asyncrat | c2b9108a7aedcb313f9df0d16cf1c52e9de3cae6afab5829f8c533924850efb7

Analysis

max time kernel
60s
max time network
141s
platform
windows7_x64
resource
win7v20201028
submitted
15-03-2021 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO_21031566AF_pdf.jar
Size

477KB
MD5

0d5327616ab7b563c34ef9a5ab1892d6
SHA1

403df150f0a5ae27c837a6a70ed993a6633889b0
SHA256

c2b9108a7aedcb313f9df0d16cf1c52e9de3cae6afab5829f8c533924850efb7
SHA512

6790cbdc75999ae65ae1353fa529459d5240945ef86dadfe5aa6c55cd8e13c33bcdf1fb35fa627267ae0797c1caa2f86106b0f9336b25572fafac7e3f6891f6e

Score

10^/10

asyncrat ratty evasion persistence rat trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

chongmei33.publicvm.com:2703

chongmei33.publicvm.com:49703

chongmei33.publicvm.com:49746

185.165.153.116:2703

185.165.153.116:49703

185.165.153.116:49746

54.37.36.116:2703

54.37.36.116:49703

54.37.36.116:49746

185.244.30.92:2703

185.244.30.92:49703

185.244.30.92:49746

dongreg202020.duckdns.org:2703

dongreg202020.duckdns.org:49703

dongreg202020.duckdns.org:49746

178.33.222.241:2703

178.33.222.241:49703

178.33.222.241:49746

rahim321.duckdns.org:2703

rahim321.duckdns.org:49703

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
hGScKRB0VrlS4WpFo0N7AmnZQApV4qsi
anti_detection
false
autorun
false
bdos
false
delay
FEB
host
chongmei33.publicvm.com,185.165.153.116,54.37.36.116,185.244.30.92,dongreg202020.duckdns.org,178.33.222.241,rahim321.duckdns.org,79.134.225.92,37.120.208.36,178.33.222.243,87.98.245.48
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
2703,49703,49746
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Ratty
Ratty is an open source Java Remote Access Tool.
trojan rat ratty

Ratty Rat Payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00050000000130e1-10.dat	family_ratty

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Async RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2260-178-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2260-179-0x000000000040C91E-mapping.dmp	asyncrat
behavioral1/memory/2260-182-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2536-231-0x000000000040C91E-mapping.dmp	asyncrat

Detect jar appended to MSI 1 IoCs

resource	yara_rule
behavioral1/files/0x00050000000130e1-10.dat	jar_in_msi

Nirsoft 14 IoCs

resource	yara_rule
behavioral1/files/0x00030000000130e8-16.dat	Nirsoft
behavioral1/files/0x00030000000130e8-17.dat	Nirsoft
behavioral1/files/0x00030000000130e8-19.dat	Nirsoft
behavioral1/files/0x00030000000130e8-21.dat	Nirsoft
behavioral1/files/0x00030000000130e8-22.dat	Nirsoft
behavioral1/files/0x00030000000130e8-23.dat	Nirsoft
behavioral1/files/0x00030000000130e8-25.dat	Nirsoft
behavioral1/files/0x00030000000130ef-99.dat	Nirsoft
behavioral1/files/0x00030000000130ef-102.dat	Nirsoft
behavioral1/files/0x00030000000130ef-100.dat	Nirsoft
behavioral1/files/0x00030000000130ef-105.dat	Nirsoft
behavioral1/files/0x00030000000130ef-106.dat	Nirsoft
behavioral1/files/0x00030000000130ef-104.dat	Nirsoft
behavioral1/files/0x00030000000130ef-108.dat	Nirsoft

Executes dropped EXE 8 IoCs

pid	Process
2040	oq1N.exe
736	AdvancedRun.exe
1228	AdvancedRun.exe
2000	jVAPsorbdr.exe
2384	AdvancedRun.exe
2428	AdvancedRun.exe
2260	oq1N.exe
2536	jVAPsorbdr.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe	oq1N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe	oq1N.exe

Loads dropped DLL 19 IoCs

pid	Process
2040	oq1N.exe
2040	oq1N.exe
736	AdvancedRun.exe
736	AdvancedRun.exe
2040	oq1N.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2384	AdvancedRun.exe
2384	AdvancedRun.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	oq1N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	oq1N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe = "0"	oq1N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	oq1N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\oq1N.exe = "0"	oq1N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	oq1N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	oq1N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	oq1N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	oq1N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe = "0"	oq1N.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jVAPsorbdr = "C:\\Users\\Public\\Documents\\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\\svchost.exe"	jVAPsorbdr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jVAPsorbdr = "C:\\Users\\Public\\Documents\\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\\svchost.exe"	oq1N.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	oq1N.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jVAPsorbdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jVAPsorbdr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	oq1N.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 28 IoCs

pid	Process
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 2260	2040	oq1N.exe	66
PID 2000 set thread context of 2536	2000	jVAPsorbdr.exe	71

