asyncrat | 8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196

Analysis

max time kernel
60s
max time network
53s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25/03/2025, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe
Size

34.8MB
MD5

cb0a22d05978b2e41a38dbc0b8e18519
SHA1

c07e0f474595ed1bf9a040b7f72902e32d83cd1a
SHA256

8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196
SHA512

c92a79e3ed02756d38150edf493cb4df4a61537594bc6c8b926c058a20be4d8041d1e360e8649d2ce2969388f5856fe43d54baf15438bd094df4e672e0faddf8
SSDEEP

786432:Wb3crXJY6tIHUrznnbjYWtND+rhvviy2BFo0yqPoYmBR73h5ITWb59ZHWdp:WbsrZY0rznn3YWWlvT27Jo5B9RWTWb5c

Score

10^/10

asyncrat njrat stormkitty default hacked defense_evasion discovery persistence privilege_escalation pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

asyncrat

Version

1.0.7 - modded by last

Botnet

Default

letaryzipthone.ddns.net:9899

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
true
install_file
RuntimeBroker.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7375914494:AAFg7abzayPkXsZ-aOwL0bNzXG_Do7nWn34/sendMessage?chat_id=5723422959

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

letaryzipthone.ddns.net:4444

Mutex

2f8a8ccfde8351da368cd6477cb06a99

Attributes

reg_key
2f8a8ccfde8351da368cd6477cb06a99
splitter
|'|'|

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Njrat family
njrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000194e6-18.dat	family_stormkitty
behavioral1/memory/2188-31-0x0000000001140000-0x0000000001172000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x0008000000019429-12.dat	family_asyncrat
behavioral1/files/0x00070000000194e6-18.dat	family_asyncrat
behavioral1/memory/1032-26-0x0000000000E60000-0x0000000000EA0000-memory.dmp	family_asyncrat

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1036	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2f8a8ccfde8351da368cd6477cb06a99.exe	Shell Infrastructure Host.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2f8a8ccfde8351da368cd6477cb06a99.exe	Shell Infrastructure Host.exe

Executes dropped EXE 7 IoCs

pid	Process
2356	UltimateLogChecker.exe
1440	Client.exe
2188	ShellExperienceHost.exe
1032	Server.exe
2444	UltimateLogChecker.exe
1900	RuntimeBroker.exe
1716	Shell Infrastructure Host.exe

Loads dropped DLL 3 IoCs

pid	Process
3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe
2444	UltimateLogChecker.exe
1032	Server.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\2f8a8ccfde8351da368cd6477cb06a99 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Shell Infrastructure Host.exe\" .."	Shell Infrastructure Host.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2f8a8ccfde8351da368cd6477cb06a99 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Shell Infrastructure Host.exe\" .."	Shell Infrastructure Host.exe

