BIOCs

Process action type = execution AND target process cmd != *-d* AND target process cmd != base64 AND base64 /dev/urandom AND base64 -w0 AND base64 --version AND base64 --help AND base64 -h AND *improbable* AND *bootstrap* AND target process name = base64 Process initiator cmd != *build*.sh* AND cgo name != containerd

Network action type = incoming , outgoing , failed AND remote ip = 198.135.184.22

Network action type = outgoing , failed AND remote host = *dynamic-dns.net , *epac.to , *longmusic.com , *compress.to , *wikaba.com , *zzux.com , *dumb1.com , *1dumb.com , *onedumb.com , *wha.la , *youdontcare.com , *yourtrap.com , *2waky.com , *sexidude.com , *mefound.com , *organiccrap.com , *toythieves.com , *justdied.com , *jungleheart.com , *mrbasic.com , *mrbonus.com , *x24hr.com , *dns04.com , *dns05.com , *zyns.com , *my03.com , *fartit.com , *itemdb.com , *instanthq.com , *xxuz.com , *jkub.com , *itsaol.com , *faqserv.com , *jetos.com , *qpoe.com , *qhigh.com , *vizvaz.com , *mrface.com , *isasecret.com , *mrslove.com , *otzo.com , *sellclassics.com , *americanunfinished.com , *serveusers.com , *serveuser.com , *freetcp.com , *ddns.info , *ns01.info , *ns02.info , *myftp.info , *mydad.info , *mymom.info , *mypicture.info , *myz.info , *squirly.info , *toh.info , *xxxy.info , *freewww.info , *freeddns.com , *myddns.com , *dynamicdns.biz , *ns01.biz , *ns02.biz , *xxxy.biz , *sexxxy.biz , *freewww.biz , *www1.biz , *dhcp.biz , *edns.biz , *ftp1.biz , *mywww.biz , *gr8domain.biz , *gr8name.biz , *ftpserver.biz , *wwwhost.biz , *moneyhome.biz , *port25.biz , *esmtp.biz , *sixth.biz , *ninth.biz , *got-game.org , *bigmoney.biz , *dns2.us , *dns1.us , *ns02.us , *ns01.us , *almostmy.com , *ocry.com , *ourhobby.com , *pcanywhere.net , *ygto.com , *ddns.me.uk , *ddns.ms , *dynamicdns.me.uk , *dynamicdns.org.uk , *ddns.us , *gettrials.com , *4mydomain.com , *25u.com , *4dq.com , *4pu.com , *3-a.net , *dsmtp.com , *mynumber.org , *ns1.name , *ns2.name , *ns3.name , *changeip.name , *ddns.name , *rebatesrule.net , *ezua.com , *sendsmtp.com , *trickip.net , *trickip.org , *dnsrd.com , *lflinkup.com , *lflinkup.net , *lflinkup.org , *lflink.com , *dns-dns.com , *proxydns.com , *myftp.name , *dyndns.pro , *changeip.net , *mysecondarydns.com , *changeip.org , *dns-stuff.com , *dynssl.com , *mylftv.com , *mynetav.net , *mynetav.org , *dynamicdns.co.uk , *ikwb.com , *acmetoy.com , *ddns.mobi , *dnset.com , *authorizeddns.net , *authorizeddns.org , *authorizeddns.us , *cleansite.biz , *cleansite.info , *cleansite.us , *https443.net , *https443.org , *mypop3.net , *mypop3.org , *ssl443.org , *iownyour.biz , *iownyour.org , *onmypc.biz , *onmypc.info , *onmypc.net , *onmypc.org , *onmypc.us , *duckdns.org , *3utilities.com , *blogsyte.com , *bounceme.net , *brasilia.me , *cable-modem.org , *ciscofreak.com , *collegefan.org , *couchpotatofries.org , *damnserver.com , *ddns.me , *ddns.net , *ddnsking.com , *ditchyourip.com , *dnsfor.me , *dnsiskinky.com , *dvrcam.info , *dynns.com , *eating-organic.net , *fantasyleague.cc , *geekgalaxy.com , *golffan.us , *health-carereform.com , *homesecuritymac.com , *homesecuritypc.com , *hopto.me , *ilovecollege.info , *ilovecollege.info , *loginto.me , *mlbfan.org , *mmafan.biz , *myactivedirectory.com , *mydissent.net , *myeffect.net , *myftp.biz , *myftp.org , *mymediapc.net , *mypsx.net , *mysecuritycamera.com , *mysecuritycamera.net , *mysecuritycamera.org , *myvnc.com , *net-freaks.com , *nflfan.org , *nhlfan.net , *no-ip.biz , *no-ip.ca , *no-ip.co.uk , *no-ip.info , *noip.me , *no-ip.net , *no-ip.org , *noip.us , *noip.com , *onthewifi.com , *pgafan.net , *point2this.com , *pointto.us , *privatizehealthinsurance.net , *quicksytes.com , *read-books.org , *redirectme.net , *securitytactics.com , *servebeer.com , *serveblog.net , *servecounterstrike.com , *serveexchange.com , *serveftp.com , *servegame.com , *servehalflife.com , *servehttp.com , *servehumour.com , *serveminecraft.net , *servemp3.com , *servep2p.com , *servepics.com , *servequake.com , *servesarcasm.com , *stufftoread.com , *ufcfan.org , *unusualperson.com , *webhop.me , *workisboring.com , *zapto.org , *at-band-camp.net , *barrel-of-knowledge.info , *barrell-of-knowledge.info , *better-than.tv , *blogdns.com , *blogdns.net , *blogdns.org , *blogsite.org , *boldlygoingnowhere.org , *broke-it.net , *buyshouses.net , *cechire.com , *dnsalias.com , *dnsalias.net , *dnsalias.org , *dnsdojo.com , *dnsdojo.net , *dnsdojo.org , *does-it.net , *doesntexist.com , *doesntexist.org , *dontexist.com , *dontexist.net , *dontexist.org , *doomdns.com , *doomdns.org , *dvrdns.org , *dyn-o-saur.com , *dynalias.com , *dynalias.net , *dynalias.org , *dynathome.net , *dyndns-at-home.com , *dyndns-at-work.com , *dyndns-blog.com , *dyndns-free.com , *dyndns-home.com , *dyndns-ip.com , *dyndns-mail.com , *dyndns-office.com , *dyndns-pics.com , *dyndns-remote.com , *dyndns-server.com , *dyndns-web.com , *dyndns-wiki.com , *dyndns-work.com , *dyndns.biz , *dyndns.info , *dyndns.org , *dyndns.tv , *dyndns.ws , *endofinternet.net , *endofinternet.org , *endoftheinternet.org , *est-a-la-maison.com , *est-a-la-masion.com , *est-le-patron.com , *est-mon-blogueur.com , *for-better.biz , *for-more.biz , *for-our.info , *for-some.biz , *for-the.biz , *forgot.her.name , *forgot.his.name , *from-ak.com , *from-al.com , *from-ar.com , *from-az.net , *from-ca.com , *from-co.net , *from-ct.com , *from-dc.com , *from-de.com , *from-fl.com , *from-ga.com , *from-hi.com , *from-ia.com , *from-id.com , *from-il.com , *from-in.com , *from-ks.com , *from-ky.com , *from-la.net , *from-ma.com , *from-md.com , *from-me.org , *from-mi.com , *from-mn.com , *from-mo.com , *from-ms.com , *from-mt.com , *from-nc.com , *from-nd.com , *from-ne.com , *from-nh.com , *from-nj.com , *from-nm.com , *from-nv.com , *from-ny.net , *from-oh.com , *from-ok.com , *from-or.com , *from-pa.com , *from-pr.com , *from-ri.com , *from-sc.com , *from-sd.com , *from-tn.com , *from-tx.com , *from-ut.com , *from-va.com , *from-vt.com , *from-wa.com , *from-wi.com , *from-wv.com , *from-wy.com , *ftpaccess.cc , *fuettertdasnetz.de , *game-host.org , *game-server.cc , *getmyip.com , *gets-it.net , *go.dyndns.org , *gotdns.com , *gotdns.org , *groks-the.info , *groks-this.info , *ham-radio-op.net , *here-for-more.info , *hobby-site.com , *hobby-site.org , *home.dyndns.org , *homedns.org , *homeftp.net , *homeftp.org , *homeip.net , *homelinux.com , *homelinux.net , *homelinux.org , *homeunix.com , *homeunix.net , *homeunix.org , *iamallama.com , *in-the-band.net , *is-a-anarchist.com , *is-a-blogger.com , *is-a-bookkeeper.com , *is-a-bruinsfan.org , *is-a-bulls-fan.com , *is-a-candidate.org , *is-a-caterer.com , *is-a-celticsfan.org , *is-a-chef.com , *is-a-chef.net , *is-a-chef.org , *is-a-conservative.com , *is-a-cpa.com , *is-a-cubicle-slave.com , *is-a-democrat.com , *is-a-designer.com , *is-a-doctor.com , *is-a-financialadvisor.com , *is-a-geek.com , *is-a-geek.net , *is-a-geek.org , *is-a-green.com , *is-a-guru.com , *is-a-hard-worker.com , *is-a-hunter.com , *is-a-knight.org , *is-a-landscaper.com , *is-a-lawyer.com , *is-a-liberal.com , *is-a-libertarian.com , *is-a-linux-user.org , *is-a-llama.com , *is-a-musician.com , *is-a-nascarfan.com , *is-a-nurse.com , *is-a-painter.com , *is-a-patsfan.org , *is-a-personaltrainer.com , *is-a-photographer.com , *is-a-player.com , *is-a-republican.com , *is-a-rockstar.com , *is-a-socialist.com , *is-a-soxfan.org , *is-a-student.com , *is-a-teacher.com , *is-a-techie.com , *is-a-therapist.com , *is-an-accountant.com , *is-an-actor.com , *is-an-actress.com , *is-an-anarchist.com , *is-an-artist.com , *is-an-engineer.com , *is-an-entertainer.com , *is-by.us , *is-certified.com , *is-found.org , *is-gone.com , *is-into-anime.com , *is-into-cars.com , *is-into-cartoons.com , *is-into-games.com , *is-leet.com , *is-lost.org , *is-not-certified.com , *is-saved.org , *is-slick.com , *is-uberleet.com , *is-very-bad.org , *is-very-evil.org , *is-very-good.org , *is-very-nice.org , *is-very-sweet.org , *is-with-theband.com , *isa-geek.com , *isa-geek.net , *isa-geek.org , *isa-hockeynut.com , *issmarterthanyou.com , *isteingeek.de , *istmein.de , *kicks-ass.net , *kicks-ass.org , *knowsitall.info , *land-4-sale.us , *lebtimnetz.de , *leitungsen.de , *likes-pie.com , *likescandy.com , *merseine.nu , *mine.nu , *misconfused.org , *mypets.ws , *myphotos.cc , *neat-url.com , *office-on-the.net , *on-the-web.tv , *podzone.net , *podzone.org , *readmyblog.org , *saves-the-whales.com , *scrapper-site.net , *scrapping.cc , *selfip.biz , *selfip.com , *selfip.info , *selfip.net , *selfip.org , *sells-for-less.com , *sells-for-u.com , *sells-it.net , *sellsyourhome.org , *servebbs.com , *servebbs.net , *servebbs.org , *serveftp.net , *serveftp.org , *servegame.org , *shacknet.nu , *simple-url.com , *space-to-rent.com , *stuff-4-sale.org , *stuff-4-sale.us , *teaches-yoga.com , *thruhere.net , *traeumtgerade.de , *webhop.biz , *webhop.info , *webhop.net , *webhop.org , *worse-than.tv , *writesthisblog.com , *publicvm.com , *linkpc.net

