asyncrat | 27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
08/12/2025, 15:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
Size 3.8MB
Sample251208-sv2jdadr41
SHA256 27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78
MD5 c9fd967cddffa06167760c9e236463ea
SHA1 4ba1935d39a1a0f7bb0e8533ed5e361d41369b6b
SHA512 bced07ce3a754537b10539f6bf4b2c9eaabcc6e3decf17b333c682ece2317952d75bafc9dc6e89c89b9b768b08d1bc0c2a01c3659a3624085df63976edccc28a
SSDEEP 98304:AC+gs3iL85OeEmWV+cbwrV7IUWcC/tfrnDqIUVI3ixY3:AdtnORHzwqLcMtSFI3iO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution asyncrat stormkitty persistence rat stealer

Malware Config

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/5080-33-0x0000000000400000-0x000000000073C000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3712	powershell.exe
5332	powershell.exe
3696	powershell.exe
3544	powershell.exe
2652	powershell.exe
2536	powershell.exe
5888	powershell.exe
5696	powershell.exe

Executes dropped EXE 11 IoCs

pid	Process
2424	kyQeaTFXfvgqCH.exe
2504	Wihnup.exe
696	Wihnup.exe
4820	kyQeaTFXfvgqCH.exe
2772	kyQeaTFXfvgqCH.exe
572	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
4024	Wihnup.exe
2684	Wihnup.exe
2076	Wihnup.exe
1888	Wihnup.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 5080	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	86
PID 2424 set thread context of 3440	2424	kyQeaTFXfvgqCH.exe	108
PID 2504 set thread context of 4024	2504	Wihnup.exe	116
PID 2076 set thread context of 1888	2076	Wihnup.exe	130