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\5f92f093887ac400ea9d1473cd969b6a\Admin@PIDEURYY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	ShellExperienceHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\5f92f093887ac400ea9d1473cd969b6a\Admin@PIDEURYY_en-US\Grabber\DRIVE-C\Users\Admin\Desktop\desktop.ini	ShellExperienceHost.exe
File created	C:\Users\Admin\AppData\Local\5f92f093887ac400ea9d1473cd969b6a\Admin@PIDEURYY_en-US\Grabber\DRIVE-C\Users\Admin\Pictures\desktop.ini	ShellExperienceHost.exe
File created	C:\Users\Admin\AppData\Local\5f92f093887ac400ea9d1473cd969b6a\Admin@PIDEURYY_en-US\Grabber\DRIVE-C\Users\Admin\Documents\desktop.ini	ShellExperienceHost.exe
File created	C:\Users\Admin\AppData\Local\5f92f093887ac400ea9d1473cd969b6a\Admin@PIDEURYY_en-US\Grabber\DRIVE-C\Users\Admin\Downloads\desktop.ini	ShellExperienceHost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	icanhazip.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000b000000012268-4.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShellExperienceHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shell Infrastructure Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2668	cmd.exe
2684	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	ShellExperienceHost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ShellExperienceHost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2016	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
864	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1440	Client.exe
1440	Client.exe
1440	Client.exe
2188	ShellExperienceHost.exe
2188	ShellExperienceHost.exe
2188	ShellExperienceHost.exe
2188	ShellExperienceHost.exe
2188	ShellExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	ShellExperienceHost.exe
Token: SeDebugPrivilege	1440	Client.exe
Token: SeDebugPrivilege	1440	Client.exe
Token: SeDebugPrivilege	1900	RuntimeBroker.exe
Token: SeDebugPrivilege	1900	RuntimeBroker.exe
Token: SeDebugPrivilege	1716	Shell Infrastructure Host.exe
Token: 33	1716	Shell Infrastructure Host.exe
Token: SeIncBasePriorityPrivilege	1716	Shell Infrastructure Host.exe
Token: 33	1716	Shell Infrastructure Host.exe
Token: SeIncBasePriorityPrivilege	1716	Shell Infrastructure Host.exe
Token: 33	1716	Shell Infrastructure Host.exe
Token: SeIncBasePriorityPrivilege	1716	Shell Infrastructure Host.exe
Token: 33	1716	Shell Infrastructure Host.exe
Token: SeIncBasePriorityPrivilege	1716	Shell Infrastructure Host.exe
Token: 33	1716	Shell Infrastructure Host.exe
Token: SeIncBasePriorityPrivilege	1716	Shell Infrastructure Host.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2356	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	31
PID 3068 wrote to memory of 2356	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	31
PID 3068 wrote to memory of 2356	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	31
PID 3068 wrote to memory of 1440	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	33
PID 3068 wrote to memory of 1440	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	33
PID 3068 wrote to memory of 1440	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	33
PID 3068 wrote to memory of 2188	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	34
PID 3068 wrote to memory of 2188	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	34
PID 3068 wrote to memory of 2188	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	34
PID 3068 wrote to memory of 2188	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	34
PID 3068 wrote to memory of 1032	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	35
PID 3068 wrote to memory of 1032	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	35
PID 3068 wrote to memory of 1032	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	35
PID 3068 wrote to memory of 1032	3068	8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe	35
PID 2356 wrote to memory of 2444	2356	UltimateLogChecker.exe	36
PID 2356 wrote to memory of 2444	2356	UltimateLogChecker.exe	36
PID 2356 wrote to memory of 2444	2356	UltimateLogChecker.exe	36
PID 1440 wrote to memory of 1976	1440	Client.exe	37
PID 1440 wrote to memory of 1976	1440	Client.exe	37
PID 1440 wrote to memory of 1976	1440	Client.exe	37
PID 1440 wrote to memory of 2628	1440	Client.exe	38
PID 1440 wrote to memory of 2628	1440	Client.exe	38
PID 1440 wrote to memory of 2628	1440	Client.exe	38
PID 1976 wrote to memory of 864	1976	cmd.exe	41
PID 1976 wrote to memory of 864	1976	cmd.exe	41
PID 1976 wrote to memory of 864	1976	cmd.exe	41
PID 2628 wrote to memory of 2016	2628	cmd.exe	42
PID 2628 wrote to memory of 2016	2628	cmd.exe	42
PID 2628 wrote to memory of 2016	2628	cmd.exe	42
PID 2628 wrote to memory of 1900	2628	cmd.exe	44
PID 2628 wrote to memory of 1900	2628	cmd.exe	44
PID 2628 wrote to memory of 1900	2628	cmd.exe	44
PID 1032 wrote to memory of 1716	1032	Server.exe	45
PID 1032 wrote to memory of 1716	1032	Server.exe	45
PID 1032 wrote to memory of 1716	1032	Server.exe	45
PID 1032 wrote to memory of 1716	1032	Server.exe	45
PID 2188 wrote to memory of 2668	2188	ShellExperienceHost.exe	46
PID 2188 wrote to memory of 2668	2188	ShellExperienceHost.exe	46
PID 2188 wrote to memory of 2668	2188	ShellExperienceHost.exe	46
PID 2188 wrote to memory of 2668	2188	ShellExperienceHost.exe	46
PID 2668 wrote to memory of 2804	2668	cmd.exe	48
PID 2668 wrote to memory of 2804	2668	cmd.exe	48
PID 2668 wrote to memory of 2804	2668	cmd.exe	48
PID 2668 wrote to memory of 2804	2668	cmd.exe	48
PID 2668 wrote to memory of 2684	2668	cmd.exe	49
PID 2668 wrote to memory of 2684	2668	cmd.exe	49
PID 2668 wrote to memory of 2684	2668	cmd.exe	49
PID 2668 wrote to memory of 2684	2668	cmd.exe	49
PID 2668 wrote to memory of 2812	2668	cmd.exe	50
PID 2668 wrote to memory of 2812	2668	cmd.exe	50
PID 2668 wrote to memory of 2812	2668	cmd.exe	50
PID 2668 wrote to memory of 2812	2668	cmd.exe	50
PID 2188 wrote to memory of 2644	2188	ShellExperienceHost.exe	51
PID 2188 wrote to memory of 2644	2188	ShellExperienceHost.exe	51
PID 2188 wrote to memory of 2644	2188	ShellExperienceHost.exe	51
PID 2188 wrote to memory of 2644	2188	ShellExperienceHost.exe	51
PID 2644 wrote to memory of 2712	2644	cmd.exe	53
PID 2644 wrote to memory of 2712	2644	cmd.exe	53
PID 2644 wrote to memory of 2712	2644	cmd.exe	53
PID 2644 wrote to memory of 2712	2644	cmd.exe	53
PID 2644 wrote to memory of 2760	2644	cmd.exe	54
PID 2644 wrote to memory of 2760	2644	cmd.exe	54
PID 2644 wrote to memory of 2760	2644	cmd.exe	54
PID 2644 wrote to memory of 2760	2644	cmd.exe	54