File action type = create , write AND file path =~ (\\inetpub\\wwwroot\\aspnet_client\\|\\frontend\\httpproxy\\owa\\auth\\|\\frontend\\httpproxy\\ecp\\auth\\).*\.aspx Process initiated by = UMWorkerProcess.exe , w3wp.exe

Process action type = execution AND target process cmd = *rtcp://*socks5* , *rtcp://*socks4* , *rudp://*socks5* , *rudp://*socks4*

Network action type = outgoing , failed AND remote host = *githubusercontent.com* , *github.com , *gitlab.com Process initiated by != iexplore.exe AND chrome.exe AND firefox.exe AND opera.exe AND msedge.exe AND microsoftedge.exe AND microsoftedgecp.exe AND brave.exe AND vivaldi.exe AND chrome AND google chrome helper AND chromium AND firefox AND opera AND safari AND brave AND vivaldi AND initiated by != microsoft edge* AND git* AND grafana-server* AND initiator path != *\microsoft vs code\code.exe AND /Applications/Visual Studio Code.app/* AND *Sisense*java.exe* AND cgo cmd != *puppetlabs* AND *TeamCity\bin*

Process action type = execution AND target process cmd =~ \s+-R\s+((\d{1,3}\.){3}\d{1,3}:)?(\d+:)?(localhost|127\.0\.0\.1):(3389|445|135|139|389|636)

Network action type = incoming , outgoing , failed Process initiated by = socat.exe , nc.exe , cryptcat.exe AND initiator cmd = *onion*

Image Load module sha256 = 32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77 , dab758bf98d9b36fa057a66cd0284737abf89857b73ca89280267ee7caf62f3b , eb6fab5a2964c5817fb239a7a5079cabca0a00464fb3e07155f28b0a57a2c0ed , c09040d35630d75dfef0f804f320f8b3d16a481071076918e9b236a321c1ea77 , ac1b2b89e60707a20e9eb1ca480bc3410ead40643b386d624c5d21b47c02917c , 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134 , ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6 , a25cadd48d70f6ea0c4a241d99c5241269e6faccb4054e62d16784640f8e53bc , D3c6785e18fba3749fb785bc313cf8346182f532c59172b69adfb31b96a5d0af Process initiated by = *businesslayerhost* , cgo name = *businesslayerhost* , os parent name = *businesslayerhost* Host host os = windows

File action type = create , write , rename AND file path = *personalization\lockscreenimage* Process os parent name = desktopimgdownldr.exe , svchost.exe AND cgo name != omadmprc.exe AND CcmExec.exe AND GoogleUpdate.exe AND ServiceShell.exe AND os parent cmd != *svchost.exe*-k*gpsvc*