35	208.67.222.222	1988	nslookup.exe
Destination IP	73	208.67.222.222	1756	nslookup.exe
Destination IP	87	117.50.22.22	3148	nslookup.exe
Destination IP	104	117.50.22.22	2160	nslookup.exe
Destination IP	106	208.67.222.222	5092	nslookup.exe
Destination IP	122	208.67.222.222	5264	nslookup.exe
Destination IP	21	208.67.220.220	5248	nslookup.exe
Destination IP	30	117.50.11.11	260	nslookup.exe
Destination IP	36	208.67.222.222	1988	nslookup.exe
Destination IP	138	117.50.22.22	940	nslookup.exe
Destination IP	145	208.67.222.222	6056	ullclgw.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	ullclgw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	ullclgw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	ullclgw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	ullclgw.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\glhlelcm\ullclgw.exe	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
File opened for modification	C:\Windows\glhlelcm\ullclgw.exe	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe

Executes a command shell one-liner 1 TTPs 57 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2028	cmd.exe
2272	cmd.exe
5536	cmd.exe
4304	cmd.exe
1652	cmd.exe
5816	cmd.exe
4244	cmd.exe
4160	cmd.exe
2044	cmd.exe
4756	cmd.exe
3936	cmd.exe
5684	cmd.exe
5084	cmd.exe
4748	cmd.exe
252	cmd.exe
948	cmd.exe
1132	cmd.exe
5600	cmd.exe
4076	cmd.exe
1588	cmd.exe
4844	cmd.exe
1832	cmd.exe
4968	cmd.exe
4452	cmd.exe
4104	cmd.exe
1200	cmd.exe
4292	cmd.exe
3516	cmd.exe
1204	cmd.exe
2640	cmd.exe
4544	cmd.exe
920	cmd.exe
5012	cmd.exe
5608	cmd.exe
5760	cmd.exe
2484	cmd.exe
5768	cmd.exe
5424	cmd.exe
5776	cmd.exe
4564	cmd.exe
4596	cmd.exe
964	cmd.exe
2820	cmd.exe
5312	cmd.exe
1772	cmd.exe
3348	cmd.exe
1124	cmd.exe
1916	cmd.exe
4712	cmd.exe
4448	cmd.exe
6068	cmd.exe
3176	cmd.exe
436	cmd.exe
3292	cmd.exe
5428	cmd.exe
4180	cmd.exe
3000	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ullclgw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ullclgw.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ullclgw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4820	PING.EXE
4244	cmd.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c590-3.dat	nsis_installer_2

