Overview

overview

10

Static

static

3

Loader.exe

windows7-x64

10

Loader.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    60s
  • max time network
    62s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-12-2024 21:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Loader.exe

  • Size

    2.1MB

  • MD5

    084519881ac16c16cf9206f97a68f79e

  • SHA1

    7b0fbc312ec9176a69ccb3036636e2423320cd79

  • SHA256

    89057bbeb5618835524cf8fc3a645fc5137553638520e763901fa1f2f8cdbe66

  • SHA512

    84b2867560cdbd3ca797196b208495631e49a87a2ea7451d6d68b52ea1ada0546c81d9b2e37b630440565cd53661c6541eb91c8bd662bb10780f87a7c7db5633

  • SSDEEP

    49152:4ZZosvRgdkadC7i03aQAZutzArxizJZTrEbupmpVwMgc:4ZZostak7RGuqGJZXdpmIn

Score
10/10
asyncratdefaultdiscoveryexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

193.161.193.99:53757

Mutex

hsaurcrgqwhjimnkbht

Attributes
  • delay

    1

  • install

    true

  • install_file

    Load.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Async RAT payload 1 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 29 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 54 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\Done.exe
      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\ACCApi'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4016
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Local\ACCApi\apihost.exe" /st 21:58 /du 23:59 /sc daily /ri 1 /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3048
      • C:\Users\Admin\AppData\Local\ACCApi\apihost.exe
        "C:\Users\Admin\AppData\Local\ACCApi\apihost.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2300
    • C:\Users\Admin\AppData\Local\Temp\Load.exe
      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1532
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1968
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCEF8.tmp.bat""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4648
        • C:\Windows\system32\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:2508
        • C:\Users\Admin\AppData\Roaming\Load.exe
          "C:\Users\Admin\AppData\Roaming\Load.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:224
    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Users\Admin\AppData\Local\Temp\Done.exe
        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        PID:3420
      • C:\Users\Admin\AppData\Local\Temp\Load.exe
        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:808
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1368
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2760
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD726.tmp.bat""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3696
          • C:\Windows\system32\timeout.exe
            timeout 3
            5⤵
            • Delays execution with timeout.exe
            PID:1540
          • C:\Users\Admin\AppData\Roaming\Load.exe
            "C:\Users\Admin\AppData\Roaming\Load.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:2428
      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3180
        • C:\Users\Admin\AppData\Local\Temp\Done.exe
          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1060
        • C:\Users\Admin\AppData\Local\Temp\Load.exe
          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2324
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"' & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3116
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "Load" /tr '"C:\Users\Admin\AppData\Roaming\Load.exe"'
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2992
        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:1612
          • C:\Users\Admin\AppData\Local\Temp\Done.exe
            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2640
          • C:\Users\Admin\AppData\Local\Temp\Load.exe
            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:4524
          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:2060
            • C:\Users\Admin\AppData\Local\Temp\Done.exe
              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4244
            • C:\Users\Admin\AppData\Local\Temp\Load.exe
              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:404
            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
              6⤵
              • Checks computer location settings
              PID:1792
              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4936
              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1608
              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                7⤵
                • Checks computer location settings
                PID:4948
                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3976
                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3312
                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                  8⤵
                  • Checks computer location settings
                  PID:4940
                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3124
                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4284
                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                    9⤵
                    • Checks computer location settings
                    PID:4924
                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3332
                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2136
                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                      10⤵
                      • Checks computer location settings
                      PID:4016
                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2612
                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3528
                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                        11⤵
                        • Checks computer location settings
                        PID:2920
                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:628
                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2024
                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                          12⤵
                          • Checks computer location settings
                          PID:1968
                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4284
                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1048
                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                            13⤵
                            • Checks computer location settings
                            PID:2648
                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:640
                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:852
                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                              14⤵
                              • Checks computer location settings
                              PID:1644
                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:1604
                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2612
                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                15⤵
                                • Checks computer location settings
                                PID:1088
                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:1368
                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1456
                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                  16⤵
                                  • Checks computer location settings
                                  PID:428
                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:2120
                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4328
                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                    17⤵
                                    • Checks computer location settings
                                    PID:4488
                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:2040
                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1716
                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                      18⤵
                                      • Checks computer location settings
                                      PID:3340
                                      • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:1904
                                      • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4076
                                      • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                        19⤵
                                        • Checks computer location settings
                                        PID:1168
                                        • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:2224
                                        • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5064
                                        • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                          20⤵
                                          • Checks computer location settings
                                          PID:1592
                                          • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:628
                                          • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4876
                                          • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                            21⤵
                                            • Checks computer location settings
                                            PID:4332
                                            • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:232
                                            • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4924
                                            • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                              22⤵
                                              • Checks computer location settings
                                              PID:3000
                                              • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:5068
                                              • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2632
                                              • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                23⤵
                                                • Checks computer location settings
                                                PID:2060
                                                • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4424
                                                • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2260
                                                • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                  24⤵
                                                  • Checks computer location settings
                                                  PID:2280
                                                  • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3400
                                                  • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4940
                                                  • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    PID:4020
                                                    • C:\Users\Admin\AppData\Local\Temp\Done.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Done.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4772
                                                    • C:\Users\Admin\AppData\Local\Temp\Load.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Load.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2240
                                                    • C:\Users\Admin\AppData\Local\Temp\Loader.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
                                                      26⤵
                                                        PID:4876
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:740
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2296
      • C:\Users\Admin\AppData\Local\ACCApi\apihost.exe
        "C:\Users\Admin\AppData\Local\ACCApi\apihost.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2996

