asyncrat | hxxps://salvador-interventions-pointing-discover[.]trycloudflare[.]com/

Analysis

max time kernel
480s
max time network
599s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
21/02/2025, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://salvador-interventions-pointing-discover.trycloudflare.com/

Score

10^/10

asyncrat stealerium xworm default collection discovery persistence privilege_escalation rat stealer trojan

Malware Config

Extracted

Family

xworm

Version

5.0

62.60.190.196:8000

Mutex

9Kl9naWliCNlyild

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

asyncrat

Botnet

Default

62.60.190.196:3232

62.60.190.141:3232

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

62.60.190.141:4056

Mutex

fagpetngyrfkiki

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3584-166-0x0000000001570000-0x000000000157E000-memory.dmp	family_xworm

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
Stealerium family
stealerium

Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs

description	pid	Process	procid_target
PID 3028 created 3352	3028	python.exe	52
PID 1404 created 3352	1404	python.exe	52
PID 2724 created 3352	2724	python.exe	52
PID 2724 created 3352	2724	python.exe	52
PID 2412 created 3352	2412	python.exe	52
PID 2412 created 3352	2412	python.exe	52

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1400-171-0x0000000001500000-0x0000000001516000-memory.dmp	family_asyncrat
behavioral2/memory/3796-176-0x000002044D860000-0x000002044D878000-memory.dmp	family_asyncrat
behavioral2/memory/2104-228-0x000001F88CBC0000-0x000001F88CBD6000-memory.dmp	family_asyncrat

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe
Key opened	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe
Key opened	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	icanhazip.com
1	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
660	cmd.exe
1824	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	notepad.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	notepad.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ban.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2352	msedge.exe
2352	msedge.exe
3888	msedge.exe
3888	msedge.exe
2944	msedge.exe
2944	msedge.exe
2532	identity_helper.exe
2532	identity_helper.exe
3240	msedge.exe
3240	msedge.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
3028	python.exe
1404	python.exe
2724	python.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe
3796	notepad.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3028	python.exe
1404	python.exe
2724	python.exe
2724	python.exe
2412	python.exe
2412	python.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	3584	explorer.exe
Token: SeDebugPrivilege	1400	explorer.exe
Token: SeDebugPrivilege	3796	notepad.exe
Token: SeDebugPrivilege	2104	notepad.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3956	WindowsTerminal.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3956	WindowsTerminal.exe
3796	notepad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 4716	3888	msedge.exe	78
PID 3888 wrote to memory of 4716	3888	msedge.exe	78
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 3404	3888	msedge.exe	79
PID 3888 wrote to memory of 2352	3888	msedge.exe	80
PID 3888 wrote to memory of 2352	3888	msedge.exe	80
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81
PID 3888 wrote to memory of 2988	3888	msedge.exe	81

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-501547156-4130638328-323075719-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	notepad.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://salvador-interventions-pointing-discover.trycloudflare.com/
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa064d3cb8,0x7ffa064d3cc8,0x7ffa064d3cd8
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
    3⤵
    PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
    3⤵
    PID:596
- - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:3240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
    3⤵
    PID:3956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
    3⤵
    PID:1272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,15827168376882628348,12887297053573493111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6496 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:780
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wt.exe"
  2⤵
  PID:3128
- - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
    wt.exe
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3956
  - - C:\Windows\system32\wsl.exe
      C:\Windows\system32\wsl.exe --list
      4⤵
      PID:1404
  - - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
      "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa38 --server 0xa34
      4⤵
      PID:2740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1544
    - - C:\Users\Admin\Downloads\ban\lob\Python312\python.exe
        
        "C:\Users\Admin\Downloads\ban\lob\Python312\python.exe" .\load.py .\an.bin
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:3028
    - - C:\Users\Admin\Downloads\ban\lob\Python312\python.exe
        
        "C:\Users\Admin\Downloads\ban\lob\Python312\python.exe" .\load.py .\pay.bin
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:1404
    - - C:\Users\Admin\Downloads\ban\lob\Python312\python.exe
        
        "C:\Users\Admin\Downloads\ban\lob\Python312\python.exe" .\load.py .\payload.bin
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:2724
    - - C:\Users\Admin\Downloads\ban\lob\Python312\python.exe
        
        "C:\Users\Admin\Downloads\ban\lob\Python312\python.exe" .\load.py .\ve.bin
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:2412
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3584
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1400
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3796
- C:\Windows\System32\notepad.exe
  C:\Windows\System32\notepad.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2104
- - C:\Windows\System32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:660
  - - C:\Windows\System32\chcp.com
      chcp 65001
      4⤵
      PID:1192
  - - C:\Windows\System32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1824
  - - C:\Windows\System32\findstr.exe
      findstr All
      4⤵
      PID:3144
- - C:\Windows\System32\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    PID:3036
  - - C:\Windows\System32\chcp.com
      chcp 65001
      4⤵
      PID:3088
  - - C:\Windows\System32\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8baaf6c583536c9e6327e9d4fddb4cc

