asyncrat | 870a4cfc58c388361c8834701aa8112a0de4155305e92aedc66e0384813d3439

Analysis

max time kernel
150s
max time network
145s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-01-2022 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ae748c103a50cdd6d338506a153caa6.exe
Size

268KB
MD5

5ae748c103a50cdd6d338506a153caa6
SHA1

cfc4f248b309c6e8ac5b8031a2a4d614a48c5ea7
SHA256

870a4cfc58c388361c8834701aa8112a0de4155305e92aedc66e0384813d3439
SHA512

b7a354d56a07aede8eef9357985545c3a576a788fb6b6c11b88401ea9f81d3f5637ca63cc399f6096a96d4c73425d9e7787fa63d7b51cb72424b5d565bec5682

Score

10^/10

asyncrat redline xmrig @xbaxissxx cheat default discovery infostealer miner rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

null:null

Mutex

DcRatMutex

Attributes

anti_vm
false
bsod
false
delay
1
install
true
install_file
RuntimeBroker.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/SctPUR4x

aes.plain

Extracted

Family

redline

Botnet

cheat

rat3000.ddns.net:56698

Extracted

Family

redline

Botnet

@xbaxissxx

137.117.100.173:36513

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/688-62-0x0000000000E70000-0x0000000000E8E000-memory.dmp	family_redline
behavioral1/memory/688-73-0x000000001A8A0000-0x000000001A8BE000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1180-54-0x00000000002D0000-0x000000000031A000-memory.dmp	asyncrat
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	asyncrat
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe	asyncrat
behavioral1/memory/688-59-0x0000000000E90000-0x0000000000EDA000-memory.dmp	asyncrat
behavioral1/memory/688-61-0x0000000000E60000-0x0000000000E6E000-memory.dmp	asyncrat
behavioral1/memory/688-63-0x000000001A6C0000-0x000000001A6CC000-memory.dmp	asyncrat

XMRig Miner Payload 11 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1676-118-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-119-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-120-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-121-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-122-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-123-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-124-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-125-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-126-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-127-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig
behavioral1/memory/1676-129-0x0000000140000000-0x0000000140787000-memory.dmp	xmrig

Executes dropped EXE 4 IoCs

Processes:

RuntimeBroker.exeminer.exeservices.exesihost64.exe

pid process

688 RuntimeBroker.exe
1708 miner.exe
1704 services.exe
1532 sihost64.exe
Loads dropped DLL 3 IoCs

Processes:

powershell.execmd.exeservices.exe

pid process

1488 powershell.exe
1780 cmd.exe
1704 services.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
688	RuntimeBroker.exe
1708	miner.exe
1704	services.exe
1532	sihost64.exe

pid	process
1488	powershell.exe
1780	cmd.exe
1704	services.exe

Drops file in System32 directory 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

services.exe

description pid process target process

PID 1704 set thread context of 1676 1704 services.exe nslookup.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1288 schtasks.exe
1676 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1364 timeout.exe

description	pid	process	target process
PID 1704 set thread context of 1676	1704	services.exe	nslookup.exe

pid	process
1288	schtasks.exe
1676	schtasks.exe

pid	process
1364	timeout.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

5ae748c103a50cdd6d338506a153caa6.exeRuntimeBroker.exepowershell.exepowershell.exepowershell.exeminer.exepowershell.exepowershell.exeservices.exenslookup.exe

pid	process
1180	5ae748c103a50cdd6d338506a153caa6.exe
1180	5ae748c103a50cdd6d338506a153caa6.exe
688	RuntimeBroker.exe
688	RuntimeBroker.exe
1488	powershell.exe
688	RuntimeBroker.exe
1488	powershell.exe
1488	powershell.exe
1400	powershell.exe
2040	powershell.exe
688	RuntimeBroker.exe
688	RuntimeBroker.exe
1708	miner.exe
1028	powershell.exe
1504	powershell.exe
1704	services.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe
1676	nslookup.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464

pid	process
464

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

5ae748c103a50cdd6d338506a153caa6.exeRuntimeBroker.exepowershell.exepowershell.exepowershell.exeminer.exepowershell.exepowershell.exeservices.exenslookup.exe