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Load.exe.log
        Filesize

        1KB

        MD5

        baf55b95da4a601229647f25dad12878

        SHA1

        abc16954ebfd213733c4493fc1910164d825cac8

        SHA256

        ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

        SHA512

        24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Loader.exe.log
        Filesize

        654B

        MD5

        2ff39f6c7249774be85fd60a8f9a245e

        SHA1

        684ff36b31aedc1e587c8496c02722c6698c1c4e

        SHA256

        e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

        SHA512

        1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Done.exe.log
        Filesize

        410B

        MD5

        3bbb825ef1319deb378787046587112b

        SHA1

        67da95f0031be525b4cf10645632ca34d66b913b

        SHA256

        d9c6d00fad02f7a9ef0fcddc298ffd58b17020fb12b1336d5733237cbfadb1e0

        SHA512

        7771ae543e188d544e1bb6c65e0453a6777c1c39790a355f4cce652a815bfaf94dd426de3db910a67bd06e463ac0143d9e2ca44d2b12af7f0d84c27b4a09cc54

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Done.exe
        Filesize

        69KB

        MD5

        2453fa8ef7ccc79cada8679f06f2be53

        SHA1

        b3db41bc85d300a069e6636b5c9e7dcf0a6a95b2

        SHA256

        e0e329ca03adcd56c5ff4a5cbdaff475a1cf636dfce64b7da1a05f5c74daac88

        SHA512

        a28398843232745153b3f57d2166aca95e9f930a8334c0ffdb2db192fc8cc8b2d5f5a0a0d123a996f2aa738668209a3541ffb9ed6f42f665aefb9300cd3d45d4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Load.exe
        Filesize

        74KB

        MD5

        4fc5086bcb8939429aea99f7322e619b

        SHA1

        8d3bd7d005710a8ae0bd0143d18b437be20018d7

        SHA256

        e31d6dc4d6f89573321f389c5b3f12838545ff8d2f1380cfba1782d39853e9fd

        SHA512

        04e230f5b39356aecf4732ac9a2f4fea96e51018907e2f22c7e3f22e51188b64cdb3e202fe324f5e3500761fae43f898bf9489aa8faa34eff3566e1119a786d2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aplisl23.3uf.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmpCEF8.tmp.bat
        Filesize

