asyncrat | 3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb

Analysis

max time kernel
47s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
Size 836KB
Sample260910-dskeraxxet
SHA256 3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb
MD5 38efb993e9a8c7facd8e026a1e15dc53
SHA1 ade51b85c529ea7d639f35d9395917e5a3e3b3bd
SHA512 c7c1cf4d9b8b9ba07bbccdf45e0d57b98208dc482a9ede3174d51425d3bcc414771249c87a77b938a07300ab8a859264704a01f28c25523825743bd94f8bee65
SSDEEP 24576:80aOEcA3VfnMb86uQniPXdM2xfMFkdTDmlw1qj0qdPS:qOLoV/MHT2xMF8m2sM
TLSH
T1510501683B5AD403D96567B80A71F2B41BBD2DEEA900D3875FD9ADEF78B5F010D00292
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

default defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

64.89.160.29:5566

Mutex

NvbzswGT7pdS

Attributes

delay
3
install
true
install_file
chill.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4960	powershell.exe
2672	powershell.exe
1516	powershell.exe
1360	powershell.exe
1120	powershell.exe
4808	powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
5476	Kj.exe
5896	chill.exe
4592	chill.exe
712	Kj.exe
2228	chill.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kj = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$gfslci=Get-Date;$yb0quf=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$gfslci=Get-Date;$ccn0c3=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXEtqLmV4ZQ==')));$uxhrxs=$env:COMPUTERNAME;& $yb0quf -FilePath $ccn0c3\""	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1456 set thread context of 924	1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe	91
PID 5476 set thread context of 712	5476	Kj.exe	107
PID 5896 set thread context of 2228	5896	chill.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2264	cmd.exe
5176	cmd.exe
1052	cmd.exe
2704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
6084	timeout.exe
3408	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2448	schtasks.exe
6016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
1120	powershell.exe
1120	powershell.exe
4808	powershell.exe
4808	powershell.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
5476	Kj.exe
5476	Kj.exe
5476	Kj.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
5896	chill.exe
5896	chill.exe
5896	chill.exe
2672	powershell.exe
2672	powershell.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeIncreaseQuotaPrivilege	1120	powershell.exe
Token: SeSecurityPrivilege	1120	powershell.exe
Token: SeTakeOwnershipPrivilege	1120	powershell.exe
Token: SeLoadDriverPrivilege	1120	powershell.exe
Token: SeSystemProfilePrivilege	1120	powershell.exe
Token: SeSystemtimePrivilege	1120	powershell.exe
Token: SeProfSingleProcessPrivilege	1120	powershell.exe
Token: SeIncBasePriorityPrivilege	1120	powershell.exe
Token: SeCreatePagefilePrivilege	1120	powershell.exe
Token: SeBackupPrivilege	1120	powershell.exe
Token: SeRestorePrivilege	1120	powershell.exe
Token: SeShutdownPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeSystemEnvironmentPrivilege	1120	powershell.exe
Token: SeRemoteShutdownPrivilege	1120	powershell.exe
Token: SeUndockPrivilege	1120	powershell.exe
Token: SeManageVolumePrivilege	1120	powershell.exe
Token: 33	1120	powershell.exe
Token: 34	1120	powershell.exe
Token: 35	1120	powershell.exe
Token: 36	1120	powershell.exe
Token: SeDebugPrivilege	924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
Token: SeDebugPrivilege	5476	Kj.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeIncreaseQuotaPrivilege	4960	powershell.exe
Token: SeSecurityPrivilege	4960	powershell.exe
Token: SeTakeOwnershipPrivilege	4960	powershell.exe
Token: SeLoadDriverPrivilege	4960	powershell.exe
Token: SeSystemProfilePrivilege	4960	powershell.exe
Token: SeSystemtimePrivilege	4960	powershell.exe
Token: SeProfSingleProcessPrivilege	4960	powershell.exe
Token: SeIncBasePriorityPrivilege	4960	powershell.exe
Token: SeCreatePagefilePrivilege	4960	powershell.exe
Token: SeBackupPrivilege	4960	powershell.exe
Token: SeRestorePrivilege	4960	powershell.exe
Token: SeShutdownPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeSystemEnvironmentPrivilege	4960	powershell.exe
Token: SeRemoteShutdownPrivilege	4960	powershell.exe
Token: SeUndockPrivilege	4960	powershell.exe
Token: SeManageVolumePrivilege	4960	powershell.exe
Token: 33	4960	powershell.exe
Token: 34	4960	powershell.exe
Token: 35	4960	powershell.exe
Token: 36	4960	powershell.exe
Token: SeDebugPrivilege	5896	chill.exe
Token: SeDebugPrivilege	2672	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1120	1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe	89
PID 1456 wrote to memory of 924	1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe	91
PID 1456 wrote to memory of 924	1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe	91
PID 1456 wrote to memory of 924	1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe	91
PID 1456 wrote to memory of 924	1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe	91
PID 1456 wrote to memory of 924	1456	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe	91
PID 4808 wrote to memory of 5476	4808	powershell.exe	94
PID 924 wrote to memory of 2264	924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe	96
PID 924 wrote to memory of 5176	924	3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe	98
PID 5176 wrote to memory of 6084	5176	cmd.exe	101
PID 2264 wrote to memory of 2448	2264	cmd.exe	100
PID 5176 wrote to memory of 4592	5176	cmd.exe	104
PID 5476 wrote to memory of 4960	5476	Kj.exe	105
PID 5476 wrote to memory of 712	5476	Kj.exe	107
PID 5476 wrote to memory of 712	5476	Kj.exe	107
PID 5476 wrote to memory of 712	5476	Kj.exe	107
PID 5476 wrote to memory of 712	5476	Kj.exe	107
PID 5476 wrote to memory of 712	5476	Kj.exe	107
PID 5896 wrote to memory of 2672	5896	chill.exe	108
PID 5896 wrote to memory of 2228	5896	chill.exe	110
PID 5896 wrote to memory of 2228	5896	chill.exe	110
PID 5896 wrote to memory of 2228	5896	chill.exe	110
PID 5896 wrote to memory of 2228	5896	chill.exe	110
PID 5896 wrote to memory of 2228	5896	chill.exe	110

