asyncrat | bcb2aaa30b4b82fac636eae9a9f290dfe43ea5023de8036c8ba3c0c66bf7be38

Resubmissions

07/09/2026, 12:55

260907-p54vpsxdjb

07/09/2026, 12:39

07/09/2026, 11:58

07/09/2026, 11:44

07/09/2026, 11:17

07/09/2026, 11:12

07/09/2026, 10:54

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AsyncClient.exe
Size 49KB
Sample260907-nd3b5avhlc
SHA256 bcb2aaa30b4b82fac636eae9a9f290dfe43ea5023de8036c8ba3c0c66bf7be38
MD5 ee0a41b295e9db0fc48e4ca1269023fb
SHA1 6923999c64cb9c52d9fd2d1a9ee4921650d11ef3
SHA512 05b011d1fc3f71dddecfdf98068b9b41f7203483b552fb8e324861a3a811a0bab19cccc8b0b609f1eaa13aeae18a6dd496b3886159767d7dae8e4564c93652b5
SSDEEP 768:jREHhW9C3crugN+AqPwngvAzBjbbganSsFDaPEGP2GnXjmFf+:jREjolbka5kO8XCFf+
TLSH
T187333B007FADC12EF6BE8F78A8F2314546B9E2673503D68A1CD411D61613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

test defense_evasion discovery execution asyncrat persistence rat suricata

Malware Config

Extracted

Family

asyncrat

Version

Reborn V1

Botnet

Test

43.228.157.121:8848

Mutex

pKrDVxvTuwqq

Attributes

delay
3
install
true
install_file
Gandon.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound 2 IoCs

Network activity triggered a Suricata alert

suricata asyncrat

flow	pid	Process
11	3164	Gandon.exe
11	3164	Gandon.exe

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000300000001e101-8.dat	family_asyncrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	AsyncClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	Gandon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	wguard.exe