description	pid	process
Token: SeDebugPrivilege	1180	5ae748c103a50cdd6d338506a153caa6.exe
Token: SeDebugPrivilege	688	RuntimeBroker.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1400	powershell.exe
Token: SeDebugPrivilege	2040	powershell.exe
Token: SeDebugPrivilege	1708	miner.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1704	services.exe
Token: SeLockMemoryPrivilege	1676	nslookup.exe
Token: SeLockMemoryPrivilege	1676	nslookup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5ae748c103a50cdd6d338506a153caa6.execmd.execmd.exeRuntimeBroker.execmd.exepowershell.exeminer.execmd.execmd.execmd.exeservices.execmd.exe

description	pid	process	target process
PID 1180 wrote to memory of 756	1180	5ae748c103a50cdd6d338506a153caa6.exe	cmd.exe
PID 1180 wrote to memory of 756	1180	5ae748c103a50cdd6d338506a153caa6.exe	cmd.exe
PID 1180 wrote to memory of 756	1180	5ae748c103a50cdd6d338506a153caa6.exe	cmd.exe
PID 1180 wrote to memory of 568	1180	5ae748c103a50cdd6d338506a153caa6.exe	cmd.exe
PID 1180 wrote to memory of 568	1180	5ae748c103a50cdd6d338506a153caa6.exe	cmd.exe
PID 1180 wrote to memory of 568	1180	5ae748c103a50cdd6d338506a153caa6.exe	cmd.exe
PID 756 wrote to memory of 1288	756	cmd.exe	schtasks.exe
PID 756 wrote to memory of 1288	756	cmd.exe	schtasks.exe
PID 756 wrote to memory of 1288	756	cmd.exe	schtasks.exe
PID 568 wrote to memory of 1364	568	cmd.exe	timeout.exe
PID 568 wrote to memory of 1364	568	cmd.exe	timeout.exe
PID 568 wrote to memory of 1364	568	cmd.exe	timeout.exe
PID 568 wrote to memory of 688	568	cmd.exe	RuntimeBroker.exe
PID 568 wrote to memory of 688	568	cmd.exe	RuntimeBroker.exe
PID 568 wrote to memory of 688	568	cmd.exe	RuntimeBroker.exe
PID 688 wrote to memory of 1764	688	RuntimeBroker.exe	cmd.exe
PID 688 wrote to memory of 1764	688	RuntimeBroker.exe	cmd.exe
PID 688 wrote to memory of 1764	688	RuntimeBroker.exe	cmd.exe
PID 1764 wrote to memory of 1488	1764	cmd.exe	powershell.exe
PID 1764 wrote to memory of 1488	1764	cmd.exe	powershell.exe
PID 1764 wrote to memory of 1488	1764	cmd.exe	powershell.exe
PID 1488 wrote to memory of 1708	1488	powershell.exe	miner.exe
PID 1488 wrote to memory of 1708	1488	powershell.exe	miner.exe
PID 1488 wrote to memory of 1708	1488	powershell.exe	miner.exe
PID 1708 wrote to memory of 576	1708	miner.exe	cmd.exe
PID 1708 wrote to memory of 576	1708	miner.exe	cmd.exe
PID 1708 wrote to memory of 576	1708	miner.exe	cmd.exe
PID 576 wrote to memory of 1400	576	cmd.exe	powershell.exe
PID 576 wrote to memory of 1400	576	cmd.exe	powershell.exe
PID 576 wrote to memory of 1400	576	cmd.exe	powershell.exe
PID 576 wrote to memory of 2040	576	cmd.exe	powershell.exe
PID 576 wrote to memory of 2040	576	cmd.exe	powershell.exe
PID 576 wrote to memory of 2040	576	cmd.exe	powershell.exe
PID 1708 wrote to memory of 1612	1708	miner.exe	cmd.exe
PID 1708 wrote to memory of 1612	1708	miner.exe	cmd.exe
PID 1708 wrote to memory of 1612	1708	miner.exe	cmd.exe
PID 1612 wrote to memory of 1676	1612	cmd.exe	schtasks.exe
PID 1612 wrote to memory of 1676	1612	cmd.exe	schtasks.exe
PID 1612 wrote to memory of 1676	1612	cmd.exe	schtasks.exe
PID 1708 wrote to memory of 1780	1708	miner.exe	cmd.exe
PID 1708 wrote to memory of 1780	1708	miner.exe	cmd.exe
PID 1708 wrote to memory of 1780	1708	miner.exe	cmd.exe
PID 1780 wrote to memory of 1704	1780	cmd.exe	services.exe
PID 1780 wrote to memory of 1704	1780	cmd.exe	services.exe
PID 1780 wrote to memory of 1704	1780	cmd.exe	services.exe
PID 1704 wrote to memory of 812	1704	services.exe	cmd.exe
PID 1704 wrote to memory of 812	1704	services.exe	cmd.exe
PID 1704 wrote to memory of 812	1704	services.exe	cmd.exe
PID 812 wrote to memory of 1028	812	cmd.exe	powershell.exe
PID 812 wrote to memory of 1028	812	cmd.exe	powershell.exe
PID 812 wrote to memory of 1028	812	cmd.exe	powershell.exe
PID 812 wrote to memory of 1504	812	cmd.exe	powershell.exe
PID 812 wrote to memory of 1504	812	cmd.exe	powershell.exe
PID 812 wrote to memory of 1504	812	cmd.exe	powershell.exe
PID 1704 wrote to memory of 1532	1704	services.exe	sihost64.exe
PID 1704 wrote to memory of 1532	1704	services.exe	sihost64.exe
PID 1704 wrote to memory of 1532	1704	services.exe	sihost64.exe
PID 1704 wrote to memory of 1676	1704	services.exe	nslookup.exe
PID 1704 wrote to memory of 1676	1704	services.exe	nslookup.exe
PID 1704 wrote to memory of 1676	1704	services.exe	nslookup.exe
PID 1704 wrote to memory of 1676	1704	services.exe	nslookup.exe
PID 1704 wrote to memory of 1676	1704	services.exe	nslookup.exe
PID 1704 wrote to memory of 1676	1704	services.exe	nslookup.exe
PID 1704 wrote to memory of 1676	1704	services.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\5ae748c103a50cdd6d338506a153caa6.exe
"C:\Users\Admin\AppData\Local\Temp\5ae748c103a50cdd6d338506a153caa6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"'
3⤵
- Creates scheduled task(s)
PID:1288

