asyncrat | 66fc76bb7fc8f2bdadb5112a0ac7396e25d847cdcfb9ff715cb790ea1e0b26eb

Analysis

max time kernel
394s
max time network
440s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
05-10-2022 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Spectrum (Global) Payment Confirmation.exe
Size

74KB
MD5

67958d190ff46bb281af29ee7b6cef28
SHA1

226ca55977aff7838fac8a5fe8c62530f84a1e22
SHA256

a7256a89909f64b9dd5bdf1b1b0849c0714c97eeca3749117775fe8c1be05f1a
SHA512

76ad2be9eb9168814693c4a8ce392b36f414f6a940d2f11937fe3452c711f107c78a86eb04c210645ef80f9eb0d587888d1d9c9bc3eaa74a1d4e01e6b43056be
SSDEEP

384:WVn7l2UC+0HgRqOflaIttttttttttttttttttttttttttttt+Q34NydLAunywWqR:WVn7lj7NaIOXSNW1SAb

Score

10^/10

asyncrat stormkitty rat spyware stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1872-311-0x0000000000424EDE-mapping.dmp	family_stormkitty
behavioral1/memory/1872-345-0x0000000000400000-0x000000000042A000-memory.dmp	family_stormkitty
behavioral1/memory/1448-1004-0x0000000000424EDE-mapping.dmp	family_stormkitty

Async RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1872-311-0x0000000000424EDE-mapping.dmp	asyncrat
behavioral1/memory/1872-345-0x0000000000400000-0x000000000042A000-memory.dmp	asyncrat
behavioral1/memory/1448-1004-0x0000000000424EDE-mapping.dmp	asyncrat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 16 IoCs

Processes:

Spectrum (Global) Payment Confirmation.exeSpectrum (Global) Payment Confirmation.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File opened for modification	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File opened for modification	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File opened for modification	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	Spectrum (Global) Payment Confirmation.exe
File created	C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\Admin@SUAJYJLY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	Spectrum (Global) Payment Confirmation.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Spectrum (Global) Payment Confirmation.exeSpectrum (Global) Payment Confirmation.exe

description	pid	process	target process
PID 2132 set thread context of 1872	2132	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 set thread context of 1448	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1008	1872	WerFault.exe	Spectrum (Global) Payment Confirmation.exe
4348	1448	WerFault.exe	Spectrum (Global) Payment Confirmation.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Spectrum (Global) Payment Confirmation.exeSpectrum (Global) Payment Confirmation.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Spectrum (Global) Payment Confirmation.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Spectrum (Global) Payment Confirmation.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Spectrum (Global) Payment Confirmation.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Spectrum (Global) Payment Confirmation.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

Processes:

powershell.exeSpectrum (Global) Payment Confirmation.exeSpectrum (Global) Payment Confirmation.exepowershell.exeSpectrum (Global) Payment Confirmation.exeSpectrum (Global) Payment Confirmation.exe

pid	process
3604	powershell.exe
3604	powershell.exe
3604	powershell.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
2132	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
1872	Spectrum (Global) Payment Confirmation.exe
648	powershell.exe
648	powershell.exe
648	powershell.exe
1248	Spectrum (Global) Payment Confirmation.exe
1248	Spectrum (Global) Payment Confirmation.exe
1248	Spectrum (Global) Payment Confirmation.exe
1248	Spectrum (Global) Payment Confirmation.exe
1248	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe
1448	Spectrum (Global) Payment Confirmation.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

Spectrum (Global) Payment Confirmation.exepowershell.exeSpectrum (Global) Payment Confirmation.exeSpectrum (Global) Payment Confirmation.exepowershell.exesvchost.exeSpectrum (Global) Payment Confirmation.exe

description	pid	process
Token: SeDebugPrivilege	2132	Spectrum (Global) Payment Confirmation.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	1872	Spectrum (Global) Payment Confirmation.exe
Token: SeDebugPrivilege	1248	Spectrum (Global) Payment Confirmation.exe
Token: SeDebugPrivilege	648	powershell.exe
Token: SeBackupPrivilege	3908	svchost.exe
Token: SeRestorePrivilege	3908	svchost.exe
Token: SeSecurityPrivilege	3908	svchost.exe
Token: SeTakeOwnershipPrivilege	3908	svchost.exe
Token: 35	3908	svchost.exe
Token: SeDebugPrivilege	1448	Spectrum (Global) Payment Confirmation.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Spectrum (Global) Payment Confirmation.exeSpectrum (Global) Payment Confirmation.execmd.execmd.exeSpectrum (Global) Payment Confirmation.exeSpectrum (Global) Payment Confirmation.execmd.execmd.exe