C:\Users\Admin\AppData\Local\Temp\3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
"C:\Users\Admin\AppData\Local\Temp\3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe
  "C:\Users\Admin\AppData\Local\Temp\3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chill" /tr '"C:\Users\Admin\AppData\Roaming\chill.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "chill" /tr '"C:\Users\Admin\AppData\Roaming\chill.exe"'
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7313.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5176
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:6084
  - - C:\Users\Admin\AppData\Roaming\chill.exe
      "C:\Users\Admin\AppData\Roaming\chill.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4592
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\chill.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1516
    - - C:\Users\Admin\AppData\Roaming\chill.exe
        
        "C:\Users\Admin\AppData\Roaming\chill.exe"
        5⤵
        
        PID:6128

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$gfslci=Get-Date;$yb0quf=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$gfslci=Get-Date;$ccn0c3=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXEtqLmV4ZQ==')));$uxhrxs=$env:COMPUTERNAME;& $yb0quf -FilePath $ccn0c3"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Roaming\Kj.exe
  "C:\Users\Admin\AppData\Roaming\Kj.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Kj.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Users\Admin\AppData\Roaming\Kj.exe
    "C:\Users\Admin\AppData\Roaming\Kj.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:712
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "chill" /tr '"C:\Users\Admin\AppData\Roaming\chill.exe"' & exit
      4⤵
      Executes a command shell one-liner
      PID:1052
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "chill" /tr '"C:\Users\Admin\AppData\Roaming\chill.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD557.tmp.bat""
      4⤵
      Executes a command shell one-liner
      PID:2704
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:3408
    - - C:\Users\Admin\AppData\Roaming\chill.exe
        
        "C:\Users\Admin\AppData\Roaming\chill.exe"
        5⤵
        
        PID:4856
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\chill.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1360
      - C:\Users\Admin\AppData\Roaming\chill.exe
        