        148B

        MD5

        be01a626b8528f7152f976b6a7d8e14b

        SHA1

        90d384a0dbb4b4875c1ef2c05e9ae24575367763

        SHA256

        8881cd5c497764da317d0d31eb7fcc2dde24d1e4cf2ef7d7c42f74ba1f93a556

        SHA512

        413fe66c9ba24e1fb037510cd206a9bc6ab09d97cd5046b9ad484fd7f30968499840a1dac4d9e7e4bf48baf48a34d31d3c295fe15e205d8a272e84a7be02568c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmpD726.tmp.bat
        Filesize

        148B

        MD5

        608eebe631027a73f68f4154967c3fa0

        SHA1

        21985bd65173baf18ad5c732f8f10057e7787804

        SHA256

        f1c1cb64e08081be555a0662fd7364b0028c2a1d40dcfe54dbe5ae468a6b7043

        SHA512

        c2c9e079ed1036c98feaf4c33e9654eff9a001bc87981f786f6d7f1525509e35d407eaa3a19ee584f453378e761798524c5113d3db01a730d18392cc6d390f85

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk
        Filesize

        1KB

        MD5

        813e1af661290166fa9f17cd879d9992

        SHA1

        e3eb93a2cf50ce76ba90a2f851a62f2d61db11c6

        SHA256

        0fe1d2d6b577450d6ace0fa963ae7022f1cbc566433ca1d32d4efc6fa0167812

        SHA512

        d38af0893c76d2d94ce81a3d30a37c5047148f43bb7e282ef804b8a76a097136e547380c8a5065767ce8ace5ec21751db60404e62054bf55a45900b6ba6fecc6

        Download Submit

      • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
        Filesize

        8B

        MD5

        cf759e4c5f14fe3eec41b87ed756cea8

        SHA1

        c27c796bb3c2fac929359563676f4ba1ffada1f5

        SHA256

        c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

        SHA512

        c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

        Download Submit

      • memory/740-141-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/740-131-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/740-137-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/740-138-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/740-133-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/740-139-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/740-142-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/740-143-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/740-140-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/740-132-0x000001CF76EA0000-0x000001CF76EA1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1432-72-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1432-31-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1432-28-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1432-25-0x0000000000550000-0x0000000000568000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2040-30-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2040-0-0x00007FFCA5843000-0x00007FFCA5845000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2040-10-0x00007FFCA5840000-0x00007FFCA6301000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2040-1-0x0000000000E50000-0x0000000001074000-memory.dmp

        Filesize

        2.1MB

        Download

      • memory/3420-90-0x0000000005B70000-0x0000000005B7A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4016-77-0x0000000006D70000-0x0000000006DA2000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4016-89-0x00000000077A0000-0x0000000007843000-memory.dmp

        Filesize

        652KB

        Download

      • memory/4016-88-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4016-93-0x00000000078D0000-0x00000000078EA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4016-92-0x00000000081F0000-0x000000000886A000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/4016-97-0x0000000007940000-0x000000000794A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4016-99-0x0000000007D60000-0x0000000007DF6000-memory.dmp

        Filesize

        600KB

        Download

      • memory/4016-100-0x0000000007CE0000-0x0000000007CF1000-memory.dmp

        Filesize

        68KB

        Download

      • memory/4016-78-0x0000000072270000-0x00000000722BC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4016-105-0x0000000007D10000-0x0000000007D1E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4016-106-0x0000000007D20000-0x0000000007D34000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4016-107-0x0000000007E20000-0x0000000007E3A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4016-108-0x0000000007E00000-0x0000000007E08000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4016-73-0x00000000067B0000-0x00000000067CE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4016-74-0x00000000067F0000-0x000000000683C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4016-67-0x00000000061C0000-0x0000000006514000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4016-53-0x0000000006150000-0x00000000061B6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4016-52-0x00000000060E0000-0x0000000006146000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4016-51-0x0000000005810000-0x0000000005832000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4016-43-0x0000000005880000-0x0000000005EA8000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/4016-39-0x0000000005210000-0x0000000005246000-memory.dmp

        Filesize

        216KB

        Download

      • memory/4948-34-0x0000000004B90000-0x0000000004C22000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4948-33-0x0000000005140000-0x00000000056E4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4948-32-0x0000000000240000-0x0000000000258000-memory.dmp

        Filesize

        96KB

        Download