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wihnup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyQeaTFXfvgqCH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wihnup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wihnup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wihnup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wihnup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kyQeaTFXfvgqCH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3808	timeout.exe
1400	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1600	schtasks.exe
4228	schtasks.exe
3456	schtasks.exe
5580	schtasks.exe
1648	schtasks.exe
3152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3712	powershell.exe
5332	powershell.exe
2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
3712	powershell.exe
5332	powershell.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
3696	powershell.exe
2424	kyQeaTFXfvgqCH.exe
2424	kyQeaTFXfvgqCH.exe
3544	powershell.exe
2424	kyQeaTFXfvgqCH.exe
2424	kyQeaTFXfvgqCH.exe
2424	kyQeaTFXfvgqCH.exe
2424	kyQeaTFXfvgqCH.exe
3696	powershell.exe
3544	powershell.exe
2652	powershell.exe
2536	powershell.exe
2504	Wihnup.exe
2504	Wihnup.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
3440	kyQeaTFXfvgqCH.exe
2652	powershell.exe
2536	powershell.exe
5888	powershell.exe
5696	powershell.exe
5696	powershell.exe
5888	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeDebugPrivilege	5332	powershell.exe
Token: SeDebugPrivilege	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
Token: SeDebugPrivilege	5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
Token: SeDebugPrivilege	3696	powershell.exe
Token: SeDebugPrivilege	2424	kyQeaTFXfvgqCH.exe
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	3440	kyQeaTFXfvgqCH.exe
Token: SeDebugPrivilege	2652	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2504	Wihnup.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	5696	powershell.exe
Token: SeDebugPrivilege	1888	Wihnup.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1888	Wihnup.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 3712	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	79
PID 2220 wrote to memory of 5332	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	81
PID 2220 wrote to memory of 4228	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	83
PID 2220 wrote to memory of 5064	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	85
PID 2220 wrote to memory of 5080	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	86
PID 2220 wrote to memory of 5080	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	86
PID 2220 wrote to memory of 5080	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	86
PID 2220 wrote to memory of 5080	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	86
PID 2220 wrote to memory of 5080	2220	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	86
PID 5080 wrote to memory of 1176	5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	90
PID 5080 wrote to memory of 3388	5080	27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe	92
PID 1176 wrote to memory of 3456	1176	cmd.exe	94
PID 3388 wrote to memory of 3808	3388	cmd.exe	95
PID 3388 wrote to memory of 696	3388	cmd.exe	98
PID 2424 wrote to memory of 3696	2424	kyQeaTFXfvgqCH.exe	99
PID 2424 wrote to memory of 3544	2424	kyQeaTFXfvgqCH.exe	101
PID 2424 wrote to memory of 5580	2424	kyQeaTFXfvgqCH.exe	102
PID 2424 wrote to memory of 2772	2424	kyQeaTFXfvgqCH.exe	105
PID 2424 wrote to memory of 4820	2424	kyQeaTFXfvgqCH.exe	106
PID 2424 wrote to memory of 572	2424	kyQeaTFXfvgqCH.exe	107
PID 2424 wrote to memory of 3440	2424	kyQeaTFXfvgqCH.exe	108
PID 2424 wrote to memory of 3440	2424	kyQeaTFXfvgqCH.exe	108
PID 2424 wrote to memory of 3440	2424	kyQeaTFXfvgqCH.exe	108
PID 2424 wrote to memory of 3440	2424	kyQeaTFXfvgqCH.exe	108
PID 2424 wrote to memory of 3440	2424	kyQeaTFXfvgqCH.exe	108
PID 2504 wrote to memory of 2652	2504	Wihnup.exe	109
PID 2504 wrote to memory of 2536	2504	Wihnup.exe	111
PID 2504 wrote to memory of 1648	2504	Wihnup.exe	112
PID 2504 wrote to memory of 2684	2504	Wihnup.exe	115
PID 2504 wrote to memory of 4024	2504	Wihnup.exe	116
PID 2504 wrote to memory of 4024	2504	Wihnup.exe	116
PID 2504 wrote to memory of 4024	2504	Wihnup.exe	116
PID 2504 wrote to memory of 4024	2504	Wihnup.exe	116
PID 2504 wrote to memory of 4024	2504	Wihnup.exe	116
PID 3440 wrote to memory of 4280	3440	kyQeaTFXfvgqCH.exe	117
PID 4280 wrote to memory of 3152	4280	cmd.exe	119
PID 3440 wrote to memory of 5576	3440	kyQeaTFXfvgqCH.exe	120
PID 5576 wrote to memory of 1400	5576	cmd.exe	122
PID 5576 wrote to memory of 2076	5576	cmd.exe	123
PID 2076 wrote to memory of 5888	2076	Wihnup.exe	124
PID 2076 wrote to memory of 5696	2076	Wihnup.exe	125
PID 2076 wrote to memory of 1600	2076	Wihnup.exe	127
PID 2076 wrote to memory of 1888	2076	Wihnup.exe	130
PID 2076 wrote to memory of 1888	2076	Wihnup.exe	130
PID 2076 wrote to memory of 1888	2076	Wihnup.exe	130
PID 2076 wrote to memory of 1888	2076	Wihnup.exe	130
PID 2076 wrote to memory of 1888	2076	Wihnup.exe	130

C:\Users\Admin\AppData\Local\Temp\27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
"C:\Users\Admin\AppData\Local\Temp\27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5332
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kyQeaTFXfvgqCH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE0EA.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4228
- C:\Users\Admin\AppData\Local\Temp\27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
  "C:\Users\Admin\AppData\Local\Temp\27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe"
  2⤵
  PID:5064
- C:\Users\Admin\AppData\Local\Temp\27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe
  "C:\Users\Admin\AppData\Local\Temp\27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Roaming\Wihnup.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Roaming\Wihnup.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3808
  - - C:\Users\Admin\AppData\Roaming\Wihnup.exe
      "C:\Users\Admin\AppData\Roaming\Wihnup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:696

