asyncrat | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

Target

42f972925508a82236e8533567487761.exe
Size

3.7MB
MD5

9d2a888ca79e1ff3820882ea1d88d574
SHA1

112c38d80bf2c0d48256249bbabe906b834b1f66
SHA256

8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA512

17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

Score

10^/10

asyncrat darkcomet warzonerat evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes

aes_key
DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo
anti_detection
true
autorun
true
bdos
false
delay
host
sandyclark255.hopto.org
hwid
install_file
install_folder
%AppData%
mutex
adweqsds56332
pastebin_config
null
port
6606,8808,7707
version
0.5.6A

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\excelsl.exe"	svuhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\1wLUcTmOU8uc.exe\",explorer.exe"	0frlnjCEAJYvKRFN.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral21/memory/336-63-0x0000000000840000-0x000000000084D000-memory.dmp	asyncrat

Warzone RAT Payload 3 IoCs

rat

resource	yara_rule
behavioral21/memory/1576-58-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral21/memory/1576-59-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral21/memory/1576-62-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Disables RegEdit via registry modification
evasion
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svuhost.exe

Executes dropped EXE 22 IoCs

pid	Process
1936	KnAqNJPP1MmvmAMa.exe
1664	0frlnjCEAJYvKRFN.exe
1924	ZSin1nGnyeBcdt8j.exe
336	lYOQ0t8Mo40pw1q4.exe
112	QvwWf6K5G4tusNX8.exe
1148	Nt8msNAljGD0o5qD.exe
844	svthost.exe
672	svthost.exe
1436	svrhost.exe
1576	eridjeht.exe
976	svbhost.exe
760	svbhost.exe
1740	svbhost.exe
1536	svbhost.exe
844	svbhost.exe
1848	svbhost.exe
2020	svehosts.exe
876	svuhost.exe
1988	svuhost.exe
112	excelsl.exe
1892	svuhost.exe
1604	prndrvest.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	svehosts.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	svehosts.exe

Loads dropped DLL 22 IoCs

pid	Process
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1148	Nt8msNAljGD0o5qD.exe
112	QvwWf6K5G4tusNX8.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
288	dw20.exe
1924	ZSin1nGnyeBcdt8j.exe
1924	ZSin1nGnyeBcdt8j.exe
1988	svuhost.exe
112	excelsl.exe
1416	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	svehosts.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	svuhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	svuhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	svehosts.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1192 set thread context of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1148 set thread context of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 112 set thread context of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 1924 set thread context of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 112 set thread context of 1892	112	excelsl.exe	52

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svehosts.exe	KnAqNJPP1MmvmAMa.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1936	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
556	timeout.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1192	42f972925508a82236e8533567487761.exe
1148	Nt8msNAljGD0o5qD.exe
1148	Nt8msNAljGD0o5qD.exe
1148	Nt8msNAljGD0o5qD.exe
112	QvwWf6K5G4tusNX8.exe
112	QvwWf6K5G4tusNX8.exe
112	QvwWf6K5G4tusNX8.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1664	0frlnjCEAJYvKRFN.exe
1924	ZSin1nGnyeBcdt8j.exe
1924	ZSin1nGnyeBcdt8j.exe
1924	ZSin1nGnyeBcdt8j.exe
1924	ZSin1nGnyeBcdt8j.exe
1924	ZSin1nGnyeBcdt8j.exe
1924	ZSin1nGnyeBcdt8j.exe
1924	ZSin1nGnyeBcdt8j.exe
336	lYOQ0t8Mo40pw1q4.exe
112	excelsl.exe
112	excelsl.exe
112	excelsl.exe
1604	prndrvest.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1436	svrhost.exe

