asyncrat | e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096

Analysis

max time kernel
147s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe
Size

807KB
MD5

4b8e7f6468b4a846bfef152f20ad625c
SHA1

de6aba8a287228b428e40decb325c45fbe66c1ee
SHA256

e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096
SHA512

3280848a0fc1bfb29a0ed5e1a913f04d463a8b06039e02b5c88230ab5717059e0f1cb974d0bdb86643595b0640c16dbcf14e10eaf44b0bd1204b9375f9a58f80
SSDEEP

6144:iSncRl5sSeGlR9o1Re8XN6W8mmHPtppXPSi9b4fcSncRlrBoLp7ua9Q:P4IGlR9o1RrN6qatppXPm4RBYEa

Score

10^/10

asyncrat stormkitty default discovery persistence privilege_escalation rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7557878970:AAGK-77Z__cCdoMjeFBTGoWLVAg2XPHco-I/sendMessage?chat_id=8178371083

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b79-14.dat	family_stormkitty
behavioral2/memory/4676-32-0x00000000001D0000-0x0000000000200000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000a000000023b79-14.dat	family_asyncrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe

Executes dropped EXE 3 IoCs

pid	Process
3584	PROXYCHECKER-MASTERZ8.EXE
4676	SERVER BOT.EXE
2308	TELEGRAM_ CONTACT @AMRNET1VIP1.MHTML.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\606d0e5e778be20f338f785186f974b7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	SERVER BOT.EXE
File created	C:\Users\Admin\AppData\Local\606d0e5e778be20f338f785186f974b7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	SERVER BOT.EXE
File created	C:\Users\Admin\AppData\Local\606d0e5e778be20f338f785186f974b7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	SERVER BOT.EXE
File opened for modification	C:\Users\Admin\AppData\Local\606d0e5e778be20f338f785186f974b7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	SERVER BOT.EXE
File created	C:\Users\Admin\AppData\Local\606d0e5e778be20f338f785186f974b7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	SERVER BOT.EXE
File created	C:\Users\Admin\AppData\Local\606d0e5e778be20f338f785186f974b7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	SERVER BOT.EXE
File created	C:\Users\Admin\AppData\Local\606d0e5e778be20f338f785186f974b7\Admin@HGNBWBGW_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	SERVER BOT.EXE

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PROXYCHECKER-MASTERZ8.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVER BOT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TELEGRAM_ CONTACT @AMRNET1VIP1.MHTML.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3980	cmd.exe
4472	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	SERVER BOT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SERVER BOT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
4556	msedge.exe
4556	msedge.exe
1984	identity_helper.exe
1984	identity_helper.exe
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
4676	SERVER BOT.EXE
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe
5048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	SERVER BOT.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3584	1100	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe	82
PID 1100 wrote to memory of 3584	1100	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe	82
PID 1100 wrote to memory of 3584	1100	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe	82
PID 1100 wrote to memory of 4676	1100	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe	83
PID 1100 wrote to memory of 4676	1100	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe	83
PID 1100 wrote to memory of 4676	1100	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe	83
PID 1100 wrote to memory of 2308	1100	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe	85
PID 1100 wrote to memory of 2308	1100	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe	85
PID 1100 wrote to memory of 2308	1100	e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe	85
PID 2308 wrote to memory of 4556	2308	TELEGRAM_ CONTACT @AMRNET1VIP1.MHTML.EXE	86
PID 2308 wrote to memory of 4556	2308	TELEGRAM_ CONTACT @AMRNET1VIP1.MHTML.EXE	86
PID 4556 wrote to memory of 4456	4556	msedge.exe	87
PID 4556 wrote to memory of 4456	4556	msedge.exe	87
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 4968	4556	msedge.exe	88
PID 4556 wrote to memory of 3944	4556	msedge.exe	89
PID 4556 wrote to memory of 3944	4556	msedge.exe	89
PID 4556 wrote to memory of 3904	4556	msedge.exe	90
PID 4556 wrote to memory of 3904	4556	msedge.exe	90
PID 4556 wrote to memory of 3904	4556	msedge.exe	90
PID 4556 wrote to memory of 3904	4556	msedge.exe	90
PID 4556 wrote to memory of 3904	4556	msedge.exe	90
PID 4556 wrote to memory of 3904	4556	msedge.exe	90
PID 4556 wrote to memory of 3904	4556	msedge.exe	90
PID 4556 wrote to memory of 3904	4556	msedge.exe	90
PID 4556 wrote to memory of 3904	4556	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe
"C:\Users\Admin\AppData\Local\Temp\e88ccd1e7f73f9371fbc1347e0fca0cf902fff7c3cb0c9ea1a71714135af7096.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\PROXYCHECKER-MASTERZ8.EXE
  "C:\Users\Admin\AppData\Local\Temp\PROXYCHECKER-MASTERZ8.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3584
- C:\Users\Admin\AppData\Local\Temp\SERVER BOT.EXE
  "C:\Users\Admin\AppData\Local\Temp\SERVER BOT.EXE"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3980
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2240
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4472
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    PID:956
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:748
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3556
- C:\Users\Admin\AppData\Local\Temp\TELEGRAM_ CONTACT @AMRNET1VIP1.MHTML.EXE
  "C:\Users\Admin\AppData\Local\Temp\TELEGRAM_ CONTACT @AMRNET1VIP1.MHTML.EXE"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\TELEGRAM_ CONTACT @AMRNET1VIP1.MHTML
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c2046f8,0x7ffa5c204708,0x7ffa5c204718
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
      4⤵
      PID:2188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,694903570503348044,3489928401884038544,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\606d0e5e778be20f338f785186f974b7\Admin@HGNBWBGW_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\606d0e5e778be20f338f785186f974b7\Admin@HGNBWBGW_en-US\System\Process.txt