C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe
C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3544
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kyQeaTFXfvgqCH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2EFA.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5580
- C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe
  "C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe"
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe
  "C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe"
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe
  "C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe"
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe
  "C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Roaming\Wihnup.exe"' & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Wihnup" /tr '"C:\Users\Admin\AppData\Roaming\Wihnup.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3152
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp4215.tmp.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5576
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1400
  - - C:\Users\Admin\AppData\Roaming\Wihnup.exe
      "C:\Users\Admin\AppData\Roaming\Wihnup.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Wihnup.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5888
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5696
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kyQeaTFXfvgqCH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9342.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1600
    - - C:\Users\Admin\AppData\Roaming\Wihnup.exe
        
        "C:\Users\Admin\AppData\Roaming\Wihnup.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1888

C:\Users\Admin\AppData\Roaming\Wihnup.exe
"C:\Users\Admin\AppData\Roaming\Wihnup.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Wihnup.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2652
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kyQeaTFXfvgqCH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3B6E.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1648
- C:\Users\Admin\AppData\Roaming\Wihnup.exe
  "C:\Users\Admin\AppData\Roaming\Wihnup.exe"
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Users\Admin\AppData\Roaming\Wihnup.exe
  "C:\Users\Admin\AppData\Roaming\Wihnup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78.exe.log
Size 1KB
SHA256 4c17576f64dea465c45a50573ee41771f7be9962ab2d07f961af4df5589bdcce
MD5 7e1ed0055c3eaa0bbc4a29ec1ef15a6a
SHA1 765b954c1adbb6a6ecc4fe912fdaa6d0fba0ae7d
SHA512 de7c784c37d18c43820908add88f08ab4864c0ef3f9d158cc2c9d1bab120613cb093dd4bfc5d7ed0c289414956cfe0b213c386f8e6b5753847dec915566297c8
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 59c692527724184404e6535949e5fc1fdb29a245e28b28c5ea3c45490f12c5ec
MD5 d7bc2787d9b23b3b37ea747c2ca51521
SHA1 1280fe3b18a005e1a140ea9d7e4f9442abc618cc
SHA512 87244c9014f1d37ececcf6caf63eda23a81e00878cf555ddbd7b99ae7439a9b1c0fb2d4812efaab23cf7eeb8a57ef4d82be333275913476e763cbbacf7b98e6d
SSDEEP 384:VTHhY1SSpFvYYR55S7sg/hSDNjjsaa8bAjUH9s9b+5nYEsapDU1C:ASSPvYYRrS7sg/8jj6nUq9b+muUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 20993cb39c4f5042ba5160a6cbdbf4a18645bb35019a8531ba459d7a72bbc0c9
MD5 4557ff094a8d6df608ef0c651e9806a8
SHA1 8b3559bdba38912d573290ca276ed882bb50a961
SHA512 87ca76821fec082aad724110b6cbad02293a9152055e454b2cb1c5fee079109f47e94675eadf3706e048904ef075cca26a50d196ef1ecd9d07600a7bec021da4
SSDEEP 384:qTHhRjSpAjLXL6FRHEMEVaHnNOHNijsaa8bpinzZnSARba5nYEIapDU1C:wjSCuRPEgN8ij6TZnT+myUM
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 420B
SHA256 efd9b9683866c3cbdaba21ad0d4d715824f7ccbb988e8272789ef75f204b794f
MD5 0e3a47a0dbe216725d7c37c48e3a0d44
SHA1 0badb7b53d026c98467f5d09fc61b154db387b6c
SHA512 b06ca7819279b4001554294c065092bcc0a7c7037d4c2757879e39c0ea3ea43266dc588187f80adc39dbf4dd9365097e6cfa82531f2449cdc17d0511057ed81d
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6aeeb3fea970d2c4938492bae83471dbcd7084926d065d581fb2d9ff78e4d3c8
MD5 84a58b3fdd29afa6907c42b4b5461c3a
SHA1 1f6fe5a5ec69abe9ef4cc495aba4447ba49e3e73
SHA512 a1a718f70b6aea6db91ae559965ff85f2b629f5afb93f156598d8ccb3c5ae29c149898e52edb4c5018a87655e72a4d9d3954486cd307b5670bfb08772c3ed172
SSDEEP 384:1OTHhMSS1U7Lt57dFRHEMEiKnnNfjs2xtgfNxh2r949J0X0iFBX:XSSCP77RPEXNfj7xtgFxhW49J0X0s
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_1u5soqlo.ybp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1u5soqlo.ybp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