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe
"C:\Users\Admin\AppData\Local\Temp\8eb0decf8260bff5514cdae9f536b7af282c514d2bed4770ce887ac86d767196.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Roaming\UltimateLogChecker.exe
  "C:\Users\Admin\AppData\Roaming\UltimateLogChecker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2356
- - C:\Users\Admin\AppData\Roaming\UltimateLogChecker.exe
    "C:\Users\Admin\AppData\Roaming\UltimateLogChecker.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2444
- C:\Users\Admin\AppData\Roaming\Client.exe
  "C:\Users\Admin\AppData\Roaming\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"' & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "RuntimeBroker" /tr '"C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:864
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpED8A.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:2016
  - - C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1900
- C:\Users\Admin\AppData\Roaming\ShellExperienceHost.exe
  "C:\Users\Admin\AppData\Roaming\ShellExperienceHost.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2804
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:2684
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      System Location Discovery: System Language Discovery
      PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2760
- C:\Users\Admin\AppData\Roaming\Server.exe
  "C:\Users\Admin\AppData\Roaming\Server.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Users\Admin\AppData\Roaming\Shell Infrastructure Host.exe
    "C:\Users\Admin\AppData\Roaming\Shell Infrastructure Host.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Shell Infrastructure Host.exe" "Shell Infrastructure Host.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\7b9b06d97359a1d6ea9fdf7ca3bd41c9\msgid.dat

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI23562\python310.dll

Filesize
4.3MB

MD5
316ce972b0104d68847ab38aba3de06a

SHA1
ca1e227fd7f1cfb1382102320dadef683213024b

SHA256
34f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e

SHA512
a11da6590a71d977c62b1c26c275763413f6a455e6d85fa052654d05d845dbbe8122bbd8e0a23887f9873d4291382ebbd5df19674ad2dda1cf0ff3206054939b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpED8A.tmp.bat

