fa6a194b62bbd5ac25d7cfb04a4ac00203cca653fcbafc6e5836c879eb1c7e42

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XwormKiller.exe
Size 64.4MB
Sample260628-p6pr6shs8s
SHA256 fa6a194b62bbd5ac25d7cfb04a4ac00203cca653fcbafc6e5836c879eb1c7e42
MD5 e89e9e56e72bfae60e2c7d6ab98a577c
SHA1 c54c0a8dc3f18c74cdae5b82cabf7b39eeabe936
SHA512 743ea8c887a2416fb4b644571ca6133f7f3532dab5d8b9abd839fd6744559c87a5a3a73e35882b139bc140a07ea459fa10e603a879e86cebb6cdb81614e5ce25
SSDEEP 393216:rdrz7whrvICwjekYGDiOtyx9z2lZAYVFexglb/vE5L5OtsFtrNTaDvd44dJNgfuo:hgjJMiOAx9EeCUV5OtsFRta9dy
TLSH
T1ABE7AF15B3D80A06E63FC27DC2638112E7F1B4931352D6CF0558EA992F53BC1AB7B266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 42 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2408	netsh.exe
5000	netsh.exe
2096	netsh.exe
1320	netsh.exe
3944	netsh.exe
2340	netsh.exe
6028	netsh.exe
1760	netsh.exe
3348	netsh.exe
3704	netsh.exe
5352	netsh.exe
3932	netsh.exe
1944	netsh.exe
5560	netsh.exe
720	netsh.exe
1636	netsh.exe
5464	netsh.exe
4276	netsh.exe
1732	netsh.exe
2300	netsh.exe
5768	netsh.exe
4152	netsh.exe
3104	netsh.exe
2860	netsh.exe
5604	netsh.exe
1124	netsh.exe
4608	netsh.exe
1972	netsh.exe
2540	netsh.exe
5816	netsh.exe
1404	netsh.exe
6052	netsh.exe
1892	netsh.exe
2224	netsh.exe
2504	netsh.exe
2992	netsh.exe
5940	netsh.exe
5496	netsh.exe
4756	netsh.exe
1940	netsh.exe
3636	netsh.exe
5324	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4392	XwormKiller.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4392	XwormKiller.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 4384	4392	XwormKiller.exe	90
PID 4392 wrote to memory of 4100	4392	XwormKiller.exe	92
PID 4392 wrote to memory of 6036	4392	XwormKiller.exe	94
PID 4392 wrote to memory of 2944	4392	XwormKiller.exe	96
PID 4392 wrote to memory of 5348	4392	XwormKiller.exe	98
PID 4392 wrote to memory of 5248	4392	XwormKiller.exe	100
PID 4392 wrote to memory of 5932	4392	XwormKiller.exe	102
PID 4392 wrote to memory of 4280	4392	XwormKiller.exe	104
PID 4392 wrote to memory of 2600	4392	XwormKiller.exe	106
PID 4392 wrote to memory of 844	4392	XwormKiller.exe	108
PID 4392 wrote to memory of 1816	4392	XwormKiller.exe	110
PID 4392 wrote to memory of 4068	4392	XwormKiller.exe	112
PID 4392 wrote to memory of 4924	4392	XwormKiller.exe	114
PID 4392 wrote to memory of 1748	4392	XwormKiller.exe	116
PID 4392 wrote to memory of 2968	4392	XwormKiller.exe	118
PID 4392 wrote to memory of 1708	4392	XwormKiller.exe	120
PID 4392 wrote to memory of 2336	4392	XwormKiller.exe	122
PID 4392 wrote to memory of 1404	4392	XwormKiller.exe	124
PID 4392 wrote to memory of 5352	4392	XwormKiller.exe	126
PID 4392 wrote to memory of 2992	4392	XwormKiller.exe	128
PID 4392 wrote to memory of 3932	4392	XwormKiller.exe	130
PID 4392 wrote to memory of 2340	4392	XwormKiller.exe	132
PID 4392 wrote to memory of 1944	4392	XwormKiller.exe	134
PID 4392 wrote to memory of 5464	4392	XwormKiller.exe	136
PID 4392 wrote to memory of 6028	4392	XwormKiller.exe	138
PID 4392 wrote to memory of 6052	4392	XwormKiller.exe	140
PID 4392 wrote to memory of 1892	4392	XwormKiller.exe	142
PID 4392 wrote to memory of 4276	4392	XwormKiller.exe	144
PID 4392 wrote to memory of 1732	4392	XwormKiller.exe	146
PID 4392 wrote to memory of 2224	4392	XwormKiller.exe	148
PID 4392 wrote to memory of 1940	4392	XwormKiller.exe	150
PID 4392 wrote to memory of 2096	4392	XwormKiller.exe	152
PID 4392 wrote to memory of 5560	4392	XwormKiller.exe	154
PID 4392 wrote to memory of 2300	4392	XwormKiller.exe	156
PID 4392 wrote to memory of 3636	4392	XwormKiller.exe	158
PID 4392 wrote to memory of 720	4392	XwormKiller.exe	160
PID 4392 wrote to memory of 5324	4392	XwormKiller.exe	162
PID 4392 wrote to memory of 3104	4392	XwormKiller.exe	164
PID 4392 wrote to memory of 2408	4392	XwormKiller.exe	166
PID 4392 wrote to memory of 5940	4392	XwormKiller.exe	168
PID 4392 wrote to memory of 5768	4392	XwormKiller.exe	170
PID 4392 wrote to memory of 2860	4392	XwormKiller.exe	172
PID 4392 wrote to memory of 5604	4392	XwormKiller.exe	174
PID 4392 wrote to memory of 1124	4392	XwormKiller.exe	176
PID 4392 wrote to memory of 1760	4392	XwormKiller.exe	178
PID 4392 wrote to memory of 4608	4392	XwormKiller.exe	180
PID 4392 wrote to memory of 1972	4392	XwormKiller.exe	182
PID 4392 wrote to memory of 5496	4392	XwormKiller.exe	184
PID 4392 wrote to memory of 2540	4392	XwormKiller.exe	186
PID 4392 wrote to memory of 3348	4392	XwormKiller.exe	188
PID 4392 wrote to memory of 4756	4392	XwormKiller.exe	190
PID 4392 wrote to memory of 4152	4392	XwormKiller.exe	192
PID 4392 wrote to memory of 1636	4392	XwormKiller.exe	194
PID 4392 wrote to memory of 5816	4392	XwormKiller.exe	196
PID 4392 wrote to memory of 5000	4392	XwormKiller.exe	198
PID 4392 wrote to memory of 2504	4392	XwormKiller.exe	200
PID 4392 wrote to memory of 1320	4392	XwormKiller.exe	202
PID 4392 wrote to memory of 3944	4392	XwormKiller.exe	204
PID 4392 wrote to memory of 3704	4392	XwormKiller.exe	206

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XwormKiller.exe
"C:\Users\Admin\AppData\Local\Temp\XwormKiller.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /query /fo csv /nh
  2⤵
  PID:4384
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\Report policies" /f
  2⤵
  PID:4100
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\Report policies" /f
  2⤵
  PID:6036
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan" /f
  2⤵
  PID:2944
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /f
  2⤵
  PID:5348
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /f
  2⤵
  PID:5248
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /f
  2⤵
  PID:5932
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /f
  2⤵
  PID:4280
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task" /f
  2⤵
  PID:2600
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\Start Oobe Expedite Work" /f
  2⤵
  PID:844
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScanAfterUpdate" /f
  2⤵
  PID:1816
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_LicenseAccepted" /f
  2⤵
  PID:4068
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\StartOobeAppsScan_OobeAppReady" /f
  2⤵
  PID:4924
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /f
  2⤵
  PID:1748
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" /f
  2⤵
  PID:2968
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /delete /tn "\Microsoft\Windows\UpdateOrchestrator\UUS Failover Task" /f
  2⤵
  PID:1708