tmp4215.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp4215.tmp.bat
Size 150B
SHA256 ca611f14d9eeee0798dd55e5f2780327fc98ae118d7501ac76bdcbda2a64480f
MD5 445b83c6038ad1b7ee84db59eef48c45
SHA1 0915e72efa56c361ad73c7717077a5f96c821ed3
SHA512 ff820662ba198669c6afc0a9682fbd963abdd16d170918a911fe3329c504b8c6979535d8ddf0e7a17054cb755f4d101026ecac009d714661f07a7e54bbcfb3f3
MD5 SHA1 SHA512

Submit Download

tmpE0EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE0EA.tmp
Size 1KB
SHA256 2129676caf432df883a0b8b9d2ada120e545da02e52855ec72195c5ab9640792
MD5 6185e1386da878579928c6b0e7bc2981
SHA1 41a04134ec52ed601d88e26ad98d758db056d1bc
SHA512 4f9302d7281ed26c0311388e5266ec030636787a6d852ab5991dec90610abb9d46f1890bf116e6db0d5ed42117a9873cf9e42b3b401b3c72ed0ebd6786a14d4b
MD5 SHA1 SHA512

Submit Download

tmpF24F.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp.bat
Size 150B
SHA256 0e6b32ad1efdc77be37d28c7a3bf6075f229f507d560bb23e8b9f266f3d1d4d2
MD5 b9602cfc447c05fcfbce1cb87185b6d5
SHA1 85dd1e1bf5c1267a11d95fe26355cc4038760880
SHA512 1ff579a880445de977c2a5b0563a53c773332d68590fce24381cf3a72d1bba1c006fcbfec64665dac062576ee17fc006f8c18b6241a149adb913bfa650839ef1
MD5 SHA1 SHA512

Submit Download

kyQeaTFXfvgqCH.exe

Path C:\Users\Admin\AppData\Roaming\kyQeaTFXfvgqCH.exe
Size 3.8MB
SHA256 27b4e7871c2374bcfae2fe960fd7fbdfebabc9ca84c2569c45e7438e0d356a78
MD5 c9fd967cddffa06167760c9e236463ea
SHA1 4ba1935d39a1a0f7bb0e8533ed5e361d41369b6b
SHA512 bced07ce3a754537b10539f6bf4b2c9eaabcc6e3decf17b333c682ece2317952d75bafc9dc6e89c89b9b768b08d1bc0c2a01c3659a3624085df63976edccc28a
SSDEEP 98304:AC+gs3iL85OeEmWV+cbwrV7IUWcC/tfrnDqIUVI3ixY3:AdtnORHzwqLcMtSFI3iO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/696-79-0x00000000062B0000-0x00000000062C6000-memory.dmp

