asyncrat | 7b579694a738437eb6aed2064bd2d78cb77d8afe92994bf6e02016a563cd50a3

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20210410
submitted
24/05/2021, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3e8bacfa3a35f43a26772be547d48a9.exe
Size 14.1MB
Sample210524-qppzed5a8a
SHA256 7b579694a738437eb6aed2064bd2d78cb77d8afe92994bf6e02016a563cd50a3
MD5 d3e8bacfa3a35f43a26772be547d48a9
SHA1 8f786e0b66ee92e0a71d88cc0f17296e836c8e17
SHA512 6a215885d7a8ca5230fbed6d319f021ad6b9f27eb42e072d5136f660a96db1d84579f098ed753c4ec8b6fc6104eb66519bf4322bd69aca0d83b3c86a8b8bb3f7
MD5 SHA1 SHA512

Score

10^/10

asyncrat xmrig miner rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

81.163.246.9:5020

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
H3XOkf5xclZtUY6prd4SD8X3oarIoAqU
anti_detection
true
autorun
false
bdos
true
delay
Default
host
81.163.246.9
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
5020
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/files/0x00050000000130c3-88.dat	asyncrat
behavioral1/files/0x00050000000130c3-91.dat	asyncrat
behavioral1/files/0x00050000000130c3-90.dat	asyncrat
behavioral1/files/0x00050000000130c3-96.dat	asyncrat
behavioral1/files/0x00050000000130c3-89.dat	asyncrat
behavioral1/files/0x00050000000130c3-97.dat	asyncrat

Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner

XMRig Miner Payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/748-169-0x0000000000400000-0x0000000000C0B000-memory.dmp	xmrig
behavioral1/memory/748-170-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/748-172-0x0000000000400000-0x0000000000C0B000-memory.dmp	xmrig
behavioral1/memory/768-174-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/1760-178-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/2004-182-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/1448-186-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/1060-190-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/1928-194-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/296-198-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/2024-202-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/1608-210-0x00000000004014C0-mapping.dmp	xmrig
behavioral1/memory/1144-214-0x00000000004014C0-mapping.dmp	xmrig

Executes dropped EXE 13 IoCs

pid	Process
2016	Cript.exe
1064	WinRaR64.exe
1496	CL_Debug_Log.txt
1852	Async.exe
1732	Helper.exe
1576	Helper.exe
1188	Helper.exe
860	tor.exe
328	Helper.exe
1496	Helper.exe
1448	Helper.exe
940	Helper.exe
1636	Helper.exe

