Malware Analysis Report

2024-10-23 19:25

Sample ID 240524-x5frwagc6w
Target Client.exe
SHA256 e13360fe12492ad8b6f72d8cbd0969cfab0003e9898d13afe1c5de7bbb143b1f
Tags
rat client asyncrat evasion
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e13360fe12492ad8b6f72d8cbd0969cfab0003e9898d13afe1c5de7bbb143b1f

Threat Level: Known bad

The file Client.exe was found to be: Known bad.

Malicious Activity Summary

rat client asyncrat evasion

Asyncrat family

AsyncRat

Async RAT payload

Grants admin privileges

Modifies Windows Firewall

Launches sc.exe

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Delays execution with timeout.exe

Collects information from the system

Enumerates processes with tasklist

Gathers network information

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Gathers system information

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-24 19:25

Signatures

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Asyncrat family

asyncrat

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-24 19:25

Reported

2024-05-24 19:31

Platform

win10-20240404-en

Max time kernel

194s

Max time network

258s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

Signatures

AsyncRat

rat asyncrat

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2676 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\system32\cmd.exe
PID 2676 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\system32\cmd.exe
PID 1164 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 1164 wrote to memory of 2640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Client.exe

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp351B.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 uk2.localto.net udp
GB 140.238.91.110:3793 uk2.localto.net tcp
US 8.8.8.8:53 110.91.238.140.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 52.111.227.14:443 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.73.42.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
GB 140.238.91.110:3793 uk2.localto.net tcp

Files

memory/2676-0-0x0000000000650000-0x0000000000666000-memory.dmp

memory/2676-1-0x00007FFA5EE13000-0x00007FFA5EE14000-memory.dmp

memory/2676-2-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

memory/2676-3-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

memory/2676-6-0x00007FFA5EE13000-0x00007FFA5EE14000-memory.dmp

memory/2676-7-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

memory/2676-8-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

memory/2676-9-0x0000000000CA0000-0x0000000000D16000-memory.dmp

memory/2676-10-0x0000000000C20000-0x0000000000C84000-memory.dmp

memory/2676-11-0x0000000000DC0000-0x0000000000DDE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp351B.tmp.bat

MD5 5f5c76c6b5adc9fe1db4c17ed2dd3687
SHA1 0621ffc0478000440704e9cbfd718dc19bed0381
SHA256 bc963de29c803e5080659affc56f467471f4627e766adf3d5c2fc5fd963c28db
SHA512 80f389d0a185db928f7bc8644ceeae0ff917f80490194aee38924bffb4de4ab68e4a56f00bbca30987031e4afbed969ff954788a108e21ed1aebcadf618df50e

memory/2676-16-0x00007FFA5EE10000-0x00007FFA5F7FC000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-24 19:25

Reported

2024-05-24 19:31

Platform

win10v2004-20240426-en

Max time kernel

190s

Max time network

204s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

Signatures

AsyncRat

rat asyncrat

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4908 wrote to memory of 5672 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\system32\cmd.exe
PID 4908 wrote to memory of 5672 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\system32\cmd.exe
PID 5672 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 5672 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Client.exe

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp14D1.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 uk2.localto.net udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
GB 140.238.91.110:3793 uk2.localto.net tcp
US 8.8.8.8:53 110.91.238.140.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
GB 140.238.91.110:3793 uk2.localto.net tcp

Files

memory/4908-0-0x0000000000E30000-0x0000000000E46000-memory.dmp

memory/4908-1-0x00007FFAA59E3000-0x00007FFAA59E5000-memory.dmp

memory/4908-2-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

memory/4908-3-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

memory/4908-6-0x00007FFAA59E3000-0x00007FFAA59E5000-memory.dmp

memory/4908-7-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

memory/4908-8-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

memory/4908-9-0x000000001C610000-0x000000001C686000-memory.dmp

memory/4908-10-0x000000001C590000-0x000000001C5F4000-memory.dmp

memory/4908-11-0x000000001C5F0000-0x000000001C60E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp14D1.tmp.bat

MD5 b1fc78b505c793156312691a8e171c97
SHA1 bdbda88516aae71eed91222b8c6209546d551c30
SHA256 013dd804880c41442d61a235a887e66bde520dbadceac9116020742c600eab1a
SHA512 118a3286f9843dcad44c918412ee5907bbc746864be2aad832413e87e66b1e6462aeaf9f743f041e5c02ec739867fc7a6dc9e42e5930507b531576c0fd23f5f2

