asyncrat | 85ba700122e35a9457bc1d0fa4ae49123c99efe4906e764b26f83e6f15ff3dcf

Analysis

max time kernel
140s
max time network
156s
platform
windows10_x64
resource
win10v20210408
submitted
08/09/2021, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe
Size 3.1MB
Sample210908-rlpyjshggl
SHA256 85ba700122e35a9457bc1d0fa4ae49123c99efe4906e764b26f83e6f15ff3dcf
MD5 fbda14f36f42a728d9a4718a98e07075
SHA1 c4918993430e7e1fc753b728cb1834becf033ffc
SHA512 c266f8a84bfee8724c6920fca48239c58dc062ad1b6f9211ebee3f266587ef55211ebbaddcb61fa1910787e01bbd22faf1298de697a2fcc350dbfa2f56339e47
MD5 SHA1 SHA512

Score

10^/10

asyncrat quasar brave21 discovery rat spyware suricata trojan

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

pettbull.ddns.net:6606
pettbull.ddns.net:7707
pettbull.ddns.net:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
J6p28HnC9XL8Dc6PzngnyEckA902Q1Ck
anti_detection
false
autorun
true
bdos
false
delay
BRAVE21
host
pettbull.ddns.net
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6606,7707,8808
version
0.5.7B

aes.plain

Extracted

Family

quasar

Version

1.4.0

Botnet

BRAVE21

pettbull.ddns.net:4782

Mutex

06538f38-9c19-4cdf-83c8-8fafb759e15a

Attributes

encryption_key
DAE9E02E5E04D59D9AF2AA1D5E82248D5919AC6A
install_name
Windows Update.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Windows
subdirectory
System32

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Quasar Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2756-182-0x0000000000400000-0x0000000000484000-memory.dmp	family_quasar
behavioral2/memory/2756-183-0x000000000047E7BE-mapping.dmp	family_quasar
behavioral2/memory/2756-198-0x0000000004F20000-0x000000000541E000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
suricata

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1200-128-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/1200-129-0x000000000040C74E-mapping.dmp	asyncrat
behavioral2/memory/1576-227-0x000000000040C74E-mapping.dmp	asyncrat

Executes dropped EXE 7 IoCs

pid	Process
584	Host.exe
1200	Host.exe
2588	Host file.exe
3600	System32.exe
2756	Host file.exe
3164	Set-up.exe
1576	System32.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe	Powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe	Powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.ipify.org
25	api.ipify.org

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 584 set thread context of 1200	584	Host.exe	82
PID 2588 set thread context of 2756	2588	Host file.exe	93
PID 3600 set thread context of 1576	3600	System32.exe	97

