asyncrat | bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe
Size 1.0MB
Sample240405-b38tzshd87
SHA256 bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73
MD5 2fd0387cb9fa37855f8a9c196c115131
SHA1 3a1b1f53e4a57a622a82ee6d149792fd7c212a13
SHA512 1fe92302bba86858e989203fc8826a4bd326226b7025d32be946f59a9035cc17d0734c50d724c560a288311ed1d4f07824c30e456988ab2e5b7432eb4d47a095
SSDEEP 12288:2fk2b3JKzOdEtjBA0zg1fA3UOaCl114p1xOAKSkjdrhV0DyqPod4/oADOUltRTrJ:q7LAzOd+jBhzkfhOaq11qIx5IrooVY4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat rat10 rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

RAT10

darkstorm275991.ddns.net:6606
darkstorm275991.ddns.net:7707
darkstorm275991.ddns.net:8808
mrreport.duckdns.org:6606
mrreport.duckdns.org:7707
mrreport.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
Microsoft.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000700000002320e-16.dat	family_asyncrat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320e-16.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/1836-35-0x0000000000DD0000-0x0000000000DE6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects executables packed with ConfuserEx Mod 3 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320b-6.dat	INDICATOR_EXE_Packed_ConfuserEx
behavioral2/memory/3724-37-0x0000000000820000-0x000000000090E000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx
behavioral2/memory/4412-113-0x0000000006D70000-0x0000000006E5E000-memory.dmp	INDICATOR_EXE_Packed_ConfuserEx

Detects file containing reversed ASEP Autorun registry keys 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000002320e-16.dat	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral2/memory/1836-35-0x0000000000DD0000-0x0000000000DE6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/memory/3724-50-0x0000000007660000-0x000000000772C000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	Microsoft.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VisualProtector.lnk	Visual Protector.exe

Executes dropped EXE 4 IoCs

pid	Process
3724	Visual Protector.exe
1836	Microsoft.exe
4412	Visual Protector.exe
1424	Microsoft.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4760	3724	WerFault.exe	84

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2456	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
116	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
3884	msedge.exe
3884	msedge.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
1836	Microsoft.exe
5084	identity_helper.exe
5084	identity_helper.exe
1424	Microsoft.exe
1424	Microsoft.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1836	Microsoft.exe
Token: SeDebugPrivilege	1424	Microsoft.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1424	Microsoft.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3724	4244	bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe	84
PID 4244 wrote to memory of 3724	4244	bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe	84
PID 4244 wrote to memory of 3724	4244	bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe	84
PID 4244 wrote to memory of 1836	4244	bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe	85
PID 4244 wrote to memory of 1836	4244	bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe	85
PID 4244 wrote to memory of 1836	4244	bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe	85
PID 4244 wrote to memory of 3884	4244	bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe	87
PID 4244 wrote to memory of 3884	4244	bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe	87
PID 3884 wrote to memory of 4672	3884	msedge.exe	88
PID 3884 wrote to memory of 4672	3884	msedge.exe	88
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 5068	3884	msedge.exe	90
PID 3884 wrote to memory of 4432	3884	msedge.exe	91
PID 3884 wrote to memory of 4432	3884	msedge.exe	91
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92
PID 3884 wrote to memory of 4060	3884	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe
"C:\Users\Admin\AppData\Local\Temp\bd54c2a5e07d4c0df9cb844d8a952ba3746dc1761d833a710d33309f75539e73.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Visual Protector.exe
  "C:\Users\Admin\AppData\Local\Visual Protector.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  PID:3724
- - C:\Users\Admin\AppData\Roaming\VisualSoft\Visual Protector.exe
    "C:\Users\Admin\AppData\Roaming\VisualSoft\Visual Protector.exe"
    3⤵
    - Executes dropped EXE
    PID:4412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3724 -s 1756
    3⤵
    - Program crash
    PID:4760
- C:\Users\Admin\AppData\Local\Microsoft.exe
  "C:\Users\Admin\AppData\Local\Microsoft.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Microsoft" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft.exe"' & exit
    3⤵
    PID:4512
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Microsoft" /tr '"C:\Users\Admin\AppData\Roaming\Microsoft.exe"'
      4⤵
      Creates scheduled task(s)
      PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7FFD.tmp.bat""
    3⤵
    PID:2640
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:116
  - - C:\Users\Admin\AppData\Roaming\Microsoft.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Private_Hacking_Cracking_Tools
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe0ddc46f8,0x7ffe0ddc4708,0x7ffe0ddc4718
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
    3⤵
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:32
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1072431203093144409,17302213676628081059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4456 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3724 -ip 3724
1⤵
PID:1956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Microsoft.exe