SHA1
0c1436d1a870038a6cb0195704658ef59ef78906

SHA256
7cea1717ca57c727378be31a2046e1b4be05ceaff81e76d45b5b3fb1a0b09507

SHA512
6cdb5d74ebf3c2f398c2032e6047f32b342db6f28f997c9c3df2351e307b316a6d66127a3ba6f0b1a721e5afd50a5578ec9835ea25708fcd49850ec4ba64dd67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5332d65d7c50eee952b71eda55782f27

SHA1
9039a05b96d6f5fc532a4ddb304ec01aa2fe5879

SHA256
b677f0eeb2f0c049f48cc35d484ead2ba5434a74e4264e64d7f426fe45f2ff0e

SHA512
eeff99092be3b0bcf81e9ba0f2a72d592938ef90952e533f903707d1e0af2138db62a4b491476f499a0909bf52fc7aada7aa832c73aa882d40f488afe5b29b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\879a4833-8f2c-410c-a219-9988153613f3.tmp

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
54141a071713478df03304be4e0f16b3

SHA1
38c9b14723d64b9b63c2be33358992564c450aa4

SHA256
26c6814e9aa6a45ab4985f80608bc52244f81ec061fac13a4638b8fe869fa3bf

SHA512
42a39de2daa23e31494d1730ffd06183e48842d9393f33bd0a3a6effffb7bbbba062ecd641636e7464832734834d4aaef15e36261d10bc3dff99f4071efe2aae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
226B

MD5
b97cd11b28fe6445b7a380b8ec53d206

SHA1
4dc43bcda25d2dc7da8985450ca6f0aba12f383b

SHA256
6a6d582031df51838cf33be075fb217f96853ff137eb74f59943576a23293888

SHA512
40174f804ad50663437386909046fa5e1098842d6767fdc49eaac6568faf84cfa8bc32201c9c79f6b3a5c4d0b5c9ab262a9c478bf49abddf627172082622272b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9bc0bab0bb4fd889ad93135129920c09

SHA1
583d836819029933357c1b00873553463c0041c6

SHA256
8660cecd0c9939c0b1a58e5b814770f1023ef5d63b5952ee4cc72fe4f5720f6d

SHA512
5a872731571e30f33bdf8739f1f164f03863e6d4c762314f13ce7198d898d65d85fb72734afdc25486cc209d43fd821edbf811e3dc51242fa3e74ef314094c45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b525a5743d5e6bc947f36b53f40f8b5f

SHA1
c896089fba12dfc3f2926d130c00c2484275ff6f

SHA256
a3d9eca52d2d48d4a3c0d8e4a7d210468d43371d8f02b6e6a398758a74d9ebc0

SHA512
6d89405aa09bbaa44309c59b9ac0e011c525d4d34911291b712d61b12575891d19041155c87069c71b812a54869788bd58b11975715ec0da77d88a67dc97d72c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
888dc68701f6622acce93592aae5ef28

SHA1
4e5fd0233f3811934fac639d99a0cbae0caf2fa9

SHA256
b9335af81a41ad604639fb64a06930cbb94011cf96bc1a0aa170466401156dd2

SHA512
6351384af88a7448e79b5aa7c39f7905d46e0d5f427b3a2e4a58ecc36d76e20e1f244dc3aebdebb8c606c14770438a9b3bdf06f2a3daf22f1d8762aae801840b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e99f009b8275ae319108e139056e5e0b

SHA1
9f76b224843a0763130cf9a60f3a76ee017e86da

SHA256
60de513bced17107a03b1a9b2763dc5d21d01e7f4a8fbf538296970d14fe4386

SHA512
af30811e84c3b3439db443b556af12eb070c4c485382eb68e5695816221800322d2cbe4a3083b1be3f55b45fadbe52de59776e2e46f8f64c8b05db726da07f7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7ba78ba8026f4ad71bdb54cada8e5fb7

SHA1
aad2116d14aa45b631159b57e774c76b8327b247

SHA256
a703142141b74a27644ffd4c70360b2cd2440f21dfaa70679eda0c471e8950d9

SHA512
4883426d8e9950ff96be3f1d8ba921fc4f2112251992401086d86fd503633069632aba34cd9485b21ea4caf2e670acd9d82e216d80e4981b3a8076faadf71c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yla4qav2.luq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\f77bb56d2fe9ab37d3701b7349ad1c1d\Admin@WFQQFFOZ_en-US\System\Process.txt

