asyncrat | 821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe
Size 1.2MB
Sample240405-bv5glahb39
SHA256 821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1
MD5 a8884d5c23826a156a79a2e40ddbc10f
SHA1 17ba269221f5e728a768f0e19bd1acf8759f44ac
SHA512 8f14f18e84aac4643655994e6d11d1c166607beadbecc9cc969afa0a5e5881df4cf3c74c77f1de092240369e0922da52574108a358b04a3043d450a77191fedd
SSDEEP 1536:67ja7Fg3dR05lpUFpILxwr1088AEUHXTit6oAfMOnYZm/ZMp+E1U793K7nadtU4s:6QiRGpUcwrXLEKXTToMMIYU60gqtU4s
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat rat15 rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

RAT15

darkstorm275991.ddns.net:6606
darkstorm275991.ddns.net:7707
darkstorm275991.ddns.net:8808
mrreport.duckdns.org:6606
mrreport.duckdns.org:7707
mrreport.duckdns.org:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
Windows Session Manager.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000d000000023157-6.dat	family_asyncrat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023157-6.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4916-29-0x00000000003A0000-0x00000000003B6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects file containing reversed ASEP Autorun registry keys 2 IoCs

resource	yara_rule
behavioral2/files/0x000d000000023157-6.dat	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse
behavioral2/memory/4916-29-0x00000000003A0000-0x00000000003B6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	Windows Session Manage.exe

Executes dropped EXE 3 IoCs

pid	Process
4916	Windows Session Manage.exe
4480	Windows Session Manager.exe
5112	Windows Session Manager.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4844	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4952	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
4916	Windows Session Manage.exe
2932	identity_helper.exe
2932	identity_helper.exe
5112	Windows Session Manager.exe
5112	Windows Session Manager.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	Windows Session Manage.exe
Token: SeDebugPrivilege	5112	Windows Session Manager.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5112	Windows Session Manager.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 4916	4428	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	86
PID 4428 wrote to memory of 4916	4428	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	86
PID 4428 wrote to memory of 4916	4428	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	86
PID 4428 wrote to memory of 4480	4428	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	87
PID 4428 wrote to memory of 4480	4428	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	87
PID 4428 wrote to memory of 4480	4428	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	87
PID 4428 wrote to memory of 3224	4428	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	89
PID 4428 wrote to memory of 3224	4428	821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe	89
PID 3224 wrote to memory of 2336	3224	msedge.exe	90
PID 3224 wrote to memory of 2336	3224	msedge.exe	90
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 1068	3224	msedge.exe	93
PID 3224 wrote to memory of 2624	3224	msedge.exe	94
PID 3224 wrote to memory of 2624	3224	msedge.exe	94
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95
PID 3224 wrote to memory of 2484	3224	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe
"C:\Users\Admin\AppData\Local\Temp\821900f5cf0981a062d0683d5a5905ce407a035d9e0ab7ee0bd110a7403321d1.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Windows Session Manage.exe
  "C:\Users\Admin\AppData\Local\Windows Session Manage.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"' & exit
    3⤵
    PID:4880
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Windows Session Manager" /tr '"C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"'
      4⤵
      Creates scheduled task(s)
      PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4825.tmp.bat""
    3⤵
    PID:3916
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4952
  - - C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe
      "C:\Users\Admin\AppData\Roaming\Windows Session Manager.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5112
- C:\Users\Admin\AppData\Local\Windows Session Manager.exe
  "C:\Users\Admin\AppData\Local\Windows Session Manager.exe"
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Private_Hacking_Cracking_Tools
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2d7446f8,0x7ffd2d744708,0x7ffd2d744718
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    PID:2588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
    3⤵
    PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:3320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15567117846154429492,12903113840710619430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2428 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Windows Session Manager.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Windows Session Manager.exe.log
Size 226B
SHA256 7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
MD5 916851e072fbabc4796d8916c5131092
SHA1 d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA512 07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932
MD5 279e783b0129b64a8529800a88fbf1ee
SHA1 204c62ec8cef8467e5729cad52adae293178744f
SHA512 32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e
MD5 cbec32729772aa6c576e97df4fef48f5
SHA1 6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba
SHA512 425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 2fb7af1be03ef9921359a415b3acfa9d6d7d61974fef854af5b6dce4a231ba22
MD5 aefeca50e91fa99402aef0e504499449
SHA1 307565651812ca774f2fa6153b80f2e1dc796f8b
SHA512 9eabad4aab72433c0742aa6a9b60d02648f3488ed3b5620883a512135e4e1bd3f58ab856f978c53813d684adb01a20333fb04f07f7f63c6f0b178446923d4a29
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 442B
SHA256 f6a28771a821e4ca9a68a08867f16b5d83925de817008140709a75ca9682fab7
MD5 97dec600ddd8c06f4cecae8c149300a0
SHA1 40b4df571592befddb5b2487b8c734cbf1e927cb
SHA512 2db9e2b1991cf0290c57af9b935a5e2f2c68a8415b6c451f25111fa81f5597894de4393220fcac24b90146c4de9ee17849e9742ecafb4b7a41d428e6da865848
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0082bb3ad06e8a17dbd538bf4236448736c0e8702614c68ef0812026ae5a36a9
MD5 7b4e8070be79bbfb347054f15583a1fc
SHA1 ef8774958bd5a31dbfcd2650f22b9fe765ff1c4b
SHA512 47a3524a79185247a635f0a6f275146cfe69753386d9fde5e203fb90ea3791191b7d8c3a0ad5dc8f94e71a826fd7c9202a627fba3b8fc930924319e64b932e99
SSDEEP 96:nVkQs1/mwpvWMoiVmdeHcmhUWQyV+VD7ziEwb:nVk5JmGWMXhrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 62a95848a4f9c5091b8a2fe525333400343f8c6a57dd2c2072eb896d0057e107
MD5 d730e76fc20a5bd4b198539d52710b51
SHA1 0ad95361c1295b269a1cad9eb1b126e78d5f6478
SHA512 64de688152b6c5bdb50b3efc9a95248dfbc57d6feb457ed4267a5bdee661c6e1568a0ef0ec9e98d605878ec2280b84d885419bf23fd6ee6f47c52eee3c809fb1
SSDEEP 96:nVkrs1/mwpvWMoiVmdeiud1jcDhUWQyV+VD7AiEwb:nVkIJmGWMSudhMrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7005fd586ba351e73d62bbd71fb30e4df85a71b71da86ec455150823ba3e513b
MD5 a8896e62f4380462109607e58a024e36
SHA1 4140bdcaa75c0595c35c381db8514e141cfaa678
SHA512 50153bee8c2c1e9614cc18905df86e77b4bd1399e4b3798d0b5f28cb108c869327da26141211148afd4ba7c8c6e4246c1ffd1e3a9383e8e9227b1e25485e1cd3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupARVe2RUXx5b9wxvFt2pTEU:A9iIxuERzA83h09RZxYARRAwTt2h3CoR
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp4825.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4825.tmp.bat
Size 167B
SHA256 1be6360a965b3e6372fd63c4229966318b5e60eee691803350a781c8c59fb85f
MD5 02be3919141b1370ff9699a0bda57132
SHA1 a03e11872b3237a31f1a2ab4b4b45aa0b3323807
SHA512 618505a547829ba74430aaf531b68eb4578cd12a2eeb89a652409182c13221e948ef6ae73f39dd61934c1b595c5919dc53390a1f0e059c0476a8514b67ef2c48
MD5 SHA1 SHA512