Filesize
4KB

MD5
4abe5f1ab825ef152064e547506e6832

SHA1
d80bc8cc60e8f5b226183eebe25438337b3bb669

SHA256
4aaf3b8c7de29998a70520e97647218cb1939172e3265e46586865e2f9e4115a

SHA512
e1a9c7323176869d0d9d151fa84b37a08071805b0f4860b45840518de8efaabb4413c449e4e5333d50e2b14f6e85d24092fef4fea472d4ba59c4a290aa375986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
124KB

MD5
0e4093110a1df64b8524481594a220e5

SHA1
3f85530bb7c8abed51c910b5c5a9a37ad3e9586b

SHA256
3346e371cb24ee50f5aa80bc872ce8576c31bdce85d183208b85d88dd7dcecac

SHA512
8348e8cf7a47698806f08f9472b37b6f667d3c0363615fcfdf43c95f1972e71fe6032d6e0febdfb74bc1923607f1c757eb9b5af547d3fb1ca09acd85a968a7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c5c14beadcfa594bd95f4911373689fb

SHA1
1638e0d675b64236369b7caf92eb8a7cec442dba

SHA256
57af3dd8b91b499b11615402ddcd9dc5f312308e27a0435c1a7a7250a6635a57

SHA512
92158810e153fcb4c60d412c4d668eeb26b28293d117c63b2cd08d31ff8a85fbaff62492452364ed18a831e50d668890fa87698ae767404be271a97cea400844

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
534cbda1caf0667b1ab4fd754e7fe45d

SHA1
cec041e670e48965d20f15cf0182245334f80cdb

SHA256
2b824286131ef64a8c6997e488afd7ca72b5855948fda373151a3ae7fab2f2c3

SHA512
aaaf929773d3c6ea5f6c13bb85b5129c496217938973533b5817f5a24121ef7e75723bc03a61a9dab1350b1514d7309a52a46f1fed5eb69f403558e94b868e65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
21fafe34aad39c3da8b36ff927386297

SHA1
d38e4aa93ce14f5ee510be353fa704716b06e662

SHA256
c1e13704e130db7ad711302a7098671f074ff0f2b2fa5ff3e4987990d7857d59

SHA512
199799d2f4eac579ae1218bc65ff1aa1cd1a7172f3f2489132907ace78a84df565d667c039d07a78db0329671890f13f1262c413092931bc9c4c7c450ba1f74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\PROXYCHECKER-MASTERZ8.EXE

