asyncrat | c3c2a6747a34c92023bef1d5abc604f697408e60ee64d1155af7a8c62727e894

Analysis

max time kernel
138s
max time network
148s
platform
windows10_x64
resource
win10
submitted
14-10-2020 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

806934432d6829ff5a0277ec0d4e3e36.exe
Size

1.4MB
MD5

806934432d6829ff5a0277ec0d4e3e36
SHA1

a9a2f97a46fcd667ffd21f9ff3091f7d53db01b3
SHA256

c3c2a6747a34c92023bef1d5abc604f697408e60ee64d1155af7a8c62727e894
SHA512

0396bfd038caf2d023182beb46ca0b99620418b5beee4ae3a16814593d385b4b6b358426e3c739ce796671d29f711239c4d40e9c3c6883806140779c1e8c88b4

Score

10^/10

asyncrat azorult oski raccoon ee3b370277b98939f8098234def6cb188c03591f discovery evasion infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

raccoon

Botnet

ee3b370277b98939f8098234def6cb188c03591f

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

oski

jamesrlon.ug

Extracted

Family

asyncrat

Version

0.5.7B

agentttt.ac.ug:6970

agentpurple.ac.ug:6970

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
s8CEqY6pD21gSg7xELYD1QWGg2YpwLUB
anti_detection
false
autorun
false
bdos
false
delay
Default
host
agentttt.ac.ug,agentpurple.ac.ug
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6970
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Contains code to disable Windows Defender 4 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/2388-85-0x0000000000400000-0x000000000040C000-memory.dmp	disable_win_def
behavioral2/memory/2404-86-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral2/memory/2388-87-0x000000000040616E-mapping.dmp	disable_win_def
behavioral2/memory/2404-88-0x0000000000403BEE-mapping.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Async RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2512-71-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/2512-73-0x000000000040C75E-mapping.dmp	asyncrat

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

Nhrdgfertqw.exeGFsdfgytrqwe.exeNhrdgfertqw.exeGFsdfgytrqwe.exe0yHQ5tfOAc.exeu6dkJovcJi.exeHsMWDO60aP.exetLHBWn6ptm.exe0yHQ5tfOAc.exe0yHQ5tfOAc.exetLHBWn6ptm.exeHsMWDO60aP.exe

pid	process
580	Nhrdgfertqw.exe
204	GFsdfgytrqwe.exe
3456	Nhrdgfertqw.exe
900	GFsdfgytrqwe.exe
1120	0yHQ5tfOAc.exe
3388	u6dkJovcJi.exe
3676	HsMWDO60aP.exe
2312	tLHBWn6ptm.exe
2516	0yHQ5tfOAc.exe
2512	0yHQ5tfOAc.exe
2404	tLHBWn6ptm.exe
2388	HsMWDO60aP.exe

Loads dropped DLL 11 IoCs

Processes:

GFsdfgytrqwe.exe806934432d6829ff5a0277ec0d4e3e36.exe

pid	process
900	GFsdfgytrqwe.exe
900	GFsdfgytrqwe.exe
900	GFsdfgytrqwe.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tLHBWn6ptm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	tLHBWn6ptm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	tLHBWn6ptm.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

806934432d6829ff5a0277ec0d4e3e36.exe

description ioc process

File created C:\Users\Admin\AppData\LocalLow\FLesFFxEsEs\desktop.ini 806934432d6829ff5a0277ec0d4e3e36.exe

description	ioc	process
File created	C:\Users\Admin\AppData\LocalLow\FLesFFxEsEs\desktop.ini	806934432d6829ff5a0277ec0d4e3e36.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

806934432d6829ff5a0277ec0d4e3e36.exeNhrdgfertqw.exeGFsdfgytrqwe.exe0yHQ5tfOAc.exeHsMWDO60aP.exetLHBWn6ptm.exe

description	pid	process	target process
PID 792 set thread context of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	806934432d6829ff5a0277ec0d4e3e36.exe
PID 580 set thread context of 3456	580	Nhrdgfertqw.exe	Nhrdgfertqw.exe
PID 204 set thread context of 900	204	GFsdfgytrqwe.exe	GFsdfgytrqwe.exe
PID 1120 set thread context of 2512	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 3676 set thread context of 2388	3676	HsMWDO60aP.exe	HsMWDO60aP.exe
PID 2312 set thread context of 2404	2312	tLHBWn6ptm.exe	tLHBWn6ptm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