        "C:\Users\Admin\AppData\Roaming\chill.exe"
        6⤵
        
        PID:560
      - C:\Users\Admin\AppData\Roaming\chill.exe
        
        "C:\Users\Admin\AppData\Roaming\chill.exe"
        6⤵
        
        PID:5260

C:\Users\Admin\AppData\Roaming\chill.exe
"C:\Users\Admin\AppData\Roaming\chill.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\chill.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Users\Admin\AppData\Roaming\chill.exe
  "C:\Users\Admin\AppData\Roaming\chill.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 525a81bb02be1517d612dbfd99d87c4c17a3373cb551e0df1e8f8cf13217cd41
MD5 8905c6bb13ae817f6b222e43459fc744
SHA1 6231207622961ea0ac1e053d3597685c22d7ecd6
SHA512 be2810ba61f4198ce3fd4162fa8fa85e7e45305bf54f1e1793a9f3302668abda0abd5eea7bc76fc269afdb8cbbcd99d27a22cd05459a685799753e1940c9aa7e
SSDEEP 384:q1eBaoT1iBGzGW14bLYht9zUSiJF2PntIAXr4B+VW8utzKwgvYbhNaP8lRtDZRfG:6exZ6GaWiX0t9zwQFIAXrq+yV/bhNaPx
TLSH
T1F2A2B578203F6DC7D8D226B410D20AE7FBE4D489DAB61194BF1BDE2F4C90EB74A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 864e5a6c85af1c44987925adb56cadfa207ec1cf91fd7bb80a72329eefc437b4
MD5 8c1f73b46caa66c3749e77284890fd3f
SHA1 270edf2c7e3fbaf310f567a38f533edcdb087bf8
SHA512 5561b52c55d12e469e1cd6be937de5f0b2c4b3f785b3dc23bfe81b2a0f26efe299921f173fae381f24715644f32854f2d00dfca040a11b72e442f86738a5e529
SSDEEP 384:S1eBaoT1iBGJhGl25/QnPO9D+MdevRsWOEkMzdC0AIACOwFjAbMuVZvqBUwUv2Fg:SexZ6GJ0l25oP+D+ceNZC0AIAX2jloZZ
TLSH
T1A6A2E628266F8DCBEE5260B400920786FBE4D555E7E192DBEF0BC91F1C45A7E8E501F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 f0ce1e4c7db38a2750ed41ad74b8473f3f7597840b12243a6a5563679a6112e9
MD5 0fb1da15276855427a46deebd8952929
SHA1 2a431e76c0071fc9a2c7eebf7185f75b1b0b9dd7
SHA512 13d4b9c4dc387a4cfc848ffb51f48bb010bdcc8d4f2f5ce38366fe578c1747a4610b086e542e1a761b104d8061ac928028b2961129a97d48cd062a27661cd08b
SSDEEP 384:MSEboT1iBGMR61bKSdYGY+C+gszhR2PtWOEPiUDzdC0AIACOwFjsbQOwaqBUwYvo:g0Z6GMAGyhY5+gISUN6UFC0AIAX2j1lB
TLSH
T12FA2182D262F99CBD85150B410820786FBF8D569EBE191DBFB4BC91F1C40A7E5E900F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bf1elef5.cwu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bf1elef5.cwu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp7313.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp7313.tmp.bat
Size 149B
SHA256 f3927d3e800b31211d7287f70cfd5b61fc53c08382060ff19fd06113852d3c3e
MD5 fa79e040abb42ea5c594b7c1886ae55b
SHA1 236907151fdcd7c1966cb443f99ac2e26138df7c
SHA512 79aa40b11c50283b155400d3c40734ae05ae9932a0f5af909f7a96d63e5d9cf147db628b65617b72da48b8f640e721dc76666f807b1d6213bbb4bc8e4f98086b
TLSH
T1D2C02B4251CBEF8E7806145312FAD4ACA173AC593F40BB80C304444E5380458F8DB381
MD5 SHA1 SHA512 TLSH

Submit Download

tmpD557.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpD557.tmp.bat
Size 149B
SHA256 900b155d6c45f3f09b6dc11923ca32483ca2b82403d84aca50a2da074630404a
MD5 4037e36347c8a2c3fd3485c6facccf9f
SHA1 539ec23047d23b99a5516c06a2f765ce3007ec9f
SHA512 8cb0f8fe3d4e8639cb34132914c2dd5893ba38d964e53d11bd6c2db8671b0b9d135751a882cdcac1778846a06c28d441fb602868357158e078aca70d59aaa5e1
TLSH
T11EC02B4255C6EA9E3807547312FAD49C91B3BC5A3F40BF80D744444E12C0848F0DA381
MD5 SHA1 SHA512 TLSH

Submit Download

Kj.exe

Path C:\Users\Admin\AppData\Roaming\Kj.exe
Size 836KB
SHA256 3f16c2e20ffd1141aeb8e81adb17f784d492db0886179f5898233ce376a63efb
MD5 38efb993e9a8c7facd8e026a1e15dc53
SHA1 ade51b85c529ea7d639f35d9395917e5a3e3b3bd
SHA512 c7c1cf4d9b8b9ba07bbccdf45e0d57b98208dc482a9ede3174d51425d3bcc414771249c87a77b938a07300ab8a859264704a01f28c25523825743bd94f8bee65
SSDEEP 24576:80aOEcA3VfnMb86uQniPXdM2xfMFkdTDmlw1qj0qdPS:qOLoV/MHT2xMF8m2sM
TLSH
T1510501683B5AD403D96567B80A71F2B41BBD2DEEA900D3875FD9ADEF78B5F010D00292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-14-0x0000000074470000-0x0000000074C2C000-memory.dmp