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2328	2040	WerFault.exe	27
2612	2000	WerFault.exe	43

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2412	timeout.exe
2180	timeout.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
736	AdvancedRun.exe
736	AdvancedRun.exe
1228	AdvancedRun.exe
1228	AdvancedRun.exe
1268	powershell.exe
820	powershell.exe
812	powershell.exe
1092	powershell.exe
1844	powershell.exe
676	powershell.exe
1920	powershell.exe
1604	powershell.exe
2384	AdvancedRun.exe
2384	AdvancedRun.exe
2428	AdvancedRun.exe
2428	AdvancedRun.exe
676	powershell.exe
1268	powershell.exe
1920	powershell.exe
812	powershell.exe
1092	powershell.exe
1604	powershell.exe
1844	powershell.exe
820	powershell.exe
2592	powershell.exe
2616	powershell.exe
2660	powershell.exe
2592	powershell.exe
2616	powershell.exe
2660	powershell.exe
2728	powershell.exe
2684	powershell.exe
2684	powershell.exe
2728	powershell.exe
2040	oq1N.exe
2040	oq1N.exe
2040	oq1N.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2328	WerFault.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2000	jVAPsorbdr.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe
2612	WerFault.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	oq1N.exe
Token: SeDebugPrivilege	736	AdvancedRun.exe
Token: SeImpersonatePrivilege	736	AdvancedRun.exe
Token: SeDebugPrivilege	1228	AdvancedRun.exe
Token: SeImpersonatePrivilege	1228	AdvancedRun.exe
Token: SeDebugPrivilege	2000	jVAPsorbdr.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	820	powershell.exe
Token: SeDebugPrivilege	812	powershell.exe
Token: SeDebugPrivilege	1092	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	2384	AdvancedRun.exe
Token: SeImpersonatePrivilege	2384	AdvancedRun.exe
Token: SeDebugPrivilege	2428	AdvancedRun.exe
Token: SeImpersonatePrivilege	2428	AdvancedRun.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2728	powershell.exe
Token: SeDebugPrivilege	2684	powershell.exe
Token: SeDebugPrivilege	2328	WerFault.exe
Token: SeDebugPrivilege	2612	WerFault.exe
Token: SeDebugPrivilege	2260	oq1N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
384	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 2040	384	java.exe	27
PID 384 wrote to memory of 2040	384	java.exe	27
PID 384 wrote to memory of 2040	384	java.exe	27
PID 384 wrote to memory of 2040	384	java.exe	27
PID 384 wrote to memory of 1244	384	java.exe	28
PID 384 wrote to memory of 1244	384	java.exe	28
PID 384 wrote to memory of 1244	384	java.exe	28
PID 2040 wrote to memory of 736	2040	oq1N.exe	32
PID 2040 wrote to memory of 736	2040	oq1N.exe	32
PID 2040 wrote to memory of 736	2040	oq1N.exe	32
PID 2040 wrote to memory of 736	2040	oq1N.exe	32
PID 736 wrote to memory of 1228	736	AdvancedRun.exe	33
PID 736 wrote to memory of 1228	736	AdvancedRun.exe	33
PID 736 wrote to memory of 1228	736	AdvancedRun.exe	33
PID 736 wrote to memory of 1228	736	AdvancedRun.exe	33
PID 2040 wrote to memory of 676	2040	oq1N.exe	34
PID 2040 wrote to memory of 676	2040	oq1N.exe	34
PID 2040 wrote to memory of 676	2040	oq1N.exe	34
PID 2040 wrote to memory of 676	2040	oq1N.exe	34
PID 2040 wrote to memory of 1844	2040	oq1N.exe	36
PID 2040 wrote to memory of 1844	2040	oq1N.exe	36
PID 2040 wrote to memory of 1844	2040	oq1N.exe	36
PID 2040 wrote to memory of 1844	2040	oq1N.exe	36
PID 2040 wrote to memory of 1604	2040	oq1N.exe	38
PID 2040 wrote to memory of 1604	2040	oq1N.exe	38
PID 2040 wrote to memory of 1604	2040	oq1N.exe	38
PID 2040 wrote to memory of 1604	2040	oq1N.exe	38
PID 2040 wrote to memory of 1920	2040	oq1N.exe	40
PID 2040 wrote to memory of 1920	2040	oq1N.exe	40
PID 2040 wrote to memory of 1920	2040	oq1N.exe	40
PID 2040 wrote to memory of 1920	2040	oq1N.exe	40
PID 2040 wrote to memory of 820	2040	oq1N.exe	41
PID 2040 wrote to memory of 820	2040	oq1N.exe	41
PID 2040 wrote to memory of 820	2040	oq1N.exe	41
PID 2040 wrote to memory of 820	2040	oq1N.exe	41
PID 2040 wrote to memory of 2000	2040	oq1N.exe	43
PID 2040 wrote to memory of 2000	2040	oq1N.exe	43
PID 2040 wrote to memory of 2000	2040	oq1N.exe	43
PID 2040 wrote to memory of 2000	2040	oq1N.exe	43
PID 2040 wrote to memory of 812	2040	oq1N.exe	45
PID 2040 wrote to memory of 812	2040	oq1N.exe	45
PID 2040 wrote to memory of 812	2040	oq1N.exe	45
PID 2040 wrote to memory of 812	2040	oq1N.exe	45
PID 2040 wrote to memory of 1092	2040	oq1N.exe	46
PID 2040 wrote to memory of 1092	2040	oq1N.exe	46
PID 2040 wrote to memory of 1092	2040	oq1N.exe	46
PID 2040 wrote to memory of 1092	2040	oq1N.exe	46
PID 2040 wrote to memory of 1268	2040	oq1N.exe	49
PID 2040 wrote to memory of 1268	2040	oq1N.exe	49
PID 2040 wrote to memory of 1268	2040	oq1N.exe	49
PID 2040 wrote to memory of 1268	2040	oq1N.exe	49
PID 2000 wrote to memory of 2384	2000	jVAPsorbdr.exe	51
PID 2000 wrote to memory of 2384	2000	jVAPsorbdr.exe	51
PID 2000 wrote to memory of 2384	2000	jVAPsorbdr.exe	51
PID 2000 wrote to memory of 2384	2000	jVAPsorbdr.exe	51
PID 2384 wrote to memory of 2428	2384	AdvancedRun.exe	52
PID 2384 wrote to memory of 2428	2384	AdvancedRun.exe	52
PID 2384 wrote to memory of 2428	2384	AdvancedRun.exe	52
PID 2384 wrote to memory of 2428	2384	AdvancedRun.exe	52
PID 2000 wrote to memory of 2592	2000	jVAPsorbdr.exe	53
PID 2000 wrote to memory of 2592	2000	jVAPsorbdr.exe	53
PID 2000 wrote to memory of 2592	2000	jVAPsorbdr.exe	53
PID 2000 wrote to memory of 2592	2000	jVAPsorbdr.exe	53
PID 2000 wrote to memory of 2616	2000	jVAPsorbdr.exe	55