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe Inc\Adobe Installer\Set-up.exe	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe
File opened for modification	C:\Program Files (x86)\Adobe Inc\Adobe Installer\Uninstall.exe	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe
File created	C:\Program Files (x86)\Adobe Inc\Adobe Installer\Uninstall.ini	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3604	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1568	timeout.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Set-up.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Set-up.exe = "11001"	Set-up.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	Set-up.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Set-up.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Set-up.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Set-up.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Set-up.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2256	Powershell.exe
2256	Powershell.exe
2256	Powershell.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
1200	Host.exe
2280	Powershell.exe
2280	Powershell.exe
2280	Powershell.exe
3592	Powershell.exe
3592	Powershell.exe
3592	Powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	584	Host.exe
Token: SeDebugPrivilege	2256	Powershell.exe
Token: SeDebugPrivilege	1200	Host.exe
Token: SeDebugPrivilege	2588	Host file.exe
Token: SeDebugPrivilege	2280	Powershell.exe
Token: SeDebugPrivilege	2756	Host file.exe
Token: SeDebugPrivilege	3600	System32.exe
Token: SeDebugPrivilege	3592	Powershell.exe
Token: SeDebugPrivilege	1576	System32.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 584	856	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe	75
PID 856 wrote to memory of 584	856	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe	75
PID 856 wrote to memory of 584	856	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe	75
PID 584 wrote to memory of 2256	584	Host.exe	80
PID 584 wrote to memory of 2256	584	Host.exe	80
PID 584 wrote to memory of 2256	584	Host.exe	80
PID 584 wrote to memory of 1200	584	Host.exe	82
PID 584 wrote to memory of 1200	584	Host.exe	82
PID 584 wrote to memory of 1200	584	Host.exe	82
PID 584 wrote to memory of 1200	584	Host.exe	82
PID 584 wrote to memory of 1200	584	Host.exe	82
PID 584 wrote to memory of 1200	584	Host.exe	82
PID 584 wrote to memory of 1200	584	Host.exe	82
PID 584 wrote to memory of 1200	584	Host.exe	82
PID 856 wrote to memory of 2588	856	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe	83
PID 856 wrote to memory of 2588	856	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe	83
PID 856 wrote to memory of 2588	856	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe	83
PID 1200 wrote to memory of 344	1200	Host.exe	84
PID 1200 wrote to memory of 344	1200	Host.exe	84
PID 1200 wrote to memory of 344	1200	Host.exe	84
PID 1200 wrote to memory of 3548	1200	Host.exe	86
PID 1200 wrote to memory of 3548	1200	Host.exe	86
PID 1200 wrote to memory of 3548	1200	Host.exe	86
PID 3548 wrote to memory of 1568	3548	cmd.exe	88
PID 3548 wrote to memory of 1568	3548	cmd.exe	88
PID 3548 wrote to memory of 1568	3548	cmd.exe	88
PID 344 wrote to memory of 3604	344	cmd.exe	89
PID 344 wrote to memory of 3604	344	cmd.exe	89
PID 344 wrote to memory of 3604	344	cmd.exe	89
PID 3548 wrote to memory of 3600	3548	cmd.exe	90
PID 3548 wrote to memory of 3600	3548	cmd.exe	90
PID 3548 wrote to memory of 3600	3548	cmd.exe	90
PID 2588 wrote to memory of 2280	2588	Host file.exe	91
PID 2588 wrote to memory of 2280	2588	Host file.exe	91
PID 2588 wrote to memory of 2280	2588	Host file.exe	91
PID 2588 wrote to memory of 2756	2588	Host file.exe	93
PID 2588 wrote to memory of 2756	2588	Host file.exe	93
PID 2588 wrote to memory of 2756	2588	Host file.exe	93
PID 2588 wrote to memory of 2756	2588	Host file.exe	93
PID 2588 wrote to memory of 2756	2588	Host file.exe	93
PID 2588 wrote to memory of 2756	2588	Host file.exe	93
PID 2588 wrote to memory of 2756	2588	Host file.exe	93
PID 2588 wrote to memory of 2756	2588	Host file.exe	93
PID 856 wrote to memory of 3164	856	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe	94
PID 856 wrote to memory of 3164	856	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe	94
PID 856 wrote to memory of 3164	856	85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe	94
PID 3600 wrote to memory of 3592	3600	System32.exe	95
PID 3600 wrote to memory of 3592	3600	System32.exe	95
PID 3600 wrote to memory of 3592	3600	System32.exe	95
PID 3600 wrote to memory of 1576	3600	System32.exe	97
PID 3600 wrote to memory of 1576	3600	System32.exe	97
PID 3600 wrote to memory of 1576	3600	System32.exe	97
PID 3600 wrote to memory of 1576	3600	System32.exe	97
PID 3600 wrote to memory of 1576	3600	System32.exe	97
PID 3600 wrote to memory of 1576	3600	System32.exe	97
PID 3600 wrote to memory of 1576	3600	System32.exe	97
PID 3600 wrote to memory of 1576	3600	System32.exe	97

C:\Users\Admin\AppData\Local\Temp\85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe
"C:\Users\Admin\AppData\Local\Temp\85BA700122E35A9457BC1D0FA4AE49123C99EFE4906E7.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Roaming\Host.exe
  "C:\Users\Admin\AppData\Roaming\Host.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    "Powershell" Copy-Item 'C:\Users\Admin\AppData\Roaming\Host.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe'
    3⤵
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Users\Admin\AppData\Roaming\Host.exe
    "C:\Users\Admin\AppData\Roaming\Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "System32" /tr '"C:\Users\Admin\AppData\Roaming\System32.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:344
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "System32" /tr '"C:\Users\Admin\AppData\Roaming\System32.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:3604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp43C0.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1568
    - - C:\Users\Admin\AppData\Roaming\System32.exe
        
        "C:\Users\Admin\AppData\Roaming\System32.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3600
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        
        "Powershell" Copy-Item 'C:\Users\Admin\AppData\Roaming\System32.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe'
        6⤵
        Drops startup file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
      - C:\Users\Admin\AppData\Roaming\System32.exe
        