Suspicious use of AdjustPrivilegeToken 80 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	42f972925508a82236e8533567487761.exe
Token: SeDebugPrivilege	1192	42f972925508a82236e8533567487761.exe
Token: SeDebugPrivilege	1148	Nt8msNAljGD0o5qD.exe
Token: SeDebugPrivilege	1936	KnAqNJPP1MmvmAMa.exe
Token: SeDebugPrivilege	1936	KnAqNJPP1MmvmAMa.exe
Token: SeDebugPrivilege	112	QvwWf6K5G4tusNX8.exe
Token: SeDebugPrivilege	336	lYOQ0t8Mo40pw1q4.exe
Token: SeDebugPrivilege	1664	0frlnjCEAJYvKRFN.exe
Token: SeDebugPrivilege	1664	0frlnjCEAJYvKRFN.exe
Token: SeDebugPrivilege	1924	ZSin1nGnyeBcdt8j.exe
Token: SeIncreaseQuotaPrivilege	1988	svuhost.exe
Token: SeSecurityPrivilege	1988	svuhost.exe
Token: SeTakeOwnershipPrivilege	1988	svuhost.exe
Token: SeLoadDriverPrivilege	1988	svuhost.exe
Token: SeSystemProfilePrivilege	1988	svuhost.exe
Token: SeSystemtimePrivilege	1988	svuhost.exe
Token: SeProfSingleProcessPrivilege	1988	svuhost.exe
Token: SeIncBasePriorityPrivilege	1988	svuhost.exe
Token: SeCreatePagefilePrivilege	1988	svuhost.exe
Token: SeBackupPrivilege	1988	svuhost.exe
Token: SeRestorePrivilege	1988	svuhost.exe
Token: SeShutdownPrivilege	1988	svuhost.exe
Token: SeDebugPrivilege	1988	svuhost.exe
Token: SeSystemEnvironmentPrivilege	1988	svuhost.exe
Token: SeChangeNotifyPrivilege	1988	svuhost.exe
Token: SeRemoteShutdownPrivilege	1988	svuhost.exe
Token: SeUndockPrivilege	1988	svuhost.exe
Token: SeManageVolumePrivilege	1988	svuhost.exe
Token: SeImpersonatePrivilege	1988	svuhost.exe
Token: SeCreateGlobalPrivilege	1988	svuhost.exe
Token: 33	1988	svuhost.exe
Token: 34	1988	svuhost.exe
Token: 35	1988	svuhost.exe
Token: SeDebugPrivilege	2020	svehosts.exe
Token: SeDebugPrivilege	2020	svehosts.exe
Token: SeDebugPrivilege	112	excelsl.exe
Token: SeIncreaseQuotaPrivilege	1892	svuhost.exe
Token: SeSecurityPrivilege	1892	svuhost.exe
Token: SeTakeOwnershipPrivilege	1892	svuhost.exe
Token: SeLoadDriverPrivilege	1892	svuhost.exe
Token: SeSystemProfilePrivilege	1892	svuhost.exe
Token: SeSystemtimePrivilege	1892	svuhost.exe
Token: SeProfSingleProcessPrivilege	1892	svuhost.exe
Token: SeIncBasePriorityPrivilege	1892	svuhost.exe
Token: SeCreatePagefilePrivilege	1892	svuhost.exe
Token: SeBackupPrivilege	1892	svuhost.exe
Token: SeRestorePrivilege	1892	svuhost.exe
Token: SeShutdownPrivilege	1892	svuhost.exe
Token: SeDebugPrivilege	1892	svuhost.exe
Token: SeSystemEnvironmentPrivilege	1892	svuhost.exe
Token: SeChangeNotifyPrivilege	1892	svuhost.exe
Token: SeRemoteShutdownPrivilege	1892	svuhost.exe
Token: SeUndockPrivilege	1892	svuhost.exe
Token: SeManageVolumePrivilege	1892	svuhost.exe
Token: SeImpersonatePrivilege	1892	svuhost.exe
Token: SeCreateGlobalPrivilege	1892	svuhost.exe
Token: 33	1892	svuhost.exe
Token: 34	1892	svuhost.exe
Token: 35	1892	svuhost.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe
Token: SeDebugPrivilege	1604	prndrvest.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe
Token: 33	2020	svehosts.exe
Token: SeIncBasePriorityPrivilege	2020	svehosts.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1892	svuhost.exe

Suspicious use of WriteProcessMemory 191 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1936	1192	42f972925508a82236e8533567487761.exe	29
PID 1192 wrote to memory of 1936	1192	42f972925508a82236e8533567487761.exe	29
PID 1192 wrote to memory of 1936	1192	42f972925508a82236e8533567487761.exe	29
PID 1192 wrote to memory of 1936	1192	42f972925508a82236e8533567487761.exe	29
PID 1192 wrote to memory of 1664	1192	42f972925508a82236e8533567487761.exe	30
PID 1192 wrote to memory of 1664	1192	42f972925508a82236e8533567487761.exe	30
PID 1192 wrote to memory of 1664	1192	42f972925508a82236e8533567487761.exe	30
PID 1192 wrote to memory of 1664	1192	42f972925508a82236e8533567487761.exe	30
PID 1192 wrote to memory of 1924	1192	42f972925508a82236e8533567487761.exe	31
PID 1192 wrote to memory of 1924	1192	42f972925508a82236e8533567487761.exe	31
PID 1192 wrote to memory of 1924	1192	42f972925508a82236e8533567487761.exe	31
PID 1192 wrote to memory of 1924	1192	42f972925508a82236e8533567487761.exe	31
PID 1192 wrote to memory of 336	1192	42f972925508a82236e8533567487761.exe	32
PID 1192 wrote to memory of 336	1192	42f972925508a82236e8533567487761.exe	32
PID 1192 wrote to memory of 336	1192	42f972925508a82236e8533567487761.exe	32
PID 1192 wrote to memory of 336	1192	42f972925508a82236e8533567487761.exe	32
PID 1192 wrote to memory of 112	1192	42f972925508a82236e8533567487761.exe	33
PID 1192 wrote to memory of 112	1192	42f972925508a82236e8533567487761.exe	33
PID 1192 wrote to memory of 112	1192	42f972925508a82236e8533567487761.exe	33
PID 1192 wrote to memory of 112	1192	42f972925508a82236e8533567487761.exe	33
PID 1192 wrote to memory of 1148	1192	42f972925508a82236e8533567487761.exe	34
PID 1192 wrote to memory of 1148	1192	42f972925508a82236e8533567487761.exe	34
PID 1192 wrote to memory of 1148	1192	42f972925508a82236e8533567487761.exe	34
PID 1192 wrote to memory of 1148	1192	42f972925508a82236e8533567487761.exe	34
PID 1192 wrote to memory of 844	1192	42f972925508a82236e8533567487761.exe	35
PID 1192 wrote to memory of 844	1192	42f972925508a82236e8533567487761.exe	35
PID 1192 wrote to memory of 844	1192	42f972925508a82236e8533567487761.exe	35
PID 1192 wrote to memory of 844	1192	42f972925508a82236e8533567487761.exe	35
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1192 wrote to memory of 672	1192	42f972925508a82236e8533567487761.exe	36
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 1148 wrote to memory of 1436	1148	Nt8msNAljGD0o5qD.exe	37
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 112 wrote to memory of 1576	112	QvwWf6K5G4tusNX8.exe	38
PID 1664 wrote to memory of 976	1664	0frlnjCEAJYvKRFN.exe	39
PID 1664 wrote to memory of 976	1664	0frlnjCEAJYvKRFN.exe	39
PID 1664 wrote to memory of 976	1664	0frlnjCEAJYvKRFN.exe	39
PID 1664 wrote to memory of 976	1664	0frlnjCEAJYvKRFN.exe	39
PID 1664 wrote to memory of 760	1664	0frlnjCEAJYvKRFN.exe	40
PID 1664 wrote to memory of 760	1664	0frlnjCEAJYvKRFN.exe	40
PID 1664 wrote to memory of 760	1664	0frlnjCEAJYvKRFN.exe	40
PID 1664 wrote to memory of 760	1664	0frlnjCEAJYvKRFN.exe	40
PID 1664 wrote to memory of 1740	1664	0frlnjCEAJYvKRFN.exe	41
PID 1664 wrote to memory of 1740	1664	0frlnjCEAJYvKRFN.exe	41
PID 1664 wrote to memory of 1740	1664	0frlnjCEAJYvKRFN.exe	41
PID 1664 wrote to memory of 1740	1664	0frlnjCEAJYvKRFN.exe	41
PID 1664 wrote to memory of 1536	1664	0frlnjCEAJYvKRFN.exe	45
PID 1664 wrote to memory of 1536	1664	0frlnjCEAJYvKRFN.exe	45
PID 1664 wrote to memory of 1536	1664	0frlnjCEAJYvKRFN.exe	45
PID 1664 wrote to memory of 1536	1664	0frlnjCEAJYvKRFN.exe	45
PID 1664 wrote to memory of 1848	1664	0frlnjCEAJYvKRFN.exe	44
PID 1664 wrote to memory of 1848	1664	0frlnjCEAJYvKRFN.exe	44
PID 1664 wrote to memory of 1848	1664	0frlnjCEAJYvKRFN.exe	44
PID 1664 wrote to memory of 1848	1664	0frlnjCEAJYvKRFN.exe	44
PID 1664 wrote to memory of 844	1664	0frlnjCEAJYvKRFN.exe	43
PID 1664 wrote to memory of 844	1664	0frlnjCEAJYvKRFN.exe	43
PID 1664 wrote to memory of 844	1664	0frlnjCEAJYvKRFN.exe	43
PID 1664 wrote to memory of 844	1664	0frlnjCEAJYvKRFN.exe	43
PID 1664 wrote to memory of 288	1664	0frlnjCEAJYvKRFN.exe	42
PID 1664 wrote to memory of 288	1664	0frlnjCEAJYvKRFN.exe	42
PID 1664 wrote to memory of 288	1664	0frlnjCEAJYvKRFN.exe	42
PID 1664 wrote to memory of 288	1664	0frlnjCEAJYvKRFN.exe	42
PID 1936 wrote to memory of 2020	1936	KnAqNJPP1MmvmAMa.exe	46
PID 1936 wrote to memory of 2020	1936	KnAqNJPP1MmvmAMa.exe	46
PID 1936 wrote to memory of 2020	1936	KnAqNJPP1MmvmAMa.exe	46
PID 1936 wrote to memory of 2020	1936	KnAqNJPP1MmvmAMa.exe	46
PID 1924 wrote to memory of 876	1924	ZSin1nGnyeBcdt8j.exe	47
PID 1924 wrote to memory of 876	1924	ZSin1nGnyeBcdt8j.exe	47
PID 1924 wrote to memory of 876	1924	ZSin1nGnyeBcdt8j.exe	47
PID 1924 wrote to memory of 876	1924	ZSin1nGnyeBcdt8j.exe	47
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1924 wrote to memory of 1988	1924	ZSin1nGnyeBcdt8j.exe	48
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 1920	1988	svuhost.exe	49
PID 1988 wrote to memory of 112	1988	svuhost.exe	50
PID 1988 wrote to memory of 112	1988	svuhost.exe	50
PID 1988 wrote to memory of 112	1988	svuhost.exe	50
PID 1988 wrote to memory of 112	1988	svuhost.exe	50
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 112 wrote to memory of 1892	112	excelsl.exe	52
PID 336 wrote to memory of 1936	336	lYOQ0t8Mo40pw1q4.exe	53
PID 336 wrote to memory of 1936	336	lYOQ0t8Mo40pw1q4.exe	53
PID 336 wrote to memory of 1936	336	lYOQ0t8Mo40pw1q4.exe	53
PID 336 wrote to memory of 1936	336	lYOQ0t8Mo40pw1q4.exe	53
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 1892 wrote to memory of 872	1892	svuhost.exe	54
PID 336 wrote to memory of 1416	336	lYOQ0t8Mo40pw1q4.exe	56
PID 336 wrote to memory of 1416	336	lYOQ0t8Mo40pw1q4.exe	56
PID 336 wrote to memory of 1416	336	lYOQ0t8Mo40pw1q4.exe	56
PID 336 wrote to memory of 1416	336	lYOQ0t8Mo40pw1q4.exe	56
PID 1416 wrote to memory of 556	1416	cmd.exe	58
PID 1416 wrote to memory of 556	1416	cmd.exe	58
PID 1416 wrote to memory of 556	1416	cmd.exe	58
PID 1416 wrote to memory of 556	1416	cmd.exe	58
PID 2020 wrote to memory of 992	2020	svehosts.exe	59
PID 2020 wrote to memory of 992	2020	svehosts.exe	59
PID 2020 wrote to memory of 992	2020	svehosts.exe	59
PID 2020 wrote to memory of 992	2020	svehosts.exe	59
PID 1416 wrote to memory of 1604	1416	cmd.exe	61
PID 1416 wrote to memory of 1604	1416	cmd.exe	61
PID 1416 wrote to memory of 1604	1416	cmd.exe	61
PID 1416 wrote to memory of 1604	1416	cmd.exe	61