GFsdfgytrqwe.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GFsdfgytrqwe.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3320 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1336 taskkill.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GFsdfgytrqwe.exe

pid	process
3320	timeout.exe

pid	process
1336	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0yHQ5tfOAc.exePowershell.exeHsMWDO60aP.exe

pid	process
1120	0yHQ5tfOAc.exe
1120	0yHQ5tfOAc.exe
3812	Powershell.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

806934432d6829ff5a0277ec0d4e3e36.exeNhrdgfertqw.exeGFsdfgytrqwe.exe

pid process

792 806934432d6829ff5a0277ec0d4e3e36.exe
580 Nhrdgfertqw.exe
204 GFsdfgytrqwe.exe

pid	process
792	806934432d6829ff5a0277ec0d4e3e36.exe
580	Nhrdgfertqw.exe
204	GFsdfgytrqwe.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

taskkill.exe0yHQ5tfOAc.exeHsMWDO60aP.exetLHBWn6ptm.exePowershell.exeHsMWDO60aP.exe

description	pid	process
Token: SeDebugPrivilege	1336	taskkill.exe
Token: SeDebugPrivilege	1120	0yHQ5tfOAc.exe
Token: SeDebugPrivilege	3676	HsMWDO60aP.exe
Token: SeDebugPrivilege	2312	tLHBWn6ptm.exe
Token: SeDebugPrivilege	3812	Powershell.exe
Token: SeDebugPrivilege	2388	HsMWDO60aP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

806934432d6829ff5a0277ec0d4e3e36.exeNhrdgfertqw.exeGFsdfgytrqwe.exe

pid process

792 806934432d6829ff5a0277ec0d4e3e36.exe
580 Nhrdgfertqw.exe
204 GFsdfgytrqwe.exe

pid	process
792	806934432d6829ff5a0277ec0d4e3e36.exe
580	Nhrdgfertqw.exe
204	GFsdfgytrqwe.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

806934432d6829ff5a0277ec0d4e3e36.exeNhrdgfertqw.exeGFsdfgytrqwe.exeGFsdfgytrqwe.execmd.exe806934432d6829ff5a0277ec0d4e3e36.execmd.exe0yHQ5tfOAc.exeHsMWDO60aP.exetLHBWn6ptm.exe