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB876.tmp.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1364

C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\miner.exe"' & exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\miner.exe"'
5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Local\Temp\miner.exe
"C:\Users\Admin\AppData\Local\Temp\miner.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
7⤵
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
8⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
8⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\system32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
7⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
8⤵
- Creates scheduled task(s)
PID:1676

C:\Windows\system32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1780

C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit
9⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"
10⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="
10⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"
9⤵
- Executes dropped EXE
PID:1532

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "kkzvbachphtbo"
10⤵
PID:1764

C:\Windows\System32\nslookup.exe
C:\Windows\System32\nslookup.exe daivxlbyevrnfy0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRha9S4YJkR8/KlqFio/vzAY7y//ZROYnArPXLiffwPBwkFEPcm1um/X4LVcLLWE6yzh89BXHBlvoLwdOofOXrjIYVZEC63s+Xjln05OgJVg2i+hmHhCMNNFLiys3ZXEOfl4xi8Oc6ap15UEmADV1nEN9AbppwZPI5X/bCUAf6jNa8G4JCw44A90muaiwnylvgzlhTqhAWoH9bO7SXtkDw+hmUkxlrUDIE77XwhKpKrxntSOxlrOTFCndPX7DJA5/LrUn85qe/FpvXZIFFuVHeKTTM7Qu0KCHbd+yluJhkLqs7OyhtSmdWHKvCZ6K4E6Ma3oBjCdhLMuh2UiXvsojMFmrwetL6+ja0kAT2p6zdzJmKJ3jbznG10lzTaEKaV9wj5xcFMWt3thKilL8HiCsBnQc1lGprtxZaLMY7BfZozoFKW1lv1J3jpNciMz3Ma1djTvaNwmOJodyZ/RgcpdTSwAMiw49I19LriEPWXRbuHQQ==
9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\miner.exe
MD5
949f649b23a332a2b5548a3356ffdce6

SHA1
63cf9f5a169e06d2f93ca216eabb630517137fa2

SHA256
2aaca35f003f56c9b58e580491c2d3aba659fe7a7438a3cfd7ff6203e15fb358

SHA512
14efd8c152811047dedd2579d6a9ebe8104c918f62ecfe9cd7ad1cefe8df1429addf7ec2d6959a6c815cb74dbf7d3a94262dcdd084f0a073b23b8be63a9c58dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\miner.exe
MD5
949f649b23a332a2b5548a3356ffdce6