Path C:\Users\Admin\AppData\Local\Microsoft.exe
Size 66KB
SHA256 76b9c70c08977641458aa123b9cf587980ccf3ee10519fd7de50da6132ae1023
MD5 3f27e1d3e8718126553bcf89a78ecf3b
SHA1 d94bfe09d2f0e4436abc10a05981b8d26cb6cf6d
SHA512 e9ff23229bc4edbb2d168aa50ddca0c327af04d16eb8e3ce15f9d8f9ce7c2ae3b3a8678a97f61730265e5374aa683ea8812477763107a6f6bbd553691177e435
SSDEEP 1536:eOzLieOokWkHKuXUYFZoPDWZhVbGvzgmBhrPlTGRx:eOHieOoklKuXUYFcivVbGvjjdix
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Microsoft.exe.log
Size 522B
SHA256 2412679218bb0a7d05ceee32869bbb223619bde9966c4c460a68304a3367724b
MD5 acc9090417037dfa2a55b46ed86e32b8
SHA1 53fa6fb25fb3e88c24d2027aca6ae492b2800a4d
SHA512 d51f7085ec147c708f446b9fb6923cd2fb64596d354ed929e125b30ace57c8cb3217589447a36960e5d3aea87a4e48aaa82c7509eced6d6c2cecd71fcfe3697b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
MD5 0764f5481d3c05f5d391a36463484b49
SHA1 2c96194f04e768ac9d7134bc242808e4d8aeb149
SHA512 a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
MD5 e494d16e4b331d7fc483b3ae3b2e0973
SHA1 d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA512 016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 26c533025f0be310c056c315fd10fb0bd6975d9c54fccfd8384c467b786042f0
MD5 9695d4f9dcc75e61d802001b22adb721
SHA1 dcbc61b18e0d5752746883bbe63914506c3cca31
SHA512 37f5335fc7a0c4e19e8e16b4763cfbe078e5e63d84ba45781c88b6d04811b468f1dd59112adae1523f2b710b1eaef896d4ca09cc5e147d1b6c81cc3a1e374a05
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 442B
SHA256 e72624a5039b426adeb9e7886537fcf2e3ae8e84fc4d809f01f5bf4a86dd8fa0
MD5 19bcaedfeae58f7a7c27a49047552273
SHA1 f7d4aa4ceeb8c65f87cfbec73f232eef5a69917d
SHA512 24c2e15a61012353d8d362419b70247865d53835151f1dcbe0a939afec998599677c83d688a55f3e4d60af47c9dd6796f122d9ed0a5ec758fb07e84c4a6cca48
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bc5118e5bfaeb0ebec0b686c66f018528ff2a59ab435356fc2f1a83de4416bcd
MD5 5993096b1b09d68036cf06e017a5d23e
SHA1 6d77e2b414eba8fd5307e8d6671584d037456ebf
SHA512 d4cf22e77064358d9c7c8ae6597009176c20d5a50f7c355b83cd113f60503a41aea4f224ee70a42b34eb757bbf8c4b56461c6ed9c4121131b8c003d98662661d
SSDEEP 96:nhkr11KB9jawpvWMoiVmdeHum1jbSQuUWQyV+VD7AiEwb:nhk5U/aGWM3umhxurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8a3f0ac4117325c97b77b6e76243d499eeffc76856f793f467b6aefba7e7cd8b
MD5 de244d7ad545b88ade91d2e4af54bdb2
SHA1 4286257d88e92a25152f5d4b1ad3daa7931ffa2f
SHA512 5988e8af5f398b89f8e9bcdda909e17a5a45f989abebac8f43a2c22ea35c050a873268d2c3355473e60190fe59b9fe588ee49807ef09656c79f34a26398bb240
SSDEEP 96:nhkQ11KB9jawpvWMoiVmdeHbeouUWQyV+VD7ziEwb:nhkEU/aGWMXrurt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 66fad3e598570525335a018f8540f6e08a9d56b7210b826456ca13ce092e2db8
MD5 a9247eaed0acab335696c70506061d51
SHA1 a73296125f2384655a9c09fc1114d15ca684a9a1
SHA512 5d4ae4a11a92d2b920472def40627f885661a970b31f10701d7a093c90c5d1aab894a8c54218a9a642eee20e98c2a1846a6c8a721955bbad6818492385f2293c
SSDEEP 192:KoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7/Ydf52e2RUylZylb8FxvA:O9iIxuERzA83h09RZxY7/Ydf6rTrFTtc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 084a1d6524a0a4e47a8ec5b32ff6233c35c8710e4ae350a204676f60d903dca5
MD5 f4cc3e8a5c67b431e9511cd498fbd4cf
SHA1 22d0fe6a084b012cee07cb10e751e453a8eae685
SHA512 b6bc101b2d6b7919a49f22e8ae90c0c8113ec347a755ecb16bf7ee6347266be9a2876df247ad7f6d504afda649962a18d43f1e34694091cc9aac8984852597b3
SSDEEP 192:poCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7/Ydf52e2RUylZylb8MxvA:V9iIxuERzA83h09RZxY7/Ydf6rTrMTtc
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp7FFD.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7FFD.tmp.bat
Size 153B
SHA256 1e241a770da5f6d23686da9660424bcd7d227d8b07269816eee9d5391c88631e
MD5 37fbcccac6c3e8d178a40b0c5b62e758
SHA1 ccdee8bacaa8a4acaa10fe75ef84b7817e903728
SHA512 43d12bec941859c97181d61247f7a453add3638e98e1ede335319049b7a91847e1f77b6e7f17947c1668a0c65aa9ffb2d23122022f32a8d58c0f4e54220779e5
MD5 SHA1 SHA512