description	pid	process	target process
PID 792 wrote to memory of 580	792	806934432d6829ff5a0277ec0d4e3e36.exe	Nhrdgfertqw.exe
PID 792 wrote to memory of 580	792	806934432d6829ff5a0277ec0d4e3e36.exe	Nhrdgfertqw.exe
PID 792 wrote to memory of 580	792	806934432d6829ff5a0277ec0d4e3e36.exe	Nhrdgfertqw.exe
PID 792 wrote to memory of 204	792	806934432d6829ff5a0277ec0d4e3e36.exe	GFsdfgytrqwe.exe
PID 792 wrote to memory of 204	792	806934432d6829ff5a0277ec0d4e3e36.exe	GFsdfgytrqwe.exe
PID 792 wrote to memory of 204	792	806934432d6829ff5a0277ec0d4e3e36.exe	GFsdfgytrqwe.exe
PID 792 wrote to memory of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	806934432d6829ff5a0277ec0d4e3e36.exe
PID 792 wrote to memory of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	806934432d6829ff5a0277ec0d4e3e36.exe
PID 792 wrote to memory of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	806934432d6829ff5a0277ec0d4e3e36.exe
PID 792 wrote to memory of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	806934432d6829ff5a0277ec0d4e3e36.exe
PID 580 wrote to memory of 3456	580	Nhrdgfertqw.exe	Nhrdgfertqw.exe
PID 580 wrote to memory of 3456	580	Nhrdgfertqw.exe	Nhrdgfertqw.exe
PID 580 wrote to memory of 3456	580	Nhrdgfertqw.exe	Nhrdgfertqw.exe
PID 580 wrote to memory of 3456	580	Nhrdgfertqw.exe	Nhrdgfertqw.exe
PID 204 wrote to memory of 900	204	GFsdfgytrqwe.exe	GFsdfgytrqwe.exe
PID 204 wrote to memory of 900	204	GFsdfgytrqwe.exe	GFsdfgytrqwe.exe
PID 204 wrote to memory of 900	204	GFsdfgytrqwe.exe	GFsdfgytrqwe.exe
PID 204 wrote to memory of 900	204	GFsdfgytrqwe.exe	GFsdfgytrqwe.exe
PID 900 wrote to memory of 2880	900	GFsdfgytrqwe.exe	cmd.exe
PID 900 wrote to memory of 2880	900	GFsdfgytrqwe.exe	cmd.exe
PID 900 wrote to memory of 2880	900	GFsdfgytrqwe.exe	cmd.exe
PID 2880 wrote to memory of 1336	2880	cmd.exe	taskkill.exe
PID 2880 wrote to memory of 1336	2880	cmd.exe	taskkill.exe
PID 2880 wrote to memory of 1336	2880	cmd.exe	taskkill.exe
PID 3964 wrote to memory of 1120	3964	806934432d6829ff5a0277ec0d4e3e36.exe	0yHQ5tfOAc.exe
PID 3964 wrote to memory of 1120	3964	806934432d6829ff5a0277ec0d4e3e36.exe	0yHQ5tfOAc.exe
PID 3964 wrote to memory of 1120	3964	806934432d6829ff5a0277ec0d4e3e36.exe	0yHQ5tfOAc.exe
PID 3964 wrote to memory of 3388	3964	806934432d6829ff5a0277ec0d4e3e36.exe	u6dkJovcJi.exe
PID 3964 wrote to memory of 3388	3964	806934432d6829ff5a0277ec0d4e3e36.exe	u6dkJovcJi.exe
PID 3964 wrote to memory of 3388	3964	806934432d6829ff5a0277ec0d4e3e36.exe	u6dkJovcJi.exe
PID 3964 wrote to memory of 3676	3964	806934432d6829ff5a0277ec0d4e3e36.exe	HsMWDO60aP.exe
PID 3964 wrote to memory of 3676	3964	806934432d6829ff5a0277ec0d4e3e36.exe	HsMWDO60aP.exe
PID 3964 wrote to memory of 3676	3964	806934432d6829ff5a0277ec0d4e3e36.exe	HsMWDO60aP.exe
PID 3964 wrote to memory of 2312	3964	806934432d6829ff5a0277ec0d4e3e36.exe	tLHBWn6ptm.exe
PID 3964 wrote to memory of 2312	3964	806934432d6829ff5a0277ec0d4e3e36.exe	tLHBWn6ptm.exe
PID 3964 wrote to memory of 2312	3964	806934432d6829ff5a0277ec0d4e3e36.exe	tLHBWn6ptm.exe
PID 3964 wrote to memory of 3732	3964	806934432d6829ff5a0277ec0d4e3e36.exe	cmd.exe
PID 3964 wrote to memory of 3732	3964	806934432d6829ff5a0277ec0d4e3e36.exe	cmd.exe
PID 3964 wrote to memory of 3732	3964	806934432d6829ff5a0277ec0d4e3e36.exe	cmd.exe
PID 3732 wrote to memory of 3320	3732	cmd.exe	timeout.exe
PID 3732 wrote to memory of 3320	3732	cmd.exe	timeout.exe
PID 3732 wrote to memory of 3320	3732	cmd.exe	timeout.exe
PID 1120 wrote to memory of 3812	1120	0yHQ5tfOAc.exe	Powershell.exe
PID 1120 wrote to memory of 3812	1120	0yHQ5tfOAc.exe	Powershell.exe
PID 1120 wrote to memory of 3812	1120	0yHQ5tfOAc.exe	Powershell.exe
PID 1120 wrote to memory of 2516	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2516	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2516	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	0yHQ5tfOAc.exe
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	HsMWDO60aP.exe
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	HsMWDO60aP.exe
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	HsMWDO60aP.exe
PID 2312 wrote to memory of 2404	2312	tLHBWn6ptm.exe	tLHBWn6ptm.exe
PID 2312 wrote to memory of 2404	2312	tLHBWn6ptm.exe	tLHBWn6ptm.exe
PID 2312 wrote to memory of 2404	2312	tLHBWn6ptm.exe	tLHBWn6ptm.exe
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	HsMWDO60aP.exe
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	HsMWDO60aP.exe