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ullclgw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ullclgw.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ullclgw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ullclgw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ullclgw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ullclgw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ullclgw.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ullclgw.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4820	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1864	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
Token: SeDebugPrivilege	3452	ullclgw.exe
Token: SeDebugPrivilege	6056	ullclgw.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1864	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
3452	ullclgw.exe
6056	ullclgw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4244	1864	2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe	89
PID 4244 wrote to memory of 4820	4244	cmd.exe	91
PID 4244 wrote to memory of 3452	4244	cmd.exe	92
PID 6056 wrote to memory of 5012	6056	ullclgw.exe	94
PID 5012 wrote to memory of 5604	5012	cmd.exe	96
PID 6056 wrote to memory of 1832	6056	ullclgw.exe	97
PID 1832 wrote to memory of 1648	1832	cmd.exe	99
PID 6056 wrote to memory of 6068	6056	ullclgw.exe	100
PID 6068 wrote to memory of 6080	6068	cmd.exe	102
PID 6056 wrote to memory of 4104	6056	ullclgw.exe	103
PID 4104 wrote to memory of 4612	4104	cmd.exe	105
PID 6056 wrote to memory of 4160	6056	ullclgw.exe	106
PID 4160 wrote to memory of 6000	4160	cmd.exe	108
PID 6056 wrote to memory of 4596	6056	ullclgw.exe	109
PID 4596 wrote to memory of 5248	4596	cmd.exe	111
PID 6056 wrote to memory of 5608	6056	ullclgw.exe	112
PID 5608 wrote to memory of 1160	5608	cmd.exe	114
PID 6056 wrote to memory of 1588	6056	ullclgw.exe	115
PID 1588 wrote to memory of 2428	1588	cmd.exe	117
PID 6056 wrote to memory of 2044	6056	ullclgw.exe	118
PID 2044 wrote to memory of 260	2044	cmd.exe	120
PID 6056 wrote to memory of 3348	6056	ullclgw.exe	121
PID 3348 wrote to memory of 2900	3348	cmd.exe	123
PID 6056 wrote to memory of 5760	6056	ullclgw.exe	124
PID 5760 wrote to memory of 1988	5760	cmd.exe	126
PID 6056 wrote to memory of 1124	6056	ullclgw.exe	127
PID 1124 wrote to memory of 1716	1124	cmd.exe	129
PID 6056 wrote to memory of 5776	6056	ullclgw.exe	130
PID 5776 wrote to memory of 6052	5776	cmd.exe	132
PID 6056 wrote to memory of 964	6056	ullclgw.exe	133
PID 964 wrote to memory of 940	964	cmd.exe	135
PID 6056 wrote to memory of 2640	6056	ullclgw.exe	136
PID 2640 wrote to memory of 4628	2640	cmd.exe	138
PID 6056 wrote to memory of 5424	6056	ullclgw.exe	139
PID 5424 wrote to memory of 880	5424	cmd.exe	141
PID 6056 wrote to memory of 5684	6056	ullclgw.exe	142
PID 5684 wrote to memory of 5360	5684	cmd.exe	144
PID 6056 wrote to memory of 4544	6056	ullclgw.exe	145
PID 4544 wrote to memory of 5156	4544	cmd.exe	147
PID 6056 wrote to memory of 4844	6056	ullclgw.exe	148
PID 4844 wrote to memory of 3276	4844	cmd.exe	150
PID 6056 wrote to memory of 4292	6056	ullclgw.exe	151
PID 4292 wrote to memory of 4940	4292	cmd.exe	153
PID 6056 wrote to memory of 3176	6056	ullclgw.exe	154
PID 3176 wrote to memory of 6036	3176	cmd.exe	156
PID 6056 wrote to memory of 4968	6056	ullclgw.exe	157
PID 4968 wrote to memory of 5172	4968	cmd.exe	159
PID 6056 wrote to memory of 948	6056	ullclgw.exe	160
PID 948 wrote to memory of 1756	948	cmd.exe	162
PID 6056 wrote to memory of 1916	6056	ullclgw.exe	163
PID 1916 wrote to memory of 2056	1916	cmd.exe	165
PID 6056 wrote to memory of 2272	6056	ullclgw.exe	166
PID 2272 wrote to memory of 1808	2272	cmd.exe	168
PID 6056 wrote to memory of 1132	6056	ullclgw.exe	169
PID 1132 wrote to memory of 5924	1132	cmd.exe	171
PID 6056 wrote to memory of 4712	6056	ullclgw.exe	173
PID 4712 wrote to memory of 2052	4712	cmd.exe	175
PID 6056 wrote to memory of 5600	6056	ullclgw.exe	176
PID 5600 wrote to memory of 3148	5600	cmd.exe	178
PID 6056 wrote to memory of 2484	6056	ullclgw.exe	179
PID 2484 wrote to memory of 4284	2484	cmd.exe	181
PID 6056 wrote to memory of 5084	6056	ullclgw.exe	182
PID 5084 wrote to memory of 3796	5084	cmd.exe	184
PID 6056 wrote to memory of 436	6056	ullclgw.exe	185

C:\Users\Admin\AppData\Local\Temp\2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_750ae382ba38a19c62108d0e356511bc_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\glhlelcm\ullclgw.exe
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4820
- - C:\Windows\glhlelcm\ullclgw.exe
    C:\Windows\glhlelcm\ullclgw.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3452

C:\Windows\glhlelcm\ullclgw.exe
C:\Windows\glhlelcm\ullclgw.exe
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
    3⤵
    PID:5604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:5248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5608
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
    3⤵
    PID:1160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:260
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
    3⤵
    PID:940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5360
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:5156
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:6036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5172
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1808
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
    3⤵
    PID:5924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5600
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:3796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  PID:436
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1200
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3292
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
    3⤵
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4452
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  PID:2820
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4076
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:896
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4564
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5536
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  PID:4304
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5972
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4448
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4748
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:252
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5428
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 8.8.8.8
    3⤵
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5768
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1436
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  PID:4180
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5312
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:920
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.222.222
    3⤵
    PID:3116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  PID:4756
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.220.220
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 8.8.8.8
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1772
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 8.8.8.8
    3⤵
    PID:1168
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 1.1.1.1
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3000
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5908
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.11.11
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3516
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.11.11
    3⤵
    PID:4872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 117.50.22.22
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3936
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.222.222
  2⤵
  - Executes a command shell one-liner
  PID:1652
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.in 208.67.220.220
  2⤵
  - Executes a command shell one-liner
  PID:1204
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.in 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:5660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 185.121.177.177
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2028
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A 0xMine1.lib 185.121.177.177
    3⤵
    PID:1976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A 0xMine1.lib 169.239.202.202
  2⤵
  - Executes a command shell one-liner
  PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ullclgw.exe

Path C:\Windows\glhlelcm\ullclgw.exe
Size 9.1MB
SHA256 3ad631daf6c16137a8a5359bc3dd83e1f8d361482bbfcb1904acde8478d9298c
MD5 7f8bb740e69d44bc1a91db7552542fd2
SHA1 e8cd8510f9b0ce4847e31a57f150d0f2439ff71e
SHA512 3f06ef95e13044af898a393d6885d7a4a1fa19add047f566be9e5f39a501f87258ede38c09b7196750658527812075b3961835b09ced3fd90bcabb50cc711fa5
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T1FAA6F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1864-0-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/1864-2-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/3452-5-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads