asyncrat | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

Target

42f972925508a82236e8533567487761(1).exe
Size

3.7MB
MD5

9d2a888ca79e1ff3820882ea1d88d574
SHA1

112c38d80bf2c0d48256249bbabe906b834b1f66
SHA256

8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138
SHA512

17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

Score

10^/10

asyncrat darkcomet warzonerat evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes

aes_key
DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo
anti_detection
true
autorun
true
bdos
false
delay
host
sandyclark255.hopto.org
hwid
install_file
install_folder
%AppData%
mutex
adweqsds56332
pastebin_config
null
port
6606,8808,7707
version
0.5.6A

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\N6HpMZyZTZaT.exe\",explorer.exe"	svbhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\k4Xq51JTS0f2R98Z\\usV8lu3uAyuV.exe\",explorer.exe"	WXbdxHBmTkkteV0d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\excelsl.exe"	svuhost.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral23/memory/1500-77-0x0000000000690000-0x000000000069D000-memory.dmp	asyncrat

Warzone RAT Payload 3 IoCs

rat

resource	yara_rule
behavioral23/memory/1772-50-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral23/memory/1772-51-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral23/memory/1772-70-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Disables RegEdit via registry modification
evasion
Disables Task Manager via registry modification
evasion

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svuhost.exe

Executes dropped EXE 18 IoCs

pid	Process
1620	TrX7aZdtAnTF7G8A.exe
1728	WXbdxHBmTkkteV0d.exe
900	rh78BimZdniODTiR.exe
1500	lCAacl0BQ28aWFom.exe
1088	AvaQTbaohwfZcobM.exe
576	svthost.exe
340	I0RIgwK20Zorrebm.exe
1080	svthost.exe
1772	eridjeht.exe
964	svrhost.exe
1612	svbhost.exe
1216	svbhost.exe
1036	svehosts.exe
680	svuhost.exe
2044	excelsl.exe
620	svbhost.exe
2000	svuhost.exe
1844	prndrvest.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	svehosts.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2d790bed038373d95093d4db590b9997.exe	svehosts.exe

Loads dropped DLL 17 IoCs

pid	Process
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1088	AvaQTbaohwfZcobM.exe
340	I0RIgwK20Zorrebm.exe
1728	WXbdxHBmTkkteV0d.exe
1612	svbhost.exe
900	rh78BimZdniODTiR.exe
680	svuhost.exe
1216	svbhost.exe
2044	excelsl.exe
972	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	svuhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	svehosts.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2d790bed038373d95093d4db590b9997 = "\"C:\\Windows\\svehosts.exe\" .."	svehosts.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\office = "C:\\Users\\Admin\\Documents\\excelsl.exe"	svuhost.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1648 set thread context of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1088 set thread context of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 340 set thread context of 964	340	I0RIgwK20Zorrebm.exe	38
PID 1728 set thread context of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 900 set thread context of 680	900	rh78BimZdniODTiR.exe	42
PID 1216 set thread context of 620	1216	svbhost.exe	46
PID 2044 set thread context of 2000	2044	excelsl.exe	49

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svehosts.exe	TrX7aZdtAnTF7G8A.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1092	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1696	timeout.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1648	42f972925508a82236e8533567487761(1).exe
1088	AvaQTbaohwfZcobM.exe
1088	AvaQTbaohwfZcobM.exe
1088	AvaQTbaohwfZcobM.exe
340	I0RIgwK20Zorrebm.exe
340	I0RIgwK20Zorrebm.exe
340	I0RIgwK20Zorrebm.exe
1728	WXbdxHBmTkkteV0d.exe
1728	WXbdxHBmTkkteV0d.exe
900	rh78BimZdniODTiR.exe
900	rh78BimZdniODTiR.exe
900	rh78BimZdniODTiR.exe
1216	svbhost.exe
1216	svbhost.exe
2044	excelsl.exe
2044	excelsl.exe
2044	excelsl.exe
1500	lCAacl0BQ28aWFom.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
964	svrhost.exe
1612	svbhost.exe

Suspicious use of AdjustPrivilegeToken 74 IoCs

description	pid	Process
Token: SeDebugPrivilege	1648	42f972925508a82236e8533567487761(1).exe
Token: SeDebugPrivilege	1648	42f972925508a82236e8533567487761(1).exe
Token: SeDebugPrivilege	1620	TrX7aZdtAnTF7G8A.exe
Token: SeDebugPrivilege	1620	TrX7aZdtAnTF7G8A.exe
Token: SeDebugPrivilege	1088	AvaQTbaohwfZcobM.exe
Token: SeDebugPrivilege	340	I0RIgwK20Zorrebm.exe
Token: SeDebugPrivilege	1728	WXbdxHBmTkkteV0d.exe
Token: SeDebugPrivilege	1728	WXbdxHBmTkkteV0d.exe
Token: SeShutdownPrivilege	1612	svbhost.exe
Token: SeDebugPrivilege	1612	svbhost.exe
Token: SeTcbPrivilege	1612	svbhost.exe
Token: SeDebugPrivilege	1500	lCAacl0BQ28aWFom.exe
Token: SeDebugPrivilege	900	rh78BimZdniODTiR.exe
Token: SeDebugPrivilege	1036	svehosts.exe
Token: SeDebugPrivilege	1036	svehosts.exe
Token: SeIncreaseQuotaPrivilege	680	svuhost.exe
Token: SeSecurityPrivilege	680	svuhost.exe
Token: SeTakeOwnershipPrivilege	680	svuhost.exe
Token: SeLoadDriverPrivilege	680	svuhost.exe
Token: SeSystemProfilePrivilege	680	svuhost.exe
Token: SeSystemtimePrivilege	680	svuhost.exe
Token: SeProfSingleProcessPrivilege	680	svuhost.exe
Token: SeIncBasePriorityPrivilege	680	svuhost.exe
Token: SeCreatePagefilePrivilege	680	svuhost.exe
Token: SeBackupPrivilege	680	svuhost.exe
Token: SeRestorePrivilege	680	svuhost.exe
Token: SeShutdownPrivilege	680	svuhost.exe
Token: SeDebugPrivilege	680	svuhost.exe
Token: SeSystemEnvironmentPrivilege	680	svuhost.exe
Token: SeChangeNotifyPrivilege	680	svuhost.exe
Token: SeRemoteShutdownPrivilege	680	svuhost.exe
Token: SeUndockPrivilege	680	svuhost.exe
Token: SeManageVolumePrivilege	680	svuhost.exe
Token: SeImpersonatePrivilege	680	svuhost.exe
Token: SeCreateGlobalPrivilege	680	svuhost.exe
Token: 33	680	svuhost.exe
Token: 34	680	svuhost.exe
Token: 35	680	svuhost.exe
Token: SeDebugPrivilege	1216	svbhost.exe
Token: SeDebugPrivilege	1216	svbhost.exe
Token: SeShutdownPrivilege	620	svbhost.exe
Token: SeDebugPrivilege	620	svbhost.exe
Token: SeTcbPrivilege	620	svbhost.exe
Token: SeDebugPrivilege	2044	excelsl.exe
Token: SeIncreaseQuotaPrivilege	2000	svuhost.exe
Token: SeSecurityPrivilege	2000	svuhost.exe
Token: SeTakeOwnershipPrivilege	2000	svuhost.exe
Token: SeLoadDriverPrivilege	2000	svuhost.exe
Token: SeSystemProfilePrivilege	2000	svuhost.exe
Token: SeSystemtimePrivilege	2000	svuhost.exe
Token: SeProfSingleProcessPrivilege	2000	svuhost.exe
Token: SeIncBasePriorityPrivilege	2000	svuhost.exe
Token: SeCreatePagefilePrivilege	2000	svuhost.exe
Token: SeBackupPrivilege	2000	svuhost.exe
Token: SeRestorePrivilege	2000	svuhost.exe
Token: SeShutdownPrivilege	2000	svuhost.exe
Token: SeDebugPrivilege	2000	svuhost.exe
Token: SeSystemEnvironmentPrivilege	2000	svuhost.exe
Token: SeChangeNotifyPrivilege	2000	svuhost.exe
Token: SeRemoteShutdownPrivilege	2000	svuhost.exe
Token: SeUndockPrivilege	2000	svuhost.exe
Token: SeManageVolumePrivilege	2000	svuhost.exe
Token: SeImpersonatePrivilege	2000	svuhost.exe
Token: SeCreateGlobalPrivilege	2000	svuhost.exe
Token: 33	2000	svuhost.exe
Token: 34	2000	svuhost.exe
Token: 35	2000	svuhost.exe
Token: 33	1036	svehosts.exe
Token: SeIncBasePriorityPrivilege	1036	svehosts.exe
Token: 33	1036	svehosts.exe
Token: SeIncBasePriorityPrivilege	1036	svehosts.exe
Token: 33	1036	svehosts.exe
Token: SeIncBasePriorityPrivilege	1036	svehosts.exe
Token: SeDebugPrivilege	1844	prndrvest.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1612	svbhost.exe
2000	svuhost.exe

Suspicious use of WriteProcessMemory 185 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 1620	1648	42f972925508a82236e8533567487761(1).exe	29
PID 1648 wrote to memory of 1620	1648	42f972925508a82236e8533567487761(1).exe	29
PID 1648 wrote to memory of 1620	1648	42f972925508a82236e8533567487761(1).exe	29
PID 1648 wrote to memory of 1620	1648	42f972925508a82236e8533567487761(1).exe	29
PID 1648 wrote to memory of 1728	1648	42f972925508a82236e8533567487761(1).exe	30
PID 1648 wrote to memory of 1728	1648	42f972925508a82236e8533567487761(1).exe	30
PID 1648 wrote to memory of 1728	1648	42f972925508a82236e8533567487761(1).exe	30
PID 1648 wrote to memory of 1728	1648	42f972925508a82236e8533567487761(1).exe	30
PID 1648 wrote to memory of 900	1648	42f972925508a82236e8533567487761(1).exe	31
PID 1648 wrote to memory of 900	1648	42f972925508a82236e8533567487761(1).exe	31
PID 1648 wrote to memory of 900	1648	42f972925508a82236e8533567487761(1).exe	31
PID 1648 wrote to memory of 900	1648	42f972925508a82236e8533567487761(1).exe	31
PID 1648 wrote to memory of 1500	1648	42f972925508a82236e8533567487761(1).exe	32
PID 1648 wrote to memory of 1500	1648	42f972925508a82236e8533567487761(1).exe	32
PID 1648 wrote to memory of 1500	1648	42f972925508a82236e8533567487761(1).exe	32
PID 1648 wrote to memory of 1500	1648	42f972925508a82236e8533567487761(1).exe	32
PID 1648 wrote to memory of 1088	1648	42f972925508a82236e8533567487761(1).exe	33
PID 1648 wrote to memory of 1088	1648	42f972925508a82236e8533567487761(1).exe	33
PID 1648 wrote to memory of 1088	1648	42f972925508a82236e8533567487761(1).exe	33
PID 1648 wrote to memory of 1088	1648	42f972925508a82236e8533567487761(1).exe	33
PID 1648 wrote to memory of 340	1648	42f972925508a82236e8533567487761(1).exe	34
PID 1648 wrote to memory of 340	1648	42f972925508a82236e8533567487761(1).exe	34
PID 1648 wrote to memory of 340	1648	42f972925508a82236e8533567487761(1).exe	34
PID 1648 wrote to memory of 340	1648	42f972925508a82236e8533567487761(1).exe	34
PID 1648 wrote to memory of 576	1648	42f972925508a82236e8533567487761(1).exe	35
PID 1648 wrote to memory of 576	1648	42f972925508a82236e8533567487761(1).exe	35
PID 1648 wrote to memory of 576	1648	42f972925508a82236e8533567487761(1).exe	35
PID 1648 wrote to memory of 576	1648	42f972925508a82236e8533567487761(1).exe	35
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1648 wrote to memory of 1080	1648	42f972925508a82236e8533567487761(1).exe	36
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 1088 wrote to memory of 1772	1088	AvaQTbaohwfZcobM.exe	37
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 340 wrote to memory of 964	340	I0RIgwK20Zorrebm.exe	38
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1728 wrote to memory of 1612	1728	WXbdxHBmTkkteV0d.exe	39
PID 1612 wrote to memory of 1216	1612	svbhost.exe	40
PID 1612 wrote to memory of 1216	1612	svbhost.exe	40
PID 1612 wrote to memory of 1216	1612	svbhost.exe	40
PID 1612 wrote to memory of 1216	1612	svbhost.exe	40
PID 1620 wrote to memory of 1036	1620	TrX7aZdtAnTF7G8A.exe	41
PID 1620 wrote to memory of 1036	1620	TrX7aZdtAnTF7G8A.exe	41
PID 1620 wrote to memory of 1036	1620	TrX7aZdtAnTF7G8A.exe	41
PID 1620 wrote to memory of 1036	1620	TrX7aZdtAnTF7G8A.exe	41
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 900 wrote to memory of 680	900	rh78BimZdniODTiR.exe	42
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 1164	680	svuhost.exe	43
PID 680 wrote to memory of 2044	680	svuhost.exe	45
PID 680 wrote to memory of 2044	680	svuhost.exe	45
PID 680 wrote to memory of 2044	680	svuhost.exe	45
PID 680 wrote to memory of 2044	680	svuhost.exe	45
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1216 wrote to memory of 620	1216	svbhost.exe	46
PID 1036 wrote to memory of 2020	1036	svehosts.exe	47
PID 1036 wrote to memory of 2020	1036	svehosts.exe	47
PID 1036 wrote to memory of 2020	1036	svehosts.exe	47
PID 1036 wrote to memory of 2020	1036	svehosts.exe	47
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2044 wrote to memory of 2000	2044	excelsl.exe	49
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 2000 wrote to memory of 1584	2000	svuhost.exe	50
PID 1500 wrote to memory of 1092	1500	lCAacl0BQ28aWFom.exe	51
PID 1500 wrote to memory of 1092	1500	lCAacl0BQ28aWFom.exe	51
PID 1500 wrote to memory of 1092	1500	lCAacl0BQ28aWFom.exe	51
PID 1500 wrote to memory of 1092	1500	lCAacl0BQ28aWFom.exe	51
PID 1500 wrote to memory of 972	1500	lCAacl0BQ28aWFom.exe	53
PID 1500 wrote to memory of 972	1500	lCAacl0BQ28aWFom.exe	53
PID 1500 wrote to memory of 972	1500	lCAacl0BQ28aWFom.exe	53
PID 1500 wrote to memory of 972	1500	lCAacl0BQ28aWFom.exe	53
PID 972 wrote to memory of 1696	972	cmd.exe	55
PID 972 wrote to memory of 1696	972	cmd.exe	55
PID 972 wrote to memory of 1696	972	cmd.exe	55
PID 972 wrote to memory of 1696	972	cmd.exe	55
PID 972 wrote to memory of 1844	972	cmd.exe	56
PID 972 wrote to memory of 1844	972	cmd.exe	56
PID 972 wrote to memory of 1844	972	cmd.exe	56
PID 972 wrote to memory of 1844	972	cmd.exe	56

C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe
"C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\TrX7aZdtAnTF7G8A.exe
  "C:\Users\Admin\AppData\Local\Temp\TrX7aZdtAnTF7G8A.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- - C:\Windows\svehosts.exe
    "C:\Windows\svehosts.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
      4⤵
      PID:2020
- C:\Users\Admin\AppData\Local\Temp\WXbdxHBmTkkteV0d.exe
  "C:\Users\Admin\AppData\Local\Temp\WXbdxHBmTkkteV0d.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
    "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
      "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 1612
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:620
- C:\Users\Admin\AppData\Local\Temp\rh78BimZdniODTiR.exe
  "C:\Users\Admin\AppData\Local\Temp\rh78BimZdniODTiR.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- - C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
    "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:680
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      PID:1164
  - - C:\Users\Admin\Documents\excelsl.exe
      "C:\Users\Admin\Documents\excelsl.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2000
      - C:\Windows\SysWOW64\notepad.exe
        
        notepad
        6⤵
        
        PID:1584
- C:\Users\Admin\AppData\Local\Temp\lCAacl0BQ28aWFom.exe
  "C:\Users\Admin\AppData\Local\Temp\lCAacl0BQ28aWFom.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB4CE.tmp.bat""
    3⤵
    - Loads dropped DLL
    PID:972
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1696
  - - C:\Users\Admin\AppData\Roaming\prndrvest.exe
      "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
      4⤵
      Executes dropped EXE
      PID:1844
- C:\Users\Admin\AppData\Local\Temp\AvaQTbaohwfZcobM.exe
  "C:\Users\Admin\AppData\Local\Temp\AvaQTbaohwfZcobM.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
    "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
    3⤵
    - Executes dropped EXE
    PID:1772
- C:\Users\Admin\AppData\Local\Temp\I0RIgwK20Zorrebm.exe
  "C:\Users\Admin\AppData\Local\Temp\I0RIgwK20Zorrebm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
    "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    PID:964
- C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
  "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
  "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
  2⤵
  - Executes dropped EXE
  PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/340-43-0x0000000001D20000-0x0000000001D21000-memory.dmp

Filesize
4KB

Download
memory/680-91-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/680-86-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/680-92-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/900-41-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/964-55-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/964-64-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1036-83-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/1080-37-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1088-42-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/1164-94-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1216-72-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1500-44-0x0000000071270000-0x000000007195E000-memory.dmp

Filesize
6.9MB

Download
memory/1500-45-0x0000000000F20000-0x0000000000F21000-memory.dmp

Filesize
4KB

Download
memory/1500-47-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/1500-77-0x0000000000690000-0x000000000069D000-memory.dmp

Filesize
52KB

Download
memory/1500-73-0x0000000000500000-0x000000000051D000-memory.dmp

Filesize
116KB

Download
memory/1500-48-0x0000000000455000-0x0000000000466000-memory.dmp

Filesize
68KB

Download
memory/1584-118-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1612-71-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1612-60-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1620-11-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/1648-3-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1648-2-0x0000000074B31000-0x0000000074B33000-memory.dmp

Filesize
8KB

Download
memory/1728-39-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/1772-50-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1772-70-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1844-131-0x0000000070B80000-0x000000007126E000-memory.dmp

Filesize
6.9MB

Download
memory/1844-132-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/1844-134-0x0000000004D80000-0x0000000004D81000-memory.dmp

Filesize
4KB

Download
memory/1844-135-0x0000000004D85000-0x0000000004D96000-memory.dmp

Filesize
68KB

Download
memory/2000-121-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2000-120-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2044-102-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download