asyncrat | hxxps://gofile[.]io/d/KEV47c

Analysis

max time kernel
150s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://gofile.io/d/KEV47c

Score

10^/10

asyncrat default discovery rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

127.0.0.1:9090

Mutex

bkakapljwrkmxi

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeRATDONTRUN.exe

pid	process
4448	msedge.exe
4448	msedge.exe
2960	msedge.exe
2960	msedge.exe
2788	identity_helper.exe
2788	identity_helper.exe
968	msedge.exe
968	msedge.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe
444	RATDONTRUN.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2960 msedge.exe
2960 msedge.exe
2960 msedge.exe
2960 msedge.exe
2960 msedge.exe
2960 msedge.exe
2960 msedge.exe
2960 msedge.exe
2960 msedge.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

RATDONTRUN.exeRATDONTRUN.exe

description pid process

Token: SeDebugPrivilege 444 RATDONTRUN.exe
Token: SeDebugPrivilege 464 RATDONTRUN.exe

description	pid	process
Token: SeDebugPrivilege	444	RATDONTRUN.exe
Token: SeDebugPrivilege	464	RATDONTRUN.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

msedge.exe

pid	process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RATDONTRUN.exe

pid process

444 RATDONTRUN.exe

pid	process
444	RATDONTRUN.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2960 wrote to memory of 4456	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 4456	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 1208	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 4448	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 4448	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe
PID 2960 wrote to memory of 2688	2960	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gofile.io/d/KEV47c
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff849ee46f8,0x7ff849ee4708,0x7ff849ee4718
2⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
2⤵
PID:1208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
2⤵
PID:1352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
2⤵
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
2⤵
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
2⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
2⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
2⤵
PID:3060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
2⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
2⤵
PID:1792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
2⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4804 /prefetch:8
2⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
2⤵
PID:2204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,10871643492548579190,6460850780587972815,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 /prefetch:2
2⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3420

C:\Users\Admin\AppData\Local\Temp\Temp1_RATDONTRUN.zip\RATDONTRUN.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_RATDONTRUN.zip\RATDONTRUN.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:444

C:\Users\Admin\Downloads\RATDONTRUN\RATDONTRUN.exe
"C:\Users\Admin\Downloads\RATDONTRUN\RATDONTRUN.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
f81236f74aa55bc1c5e17778982b7c98

SHA1
f626146d8525d053e4bf1759dfde4981a0ac48e4

SHA256
22df86ae6abc874182e8d59ca1426adaa238a26fc27d19cb81e8251ab7a806b7

SHA512
49a239b0b34527c08c221e9d590a658329352233870a6872238c499f109aba4b2c05188df1f9115698ef9fdecb75d528d43e4dfbf92f99d467763824832f0e0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
391B

MD5
f89a5a8d6bbe6a249da3ec2861c275ec

SHA1
6e04c3bd8a43770afc1711a89ea28fe8353cfe42

SHA256
287e463e9a6bb4d2b6e78e028eaaadc27c4704dceb1d13c8e8549b6266704d94

SHA512
bde7dc3bdfc28b9a9da516e1ecc033a46c811b027460e4b4b62b4b1350b7f55b80786ec20e74ca60091d9ae1591234b88b841945d31d81e41ea4c9d2dbd36914

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cc54c045f9158a04fc7b97b992b3fc05

SHA1
40bbd3550923de10be6024228dd16b9870d5e090

SHA256
1b45bab468d8b0ba357f8649c3607a8c848d8f93dc2ff64ce47a1b163de78524

SHA512
31d5c8240edd87e4d4a15f61a59bb22e5d97bc625473783ed6f145703163659f82ae6cf821588b41f89d9b8d633488437cfbf11bc3f0d6a75617f138216b30f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d6ef1a4e88545059f022fe1b3db4211b

SHA1
5d3b62c7f54832bca6277fd9ddaeeec7fac7059e

SHA256
16b5b6d9da22cbbcccd6d5e6262bac036381e3b1357006f53bfba4ef4f4d0ee1

SHA512
d9de8ce7fc9c5886f49f523389d61177c76b2079e6683c073ce4dc2a709a680202048ac46533f072a03a821fc5a932ac1bb334d6504d0b274cdaa6b6f0bb09c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8ffe92b8b82ea4bdaf38d82a2222a0c

SHA1
51824b148656331c0558ba25df1ec5924e793af8

SHA256
599e0f191ccf1336cbc3990d48897d7571e35793891180a484425337aa18e614

SHA512
b5e503e67f383b32c98010e98b6994122718d27777804d809a6eb80dff8039227238506d4439fc3b48724e38b7d6126ea33b0a4379b9bc0bf4ca0239e51a74ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
015bb5f7d62d8c42f2f2b10815eaae09

SHA1
0a250bf728cf390ce671577aab83a77bf5dd172c

SHA256
5eef6b730fb9eaec335ef2e2068b86f85d2b01c090975714ab266dfaf8cc8aad

SHA512
7859085c3e7b4b84525840ec5e012479df74fcd2603703f22c9e678e262036e8c9f94ce94142b1325cbedc38e05e4f9a1f68ff7500b8eda35bc47311d1748d20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
be8fc9c36fe10fbc32babe6007c1f9e3

SHA1
396c90dadd558f33ee36f36a3cb43693ee1ac5ab

SHA256
930c6d2300aa98526852f0b861233fde9463d1602372b4d6027b4a5701855caf

SHA512
047ddbcc9397ba438745deec64c16eab2bd2ad42334463ac68b1fcd9d1322a4cde16fa561a2f98f97fb7cf568fbd680e481e5453578b9d0fc6c2fc84bafd29d2

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
C:\Users\Admin\Downloads\RATDONTRUN.zip

Filesize
35KB

MD5
311c7ec39849e7aa5c9448cfba26b0c6

SHA1
48ed64367e8600f0dad872430e9c04554251bb9a

SHA256
16009984db9084e3c8b090b724ec78c1682577e76d714c14e7a525e9a8a6a4b7

SHA512
7907ab9c6211aea783f5643e4ad8e3c247562fd92af20490c8317476dea1a5b4ab3238e6c2fdea68e44e9dafead0eb4ecaabac710c7b6b0b28e89d8d196f4561

Download Submit
\??\pipe\LOCAL\crashpad_2960_MGYIGEHSWIZXXSZJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/444-115-0x0000000000C70000-0x0000000000C88000-memory.dmp

Filesize
96KB

Download