SHA1
63cf9f5a169e06d2f93ca216eabb630517137fa2

SHA256
2aaca35f003f56c9b58e580491c2d3aba659fe7a7438a3cfd7ff6203e15fb358

SHA512
14efd8c152811047dedd2579d6a9ebe8104c918f62ecfe9cd7ad1cefe8df1429addf7ec2d6959a6c815cb74dbf7d3a94262dcdd084f0a073b23b8be63a9c58dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB876.tmp.bat
MD5
35ea304410e9e28c8e0cb6217bbe2f5d

SHA1
2d2440580f384fbc2a24de060deaed1efb142975

SHA256
ee4c51b5ca057fb1c762e91af9aaa68513683faf65f898e592c1e280e61ead58

SHA512
97f7bc1748414b9e62245b2e85759515a85538b401892d0e517d265b99fb93fd246ff8b7ccdfee58acc2d92ad396e99b97bd3b0eaaa2ba6fcba805b4c70edad4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
MD5
571fd11292a309b3a2f98bbf16eef955

SHA1
9d44e080fdd7ad4a90a26e8c83fdf1d8d04a7c10

SHA256
4a0640dd32d5549051fe2c69ee4f444fa971f03740ab9c65545f22fcb583e1eb

SHA512
7ed4d423d84459dd203f0de4ec50d00ff9b50b40cf4fc93bb3195505c92a77a32864aecc6eb6a73a8e8b9398f6c398fe5e72f67d94a8948979c6ede041b33f55

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
6414c549ad89281daf1b74486d3c4e46

SHA1
57bde34f51788a5bc0ea4d787a536be39b20feb2

SHA256
ac317e9cfde12390e7ac76710e04a3da8de19b88d29d6d469ed583bdc790b7a5

SHA512
4f2e98bece4cf98295f8e658ff270f6ce99659f2bb74ce4de189ff4a6d14b50c57754e35052a3f07b9ac21ee3ff0de63fe18a9a83c6d07dec4d78ba5ade79cba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
6414c549ad89281daf1b74486d3c4e46

SHA1
57bde34f51788a5bc0ea4d787a536be39b20feb2

SHA256
ac317e9cfde12390e7ac76710e04a3da8de19b88d29d6d469ed583bdc790b7a5

SHA512
4f2e98bece4cf98295f8e658ff270f6ce99659f2bb74ce4de189ff4a6d14b50c57754e35052a3f07b9ac21ee3ff0de63fe18a9a83c6d07dec4d78ba5ade79cba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
6414c549ad89281daf1b74486d3c4e46

SHA1
57bde34f51788a5bc0ea4d787a536be39b20feb2

SHA256
ac317e9cfde12390e7ac76710e04a3da8de19b88d29d6d469ed583bdc790b7a5

SHA512
4f2e98bece4cf98295f8e658ff270f6ce99659f2bb74ce4de189ff4a6d14b50c57754e35052a3f07b9ac21ee3ff0de63fe18a9a83c6d07dec4d78ba5ade79cba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
6414c549ad89281daf1b74486d3c4e46

SHA1
57bde34f51788a5bc0ea4d787a536be39b20feb2

SHA256
ac317e9cfde12390e7ac76710e04a3da8de19b88d29d6d469ed583bdc790b7a5

SHA512
4f2e98bece4cf98295f8e658ff270f6ce99659f2bb74ce4de189ff4a6d14b50c57754e35052a3f07b9ac21ee3ff0de63fe18a9a83c6d07dec4d78ba5ade79cba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
MD5
949f649b23a332a2b5548a3356ffdce6

SHA1
63cf9f5a169e06d2f93ca216eabb630517137fa2

SHA256
2aaca35f003f56c9b58e580491c2d3aba659fe7a7438a3cfd7ff6203e15fb358

SHA512
14efd8c152811047dedd2579d6a9ebe8104c918f62ecfe9cd7ad1cefe8df1429addf7ec2d6959a6c815cb74dbf7d3a94262dcdd084f0a073b23b8be63a9c58dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
MD5
949f649b23a332a2b5548a3356ffdce6

SHA1
63cf9f5a169e06d2f93ca216eabb630517137fa2

SHA256
2aaca35f003f56c9b58e580491c2d3aba659fe7a7438a3cfd7ff6203e15fb358

SHA512
14efd8c152811047dedd2579d6a9ebe8104c918f62ecfe9cd7ad1cefe8df1429addf7ec2d6959a6c815cb74dbf7d3a94262dcdd084f0a073b23b8be63a9c58dd

Download Submit
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
MD5
5ae748c103a50cdd6d338506a153caa6