Loads dropped DLL 23 IoCs

pid	Process
540	d3e8bacfa3a35f43a26772be547d48a9.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
1064	WinRaR64.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
540	d3e8bacfa3a35f43a26772be547d48a9.exe
1576	Helper.exe
1576	Helper.exe
1576	Helper.exe
1576	Helper.exe
860	tor.exe
860	tor.exe
860	tor.exe
860	tor.exe
860	tor.exe
860	tor.exe
860	tor.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 1576 set thread context of 1188	1576	Helper.exe	42
PID 1576 set thread context of 1448	1576	Helper.exe	49
PID 1576 set thread context of 748	1576	Helper.exe	51
PID 1576 set thread context of 768	1576	Helper.exe	54
PID 1576 set thread context of 1760	1576	Helper.exe	56
PID 1576 set thread context of 2004	1576	Helper.exe	59
PID 1576 set thread context of 1448	1576	Helper.exe	63
PID 1576 set thread context of 1060	1576	Helper.exe	65
PID 1576 set thread context of 1928	1576	Helper.exe	67
PID 1576 set thread context of 296	1576	Helper.exe	70
PID 1576 set thread context of 2024	1576	Helper.exe	73
PID 1576 set thread context of 1608	1576	Helper.exe	77
PID 1576 set thread context of 1144	1576	Helper.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
736	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	WinRaR64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	WinRaR64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\RarSFX0\winmgmts:\MRBKYMNO\root\CIMV2	WinRaR64.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	23	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeRestorePrivilege	1496	CL_Debug_Log.txt
Token: 35	1496	CL_Debug_Log.txt
Token: SeSecurityPrivilege	1496	CL_Debug_Log.txt
Token: SeSecurityPrivilege	1496	CL_Debug_Log.txt
Token: SeDebugPrivilege	1852	Async.exe
Token: SeDebugPrivilege	1852	Async.exe
Token: SeRestorePrivilege	1188	Helper.exe
Token: 35	1188	Helper.exe
Token: SeSecurityPrivilege	1188	Helper.exe
Token: SeSecurityPrivilege	1188	Helper.exe
Token: SeRestorePrivilege	1448	Helper.exe
Token: 35	1448	Helper.exe
Token: SeSecurityPrivilege	1448	Helper.exe
Token: SeSecurityPrivilege	1448	Helper.exe
Token: SeLockMemoryPrivilege	748	attrib.exe
Token: SeLockMemoryPrivilege	748	attrib.exe
Token: SeLockMemoryPrivilege	768	attrib.exe
Token: SeLockMemoryPrivilege	768	attrib.exe
Token: SeLockMemoryPrivilege	1760	attrib.exe
Token: SeLockMemoryPrivilege	1760	attrib.exe
Token: SeLockMemoryPrivilege	2004	attrib.exe
Token: SeLockMemoryPrivilege	2004	attrib.exe
Token: SeLockMemoryPrivilege	1448	attrib.exe
Token: SeLockMemoryPrivilege	1448	attrib.exe
Token: SeLockMemoryPrivilege	1060	attrib.exe
Token: SeLockMemoryPrivilege	1060	attrib.exe
Token: SeLockMemoryPrivilege	1928	attrib.exe
Token: SeLockMemoryPrivilege	1928	attrib.exe
Token: SeLockMemoryPrivilege	296	attrib.exe
Token: SeLockMemoryPrivilege	296	attrib.exe
Token: SeLockMemoryPrivilege	2024	attrib.exe
Token: SeLockMemoryPrivilege	2024	attrib.exe
Token: SeLockMemoryPrivilege	1608	attrib.exe
Token: SeLockMemoryPrivilege	1608	attrib.exe
Token: SeLockMemoryPrivilege	1144	attrib.exe
Token: SeLockMemoryPrivilege	1144	attrib.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1576	Helper.exe
1576	Helper.exe
1576	Helper.exe
328	Helper.exe
328	Helper.exe
328	Helper.exe
1496	Helper.exe
1496	Helper.exe
1496	Helper.exe
1636	Helper.exe
1636	Helper.exe
1636	Helper.exe
940	Helper.exe
940	Helper.exe
940	Helper.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1064	WinRaR64.exe
1064	WinRaR64.exe
1064	WinRaR64.exe
1576	Helper.exe
1576	Helper.exe
1576	Helper.exe
328	Helper.exe
328	Helper.exe
328	Helper.exe
1496	Helper.exe
1496	Helper.exe
1496	Helper.exe
1636	Helper.exe
1636	Helper.exe
1636	Helper.exe
940	Helper.exe