C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Users\Admin\AppData\Local\Temp\KnAqNJPP1MmvmAMa.exe
  "C:\Users\Admin\AppData\Local\Temp\KnAqNJPP1MmvmAMa.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- - C:\Windows\svehosts.exe
    "C:\Windows\svehosts.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
      4⤵
      PID:992
- C:\Users\Admin\AppData\Local\Temp\0frlnjCEAJYvKRFN.exe
  "C:\Users\Admin\AppData\Local\Temp\0frlnjCEAJYvKRFN.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
    "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
    3⤵
    - Executes dropped EXE
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
    "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
    3⤵
    - Executes dropped EXE
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
    "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
    3⤵
    - Executes dropped EXE
    PID:1740
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 660
    3⤵
    - Loads dropped DLL
    PID:288
- - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
    "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
    3⤵
    - Executes dropped EXE
    PID:844
- - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
    "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
    3⤵
    - Executes dropped EXE
    PID:1848
- - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
    "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
    3⤵
    - Executes dropped EXE
    PID:1536
- C:\Users\Admin\AppData\Local\Temp\ZSin1nGnyeBcdt8j.exe
  "C:\Users\Admin\AppData\Local\Temp\ZSin1nGnyeBcdt8j.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- - C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
    "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
    3⤵
    - Executes dropped EXE
    PID:876
- - C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
    "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      PID:1920
  - - C:\Users\Admin\Documents\excelsl.exe
      "C:\Users\Admin\Documents\excelsl.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:112
    - - C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1892
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        
        PID:872
- C:\Users\Admin\AppData\Local\Temp\lYOQ0t8Mo40pw1q4.exe
  "C:\Users\Admin\AppData\Local\Temp\lYOQ0t8Mo40pw1q4.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:336
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1084.tmp.bat""
    3⤵
    - Loads dropped DLL
    PID:1416
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:556
  - - C:\Users\Admin\AppData\Roaming\prndrvest.exe
      "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1604
- C:\Users\Admin\AppData\Local\Temp\QvwWf6K5G4tusNX8.exe
  "C:\Users\Admin\AppData\Local\Temp\QvwWf6K5G4tusNX8.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
    "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
    3⤵
    - Executes dropped EXE
    PID:1576
- C:\Users\Admin\AppData\Local\Temp\Nt8msNAljGD0o5qD.exe
  "C:\Users\Admin\AppData\Local\Temp\Nt8msNAljGD0o5qD.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
    "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1436
- C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
  "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
  "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
  2⤵
  - Executes dropped EXE
  PID:672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-106-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/112-43-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/288-81-0x00000000005D0000-0x00000000005D1000-memory.dmp