description	pid	process	target process
PID 2132 wrote to memory of 3604	2132	Spectrum (Global) Payment Confirmation.exe	powershell.exe
PID 2132 wrote to memory of 3604	2132	Spectrum (Global) Payment Confirmation.exe	powershell.exe
PID 2132 wrote to memory of 3604	2132	Spectrum (Global) Payment Confirmation.exe	powershell.exe
PID 2132 wrote to memory of 1872	2132	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 2132 wrote to memory of 1872	2132	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 2132 wrote to memory of 1872	2132	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 2132 wrote to memory of 1872	2132	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 2132 wrote to memory of 1872	2132	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 2132 wrote to memory of 1872	2132	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 2132 wrote to memory of 1872	2132	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 2132 wrote to memory of 1872	2132	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1872 wrote to memory of 384	1872	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 1872 wrote to memory of 384	1872	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 1872 wrote to memory of 384	1872	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 384 wrote to memory of 748	384	cmd.exe	chcp.com
PID 384 wrote to memory of 748	384	cmd.exe	chcp.com
PID 384 wrote to memory of 748	384	cmd.exe	chcp.com
PID 384 wrote to memory of 4944	384	cmd.exe	netsh.exe
PID 384 wrote to memory of 4944	384	cmd.exe	netsh.exe
PID 384 wrote to memory of 4944	384	cmd.exe	netsh.exe
PID 384 wrote to memory of 2172	384	cmd.exe	findstr.exe
PID 384 wrote to memory of 2172	384	cmd.exe	findstr.exe
PID 384 wrote to memory of 2172	384	cmd.exe	findstr.exe
PID 1872 wrote to memory of 4508	1872	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 1872 wrote to memory of 4508	1872	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 1872 wrote to memory of 4508	1872	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 4508 wrote to memory of 3760	4508	cmd.exe	chcp.com
PID 4508 wrote to memory of 3760	4508	cmd.exe	chcp.com
PID 4508 wrote to memory of 3760	4508	cmd.exe	chcp.com
PID 4508 wrote to memory of 4512	4508	cmd.exe	netsh.exe
PID 4508 wrote to memory of 4512	4508	cmd.exe	netsh.exe
PID 4508 wrote to memory of 4512	4508	cmd.exe	netsh.exe
PID 1248 wrote to memory of 648	1248	Spectrum (Global) Payment Confirmation.exe	powershell.exe
PID 1248 wrote to memory of 648	1248	Spectrum (Global) Payment Confirmation.exe	powershell.exe
PID 1248 wrote to memory of 648	1248	Spectrum (Global) Payment Confirmation.exe	powershell.exe
PID 1248 wrote to memory of 60	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 60	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 60	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 1448	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 1448	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 1448	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 1448	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 1448	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 1448	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 1448	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1248 wrote to memory of 1448	1248	Spectrum (Global) Payment Confirmation.exe	Spectrum (Global) Payment Confirmation.exe
PID 1448 wrote to memory of 4828	1448	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 1448 wrote to memory of 4828	1448	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 1448 wrote to memory of 4828	1448	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 4828 wrote to memory of 3612	4828	cmd.exe	chcp.com
PID 4828 wrote to memory of 3612	4828	cmd.exe	chcp.com
PID 4828 wrote to memory of 3612	4828	cmd.exe	chcp.com
PID 4828 wrote to memory of 4872	4828	cmd.exe	netsh.exe
PID 4828 wrote to memory of 4872	4828	cmd.exe	netsh.exe
PID 4828 wrote to memory of 4872	4828	cmd.exe	netsh.exe
PID 4828 wrote to memory of 2912	4828	cmd.exe	findstr.exe
PID 4828 wrote to memory of 2912	4828	cmd.exe	findstr.exe
PID 4828 wrote to memory of 2912	4828	cmd.exe	findstr.exe
PID 1448 wrote to memory of 4340	1448	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 1448 wrote to memory of 4340	1448	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 1448 wrote to memory of 4340	1448	Spectrum (Global) Payment Confirmation.exe	cmd.exe
PID 4340 wrote to memory of 1020	4340	cmd.exe	chcp.com
PID 4340 wrote to memory of 1020	4340	cmd.exe	chcp.com
PID 4340 wrote to memory of 1020	4340	cmd.exe	chcp.com