C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe
"C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
"C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
"C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"
3⤵
- Executes dropped EXE
PID:3456

C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
"C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204

C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
"C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 900 & erase C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe & RD /S /Q C:\\ProgramData\\572453891085442\\* & exit
4⤵
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 900
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe
"C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe"
2⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:3964

C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe
"C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ddcvlc.exe"'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3812

C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe
"C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe"
4⤵
- Executes dropped EXE
PID:2516

C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe
"C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe"
4⤵
- Executes dropped EXE
PID:2512

C:\Users\Admin\AppData\Local\Temp\u6dkJovcJi.exe
"C:\Users\Admin\AppData\Local\Temp\u6dkJovcJi.exe"
3⤵
- Executes dropped EXE
PID:3388

C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe
"C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676

C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe
"C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388

\??\c:\windows\SysWOW64\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\1npihvat.inf
5⤵
PID:2200

C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe
"C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312

C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe
"C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe"
4⤵
- Executes dropped EXE
- Windows security modification
PID:2404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
5⤵
PID:1252

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0yHQ5tfOAc.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tLHBWn6ptm.exe.log

Download Submit
C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe

MD5
379ecc91d09be4613ac661cd7ff2c7e0

SHA1
e7817b8a98a1569b3ef688568958555ac28a33f4

SHA256
f41ca6cf899af666a30b34216cb9d517e6949a3bcabd104bb2e34c96b48444a6

SHA512
23d1f27ade2c76d7bf5ba179a07ffdcb4c9adaece7187f8cf1ab4265933918e8bc70e0664a11df4656f42fcbbf5e2d4ba42ab3122a4f581818c04977078cb48b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe

MD5
379ecc91d09be4613ac661cd7ff2c7e0

SHA1
e7817b8a98a1569b3ef688568958555ac28a33f4

SHA256
f41ca6cf899af666a30b34216cb9d517e6949a3bcabd104bb2e34c96b48444a6

SHA512
23d1f27ade2c76d7bf5ba179a07ffdcb4c9adaece7187f8cf1ab4265933918e8bc70e0664a11df4656f42fcbbf5e2d4ba42ab3122a4f581818c04977078cb48b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe

MD5
379ecc91d09be4613ac661cd7ff2c7e0

SHA1
e7817b8a98a1569b3ef688568958555ac28a33f4

SHA256
f41ca6cf899af666a30b34216cb9d517e6949a3bcabd104bb2e34c96b48444a6

SHA512
23d1f27ade2c76d7bf5ba179a07ffdcb4c9adaece7187f8cf1ab4265933918e8bc70e0664a11df4656f42fcbbf5e2d4ba42ab3122a4f581818c04977078cb48b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe

MD5
f0e0c42c773471dd2c5c853ba6fe2f1e

SHA1
f8c6e0a7a0573fab9cbdd85d22f97950088a3923

SHA256
862149f12c57c95e9f42abca2d796f10df6e6633c8fa234cf21ea11866078b96

SHA512
9ceb7a4016ad3272cabb1e186afbbd607094c273022493d48e24d06ed44eebd1cc72ec062b1d0e9a08d1ac066ee8918ad4ec894d6fccb0af7161e49aa8720214

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe

MD5
f0e0c42c773471dd2c5c853ba6fe2f1e

SHA1
f8c6e0a7a0573fab9cbdd85d22f97950088a3923

SHA256
862149f12c57c95e9f42abca2d796f10df6e6633c8fa234cf21ea11866078b96

SHA512
9ceb7a4016ad3272cabb1e186afbbd607094c273022493d48e24d06ed44eebd1cc72ec062b1d0e9a08d1ac066ee8918ad4ec894d6fccb0af7161e49aa8720214

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe

MD5
f0e0c42c773471dd2c5c853ba6fe2f1e

SHA1
f8c6e0a7a0573fab9cbdd85d22f97950088a3923

SHA256
862149f12c57c95e9f42abca2d796f10df6e6633c8fa234cf21ea11866078b96

SHA512
9ceb7a4016ad3272cabb1e186afbbd607094c273022493d48e24d06ed44eebd1cc72ec062b1d0e9a08d1ac066ee8918ad4ec894d6fccb0af7161e49aa8720214