memory/4908-16-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-24 19:25

Reported

2024-05-24 19:30

Platform

win11-20240508-en

Max time kernel

187s

Max time network

202s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

Signatures

AsyncRat

rat asyncrat

Grants admin privileges

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A

Collects information from the system

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\NETSTAT.EXE N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3468 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\cmd.exe
PID 3468 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\cmd.exe
PID 3468 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\cmd.exe
PID 3468 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\SYSTEM32\cmd.exe
PID 4236 wrote to memory of 3776 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4236 wrote to memory of 3776 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4236 wrote to memory of 4968 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\HOSTNAME.EXE
PID 4236 wrote to memory of 4968 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\HOSTNAME.EXE
PID 4236 wrote to memory of 3936 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4236 wrote to memory of 3936 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4236 wrote to memory of 4576 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 4236 wrote to memory of 4576 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 4576 wrote to memory of 4040 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4576 wrote to memory of 4040 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4236 wrote to memory of 3884 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\query.exe
PID 4236 wrote to memory of 3884 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\query.exe
PID 3884 wrote to memory of 3552 N/A C:\Windows\system32\query.exe C:\Windows\system32\quser.exe
PID 3884 wrote to memory of 3552 N/A C:\Windows\system32\query.exe C:\Windows\system32\quser.exe
PID 4236 wrote to memory of 2388 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 4236 wrote to memory of 2388 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 2388 wrote to memory of 3368 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2388 wrote to memory of 3368 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4236 wrote to memory of 2680 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 4236 wrote to memory of 2680 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 2680 wrote to memory of 2184 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 2680 wrote to memory of 2184 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4236 wrote to memory of 404 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 4236 wrote to memory of 404 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 404 wrote to memory of 1916 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 404 wrote to memory of 1916 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4236 wrote to memory of 748 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 4236 wrote to memory of 748 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\net.exe
PID 748 wrote to memory of 5020 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 748 wrote to memory of 5020 N/A C:\Windows\system32\net.exe C:\Windows\system32\net1.exe
PID 4236 wrote to memory of 3320 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4236 wrote to memory of 3320 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4236 wrote to memory of 5004 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4236 wrote to memory of 5004 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4236 wrote to memory of 3680 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 4236 wrote to memory of 3680 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 4236 wrote to memory of 2656 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ROUTE.EXE
PID 4236 wrote to memory of 2656 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ROUTE.EXE
PID 4236 wrote to memory of 2688 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ARP.EXE
PID 4236 wrote to memory of 2688 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ARP.EXE
PID 4236 wrote to memory of 4428 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\NETSTAT.EXE
PID 4236 wrote to memory of 4428 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\NETSTAT.EXE
PID 4236 wrote to memory of 1432 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\sc.exe
PID 4236 wrote to memory of 1432 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\sc.exe
PID 4236 wrote to memory of 1188 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 4236 wrote to memory of 1188 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 4236 wrote to memory of 2360 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 4236 wrote to memory of 2360 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 3468 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\system32\cmd.exe
PID 3468 wrote to memory of 2344 N/A C:\Users\Admin\AppData\Local\Temp\Client.exe C:\Windows\system32\cmd.exe
PID 2344 wrote to memory of 1528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 2344 wrote to memory of 1528 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Client.exe

"C:\Users\Admin\AppData\Local\Temp\Client.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd"

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe"

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\system32\HOSTNAME.EXE

hostname

C:\Windows\System32\Wbem\WMIC.exe

wmic logicaldisk get caption,description,providername

C:\Windows\system32\net.exe

net user

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user

C:\Windows\system32\query.exe

query user

C:\Windows\system32\quser.exe

"C:\Windows\system32\quser.exe"

C:\Windows\system32\net.exe

net localgroup

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup

C:\Windows\system32\net.exe

net localgroup administrators

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 localgroup administrators

C:\Windows\system32\net.exe

net user guest

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user guest

C:\Windows\system32\net.exe

net user administrator

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 user administrator

C:\Windows\System32\Wbem\WMIC.exe

wmic startup get caption,command

C:\Windows\system32\tasklist.exe

tasklist /svc

C:\Windows\system32\ipconfig.exe

ipconfig /all

C:\Windows\system32\ROUTE.EXE

route print

C:\Windows\system32\ARP.EXE

arp -a

C:\Windows\system32\NETSTAT.EXE

netstat -ano

C:\Windows\system32\sc.exe

sc query type= service state= all

C:\Windows\system32\netsh.exe

netsh firewall show state

C:\Windows\system32\netsh.exe

netsh firewall show config

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3C20.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
GB 140.238.91.110:3793 uk2.localto.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
GB 140.238.91.110:3793 uk2.localto.net tcp
GB 140.238.91.110:3793 uk2.localto.net tcp
GB 140.238.91.110:3793 uk2.localto.net tcp
GB 140.238.91.110:3793 uk2.localto.net tcp
GB 140.238.91.110:3793 uk2.localto.net tcp

Files

memory/3468-0-0x00007FFA51183000-0x00007FFA51185000-memory.dmp

memory/3468-1-0x0000000000790000-0x00000000007A6000-memory.dmp

memory/3468-2-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/3468-3-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/3468-6-0x00007FFA51183000-0x00007FFA51185000-memory.dmp

memory/3468-7-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/3468-8-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp

memory/3468-9-0x000000001D4F0000-0x000000001D566000-memory.dmp

memory/3468-10-0x000000001D470000-0x000000001D48C000-memory.dmp

memory/3468-11-0x000000001D4B0000-0x000000001D4CE000-memory.dmp

memory/3468-12-0x0000000000F60000-0x0000000000F70000-memory.dmp

memory/3468-13-0x0000000000F90000-0x0000000000FA0000-memory.dmp

memory/3468-14-0x0000000000FA0000-0x0000000000FAE000-memory.dmp

\??\PIPE\lsarpc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3468-17-0x0000000000FB0000-0x0000000001014000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp3C20.tmp.bat

MD5 d3aa54ce507f6fccf97d8993a4933dad
SHA1 38ecdedf3f188c40fb4896418176699dcd0784db
SHA256 3b0d0d89ac3d0225248c866fbbee48c150cffff558fa5f7b3fee7bfa40b18afa
SHA512 d189b4bf06f99a3e19a3a4e06ea27c00d691695d1dcd0664ba90dfbd83596673c694daa1eeb6c15ba80deeacebd7a95add7432d965246a403d40357397944b57

memory/3468-22-0x00007FFA51180000-0x00007FFA51C42000-memory.dmp