C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe"
2⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
3⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:748

C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
4⤵
PID:4944

C:\Windows\SysWOW64\findstr.exe
findstr All
4⤵
PID:2172

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
3⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:3760

C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
4⤵
PID:4512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 2156
3⤵
- Program crash
PID:1008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4220

C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe"
2⤵
PID:60

C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe
"C:\Users\Admin\AppData\Local\Temp\Spectrum (Global) Payment Confirmation.exe"
2⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
3⤵
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:3612

C:\Windows\SysWOW64\netsh.exe
netsh wlan show profile
4⤵
PID:4872

C:\Windows\SysWOW64\findstr.exe
findstr All
4⤵
PID:2912

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
3⤵
- Suspicious use of WriteProcessMemory
PID:4340

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:1020

C:\Windows\SysWOW64\netsh.exe
netsh wlan show networks mode=bssid
4⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 2392
3⤵
- Program crash
PID:4348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Spectrum (Global) Payment Confirmation.exe.log
Filesize
1KB

MD5
86d6e792cf292d47353fa2dae047a078

SHA1
7b12913eae29285e77d737113a8f28316863c332

SHA256
f5b31295626e88fd30f12d60d579ef5682961734eebd1bb1ad5d4559426c09bb

SHA512
0e91e30e6dfdb96cc91be2ff8c439771f5dde8e5d75565b931c76b96910e2e68aceb9c22f30db02bfe94248e055a951136bc80f5461abe17b3bb232656e06fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
b42b8394f52b01b93879625688c3d79d

SHA1
3ed5877ab13e7655482c19e8b7511f8b2bfcdbb3

SHA256
b7b0a0ab5e777b74a8d7ec285804091eb3a4c71fcc2c57cddfa8541d05409cdd

SHA512
86357e54c29ee9c107b5655d457121f35117565fae4fdd018e56079eb7ca012e4afe0a5d5562bc2996b932b02450ad0fbb7f27047315b524138a0fe08c4f79c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
45KB

MD5
5f640bd48e2547b4c1a7421f080f815f

SHA1
a8f4a743f5b7da5cba7b8e6fb1d7ad4d67fefc6a

SHA256
916c83c7c8d059aea295523b8b3f24e1e2436df894f7fae26c47c9bad04baa9c

SHA512
a6ac100a351946b1bbb40c98aeda6e16e12f90f81063aff08c16d4d9afec8ed65c2cbcf25b42946627d67653f75740b1137dab625c99e9492ba35aba68b79a8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
3b8e4608aacf124ab46681e826958238

SHA1
fb0cd5997ca694f4875838fc272f9f9dff253987

SHA256
f267bbd7babc77204dde78938d6717ebea661a4089ee6feb6423dd74cdebbb22

SHA512
ba3344b8fe2d6f4a6b90510768bf133845fd6c5f9e7039acc9c8c4fdbd6fbe9c6d284f7838587accdd8b630c1ba4743c6b0361b9b694d48f825b0afc33acb346

Download Submit
C:\Users\Admin\AppData\Local\Temp\078BFBFF000306D2-Admin.zip
Filesize
67KB

MD5
4219a5d09b8ee20f6f252141dc3f52d1

SHA1
5b5667af9542597d5a582ece997dcd79ff6630af

SHA256
f12d2a2742c293a8da0fe7d355e3a78c67f848fb228bf5a390a31c5293b06adf

SHA512
908659253817b456198586227ebe844966f7d4c5e809d577eebb037a60ea0bb767da333fde5a5ef82290172464ef02079faf778cf4a1abc6f08b29cf3d81cbfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\places.raw
Filesize
5.0MB

MD5
0bbe1990240f44d9bf805d62eab40a45

SHA1
c96a4ee5b9e16d58b7f801e733f027c892eb65fe

SHA256
fb093c7bec5decbff83301b1088bb3cc16232e03d50fcc025af169634ac22ea1

SHA512
629c5f41bf44bb8ee012ef6f17df17b23ca6c7ae242b680f7add258a2299b353bbb896dd43e46007234a9250677280b71687541e8fc03e681993a0fee6792b2d

Download Submit
C:\Users\Admin\AppData\Local\acc589071e8e0a03231dd76fd3846b60\msgid.dat
Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
memory/384-373-0x0000000000000000-mapping.dmp