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q C:\$Recycle.Bin 2>nul
  2⤵
  PID:2336
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_1337"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1404
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_1337" dir=in action=block protocol=tcp localport=1337
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5352
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_1337_out" dir=out action=block protocol=tcp localport=1337
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2992
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_4444"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3932
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_4444" dir=in action=block protocol=tcp localport=4444
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2340
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_4444_out" dir=out action=block protocol=tcp localport=4444
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1944
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_5555"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5464
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_5555" dir=in action=block protocol=tcp localport=5555
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:6028
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_5555_out" dir=out action=block protocol=tcp localport=5555
  2⤵
  - Modifies Windows Firewall
  PID:6052
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_6666"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1892
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_6666" dir=in action=block protocol=tcp localport=6666
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4276
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_6666_out" dir=out action=block protocol=tcp localport=6666
  2⤵
  - Modifies Windows Firewall
  PID:1732
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_7777"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2224
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_7777" dir=in action=block protocol=tcp localport=7777
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1940
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_7777_out" dir=out action=block protocol=tcp localport=7777
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2096
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_8888"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5560
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_8888" dir=in action=block protocol=tcp localport=8888
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2300
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_8888_out" dir=out action=block protocol=tcp localport=8888
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3636
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_9999"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:720
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_9999" dir=in action=block protocol=tcp localport=9999
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5324
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_9999_out" dir=out action=block protocol=tcp localport=9999
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3104
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_8080"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2408
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_8080" dir=in action=block protocol=tcp localport=8080
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5940
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_8080_out" dir=out action=block protocol=tcp localport=8080
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5768
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_1604"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2860
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_1604" dir=in action=block protocol=tcp localport=1604
  2⤵
  - Modifies Windows Firewall
  PID:5604
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_1604_out" dir=out action=block protocol=tcp localport=1604
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1124
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_3306"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1760
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_3306" dir=in action=block protocol=tcp localport=3306
  2⤵
  - Modifies Windows Firewall
  PID:4608
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_3306_out" dir=out action=block protocol=tcp localport=3306
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1972
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_3389"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5496
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_3389" dir=in action=block protocol=tcp localport=3389
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2540
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_3389_out" dir=out action=block protocol=tcp localport=3389
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3348
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_5900"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4756
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_5900" dir=in action=block protocol=tcp localport=5900
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:4152
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_5900_out" dir=out action=block protocol=tcp localport=5900
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1636
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_54321"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5816
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_54321" dir=in action=block protocol=tcp localport=54321
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:5000
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_54321_out" dir=out action=block protocol=tcp localport=54321
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:2504
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall delete rule name="Block_RAT_Port_31337"
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1320
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_31337" dir=in action=block protocol=tcp localport=31337
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3944
- C:\Windows\SYSTEM32\netsh.exe
  "netsh.exe" advfirewall firewall add rule name="Block_RAT_Port_31337_out" dir=out action=block protocol=tcp localport=31337
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3704