Filesize
4KB

Download
memory/288-78-0x0000000002000000-0x0000000002011000-memory.dmp

Filesize
68KB

Download
memory/336-63-0x0000000000840000-0x000000000084D000-memory.dmp

Filesize
52KB

Download
memory/336-45-0x00000000012A0000-0x00000000012A1000-memory.dmp

Filesize
4KB

Download
memory/336-32-0x0000000072030000-0x000000007271E000-memory.dmp

Filesize
6.9MB

Download
memory/336-47-0x00000000011A0000-0x00000000011A1000-memory.dmp

Filesize
4KB

Download
memory/336-48-0x00000000011A5000-0x00000000011B6000-memory.dmp

Filesize
68KB

Download
memory/336-49-0x0000000000890000-0x00000000008AD000-memory.dmp

Filesize
116KB

Download
memory/672-37-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/872-116-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1148-44-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1192-2-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1192-3-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/1436-51-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1436-55-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1576-58-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1576-62-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1604-130-0x0000000071940000-0x000000007202E000-memory.dmp

Filesize
6.9MB

Download
memory/1604-134-0x0000000004255000-0x0000000004266000-memory.dmp

Filesize
68KB

Download
memory/1604-131-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1604-133-0x0000000004250000-0x0000000004251000-memory.dmp

Filesize
4KB

Download
memory/1664-39-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1892-119-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1892-118-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1920-98-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1924-41-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/1936-35-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Filesize
4KB

Download
memory/1988-102-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1988-95-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1988-91-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2020-86-0x0000000000C60000-0x0000000000C61000-memory.dmp

Filesize
4KB

Download