        "C:\Users\Admin\AppData\Roaming\System32.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1576
- C:\Users\Admin\AppData\Roaming\Host file.exe
  "C:\Users\Admin\AppData\Roaming\Host file.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
    "Powershell" Copy-Item 'C:\Users\Admin\AppData\Roaming\Host file.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exe'
    3⤵
    - Drops startup file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Users\Admin\AppData\Roaming\Host file.exe
    "C:\Users\Admin\AppData\Roaming\Host file.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\Program Files (x86)\Adobe Inc\Adobe Installer\Set-up.exe
  "C:\Program Files (x86)\Adobe Inc\Adobe Installer\Set-up.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  PID:3164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/584-119-0x0000000005150000-0x0000000005151000-memory.dmp

Download

memory/584-117-0x0000000000780000-0x0000000000781000-memory.dmp

Download

memory/584-142-0x00000000051F0000-0x00000000056EE000-memory.dmp

Download

memory/584-121-0x0000000005490000-0x0000000005491000-memory.dmp

Download

memory/584-120-0x00000000056F0000-0x00000000056F1000-memory.dmp

Download

memory/584-124-0x0000000005450000-0x0000000005465000-memory.dmp

Download

memory/584-122-0x00000000051F0000-0x00000000056EE000-memory.dmp

Download

memory/1200-153-0x0000000005850000-0x0000000005851000-memory.dmp

Download

memory/1200-128-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1576-259-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/2256-143-0x0000000006822000-0x0000000006823000-memory.dmp

Download

memory/2256-148-0x00000000074B0000-0x00000000074B1000-memory.dmp

Download

memory/2256-161-0x0000000006823000-0x0000000006824000-memory.dmp

Download

memory/2256-158-0x0000000008AF0000-0x0000000008AF1000-memory.dmp

Download

memory/2256-157-0x0000000008AA0000-0x0000000008AA1000-memory.dmp

Download

memory/2256-127-0x00000000042B0000-0x00000000042B1000-memory.dmp

Download

memory/2256-156-0x0000000008D50000-0x0000000008D51000-memory.dmp

Download

memory/2256-150-0x0000000007E70000-0x0000000007E71000-memory.dmp

Download

memory/2256-144-0x0000000006C80000-0x0000000006C81000-memory.dmp

Download

memory/2256-149-0x0000000007E00000-0x0000000007E01000-memory.dmp

Download

memory/2256-131-0x0000000006E60000-0x0000000006E61000-memory.dmp

Download

memory/2256-145-0x0000000006DA0000-0x0000000006DA1000-memory.dmp

Download

memory/2256-141-0x0000000006820000-0x0000000006821000-memory.dmp

Download

memory/2256-147-0x0000000007750000-0x0000000007751000-memory.dmp

Download

memory/2256-146-0x00000000076E0000-0x00000000076E1000-memory.dmp

Download

memory/2280-217-0x0000000006873000-0x0000000006874000-memory.dmp

Download

memory/2280-201-0x0000000006870000-0x0000000006871000-memory.dmp

Download

memory/2280-199-0x00000000076C0000-0x00000000076C1000-memory.dmp

Download

memory/2280-202-0x0000000006872000-0x0000000006873000-memory.dmp

Download

memory/2280-205-0x0000000007BA0000-0x0000000007BA1000-memory.dmp

Download

memory/2588-137-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/2588-196-0x00000000052A0000-0x000000000579E000-memory.dmp

Download

memory/2588-200-0x00000000052A0000-0x000000000579E000-memory.dmp

Download

memory/2756-182-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/2756-198-0x0000000004F20000-0x000000000541E000-memory.dmp

Download

memory/2756-220-0x0000000005F30000-0x0000000005F31000-memory.dmp

Download

memory/2756-221-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/2756-222-0x00000000059E0000-0x00000000059E1000-memory.dmp

Download

memory/2756-218-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download

memory/3592-237-0x0000000004660000-0x0000000004661000-memory.dmp

Download

memory/3592-238-0x0000000004662000-0x0000000004663000-memory.dmp

Download

memory/3592-258-0x0000000004663000-0x0000000004664000-memory.dmp

Download

memory/3600-235-0x0000000004BE0000-0x00000000050DE000-memory.dmp

Download

memory/3600-236-0x0000000004BE0000-0x00000000050DE000-memory.dmp

Download