Download
memory/648-977-0x0000000007E80000-0x0000000007ECB000-memory.dmp

Filesize
300KB

Download
memory/648-913-0x0000000000000000-mapping.dmp

Download
memory/748-382-0x0000000000000000-mapping.dmp

Download
memory/1020-1302-0x0000000000000000-mapping.dmp

Download
memory/1248-901-0x00000000065F0000-0x0000000006940000-memory.dmp

Filesize
3.3MB

Download
memory/1448-1004-0x0000000000424EDE-mapping.dmp

Download
memory/1872-311-0x0000000000424EDE-mapping.dmp

Download
memory/1872-795-0x0000000005D10000-0x0000000005D22000-memory.dmp

Filesize
72KB

Download
memory/1872-794-0x0000000005C70000-0x0000000005C7A000-memory.dmp

Filesize
40KB

Download
memory/1872-345-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2132-147-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-183-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-140-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-141-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-142-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-143-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-144-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-145-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-146-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-120-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-148-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-149-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-150-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-151-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-152-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-153-0x0000000000B90000-0x0000000000BA8000-memory.dmp

Filesize
96KB

Download
memory/2132-154-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-155-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-156-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-157-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-158-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-159-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-160-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-161-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-162-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-163-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-164-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-165-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-166-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-167-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-168-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-169-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-170-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-171-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-172-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-173-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-174-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-175-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-176-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-177-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-178-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-179-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-180-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-181-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-182-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-139-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-184-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-198-0x0000000006320000-0x00000000063D6000-memory.dmp

Filesize
728KB

Download
memory/2132-199-0x00000000064A0000-0x0000000006532000-memory.dmp

Filesize
584KB

Download
memory/2132-200-0x0000000006580000-0x00000000065A2000-memory.dmp

Filesize
136KB

Download
memory/2132-202-0x00000000065C0000-0x0000000006910000-memory.dmp

Filesize
3.3MB

Download
memory/2132-121-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-122-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-123-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-124-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-125-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-126-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-127-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-128-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-130-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-131-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-307-0x0000000005570000-0x0000000005602000-memory.dmp

Filesize
584KB

Download
memory/2132-308-0x00000000074D0000-0x00000000079CE000-memory.dmp

Filesize
5.0MB

Download
memory/2132-138-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-137-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-136-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-135-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-133-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-129-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-132-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2132-134-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2172-407-0x0000000000000000-mapping.dmp

Download
memory/2912-1106-0x0000000000000000-mapping.dmp

Download
memory/3604-295-0x0000000008C70000-0x0000000008C8A000-memory.dmp

Filesize
104KB

Download
memory/3604-274-0x0000000006ED0000-0x0000000006F36000-memory.dmp

Filesize
408KB

Download
memory/3604-214-0x0000000000000000-mapping.dmp

Download
memory/3604-250-0x0000000000B20000-0x0000000000B56000-memory.dmp

Filesize
216KB

Download
memory/3604-294-0x0000000009550000-0x0000000009BC8000-memory.dmp

Filesize
6.5MB

Download
memory/3604-283-0x0000000007DB0000-0x0000000007E26000-memory.dmp

Filesize
472KB

Download
memory/3604-279-0x0000000008070000-0x00000000080BB000-memory.dmp

Filesize
300KB

Download
memory/3604-278-0x0000000006FB0000-0x0000000006FCC000-memory.dmp

Filesize
112KB

Download
memory/3604-275-0x0000000006F40000-0x0000000006FA6000-memory.dmp

Filesize
408KB

Download
memory/3604-255-0x0000000006FE0000-0x0000000007608000-memory.dmp

Filesize
6.2MB

Download
memory/3612-1083-0x0000000000000000-mapping.dmp

Download
memory/3760-608-0x0000000000000000-mapping.dmp

Download
memory/4340-1296-0x0000000000000000-mapping.dmp

Download
memory/4508-602-0x0000000000000000-mapping.dmp

Download
memory/4512-616-0x0000000000000000-mapping.dmp

Download
memory/4688-1310-0x0000000000000000-mapping.dmp

Download
memory/4828-1068-0x0000000000000000-mapping.dmp

Download
memory/4872-1104-0x0000000000000000-mapping.dmp

Download
memory/4944-403-0x0000000000000000-mapping.dmp

Download