Download Submit
C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\u6dkJovcJi.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\u6dkJovcJi.exe

Download Submit
C:\Windows\temp\1npihvat.inf

Download Submit
\ProgramData\mozglue.dll

Download Submit
\ProgramData\nss3.dll

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\ProgramData\sqlite3.dll

MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\freebl3.dll

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\mozglue.dll

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\nss3.dll

MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\softokn3.dll

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\softokn3.dll

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll

Download Submit
memory/204-6-0x0000000000000000-mapping.dmp

Download
memory/580-2-0x0000000000000000-mapping.dmp

Download
memory/900-22-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/900-18-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/900-20-0x0000000000417A8B-mapping.dmp

Download
memory/1120-45-0x0000000071540000-0x0000000071C2E000-memory.dmp

Filesize
6.9MB

Download
memory/1120-47-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/1120-67-0x0000000002DE0000-0x0000000002DFA000-memory.dmp

Filesize
104KB

Download
memory/1120-42-0x0000000000000000-mapping.dmp

Download
memory/1120-69-0x0000000005300000-0x000000000530D000-memory.dmp

Filesize
52KB

Download
memory/1252-99-0x0000000000000000-mapping.dmp

Download
memory/1252-106-0x0000000071540000-0x0000000071C2E000-memory.dmp

Filesize
6.9MB

Download
memory/1336-33-0x0000000000000000-mapping.dmp

Download
memory/2200-102-0x0000000000000000-mapping.dmp

Download
memory/2200-108-0x00000000044E0000-0x00000000044E1000-memory.dmp

Filesize
4KB

Download
memory/2200-110-0x00000000045F0000-0x00000000045F1000-memory.dmp

Filesize
4KB

Download
memory/2312-55-0x0000000000000000-mapping.dmp

Download
memory/2312-65-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2312-62-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2312-60-0x0000000071540000-0x0000000071C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2312-81-0x000000000A310000-0x000000000A324000-memory.dmp

Filesize
80KB

Download
memory/2388-85-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2388-101-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/2388-98-0x00000000059F0000-0x00000000059F1000-memory.dmp

Filesize
4KB

Download
memory/2388-87-0x000000000040616E-mapping.dmp

Download
memory/2388-93-0x0000000071540000-0x0000000071C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2404-88-0x0000000000403BEE-mapping.dmp

Download
memory/2404-86-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2404-92-0x0000000071540000-0x0000000071C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-73-0x000000000040C75E-mapping.dmp

Download
memory/2512-77-0x0000000071540000-0x0000000071C2E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-71-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2880-32-0x0000000000000000-mapping.dmp

Download
memory/3320-66-0x0000000000000000-mapping.dmp

Download
memory/3388-46-0x0000000000000000-mapping.dmp

Download
memory/3456-19-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3456-14-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3456-16-0x000000000041A684-mapping.dmp

Download
memory/3676-64-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download
memory/3676-51-0x0000000000000000-mapping.dmp

Download
memory/3676-54-0x0000000071540000-0x0000000071C2E000-memory.dmp

Filesize
6.9MB

Download
memory/3676-82-0x0000000005790000-0x00000000057A6000-memory.dmp

Filesize
88KB

Download
memory/3676-57-0x0000000000E80000-0x0000000000E81000-memory.dmp

Filesize
4KB

Download
memory/3732-56-0x0000000000000000-mapping.dmp

Download
memory/3812-75-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/3812-100-0x0000000006D70000-0x0000000006D71000-memory.dmp

Filesize
4KB

Download
memory/3812-68-0x0000000000000000-mapping.dmp

Download
memory/3812-72-0x0000000071540000-0x0000000071C2E000-memory.dmp

Filesize
6.9MB

Download
memory/3812-103-0x0000000007730000-0x0000000007731000-memory.dmp

Filesize
4KB

Download
memory/3812-105-0x0000000006E40000-0x0000000006E41000-memory.dmp

Filesize
4KB

Download
memory/3812-78-0x0000000006EB0000-0x0000000006EB1000-memory.dmp

Filesize
4KB

Download
memory/3812-107-0x00000000077A0000-0x00000000077A1000-memory.dmp

Filesize
4KB

Download
memory/3964-15-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/3964-12-0x0000000000440102-mapping.dmp

Download
memory/3964-10-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download