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	oq1N.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jVAPsorbdr.exe

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\PO_21031566AF_pdf.jar
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:384
- C:\Users\Admin\oq1N.exe
  C:\Users\Admin\oq1N.exe
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2040
- - C:\Users\Admin\AppData\Local\Temp\c9175120-05de-4513-bcba-7a143c63359f\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\c9175120-05de-4513-bcba-7a143c63359f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c9175120-05de-4513-bcba-7a143c63359f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Users\Admin\AppData\Local\Temp\c9175120-05de-4513-bcba-7a143c63359f\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\c9175120-05de-4513-bcba-7a143c63359f\AdvancedRun.exe" /SpecialRun 4101d8 736
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:820
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\8ba8dc39-46d4-4b7d-be92-f35fd4ee9d53\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\8ba8dc39-46d4-4b7d-be92-f35fd4ee9d53\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\8ba8dc39-46d4-4b7d-be92-f35fd4ee9d53\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\8ba8dc39-46d4-4b7d-be92-f35fd4ee9d53\AdvancedRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8ba8dc39-46d4-4b7d-be92-f35fd4ee9d53\AdvancedRun.exe" /SpecialRun 4101d8 2384
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2592
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2616
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2660
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2684
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2728
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      PID:2404
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        Delays execution with timeout.exe
        