Submit Download

Visual Protector.exe

Path C:\Users\Admin\AppData\Local\Visual Protector.exe
Size 918KB
SHA256 e951ba4ae0d7057f76be784018b5a6d654fd712ba612ba64ddf992e8b1772a4d
MD5 e66560e9fbefd68d816e7c3589a2445d
SHA1 984a14b2ce1267986c0d042382917030afd2c210
SHA512 79976980f123d6abb8531788985ce311dfec421df9b6e3de04de3e01efa4ad2636ce052cb24c22db2220131440ee1a1f20f58b9e079c6a19e4396c830672e57c
SSDEEP 12288:DyzIAeFz70Rm8YRvT9b1jDA94BiOT2F/KmNPCL6I3NQiCgFdmHqFqiKgLrykMw1V:DVLom8Ixb1DA9e4F/Kn6EQwmHmOgL2k
MD5 SHA1 SHA512 SSDEEP

Submit Download

VisualProtector.lnk

Path C:\Users\Admin\Desktop\VisualProtector.lnk
Size 1KB
SHA256 ad7bcedb52310ec8902326ec056c0c19af8a7152aa3a5d215524b4be71abdf04
MD5 bd6b117a21b0062326d9d3248984307b
SHA1 85d810a055b1e600d258d6604c93ec0f097c8f7d
SHA512 5501f3d311d92528f06160c0d0e7616fbb6e2f978b247af409472dcef01d7d28460c92cf77d371857678609e160fc89e711036d1f6ed9859802952773cb757c4
MD5 SHA1 SHA512

Submit Download

memory/1424-167-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/1424-166-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/1424-141-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Download

memory/1424-140-0x0000000005000000-0x0000000005010000-memory.dmp

Download

memory/1424-123-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/1836-101-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/1836-65-0x0000000005700000-0x0000000005710000-memory.dmp

Download

memory/1836-35-0x0000000000DD0000-0x0000000000DE6000-memory.dmp

Download

memory/1836-36-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/3724-133-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/3724-58-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/3724-59-0x0000000009F80000-0x000000000A524000-memory.dmp

Download

memory/3724-60-0x00000000052E0000-0x0000000005372000-memory.dmp

Download

memory/3724-66-0x00000000052A0000-0x00000000052AA000-memory.dmp

Download

memory/3724-38-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/3724-69-0x0000000005520000-0x0000000005576000-memory.dmp

Download

memory/3724-57-0x0000000009930000-0x00000000099CC000-memory.dmp

Download

memory/3724-37-0x0000000000820000-0x000000000090E000-memory.dmp

Download

memory/3724-50-0x0000000007660000-0x000000000772C000-memory.dmp

Download

memory/3724-82-0x00000000052D0000-0x00000000052E0000-memory.dmp

Download

memory/4244-29-0x00007FFE10EF0000-0x00007FFE119B1000-memory.dmp

Download

memory/4244-0-0x00000000001F0000-0x00000000002F8000-memory.dmp

Download

memory/4244-2-0x00007FFE10EF0000-0x00007FFE119B1000-memory.dmp

Download

memory/4412-96-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/4412-113-0x0000000006D70000-0x0000000006E5E000-memory.dmp

Download

memory/4412-165-0x0000000074450000-0x0000000074C00000-memory.dmp

Download

memory/4412-103-0x0000000005660000-0x0000000005670000-memory.dmp

Download