asyncrat | hxxps://drive[.]google[.]com/open?id=1SiPYS7dOCqZL-RA623kuWfn_3-qYOBlu

Analysis

max time kernel
299s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
24-01-2025 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/open?id=1SiPYS7dOCqZL-RA623kuWfn_3-qYOBlu

Score

10^/10

asyncrat serverdiscotek discovery rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7A

Botnet

SERVERDISCOTEK

discotek.duckdns.org:6606

Mutex

cjebudnuemhbsoyv

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TypeId.vbs	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe

Executes dropped EXE 3 IoCs

pid	Process
3396	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
9108	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
8640	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
1	drive.google.com
7	drive.google.com
8	drive.google.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3396 set thread context of 6120	3396	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe	105
PID 9108 set thread context of 7116	9108	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe	106

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
3108	msedge.exe
3108	msedge.exe
3052	msedge.exe
3052	msedge.exe
696	identity_helper.exe
696	identity_helper.exe
2064	msedge.exe
2064	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
3396	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
3396	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
9108	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
9108	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	1188	7zG.exe
Token: 35	1188	7zG.exe
Token: SeSecurityPrivilege	1188	7zG.exe
Token: SeSecurityPrivilege	1188	7zG.exe
Token: SeDebugPrivilege	3396	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
Token: SeDebugPrivilege	9108	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
Token: SeDebugPrivilege	3396	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
Token: SeDebugPrivilege	9108	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
Token: SeDebugPrivilege	8640	EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
1188	7zG.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 3412	3108	msedge.exe	79
PID 3108 wrote to memory of 3412	3108	msedge.exe	79
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4996	3108	msedge.exe	80
PID 3108 wrote to memory of 4456	3108	msedge.exe	81
PID 3108 wrote to memory of 4456	3108	msedge.exe	81
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82
PID 3108 wrote to memory of 4940	3108	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://drive.google.com/open?id=1SiPYS7dOCqZL-RA623kuWfn_3-qYOBlu
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc06ee3cb8,0x7ffc06ee3cc8,0x7ffc06ee3cd8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1872,15191067710798504481,2310091382342824040,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2140

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap16061:194:7zEvent241
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1188

C:\Users\Admin\Downloads\EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
"C:\Users\Admin\Downloads\EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6120

C:\Users\Admin\Downloads\EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
"C:\Users\Admin\Downloads\EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:9108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7116

C:\Users\Admin\Downloads\EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe
"C:\Users\Admin\Downloads\EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:8640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aad1d98ca9748cc4c31aa3b5abfe0fed

SHA1
32e8d4d9447b13bc00ec3eb15a88c55c29489495

SHA256
2a07cac05ffcf140a9ad32e58ef51b32ecccf1e3ab5ef4e656770df813a8944e

SHA512
150ebf7e37d20f88b21ab7ea0793afe1d40b00611ed36f0cf1ac1371b656d26f11b08a84dbb958891c79776fae04c9c616e45e2e211d292988a5709857a3bf72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb557349d7af9d6754aed39b4ace5bee

SHA1
04de2ac30defbb36508a41872ddb475effe2d793

SHA256
cfc24ed7d1c2e2c6585f53db7b39aa2447bf9212487b0a3c8c2a7d8e7e5572ee

SHA512
f0cf51f42d975d720d613d09f201435bf98c6283ae5bc033207f4ada93b15e49743a235a1cfb1b761bde268e2f7f8561aa57619b99bff67a36820bc1a4d0ec4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
c070b587a97a66d9a4f60213ad47cb69

SHA1
fc19e323aa8b0586568f6ca7d0bac70c7ccc863f

SHA256
1f9a8c5e39a590f5dc8d5f057affe57b09f50ca989e71f3ea1e0d0778edd0ed1

SHA512
02825d5c26ab6903515e7146b3375043916eee55b89a2643976cee4315a2ffbc85d5573b6134574ad3301303f69e99d5bb6921c07b52212d1585db6e4a18d263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ee5f5d8e864ea0f54f8dff18b609d886

SHA1
59fce37696194f19dc07914197efba86919a6320

SHA256
6f33a3ca2d10542f83f0e766e0950fc060716a5daea21f28ce9a7ccf62268afb

SHA512
b9a01c787a86c7908056e41f9c18ac7ed5069e8aff4c009f6465119abdcdde4dc5a58fc80d2a9a819eee9f5658e467fb5dea0601e63ec1ab9e05fefcaff92bed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
ec220d87d6f6e5382d09164e2fd58008

SHA1
9a7dbb75e1ee29c1b25c2410bb96d7e2e9516e82

SHA256
5255d964729d588840f33f7c4095cf04a13c7e699d58798eca1ea4089ddd75c2

SHA512
3a8a445e1478d059fe0e7517063c4a450f910792e1b644cb16fff8cf8e7c62b3b5a73832ca932faa1b25738e4afabdf32662e111eb8c467ef736ffb478b56df2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
251a789ae06239b12a59da8c583791b8

SHA1
4045d5609a7636151b0b79a5ffcf1420d9216e3c

SHA256
2fa8e19b6bfd5aa9bb8cacc0c75b9f52408715d6edc5a98e6d2a11baa41f2443

SHA512
1544daf8b967303771a87b04ece2dc945d37ccb2c84acfad94c99340fb5269be4b931967bc569a5239c3d6039f688d6ceb51e121f5d77507a668c2a727397bcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
619c26c8ffad887e398c1c0ad15965e8