SHA1
cfc4f248b309c6e8ac5b8031a2a4d614a48c5ea7

SHA256
870a4cfc58c388361c8834701aa8112a0de4155305e92aedc66e0384813d3439

SHA512
b7a354d56a07aede8eef9357985545c3a576a788fb6b6c11b88401ea9f81d3f5637ca63cc399f6096a96d4c73425d9e7787fa63d7b51cb72424b5d565bec5682

Download Submit
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
MD5
5ae748c103a50cdd6d338506a153caa6

SHA1
cfc4f248b309c6e8ac5b8031a2a4d614a48c5ea7

SHA256
870a4cfc58c388361c8834701aa8112a0de4155305e92aedc66e0384813d3439

SHA512
b7a354d56a07aede8eef9357985545c3a576a788fb6b6c11b88401ea9f81d3f5637ca63cc399f6096a96d4c73425d9e7787fa63d7b51cb72424b5d565bec5682

Download Submit
\Users\Admin\AppData\Local\Temp\miner.exe
MD5
949f649b23a332a2b5548a3356ffdce6

SHA1
63cf9f5a169e06d2f93ca216eabb630517137fa2

SHA256
2aaca35f003f56c9b58e580491c2d3aba659fe7a7438a3cfd7ff6203e15fb358

SHA512
14efd8c152811047dedd2579d6a9ebe8104c918f62ecfe9cd7ad1cefe8df1429addf7ec2d6959a6c815cb74dbf7d3a94262dcdd084f0a073b23b8be63a9c58dd

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe
MD5
571fd11292a309b3a2f98bbf16eef955

SHA1
9d44e080fdd7ad4a90a26e8c83fdf1d8d04a7c10

SHA256
4a0640dd32d5549051fe2c69ee4f444fa971f03740ab9c65545f22fcb583e1eb

SHA512
7ed4d423d84459dd203f0de4ec50d00ff9b50b40cf4fc93bb3195505c92a77a32864aecc6eb6a73a8e8b9398f6c398fe5e72f67d94a8948979c6ede041b33f55

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\services.exe
MD5
949f649b23a332a2b5548a3356ffdce6

SHA1
63cf9f5a169e06d2f93ca216eabb630517137fa2

SHA256
2aaca35f003f56c9b58e580491c2d3aba659fe7a7438a3cfd7ff6203e15fb358

SHA512
14efd8c152811047dedd2579d6a9ebe8104c918f62ecfe9cd7ad1cefe8df1429addf7ec2d6959a6c815cb74dbf7d3a94262dcdd084f0a073b23b8be63a9c58dd

Download Submit
memory/688-59-0x0000000000E90000-0x0000000000EDA000-memory.dmp

Filesize
296KB

Download
memory/688-60-0x000000001B150000-0x000000001B152000-memory.dmp

Filesize
8KB

Download
memory/688-63-0x000000001A6C0000-0x000000001A6CC000-memory.dmp

Filesize
48KB

Download
memory/688-61-0x0000000000E60000-0x0000000000E6E000-memory.dmp

Filesize
56KB

Download
memory/688-73-0x000000001A8A0000-0x000000001A8BE000-memory.dmp

Filesize
120KB

Download
memory/688-62-0x0000000000E70000-0x0000000000E8E000-memory.dmp

Filesize
120KB

Download
memory/1028-97-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/1028-102-0x00000000027F0000-0x00000000027F2000-memory.dmp