Download

memory/2220-5-0x0000000008ED0000-0x0000000008EE6000-memory.dmp

Download

memory/2220-7-0x0000000009740000-0x00000000097DC000-memory.dmp

Download

memory/2220-6-0x0000000008EE0000-0x0000000009262000-memory.dmp

Download

memory/2220-0-0x0000000000CD0000-0x00000000010A4000-memory.dmp

Download

memory/2220-4-0x0000000005BF0000-0x0000000005BFA000-memory.dmp

Download

memory/2220-3-0x0000000005E40000-0x0000000005E50000-memory.dmp

Download

memory/2220-2-0x0000000005B40000-0x0000000005BD2000-memory.dmp

Download

memory/2220-1-0x0000000006200000-0x00000000067A6000-memory.dmp

Download

memory/2536-149-0x0000000070760000-0x00000000707AC000-memory.dmp

Download

memory/2652-148-0x0000000070760000-0x00000000707AC000-memory.dmp

Download

memory/2652-134-0x0000000005A20000-0x0000000005D77000-memory.dmp

Download

memory/2652-144-0x0000000005F20000-0x0000000005F6C000-memory.dmp

Download

memory/2652-162-0x00000000070D0000-0x0000000007174000-memory.dmp

Download

memory/2652-164-0x0000000007440000-0x0000000007451000-memory.dmp

Download

memory/2652-165-0x0000000007480000-0x0000000007495000-memory.dmp

Download

memory/3544-112-0x0000000070BD0000-0x0000000070C1C000-memory.dmp

Download

memory/3696-120-0x0000000007EC0000-0x0000000007ED5000-memory.dmp

Download

memory/3696-119-0x0000000007E80000-0x0000000007E91000-memory.dmp

Download

memory/3696-111-0x0000000007BA0000-0x0000000007C44000-memory.dmp

Download

memory/3696-104-0x0000000070BD0000-0x0000000070C1C000-memory.dmp

Download

memory/3696-103-0x0000000006530000-0x000000000657C000-memory.dmp

Download

memory/3696-87-0x0000000006A50000-0x0000000006DA7000-memory.dmp

Download

memory/3712-20-0x0000000006000000-0x0000000006066000-memory.dmp

Download

memory/3712-15-0x0000000005960000-0x0000000005F8A000-memory.dmp

Download

memory/3712-12-0x0000000002D00000-0x0000000002D36000-memory.dmp

Download

memory/3712-63-0x0000000007AB0000-0x0000000007AC5000-memory.dmp

Download

memory/3712-62-0x0000000007AA0000-0x0000000007AAE000-memory.dmp

Download

memory/3712-14-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/3712-13-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/3712-59-0x00000000078E0000-0x00000000078EA000-memory.dmp

Download

memory/3712-64-0x0000000007BB0000-0x0000000007BCA000-memory.dmp

Download

memory/3712-19-0x0000000005F90000-0x0000000005FF6000-memory.dmp

Download

memory/3712-40-0x00000000076E0000-0x0000000007714000-memory.dmp

Download

memory/3712-18-0x0000000005680000-0x00000000056A2000-memory.dmp

Download

memory/3712-49-0x0000000007740000-0x00000000077E4000-memory.dmp

Download

memory/3712-41-0x0000000074E60000-0x0000000074EAC000-memory.dmp

Download

memory/3712-48-0x0000000007720000-0x000000000773E000-memory.dmp

Download

memory/3712-37-0x0000000006A40000-0x0000000006A8C000-memory.dmp

Download

memory/3712-36-0x0000000006520000-0x000000000653E000-memory.dmp

Download

memory/3712-27-0x0000000006070000-0x00000000063C7000-memory.dmp

Download

memory/5080-33-0x0000000000400000-0x000000000073C000-memory.dmp

Download

memory/5332-61-0x0000000007CB0000-0x0000000007CC1000-memory.dmp

Download

memory/5332-58-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

Download

memory/5332-16-0x0000000005410000-0x0000000005420000-memory.dmp

Download

memory/5332-57-0x00000000080E0000-0x000000000875A000-memory.dmp

Download

memory/5332-60-0x0000000007D30000-0x0000000007DC6000-memory.dmp

Download

memory/5332-50-0x0000000074E60000-0x0000000074EAC000-memory.dmp

Download

memory/5332-65-0x0000000007DE0000-0x0000000007DE8000-memory.dmp

Download

memory/5696-190-0x0000000006D20000-0x0000000006D6C000-memory.dmp

Download

memory/5696-191-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/5696-198-0x00000000079A0000-0x0000000007A44000-memory.dmp

Download

memory/5696-206-0x0000000007CE0000-0x0000000007CF1000-memory.dmp

Download

memory/5696-207-0x0000000007D10000-0x0000000007D25000-memory.dmp

Download

memory/5888-199-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download