Submit Download

Windows Session Manage.exe

Path C:\Users\Admin\AppData\Local\Windows Session Manage.exe
Size 66KB
SHA256 5732891fc200a9a59fdf3b2f96d5977152d1b76eb7220c8fcb28fc476945cddc
MD5 0dda2fcee8bec9941a9cf9c5bd866f10
SHA1 29dba01814ef258f12fc06f9771f8e795e0337af
SHA512 030eee3ec291fe9a5bf7b6ab1155a853eec01dc13b7319e198872c3af8826f084dda7c60955daf5e893515a528485fadf62e1ad404060b664cecddb0093ed362
SSDEEP 1536:42MX66CQkCANKu/UYF9VCFCfn2W4bpfbPkgZIcrPlTGRG:42I66CQk7Ku/UYFOEd4bpzsgZIcdqG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Session Manager.exe

Path C:\Users\Admin\AppData\Local\Windows Session Manager.exe
Size 5KB
SHA256 f5a031207da80580fd8a2f853f4026bec68e7acddb9bbdb7b586ede6cc643d3b
MD5 0200bc51a30cbce0876330588b6dedc7
SHA1 0f905add671396719246bd2d1874bc64ccf73819
SHA512 549bd875dbcf59cbe93b3a594d2124f0a463f7676ca4393c6d54e466133b8e579dfa28290f360d62854f62ec22ec34a02d7103242eb94a899f1ce84755b1bd8c
SSDEEP 48:60v0HSz3phKEwQNM0+s8TuNNCH1VPtKbDGZYtB8/zlC/yh/WB/WFTpfbNtm:GgGE1+Vu4VPtKviz2yp2kzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4428-2-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

Download

memory/4428-34-0x00007FFD30870000-0x00007FFD31331000-memory.dmp

Download

memory/4428-0-0x0000000000290000-0x00000000002B0000-memory.dmp

Download

memory/4480-30-0x0000000000750000-0x0000000000758000-memory.dmp

Download

memory/4480-42-0x0000000074830000-0x0000000074FE0000-memory.dmp

Download

memory/4480-33-0x0000000074830000-0x0000000074FE0000-memory.dmp

Download

memory/4916-87-0x0000000074830000-0x0000000074FE0000-memory.dmp

Download

memory/4916-82-0x0000000004BF0000-0x0000000004C8C000-memory.dmp

Download

memory/4916-79-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Download

memory/4916-29-0x00000000003A0000-0x00000000003B6000-memory.dmp

Download

memory/4916-31-0x0000000074830000-0x0000000074FE0000-memory.dmp

Download

memory/5112-106-0x0000000005900000-0x0000000005910000-memory.dmp

Download

memory/5112-101-0x0000000074830000-0x0000000074FE0000-memory.dmp

Download

memory/5112-121-0x00000000060C0000-0x0000000006664000-memory.dmp

Download

memory/5112-122-0x0000000005CB0000-0x0000000005D42000-memory.dmp

Download

memory/5112-123-0x0000000005C50000-0x0000000005C5A000-memory.dmp

Download

memory/5112-131-0x0000000005DC0000-0x0000000005E26000-memory.dmp

Download

memory/5112-146-0x0000000074830000-0x0000000074FE0000-memory.dmp

Download

memory/5112-147-0x0000000005900000-0x0000000005910000-memory.dmp

Download