Executes dropped EXE 3 IoCs

pid	Process
3164	Gandon.exe
2788	Gandon.exe
1296	wguard.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	api.ipify.org
16	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 46 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3376	cmd.exe
4836	cmd.exe
4248	cmd.exe
4332	cmd.exe
564	cmd.exe
652	cmd.exe
1720	cmd.exe
3980	cmd.exe
3312	cmd.exe
2676	cmd.exe
1964	cmd.exe
1740	cmd.exe
3776	cmd.exe
2112	cmd.exe
4896	cmd.exe
3916	cmd.exe
4676	cmd.exe
2736	cmd.exe
4680	cmd.exe
1068	cmd.exe
4224	cmd.exe
3316	cmd.exe
4028	cmd.exe
1820	cmd.exe
4976	cmd.exe
1072	cmd.exe
2896	cmd.exe
4136	cmd.exe
2460	cmd.exe
4460	cmd.exe
4168	cmd.exe
3080	cmd.exe
2168	cmd.exe
4164	cmd.exe
2548	cmd.exe
3972	cmd.exe
1276	cmd.exe
3764	cmd.exe
2996	cmd.exe
2200	cmd.exe
4828	cmd.exe
3492	cmd.exe
4368	cmd.exe
2040	cmd.exe
4740	cmd.exe
2476	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4768	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 45 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1732	schtasks.exe
2684	schtasks.exe
4944	schtasks.exe
636	schtasks.exe
4932	schtasks.exe
2164	schtasks.exe
4324	schtasks.exe
4724	schtasks.exe
4388	schtasks.exe
3892	schtasks.exe
2516	schtasks.exe
2148	schtasks.exe
1012	schtasks.exe
2856	schtasks.exe
4832	schtasks.exe
1416	schtasks.exe
1380	schtasks.exe
1128	schtasks.exe
4216	schtasks.exe
2820	schtasks.exe
1236	schtasks.exe
4804	schtasks.exe
1192	schtasks.exe
1560	schtasks.exe
4832	schtasks.exe
772	schtasks.exe
176	schtasks.exe
4636	schtasks.exe
4104	schtasks.exe
4300	schtasks.exe
4768	schtasks.exe
2588	schtasks.exe
4612	schtasks.exe
4240	schtasks.exe
4752	schtasks.exe
2024	schtasks.exe
968	schtasks.exe
2592	schtasks.exe
2732	schtasks.exe
2244	schtasks.exe
4100	schtasks.exe
2144	schtasks.exe
3624	schtasks.exe
3444	schtasks.exe
1752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
2300	AsyncClient.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe
1296	wguard.exe
3164	Gandon.exe
1296	wguard.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	AsyncClient.exe
Token: SeDebugPrivilege	3164	Gandon.exe
Token: SeDebugPrivilege	1296	wguard.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2548	2300	AsyncClient.exe	89
PID 2300 wrote to memory of 4368	2300	AsyncClient.exe	91
PID 4368 wrote to memory of 4768	4368	cmd.exe	93
PID 2548 wrote to memory of 2684	2548	cmd.exe	94
PID 4368 wrote to memory of 2788	4368	cmd.exe	99
PID 3164 wrote to memory of 1296	3164	Gandon.exe	105
PID 1296 wrote to memory of 3312	1296	wguard.exe	106
PID 3312 wrote to memory of 4100	3312	cmd.exe	108
PID 1296 wrote to memory of 2676	1296	wguard.exe	109
PID 2676 wrote to memory of 4832	2676	cmd.exe	111
PID 1296 wrote to memory of 4680	1296	wguard.exe	112
PID 4680 wrote to memory of 1012	4680	cmd.exe	114
PID 1296 wrote to memory of 2112	1296	wguard.exe	117
PID 2112 wrote to memory of 4388	2112	cmd.exe	119
PID 1296 wrote to memory of 2896	1296	wguard.exe	120
PID 2896 wrote to memory of 2856	2896	cmd.exe	122
PID 1296 wrote to memory of 3972	1296	wguard.exe	125
PID 1296 wrote to memory of 1068	1296	wguard.exe	129
PID 1068 wrote to memory of 4300	1068	cmd.exe	131
PID 1296 wrote to memory of 4224	1296	wguard.exe	132
PID 4224 wrote to memory of 4216	4224	cmd.exe	134
PID 1296 wrote to memory of 1276	1296	wguard.exe	135
PID 1276 wrote to memory of 4944	1276	cmd.exe	137
PID 1296 wrote to memory of 2040	1296	wguard.exe	138
PID 2040 wrote to memory of 4768	2040	cmd.exe	140
PID 1296 wrote to memory of 4136	1296	wguard.exe	141
PID 4136 wrote to memory of 636	4136	cmd.exe	143
PID 1296 wrote to memory of 2460	1296	wguard.exe	145
PID 2460 wrote to memory of 4932	2460	cmd.exe	147
PID 1296 wrote to memory of 4896	1296	wguard.exe	148
PID 4896 wrote to memory of 2144	4896	cmd.exe	150
PID 1296 wrote to memory of 3316	1296	wguard.exe	151
PID 3316 wrote to memory of 2164	3316	cmd.exe	153
PID 1296 wrote to memory of 3916	1296	wguard.exe	154
PID 3916 wrote to memory of 4832	3916	cmd.exe	156
PID 1296 wrote to memory of 1964	1296	wguard.exe	158
PID 1964 wrote to memory of 4752	1964	cmd.exe	160
PID 1296 wrote to memory of 4460	1296	wguard.exe	161
PID 4460 wrote to memory of 2820	4460	cmd.exe	163
PID 1296 wrote to memory of 4168	1296	wguard.exe	164
PID 4168 wrote to memory of 3624	4168	cmd.exe	166
PID 1296 wrote to memory of 3764	1296	wguard.exe	167
PID 3764 wrote to memory of 772	3764	cmd.exe	169
PID 1296 wrote to memory of 4028	1296	wguard.exe	170
PID 4028 wrote to memory of 1236	4028	cmd.exe	172
PID 1296 wrote to memory of 3080	1296	wguard.exe	173
PID 3080 wrote to memory of 2024	3080	cmd.exe	175
PID 1296 wrote to memory of 3980	1296	wguard.exe	176
PID 3980 wrote to memory of 2588	3980	cmd.exe	178
PID 1296 wrote to memory of 1820	1296	wguard.exe	179
PID 1820 wrote to memory of 4324	1820	cmd.exe	181
PID 1296 wrote to memory of 2996	1296	wguard.exe	182
PID 2996 wrote to memory of 3444	2996	cmd.exe	184
PID 1296 wrote to memory of 4976	1296	wguard.exe	185
PID 4976 wrote to memory of 4612	4976	cmd.exe	187
PID 1296 wrote to memory of 2200	1296	wguard.exe	188
PID 2200 wrote to memory of 1732	2200	cmd.exe	190
PID 1296 wrote to memory of 1740	1296	wguard.exe	191
PID 1740 wrote to memory of 1416	1740	cmd.exe	193
PID 1296 wrote to memory of 2168	1296	wguard.exe	194
PID 2168 wrote to memory of 4724	2168	cmd.exe	196
PID 1296 wrote to memory of 4828	1296	wguard.exe	197
PID 4828 wrote to memory of 4804	4828	cmd.exe	199
PID 1296 wrote to memory of 4164	1296	wguard.exe	200