        PID:2412
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jVAPsorbdr.exe"
      4⤵
      Executes dropped EXE
      PID:2536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 1956
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:812
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\oq1N.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Public\Documents\MDQFAmWIBzGkRBgoGDgjMoTajtClJ\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 1
    3⤵
    PID:2092
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:2180
- - C:\Users\Admin\oq1N.exe
    "C:\Users\Admin\oq1N.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1964
    3⤵
    - Loads dropped DLL
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\IxVhFD18YESB.jar"
  2⤵
  PID:1244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-2-0x000007FEFB9D1000-0x000007FEFB9D3000-memory.dmp

Filesize
8KB

Download
memory/384-3-0x0000000002160000-0x00000000023D0000-memory.dmp

Filesize
2.4MB

Download
memory/676-63-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/676-64-0x0000000004982000-0x0000000004983000-memory.dmp

Filesize
4KB

Download
memory/676-67-0x00000000049C0000-0x00000000049C1000-memory.dmp

Filesize
4KB

Download
memory/676-53-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/676-58-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/736-20-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/812-71-0x00000000049B2000-0x00000000049B3000-memory.dmp

Filesize
4KB

Download
memory/812-55-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/812-93-0x00000000049B0000-0x00000000049B1000-memory.dmp

Filesize
4KB

Download
memory/820-201-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/820-95-0x00000000048C2000-0x00000000048C3000-memory.dmp

Filesize
4KB

Download
memory/820-118-0x0000000004890000-0x0000000004891000-memory.dmp

Filesize
4KB

Download
memory/820-186-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/820-197-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/820-199-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/820-246-0x0000000006390000-0x0000000006391000-memory.dmp

Filesize
4KB

Download
memory/820-208-0x0000000006300000-0x0000000006301000-memory.dmp

Filesize
4KB

Download
memory/820-244-0x0000000006380000-0x0000000006381000-memory.dmp

Filesize
4KB

Download
memory/820-74-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/820-51-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/820-217-0x00000000062B0000-0x00000000062B1000-memory.dmp

Filesize
4KB

Download
memory/1092-62-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/1092-56-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1092-94-0x0000000004932000-0x0000000004933000-memory.dmp

Filesize
4KB

Download
memory/1244-13-0x00000000021F0000-0x0000000002460000-memory.dmp

Filesize
2.4MB

Download
memory/1268-73-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1268-92-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/1268-97-0x0000000002922000-0x0000000002923000-memory.dmp

Filesize
4KB

Download
memory/1604-66-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1604-91-0x0000000004B72000-0x0000000004B73000-memory.dmp

Filesize
4KB

Download
memory/1604-80-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/1844-88-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/1844-110-0x0000000000D50000-0x0000000000D51000-memory.dmp

Filesize
4KB

Download
memory/1844-76-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1844-90-0x0000000004BE2000-0x0000000004BE3000-memory.dmp

Filesize
4KB

Download
memory/1920-84-0x00000000049D0000-0x00000000049D1000-memory.dmp

Filesize
4KB

Download
memory/1920-78-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/1920-96-0x00000000049D2000-0x00000000049D3000-memory.dmp

Filesize
4KB

Download
memory/2000-39-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/2000-42-0x0000000000B80000-0x0000000000B81000-memory.dmp

Filesize
4KB

Download
memory/2000-57-0x00000000050A0000-0x00000000050A1000-memory.dmp

Filesize
4KB

Download
memory/2040-15-0x00000000008A0000-0x000000000091E000-memory.dmp

Filesize
504KB

Download
memory/2040-14-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/2040-11-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/2040-7-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/2260-245-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/2260-181-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/2260-178-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2260-182-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2328-189-0x0000000001DC0000-0x0000000001DD1000-memory.dmp

Filesize
68KB

Download
memory/2328-200-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/2536-235-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/2536-263-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2592-149-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/2592-137-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/2592-155-0x0000000004A42000-0x0000000004A43000-memory.dmp

Filesize
4KB

Download
memory/2612-256-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/2612-239-0x0000000001DC0000-0x0000000001DD1000-memory.dmp

Filesize
68KB

Download
memory/2616-154-0x00000000049F2000-0x00000000049F3000-memory.dmp

Filesize
4KB

Download
memory/2616-167-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/2616-142-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/2660-151-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/2660-168-0x00000000026A2000-0x00000000026A3000-memory.dmp

Filesize
4KB

Download
memory/2660-146-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/2684-158-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/2684-141-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/2684-161-0x00000000025F2000-0x00000000025F3000-memory.dmp

Filesize
4KB

Download
memory/2728-166-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/2728-163-0x0000000002752000-0x0000000002753000-memory.dmp

Filesize
4KB

Download
memory/2728-144-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download