Download

memory/924-50-0x0000000074470000-0x0000000074C2C000-memory.dmp

Download

memory/924-11-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1120-15-0x0000000005750000-0x0000000005D9A000-memory.dmp

Download

memory/1120-23-0x0000000005DE0000-0x000000000613B000-memory.dmp

Download

memory/1120-38-0x0000000007CB0000-0x000000000832C000-memory.dmp

Download

memory/1120-39-0x0000000007670000-0x000000000768A000-memory.dmp

Download

memory/1120-13-0x0000000074470000-0x0000000074C2C000-memory.dmp

Download

memory/1120-32-0x00000000072F0000-0x0000000007326000-memory.dmp

Download

memory/1120-16-0x0000000074470000-0x0000000074C2C000-memory.dmp

Download

memory/1120-17-0x0000000005530000-0x0000000005552000-memory.dmp

Download

memory/1120-19-0x0000000005640000-0x00000000056A6000-memory.dmp

Download

memory/1120-18-0x00000000055D0000-0x0000000005636000-memory.dmp

Download

memory/1120-22-0x0000000074470000-0x0000000074C2C000-memory.dmp

Download

memory/1120-40-0x00000000076E0000-0x00000000076EA000-memory.dmp

Download

memory/1120-12-0x0000000002B00000-0x0000000002B36000-memory.dmp

Download

memory/1120-25-0x0000000006300000-0x000000000631E000-memory.dmp

Download

memory/1120-26-0x0000000006350000-0x000000000639C000-memory.dmp

Download

memory/1120-41-0x00000000078E0000-0x0000000007976000-memory.dmp

Download

memory/1120-44-0x0000000074470000-0x0000000074C2C000-memory.dmp

Download

memory/1120-33-0x0000000074D30000-0x0000000074D7C000-memory.dmp

Download

memory/1120-37-0x0000000007530000-0x00000000075D3000-memory.dmp

Download

memory/1120-36-0x00000000068E0000-0x0000000006900000-memory.dmp

Download

memory/1360-98-0x00000000062F0000-0x000000000664B000-memory.dmp

Download

memory/1360-100-0x0000000006D80000-0x0000000006DCC000-memory.dmp

Download

memory/1360-101-0x0000000070760000-0x00000000707AC000-memory.dmp

Download

memory/1360-104-0x0000000007AE0000-0x0000000007B83000-memory.dmp

Download

memory/1456-24-0x0000000074470000-0x0000000074C2C000-memory.dmp

Download

memory/1456-6-0x0000000074470000-0x0000000074C2C000-memory.dmp

Download

memory/1456-8-0x0000000074482000-0x0000000074483000-memory.dmp

Download

memory/1456-5-0x0000000004E50000-0x0000000004EEC000-memory.dmp

Download

memory/1456-4-0x0000000004C30000-0x0000000004C3A000-memory.dmp

Download

memory/1456-0-0x0000000074482000-0x0000000074483000-memory.dmp

Download

memory/1456-10-0x0000000007790000-0x000000000783C000-memory.dmp

Download

memory/1456-9-0x0000000074470000-0x0000000074C2C000-memory.dmp

Download

memory/1456-1-0x0000000000180000-0x0000000000258000-memory.dmp

Download

memory/1456-3-0x0000000004CE0000-0x0000000004D72000-memory.dmp

Download

memory/1456-7-0x0000000005120000-0x000000000513E000-memory.dmp

Download

memory/1456-2-0x00000000052A0000-0x000000000585A000-memory.dmp

Download

memory/1516-80-0x00000000706E0000-0x000000007072C000-memory.dmp

Download

memory/2672-71-0x0000000006810000-0x000000000685C000-memory.dmp

Download

memory/2672-75-0x00000000074B0000-0x0000000007553000-memory.dmp

Download

memory/2672-72-0x00000000706E0000-0x000000007072C000-memory.dmp

Download

memory/4808-29-0x000001EE75470000-0x000001EE75492000-memory.dmp

Download

memory/4960-64-0x0000000006FC0000-0x0000000007063000-memory.dmp

Download

memory/4960-61-0x0000000070660000-0x00000000706AC000-memory.dmp

Download

memory/4960-60-0x0000000006190000-0x00000000061DC000-memory.dmp

Download

memory/4960-56-0x0000000005800000-0x0000000005B5B000-memory.dmp

Download