Filesize
157B

MD5
393eca2caa87c8948c305c071233029b

SHA1
e0eaa14061f8d2651a38680581b6786bd60d41b0

SHA256
59d0a47a66c66c8a8133ab3592cf9554b87d2adc405a9ca716cd8d5afb899e4b

SHA512
138340ae56395c8fb91ddbf5c48dad57a53ccb786ae2ffc76653c3299167feccb653d5db84d768b2037fb3d4f369447d0c4024d0b06064f9ccaafbf28a3c8bb6

Download Submit
C:\Users\Admin\AppData\Roaming\Client.exe

Filesize
63KB

MD5
49f8b45538cd2fa2b2f13a7c98736971

SHA1
147e4bfd982902583d320869c32745a1e1ea6f4b

SHA256
509495c19a2442b30ded385e32aa696d5e6ee6da45bef081ad2c0c1f4a0c9ac8

SHA512
78eeb42a2170ccd44de6593e267b1a22fe2484c9bc1acbcb63c107a95fdd3b0aec655859f0d5cf2522ea73b2227be89ab7a7324249ffaf6a9d91bcf5dcd392d1

Download Submit
C:\Users\Admin\AppData\Roaming\Server.exe

Filesize
23KB

MD5
04265e612f3a7c2328bdcdd28da2ae44

SHA1
d0e77cfd68d7585ef53c6755f482f4f3ca08d5d1

SHA256
511f7b85ac2b7830278f14c51c8c8bfe400d4764a767189158508cb0246392f5

SHA512
c8660324686d8a4db8e526dff943218eba931f3b93ac1b2a58039c2169baf4ec43137e88071f0dff096b49c18e2dc8a2e7bccf5fe0ca9b69dde2356f17b3f9b3

Download Submit
C:\Users\Admin\AppData\Roaming\ShellExperienceHost.exe

Filesize
175KB

MD5
a7e64a526fc947df9acbdebf7e34f094

SHA1
820da6a50c70f3e11e03446ed86a9cccec7cd093

SHA256
da98da5a5e1e680594895cc513d1ac6245a82ad64b4850f66ead878e0d1e110b

SHA512
c6d3143218d027e5df753d30bf56e3d7cb5ad55d82ce6207f3c33d6373266f1e7b24726f2ab5c0c6af7c4a755e7f4930d369a5a7c282a4fd1e47d4b1c32100ef

Download Submit
\Users\Admin\AppData\Roaming\UltimateLogChecker.exe

Filesize
34.5MB

MD5
3bf5ce667dcc119c3371a0206c0f10e7

SHA1
ee5e36bba76f79025af13d4285a0759029a89f5b

SHA256
690b88e7ae00c04cef2e0aaef3251241f63137b55499d2d6a5b8d0a10e6e69e9

SHA512
947d058334fe72cb67fee7fa0ff9989ad1cf0af2cdcaaa784fca39969468ff5008306f32b3e6523dd5865cd8293760bddc91a03bd1391ec8ba9f8fd6885e60e0

Download Submit
memory/1032-26-0x0000000000E60000-0x0000000000EA0000-memory.dmp

Filesize
256KB

Download
memory/1440-25-0x00000000000F0000-0x0000000000106000-memory.dmp

Filesize
88KB

Download
memory/1900-196-0x0000000000EE0000-0x0000000000EF6000-memory.dmp

Filesize
88KB

Download
memory/2188-31-0x0000000001140000-0x0000000001172000-memory.dmp

Filesize
200KB

Download
memory/3068-0-0x000007FEF5AB3000-0x000007FEF5AB4000-memory.dmp

Filesize
4KB

Download
memory/3068-1-0x0000000001070000-0x0000000003342000-memory.dmp

Filesize
34.8MB

Download