Filesize
451B

MD5
23324d7f7ea20eeb2ac9d4ecd6f90c1e

SHA1
df8cea044ee27d97b7d34af6a02e02823f143e94

SHA256
069e67b47afcb3d45f4e6dd3cfb0856e739a6dc498e66ec046aa15ab907627cd

SHA512
32521c21053e4ee5d3dc336a069faafe9d55b32fc69beb18b9cf70e58b5de0cf40814062b6f4cdbd45e8bed4984f8809e76db84ec34aaa727d22bdc5d17fea29

Download Submit
C:\Users\Admin\AppData\Local\f77bb56d2fe9ab37d3701b7349ad1c1d\Admin@WFQQFFOZ_en-US\System\Process.txt

Filesize
2KB

MD5
45329175abfb49da9d89b44a623edc30

SHA1
6bc5c8fec3892d6eca1d1f0ba4df93d69338c601

SHA256
78257f3a263fa2f1f1fc7ac5a9d439da28293de16e8d8a8a088b80196927ae41

SHA512
1384b87879c9055ed1cbadb20b2872c01084aa080042d32f8397d79178cc7a7f15793ff1bbf0679e3984a8915bc612fd78967d0d8b8408b3029c43b424ef98f8

Download Submit
C:\Users\Admin\AppData\Local\f77bb56d2fe9ab37d3701b7349ad1c1d\Admin@WFQQFFOZ_en-US\System\Process.txt

Filesize
4KB

MD5
195cd685aa9113bf18d8b29478a778cd

SHA1
ebab0e87f1c042aaf2f82389973c0c723aa0d754

SHA256
5588459065832b0593f9ae829f5a2b1c0a6ace16556e8ef02e1c534f2d7f8865

SHA512
62408613316f222cd0c071fe420d86a8f4669565ae9aa742b0b9922004b0ba2181f957bb1ce5890098bb6eb1e38563fada95b01a9985053a12f43d8d800fa473

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 182208.crdownload

Filesize
19.7MB

MD5
e3dd46f757b5e97f3de1eda54db78044

SHA1
34546b055cbcebb09c22fb4048fe0068153b3bc8

SHA256
6cea485ebdaabac42296d07089361d7e745ec1be124bdc0cc45c654fb783dfe3

SHA512
ea53a5bfd3cfbcda55222fc7b2b0c47f54e61a032e74b720b617a35004c725697871274f7d790ee79b5bab68d9ea4aa0e561c18adcb59f6e4ece1512922a7277

Download Submit
C:\Users\Admin\Downloads\ban.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/1400-171-0x0000000001500000-0x0000000001516000-memory.dmp

Filesize
88KB

Download
memory/1400-169-0x0000000000D80000-0x0000000000D9A000-memory.dmp

Filesize
104KB

Download
memory/1404-168-0x000001AFF6330000-0x000001AFF6390000-memory.dmp

Filesize
384KB

Download
memory/1544-160-0x000002C1D1B10000-0x000002C1D1B2E000-memory.dmp

Filesize
120KB

Download
memory/1544-159-0x000002C1D1F70000-0x000002C1D1FE6000-memory.dmp

Filesize
472KB

Download
memory/1544-126-0x000002C1B94B0000-0x000002C1B94D2000-memory.dmp

Filesize
136KB

Download
memory/1544-130-0x000002C1D1EA0000-0x000002C1D1EE6000-memory.dmp

Filesize
280KB

Download
memory/2104-226-0x000001F88B010000-0x000001F88B02A000-memory.dmp

Filesize
104KB

Download
memory/2104-228-0x000001F88CBC0000-0x000001F88CBD6000-memory.dmp

Filesize
88KB

Download
memory/2104-229-0x000001F8A59A0000-0x000001F8A5B28000-memory.dmp

Filesize
1.5MB

Download
memory/2104-234-0x000001F88CD70000-0x000001F88CD7A000-memory.dmp

Filesize
40KB

Download
memory/2104-391-0x000001F8A5FF0000-0x000001F8A606A000-memory.dmp

Filesize
488KB

Download
memory/2412-225-0x00000280F5E50000-0x00000280F5EB0000-memory.dmp

Filesize
384KB

Download
memory/2724-173-0x000002E3FFF20000-0x000002E3FFF83000-memory.dmp

Filesize
396KB

Download
memory/3028-163-0x0000019967770000-0x00000199677C8000-memory.dmp

Filesize
352KB

Download
memory/3584-178-0x0000000003060000-0x000000000306C000-memory.dmp

Filesize
48KB

Download
memory/3584-166-0x0000000001570000-0x000000000157E000-memory.dmp

Filesize
56KB

Download
memory/3584-164-0x0000000001000000-0x0000000001012000-memory.dmp

Filesize
72KB

Download
memory/3796-176-0x000002044D860000-0x000002044D878000-memory.dmp

Filesize
96KB

Download
memory/3796-174-0x000002044BCB0000-0x000002044BCCC000-memory.dmp

Filesize
112KB

Download