C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe
"C:\Users\Admin\AppData\Local\Temp\AsyncClient.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp71B0.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4768
- - C:\Users\Admin\AppData\Roaming\Gandon.exe
    "C:\Users\Admin\AppData\Roaming\Gandon.exe"
    3⤵
    - Executes dropped EXE
    PID:2788

C:\Users\Admin\AppData\Roaming\Gandon.exe
"C:\Users\Admin\AppData\Roaming\Gandon.exe"
1⤵
- Suricata alert: AsyncRAT Malware Default X.509 Certificate Detected - Inbound
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Users\Admin\AppData\Roaming\wguard.exe
  "C:\Users\Admin\AppData\Roaming\wguard.exe" --watchdog
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4100
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2856
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3972
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4300
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4768
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4932
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4832
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4324
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4724
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4804
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4164
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    PID:3492
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    PID:2736
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4676
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4332
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1072
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3892
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    PID:3776
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    PID:564
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4740
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:652
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4240
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2476
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    PID:3376
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4836
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1720
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4248
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "Gandon" /tr '"C:\Users\Admin\AppData\Roaming\Gandon.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp71B0.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp71B0.tmp.bat
Size 150B
SHA256 45769f84dff70b85f4561f706a44a989de98f3fabc7a79f8407a6e373f43467c
MD5 e93edf872fa2f26c6ea0a8db032591e1
SHA1 0d19db8a26061ac219caea3e364f1e88b1103053
SHA512 050eab9cd4ff3f07d6b3c3066b6aa4acd3ca4dd5ea40ac4e792abde0a84693868a35904677dbb760544c66511498d15fd1d6cc081ec356e4151f5c8ed4d039b3
TLSH
T10CC02B5251C5EB0E2805141302FED4CCA1736C5D3F40BF10C348407D93C04C8F9D9345
MD5 SHA1 SHA512 TLSH

Submit Download

Gandon.exe

Path C:\Users\Admin\AppData\Roaming\Gandon.exe
Size 49KB
SHA256 bcb2aaa30b4b82fac636eae9a9f290dfe43ea5023de8036c8ba3c0c66bf7be38
MD5 ee0a41b295e9db0fc48e4ca1269023fb
SHA1 6923999c64cb9c52d9fd2d1a9ee4921650d11ef3
SHA512 05b011d1fc3f71dddecfdf98068b9b41f7203483b552fb8e324861a3a811a0bab19cccc8b0b609f1eaa13aeae18a6dd496b3886159767d7dae8e4564c93652b5
SSDEEP 768:jREHhW9C3crugN+AqPwngvAzBjbbganSsFDaPEGP2GnXjmFf+:jREjolbka5kO8XCFf+
TLSH
T187333B007FADC12EF6BE8F78A8F2314546B9E2673503D68A1CD411D61613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2300-0-0x0000000000FB0000-0x0000000000FC2000-memory.dmp

Download

memory/2300-1-0x0000000005980000-0x0000000005990000-memory.dmp

Download

memory/2300-2-0x0000000005990000-0x0000000005A2C000-memory.dmp

Download

memory/3164-23-0x0000000006460000-0x0000000006A04000-memory.dmp

Download

memory/3164-24-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Download