SHA1
9402ee5d0317493e5beda6ef8773f607897902bd

SHA256
7b5bc3dd5c2640bca83384ce8d059dd43cba55ffe6d8736915a3311384bcbe0d

SHA512
d186aff4708098ab9ee92b0011f0397e1663be67449bdc9e19e464743a61d64e61ddb45f796f99a813e8a16f43d573e703d948cec9c3c81a074955edc3c4d754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efc443dc2d1f88fbb9d377a48a3929c7

SHA1
e833f377524d77e9a791dcd6ee41afb3d8943d2c

SHA256
089a26877e9920e6854432f48e886cd96d3529effd0cadbdc523bb737c2f17ed

SHA512
e57a3344b8b96632243f1449a7ae9a9e0e97dab84f19d2a32f1bc104b8000b0c6081ed97e21956f2abf3b393ea316bbf32fee6e21406d6db4b3d1c1ec5d2cfc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c3d7ac94cad98c41e8eceaa909947812

SHA1
de479f37b5a5c2f929226825696efbccbe7e7f03

SHA256
38203d21dfc77a941c624785bbaf727c41d3af37853b7047652cfe8b626770ba

SHA512
3dfb5ddabc02ece73da7090725df0231cb748df8829b5fc375b13a543e16af9bd851fb4448690a13efa2b8ea9662d665db1be4dc44b284e4b1cf4a81f2a3bf1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eb4f1a9d169709746e6da0e007493621

SHA1
3ff90665bf7fd556d42cabf706a19c8019bc5d96

SHA256
5a48948616e1225d3090b61bf7bc5cc576b3ce85755cdde487896dc2ec2c4b2c

SHA512
12b2cfc48bfedd2d595d92c7585c9ba4fbce4812e1269b95925d145f5aeb00400d8258f8b865dc3d9dea21086e33162007e4ab8993e5ce6acb65752e37dfaa1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f98f31636f1383cfefcf88c5ccf3fd4d

SHA1
a0664e138b712e4def78997ec38b1e39f6e5f8ab

SHA256
5fffe5a9bcae51085c4bb61ad2a343c0ea4c23cad5bb303a2bea09e0b5b16c71

SHA512
19b47f933d7cf34783d4f4c03a167139ad6124283b51d0f41cee4a2d0badb802cbcfc93060173af12e68971b3b4b00394ccd1de9064abb43039e2b04c9b9e358

Download Submit
C:\Users\Admin\Downloads\EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.exe

Filesize
1.4MB

MD5
ceca5338efefd5ab6950dd33126099e9

SHA1
e95248f41489259e6e38751588473a3d37ce8b36

SHA256
79a23e29085113b45b0f15563b1884dd9c62eb89903898c253bdd111c99478b3

SHA512
aa8d26596e01211259b0771448f91703ad549640d3c9c8b6d4abc2225979b2c6e190d98ab7b65bec444057c3ddd0fb83235fd20a57a34450803f971d71e213be

Download Submit
C:\Users\Admin\Downloads\EMISION Y ELABORACION, FACTURA ELECTRONICA APROBADA, RD 9065412254.rar:Zone.Identifier

Filesize
186B

MD5
3e5ecb17b01e436b1f649a8a0ae85ba6

SHA1
d5e88498a0f11981cadc6d457a4b4af5ce51537d

SHA256
e91a22f3acd9da339ed7fcf9fc3431391e76a4dd1c43e1cf02aebfcaae14f6a7

SHA512
330e22bbb32604fd897d558e4abd2a3f087b292194f8d64149e5ce90c177bbe1783c7ea3d9cffffc4d1f6dc2c7de8a45372f227fad56eeab3aa1b466dc7fd636

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 306742.crdownload

Filesize
1.1MB

MD5
a83cbb03d0b0aad8ac1bd520255f0ca5

SHA1
0e97977fb7b697a0c8f56cde9b965f41b1f83b29

SHA256
8ef267c43563c355736912d5af771681de4f6c7dc732eecbbff8445a4bd4b1eb

SHA512
e040cfc8129bc4419c8d190ecceb7f5bcc0a7ef46cae6e17953c1314d75c6ebd258ca5acf58703ac6bc31638bf894f794a39bac59e7ff0500be479979819dcf8

Download Submit
memory/3396-226-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-244-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-220-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-218-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-216-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-215-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-257-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-258-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-261-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-271-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-222-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-224-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-213-0x00000000060A0000-0x0000000006646000-memory.dmp

Filesize
5.6MB

Download
memory/3396-228-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-230-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-232-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-234-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-236-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-238-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-240-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-242-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-214-0x0000000005BD0000-0x0000000005C62000-memory.dmp

Filesize
584KB

Download
memory/3396-246-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-248-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-250-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-252-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-254-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-262-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-264-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-266-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-268-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-272-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-274-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-276-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-278-0x00000000059F0000-0x0000000005AED000-memory.dmp

Filesize
1012KB

Download
memory/3396-1539-0x0000000005D70000-0x0000000005DBC000-memory.dmp

Filesize
304KB

Download
memory/3396-1538-0x0000000005D00000-0x0000000005D5A000-memory.dmp

Filesize
360KB

Download
memory/3396-1537-0x0000000005CA0000-0x0000000005CFC000-memory.dmp

Filesize
368KB

Download
memory/3396-2863-0x0000000005DF0000-0x0000000005E44000-memory.dmp

Filesize
336KB

Download
memory/3396-211-0x0000000000F20000-0x0000000001086000-memory.dmp

Filesize
1.4MB

Download
memory/3396-212-0x00000000059F0000-0x0000000005AF4000-memory.dmp

Filesize
1.0MB

Download
memory/6120-2867-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/8640-2890-0x0000000005710000-0x0000000005814000-memory.dmp

Filesize
1.0MB

Download