Filesize
8KB

Download
memory/1028-96-0x000007FEE7860000-0x000007FEE83BD000-memory.dmp

Filesize
11.4MB

Download
memory/1028-103-0x00000000027F2000-0x00000000027F4000-memory.dmp

Filesize
8KB

Download
memory/1028-104-0x00000000027F4000-0x00000000027F7000-memory.dmp

Filesize
12KB

Download
memory/1028-105-0x00000000027FB000-0x000000000281A000-memory.dmp

Filesize
124KB

Download
memory/1180-54-0x00000000002D0000-0x000000000031A000-memory.dmp

Filesize
296KB

Download
memory/1180-55-0x000000001B2F0000-0x000000001B2F2000-memory.dmp

Filesize
8KB

Download
memory/1400-85-0x0000000002324000-0x0000000002327000-memory.dmp

Filesize
12KB

Download
memory/1400-84-0x0000000002322000-0x0000000002324000-memory.dmp

Filesize
8KB

Download
memory/1400-86-0x000000000232B000-0x000000000234A000-memory.dmp

Filesize
124KB

Download
memory/1400-83-0x0000000002320000-0x0000000002322000-memory.dmp

Filesize
8KB

Download
memory/1400-81-0x000007FEE7860000-0x000007FEE83BD000-memory.dmp

Filesize
11.4MB

Download
memory/1488-67-0x0000000002572000-0x0000000002574000-memory.dmp

Filesize
8KB

Download
memory/1488-69-0x0000000002574000-0x0000000002577000-memory.dmp

Filesize
12KB

Download
memory/1488-64-0x000007FEFB931000-0x000007FEFB933000-memory.dmp

Filesize
8KB

Download
memory/1488-65-0x000007FEE8200000-0x000007FEE8D5D000-memory.dmp

Filesize
11.4MB

Download
memory/1488-66-0x0000000002470000-0x0000000002572000-memory.dmp

Filesize
1.0MB

Download
memory/1488-68-0x000000000257B000-0x000000000259A000-memory.dmp

Filesize
124KB

Download
memory/1504-112-0x00000000023DB000-0x00000000023FA000-memory.dmp

Filesize
124KB

Download
memory/1504-108-0x000007FEE8140000-0x000007FEE8C9D000-memory.dmp

Filesize
11.4MB

Download
memory/1504-110-0x00000000023D2000-0x00000000023D4000-memory.dmp

Filesize
8KB

Download
memory/1504-109-0x00000000023D0000-0x00000000023D2000-memory.dmp

Filesize
8KB

Download
memory/1504-111-0x00000000023D4000-0x00000000023D7000-memory.dmp

Filesize
12KB

Download
memory/1676-120-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-122-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-129-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-128-0x00000000000E0000-0x0000000000100000-memory.dmp

Filesize
128KB

Download
memory/1676-126-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-131-0x0000000001F50000-0x0000000001F70000-memory.dmp

Filesize
128KB

Download
memory/1676-130-0x0000000000530000-0x0000000000550000-memory.dmp

Filesize
128KB

Download
memory/1676-121-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-124-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-123-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-127-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-125-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-115-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-116-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-117-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-118-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1676-119-0x0000000140000000-0x0000000140787000-memory.dmp

Filesize
7.5MB

Download
memory/1704-98-0x000000001C342000-0x000000001C344000-memory.dmp

Filesize
8KB

Download
memory/1704-101-0x000000001C347000-0x000000001C348000-memory.dmp

Filesize
4KB

Download
memory/1704-100-0x000000001C346000-0x000000001C347000-memory.dmp

Filesize
4KB

Download
memory/1704-99-0x000000001C344000-0x000000001C346000-memory.dmp

Filesize
8KB

Download
memory/1708-75-0x0000000000B00000-0x0000000000F07000-memory.dmp

Filesize
4.0MB

Download
memory/1708-74-0x000000001C800000-0x000000001CC08000-memory.dmp

Filesize
4.0MB

Download
memory/1708-77-0x000000001C374000-0x000000001C376000-memory.dmp

Filesize
8KB

Download
memory/1708-82-0x000000001C377000-0x000000001C378000-memory.dmp

Filesize
4KB

Download
memory/1708-78-0x000000001C376000-0x000000001C377000-memory.dmp

Filesize
4KB

Download
memory/1708-76-0x000000001C372000-0x000000001C374000-memory.dmp

Filesize
8KB

Download
memory/1764-132-0x00000000000A0000-0x00000000000A7000-memory.dmp

Filesize
28KB

Download
memory/1764-133-0x0000000001AA0000-0x0000000001AA6000-memory.dmp

Filesize
24KB

Download
memory/1764-135-0x000000001ABF2000-0x000000001ABF4000-memory.dmp

Filesize
8KB

Download
memory/1764-137-0x000000001ABF6000-0x000000001ABF7000-memory.dmp

Filesize
4KB

Download
memory/1764-136-0x000000001ABF4000-0x000000001ABF6000-memory.dmp

Filesize
8KB

Download
memory/1764-138-0x000000001ABF7000-0x000000001ABF8000-memory.dmp

Filesize
4KB

Download
memory/2040-89-0x000007FEE8200000-0x000007FEE8D5D000-memory.dmp

Filesize
11.4MB

Download
memory/2040-90-0x00000000025A4000-0x00000000025A7000-memory.dmp

Filesize
12KB

Download
memory/2040-91-0x00000000025AB000-0x00000000025CA000-memory.dmp

Filesize
124KB

Download