Filesize
65KB

MD5
047b902ab5e9a317eef11e6dcf4cfa8d

SHA1
e4212a9c195b85fd3409cd7dbba80dac9f66abfd

SHA256
e023315bebd54dbf73c6e2e92466edb8cc108e2c8b0658f3762d32447f6fd553

SHA512
900dcbe105b4b899afa9cfa92de0aa37bb05ad11fc425bb53ad6d3ed8dcebc9b6b67e2060fca78bddffb206c34fa5ebfe5fbf20996cfac0cc5aba7b1d5cf48fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\SERVER BOT.EXE

Filesize
170KB

MD5
2e7cb0a4c91b31337f17742a2f73aaf7

SHA1
08b2db3956a4af5671d374f62e753fdbeeb94d36

SHA256
c92ccebe416798a16a22f1f45978df59988b4219d118eb9d2100fabe2eb78c3b

SHA512
7487c1f068a3edf4ae74f08a27fde66888703b3ee5883f88774e477c7b645eff1b6a950354f391239aca82a5cf0b9d28a1ad8adbac4159cfd92dc31fa34fbcb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\TELEGRAM_ CONTACT @AMRNET1VIP1.MHTML

Filesize
466KB

MD5
f9035161bd488986f5bac378372168cf

SHA1
7e6ceaffefb0529e72c1ded8c3b98230e85e2842

SHA256
17677889889bf300ebceb7b998ffef915ce1d7ae74ba106783afb569c8ec92d4

SHA512
cf1a25f5f728a4145e5f64c0f14f87beb5e6da8de8647330eb9322e9f4f15e0cb9b1f2d3aae72221e8359f747621d273f67755babf04dc8270122c273dd1da85

Download Submit
C:\Users\Admin\AppData\Local\Temp\TELEGRAM_ CONTACT @AMRNET1VIP1.MHTML.EXE

Filesize
519KB

MD5
7c908443c3e7c8713df4d3482adc6a89

SHA1
545145ded60fd817d329062b6df4e12818c530d3

SHA256
f06f72d8206e8476e7bf3261b18d19a6ddd7e02aed0b69cc932c261a9da2b620

SHA512
76d90435d08992ac4343f4b1cb01944f2713dc67691bb7038643fc8b05f73bed75515a4d1000a6e44ad2c2a37508af7128c4e50b8c3064e0786e84099903c951

Download Submit
C:\Users\Admin\AppData\Local\dfb609e2a7ae0b0fab490ff79f15c6f7\msgid.dat

Filesize
4B

MD5
37f65c068b7723cd7809ee2d31d7861c

SHA1
9ec169198ed9589be7ec3b9d9096e8a67edf2980

SHA256
d663eacf96884a69dc0db85e1544feac4a4fc447d838b0e3750b238e12896a83

SHA512
ba031c69ccb62eb32a4b2cd1050e5e30e8a88a67fce2d50278d30a31dfbbb4ecf0c0e4e8fb827628afbd209d15f8a7936a563daed3a432e767ed601775fa903d

Download Submit
memory/3584-35-0x0000000001700000-0x0000000001706000-memory.dmp

Filesize
24KB

Download
memory/3584-83-0x0000000074090000-0x0000000074840000-memory.dmp

Filesize
7.7MB

Download
memory/3584-37-0x0000000074090000-0x0000000074840000-memory.dmp

Filesize
7.7MB

Download
memory/3584-36-0x0000000074090000-0x0000000074840000-memory.dmp

Filesize
7.7MB

Download
memory/3584-33-0x0000000000E90000-0x0000000000EA6000-memory.dmp

Filesize
88KB

Download
memory/4676-80-0x000000007409E000-0x000000007409F000-memory.dmp

Filesize
4KB

Download
memory/4676-69-0x0000000004AA0000-0x0000000004B06000-memory.dmp

Filesize
408KB

Download
memory/4676-32-0x00000000001D0000-0x0000000000200000-memory.dmp

Filesize
192KB

Download
memory/4676-258-0x00000000053C0000-0x0000000005452000-memory.dmp

Filesize
584KB

Download
memory/4676-259-0x0000000005A10000-0x0000000005FB4000-memory.dmp

Filesize
5.6MB

Download
memory/4676-263-0x00000000054E0000-0x00000000054EA000-memory.dmp

Filesize
40KB

Download
memory/4676-31-0x000000007409E000-0x000000007409F000-memory.dmp

Filesize
4KB

Download
memory/4676-278-0x00000000059F0000-0x0000000005A02000-memory.dmp

Filesize
72KB

Download