940	Helper.exe
940	Helper.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2016	540	d3e8bacfa3a35f43a26772be547d48a9.exe	26
PID 540 wrote to memory of 2016	540	d3e8bacfa3a35f43a26772be547d48a9.exe	26
PID 540 wrote to memory of 2016	540	d3e8bacfa3a35f43a26772be547d48a9.exe	26
PID 540 wrote to memory of 2016	540	d3e8bacfa3a35f43a26772be547d48a9.exe	26
PID 2016 wrote to memory of 1448	2016	Cript.exe	27
PID 2016 wrote to memory of 1448	2016	Cript.exe	27
PID 2016 wrote to memory of 1448	2016	Cript.exe	27
PID 2016 wrote to memory of 1448	2016	Cript.exe	27
PID 540 wrote to memory of 1064	540	d3e8bacfa3a35f43a26772be547d48a9.exe	28
PID 540 wrote to memory of 1064	540	d3e8bacfa3a35f43a26772be547d48a9.exe	28
PID 540 wrote to memory of 1064	540	d3e8bacfa3a35f43a26772be547d48a9.exe	28
PID 540 wrote to memory of 1064	540	d3e8bacfa3a35f43a26772be547d48a9.exe	28
PID 1064 wrote to memory of 1496	1064	WinRaR64.exe	33
PID 1064 wrote to memory of 1496	1064	WinRaR64.exe	33
PID 1064 wrote to memory of 1496	1064	WinRaR64.exe	33
PID 1064 wrote to memory of 1496	1064	WinRaR64.exe	33
PID 1064 wrote to memory of 240	1064	WinRaR64.exe	35
PID 1064 wrote to memory of 240	1064	WinRaR64.exe	35
PID 1064 wrote to memory of 240	1064	WinRaR64.exe	35
PID 1064 wrote to memory of 240	1064	WinRaR64.exe	35
PID 240 wrote to memory of 736	240	cmd.exe	37
PID 240 wrote to memory of 736	240	cmd.exe	37
PID 240 wrote to memory of 736	240	cmd.exe	37
PID 240 wrote to memory of 736	240	cmd.exe	37
PID 540 wrote to memory of 1852	540	d3e8bacfa3a35f43a26772be547d48a9.exe	38
PID 540 wrote to memory of 1852	540	d3e8bacfa3a35f43a26772be547d48a9.exe	38
PID 540 wrote to memory of 1852	540	d3e8bacfa3a35f43a26772be547d48a9.exe	38
PID 540 wrote to memory of 1852	540	d3e8bacfa3a35f43a26772be547d48a9.exe	38
PID 1812 wrote to memory of 1576	1812	taskeng.exe	40
PID 1812 wrote to memory of 1732	1812	taskeng.exe	41
PID 1812 wrote to memory of 1576	1812	taskeng.exe	40
PID 1812 wrote to memory of 1576	1812	taskeng.exe	40
PID 1812 wrote to memory of 1732	1812	taskeng.exe	41
PID 1812 wrote to memory of 1576	1812	taskeng.exe	40
PID 1812 wrote to memory of 1732	1812	taskeng.exe	41
PID 1812 wrote to memory of 1732	1812	taskeng.exe	41
PID 1576 wrote to memory of 1188	1576	Helper.exe	42
PID 1576 wrote to memory of 1188	1576	Helper.exe	42
PID 1576 wrote to memory of 1188	1576	Helper.exe	42
PID 1576 wrote to memory of 1188	1576	Helper.exe	42
PID 1576 wrote to memory of 1188	1576	Helper.exe	42
PID 1576 wrote to memory of 1188	1576	Helper.exe	42
PID 1576 wrote to memory of 860	1576	Helper.exe	44
PID 1576 wrote to memory of 860	1576	Helper.exe	44
PID 1576 wrote to memory of 860	1576	Helper.exe	44
PID 1576 wrote to memory of 860	1576	Helper.exe	44
PID 1448 wrote to memory of 944	1448	WScript.exe	45
PID 1448 wrote to memory of 944	1448	WScript.exe	45
PID 1448 wrote to memory of 944	1448	WScript.exe	45
PID 1448 wrote to memory of 944	1448	WScript.exe	45
PID 1812 wrote to memory of 328	1812	taskeng.exe	48
PID 1812 wrote to memory of 328	1812	taskeng.exe	48
PID 1812 wrote to memory of 328	1812	taskeng.exe	48
PID 1812 wrote to memory of 328	1812	taskeng.exe	48
PID 1812 wrote to memory of 1496	1812	taskeng.exe	47
PID 1812 wrote to memory of 1496	1812	taskeng.exe	47
PID 1812 wrote to memory of 1496	1812	taskeng.exe	47
PID 1812 wrote to memory of 1496	1812	taskeng.exe	47
PID 1576 wrote to memory of 1448	1576	Helper.exe	49
PID 1576 wrote to memory of 1448	1576	Helper.exe	49
PID 1576 wrote to memory of 1448	1576	Helper.exe	49
PID 1576 wrote to memory of 1448	1576	Helper.exe	49
PID 1576 wrote to memory of 1448	1576	Helper.exe	49
PID 1576 wrote to memory of 1448	1576	Helper.exe	49

