asyncrat | hxxps://mega[.]nz/file/qKZwlZYT#s7jCybOC6dPKwUdHm3qyaSFckiBCMQuX_B6bVo-YcLU

Analysis

max time kernel
87s
max time network
83s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 22:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/qKZwlZYT#s7jCybOC6dPKwUdHm3qyaSFckiBCMQuX_B6bVo-YcLU

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

127.0.0.1:9001

91.92.254.89:4449

91.92.254.89:9001

Mutex

fefewfewfewf

Attributes

delay
1
install
true
install_file
Realltek Audio Service 86x.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000700000002355b-190.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	Password Bruteforcer.exe

Executes dropped EXE 5 IoCs

pid	Process
5328	Password Bruteforcer.exe
5936	Realltek Audio Service 86x.exe
3740	Password Bruteforcer.exe
5228	Password Bruteforcer.exe
5208	Password Bruteforcer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5612	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 467401.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
4384	msedge.exe
4384	msedge.exe
4624	identity_helper.exe
4624	identity_helper.exe
5208	msedge.exe
5208	msedge.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5328	Password Bruteforcer.exe
5936	Realltek Audio Service 86x.exe
5936	Realltek Audio Service 86x.exe
5936	Realltek Audio Service 86x.exe
5936	Realltek Audio Service 86x.exe
5936	Realltek Audio Service 86x.exe
5936	Realltek Audio Service 86x.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	4312	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4312	AUDIODG.EXE
Token: SeDebugPrivilege	5328	Password Bruteforcer.exe
Token: SeDebugPrivilege	5936	Realltek Audio Service 86x.exe
Token: SeDebugPrivilege	3740	Password Bruteforcer.exe
Token: SeDebugPrivilege	5228	Password Bruteforcer.exe
Token: SeDebugPrivilege	5208	Password Bruteforcer.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5936	Realltek Audio Service 86x.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 640	4384	msedge.exe	84
PID 4384 wrote to memory of 640	4384	msedge.exe	84
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 2696	4384	msedge.exe	85
PID 4384 wrote to memory of 3480	4384	msedge.exe	86
PID 4384 wrote to memory of 3480	4384	msedge.exe	86
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87
PID 4384 wrote to memory of 4904	4384	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/qKZwlZYT#s7jCybOC6dPKwUdHm3qyaSFckiBCMQuX_B6bVo-YcLU
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffd24f546f8,0x7ffd24f54708,0x7ffd24f54718
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,6838257163953875570,11324015967227949498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5208
- C:\Users\Admin\Downloads\Password Bruteforcer.exe
  "C:\Users\Admin\Downloads\Password Bruteforcer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5328
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Realltek Audio Service 86x" /tr '"C:\Users\Admin\AppData\Roaming\Realltek Audio Service 86x.exe"' & exit
    3⤵
    PID:5512
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Realltek Audio Service 86x" /tr '"C:\Users\Admin\AppData\Roaming\Realltek Audio Service 86x.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp23FE.tmp.bat""
    3⤵
    PID:5536
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:5612
  - - C:\Users\Admin\AppData\Roaming\Realltek Audio Service 86x.exe
      "C:\Users\Admin\AppData\Roaming\Realltek Audio Service 86x.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d0 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6012

C:\Users\Admin\Downloads\Password Bruteforcer.exe
"C:\Users\Admin\Downloads\Password Bruteforcer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Users\Admin\Downloads\Password Bruteforcer.exe
"C:\Users\Admin\Downloads\Password Bruteforcer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Users\Admin\Downloads\Password Bruteforcer.exe
"C:\Users\Admin\Downloads\Password Bruteforcer.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Password Bruteforcer.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
66212184ee26b9dcefe19632e4b53c68

SHA1
5b42b5c2e80ad713dc0182e2b9331254891dbad2

SHA256
a65d56699129349ef5aff3ce3b6b029b939c72da48f1c48994db4f98832e2d95

SHA512
d23032dcfbdbc850f98a4d24c78215100cd2db3c021571eee149ce5aefad84e2f6c83fe34bb11b1e9e8c8257fb8202dba5e6491ed997bb6b3d7047c25c03dd30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
826191c76e45b84509aa062a06a51deb

SHA1
3f9b390ded195ff925b16489476d9f9f94f08164

SHA256
e0ee0e620e39c605fee689e04db336b7b8a8b50bef6746446b2009de0dc8ba77

SHA512
f9c9d5eaf899713a7cfdb4cb6853b6aebe29fbe2d857ce6692576a262a9fca16841a37a677f818de1dd6544e6d190ec4b5cb7af173801941479467d4eaac2f46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a48354ee4c120e8c3e2f7361da90d22

SHA1
5e9c068a77d87d10686c20bb853f43aadf158dfb

SHA256
7747500646cb9b69a17c6e3b177bb0a1abcfa4dcf97672fcbe3675e084329e70

SHA512
44c22634c84a73733401b5460299ae7da1f484370217aff84ef7525014179d17d18e7aeb9a4f05db3ae3d1424baa79580c22bbf21cdaa4f9d95386e00cc744c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
894f5f59be02c9b8921a55762957edd2

SHA1
04b700eb754a086ad1233205ebae33e8c31a0d04

SHA256
5e339e7844c76cfc0bcd2516e30ada2f7851ef466eaf7a7a38ef5cfa738de1d7

SHA512
e5d7b25ca12d3ad2c818edf385485f7d16fe9c801c737456669305522a96bd118113f1efff28a81b529adb99030feff3dd8876c48af23676d48616fb70e3be2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
c16bc7f15433209e04a6dbbfa8f2aae7

SHA1
6e07b97bc915dd89305adedab5ad324759ec4f57

SHA256
eb8a021d5045c999fd76f73dacb93f5a8adc2864b3874d8426b323de0380da28

SHA512
292626e8bee0ac9024f90bdd78d88e15118743e00571cc7fdc6f34479ba9cb59b4c0a5c571901ef8ce3d94819edcf69beea55d163981e2d2a9143c284ef62485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57fafa.TMP

Filesize
48B

MD5
1d590664898d898f82fcee916b04fe23

SHA1
8b3f67f24cdeb96cac169b8b93d475151e97f468

SHA256
8ac096b3d28b944893b2b3a6eaed3ef6f50215b0f2d86f50a5940fce31126540

SHA512
c8eddcf58fc5dc1bc16fb3bb92e2233c12f16418a6d97e90c466a5498c34235ced5602de50c01534f5262e62fefa1ab2f0e2909fd22f727c706a76a41a48d91d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
aa1b58e4fdcaa6fe575d288f96eccfae

SHA1
4eba60654f69ec2ba9aa7fa636c155b77e1ca3c3

SHA256
23c3f4040f239c7b8145d4eb3852c2c13afb395a6f0091d1d9caf9d78cb2f8b2

SHA512
e0afbe471e64e05d40520533a74e4d2c9650fd932b1fa106ec20dd20cd75bf80806fe8ed557972fab401257fe1a0baf1d3a8264809deb9cdaffcfc195c90cbe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2f4c19bb75483387e39551cb09478ca0

SHA1
208da76ed5f3c9e5ee0e1b1d6f43251807b312c3

SHA256
f498c72e94864257e35124037c7593c9cadba23f4ea9203d0806e0b3e22e1269

SHA512
9c87193c096300b8cdaa4b16a4d6bd7a0df0f89c5cf3ca9b564e38420310a8c34773acc64a2a9e7d211733523898d9f71b756e7f7d815f911574111bfd097a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp23FE.tmp.bat

Filesize
170B

MD5
2718d176bfe489232d3f3d925af0cb7c

SHA1
7811ef12bb5d51feb9cbdf140f4fe423b097c215

SHA256
84d6f4c97cc730b40527f4c64e209cc8f068b3db675ac967e72e9a665600bb45

SHA512
eb7afede09961b8c97c17c9b133315d5dd866877826feecc05008baf172ffc6229f6569a9490e1bb704025757a761fc96d1b969f803fe6715ba6b86b72714f0b

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
C:\Users\Admin\Downloads\Password Bruteforcer.exe

Filesize
82KB

MD5
401cdb3441eaa85c7d5d85b8cfe0fe54

SHA1
6bbb659c5c2b30c24313efa7a3775b78cbf385c5

SHA256
f1cf79e0ebbb693d10ca8b96d6c6aae0176c3a3417512bacaf0016207e60492d

SHA512
fb70afc7e5a382b3970cf92feaa12c4cfeba7a7dbca0d0f8736b5a38c0e4c42204cf4975081eab940524332fd3067bc4d5da053b55e71f983e01bc20454822bf

Download Submit
memory/5328-204-0x00000000001F0000-0x000000000020A000-memory.dmp

Filesize
104KB

Download