Views/modifies file attributes 1 TTPs 18 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
748	attrib.exe
1060	attrib.exe
1608	attrib.exe
1856	attrib.exe
2024	attrib.exe
1144	attrib.exe
328	attrib.exe
1920	attrib.exe
944	attrib.exe
2004	attrib.exe
1760	attrib.exe
768	attrib.exe
572	attrib.exe
1928	attrib.exe
296	attrib.exe
1760	attrib.exe
1772	attrib.exe
1448	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d3e8bacfa3a35f43a26772be547d48a9.exe
"C:\Users\Admin\AppData\Local\Temp\d3e8bacfa3a35f43a26772be547d48a9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Cript.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Cript.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Driverdll\ssbT9GVu.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Driverdll\jZWXmLWSCTcFHfd1q.bat" "
      4⤵
      PID:944
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinRaR64.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinRaR64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
    C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Creates scheduled task(s)
      PID:736
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Async.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Async.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1852

C:\Windows\system32\taskeng.exe
taskeng.exe {60742E86-5D42-41EF-BC47-9F824027695F} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:860
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:748
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Views/modifies file attributes
    PID:1920
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:768
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:1760
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Views/modifies file attributes
    PID:944
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:2004
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Views/modifies file attributes
    PID:1772
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Views/modifies file attributes
    PID:572
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:1448
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:1060
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:1928
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Views/modifies file attributes
    PID:1856
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:296
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Views/modifies file attributes
    PID:1760
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:2024
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:1608
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Views/modifies file attributes
    PID:1144
- - C:\Windows\SysWOW64\attrib.exe
    -o stratum+tcp://rutracker.host:3333 -u -p x -t 2
    3⤵
    - Views/modifies file attributes
    PID:328
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1496
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:328
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:940
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/540-59-0x0000000075A71000-0x0000000075A73000-memory.dmp

Download

memory/748-172-0x0000000000400000-0x0000000000C0B000-memory.dmp

Download

memory/748-169-0x0000000000400000-0x0000000000C0B000-memory.dmp

Download

memory/860-139-0x000000006EA00000-0x000000006EAA7000-memory.dmp

Download

memory/860-145-0x0000000000CA0000-0x0000000001048000-memory.dmp

Download

memory/860-142-0x000000006EEF0000-0x000000006EFAD000-memory.dmp

Download

memory/860-141-0x000000006F000000-0x000000006F021000-memory.dmp

Download

memory/860-140-0x0000000000CA0000-0x0000000001048000-memory.dmp

Download

memory/860-143-0x000000006EAB0000-0x000000006ECBB000-memory.dmp

Download

memory/860-138-0x000000006EAB0000-0x000000006ECBB000-memory.dmp

Download

memory/860-137-0x000000006EEF0000-0x000000006EFAD000-memory.dmp

Download

memory/860-136-0x000000006F000000-0x000000006F021000-memory.dmp

Download

memory/860-144-0x000000006EA00000-0x000000006EAA7000-memory.dmp

Download

memory/1064-87-0x0000000001000000-0x0000000001001000-memory.dmp

Download

memory/1188-109-0x00000000004D0000-0x0000000000590000-memory.dmp

Download

memory/1188-113-0x00000000004D0000-0x0000000000590000-memory.dmp

Download

memory/1448-155-0x0000000000080000-0x0000000000140000-memory.dmp

Download

memory/1448-159-0x0000000000080000-0x0000000000140000-memory.dmp

Download

memory/1852-98-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/1852-101-0x0000000000750000-0x0000000000751000-memory.dmp

Download