quasar | 8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2

Analysis

max time kernel
83s
max time network
156s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-05-2022 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
Size

618KB
MD5

b4a017055a4928d2c8d7261285f9bda9
SHA1

4987b49f51a86f302d77f48c542e270952242b13
SHA256

8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2
SHA512

c75306c8514ebe0ccb10c2d31c0323d4c1d0cce98f3e20c30bf18e965bf040c0237c9d1afee38f79ee8d62b16839c6b67dfe35753a77ae046211eadc808dad2c

Score

10^/10

quasar venomrat windows defender security host evasion persistence rat rootkit spyware stealer suricata trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Windows Defender Security Host

vilvaraj-32652.portmap.io:32652

Mutex

VNM_MUTEX_s1ArJSYbui8dt0HUpJ

Attributes

encryption_key
8gl4TCjsLQUmqCIxalku
install_name
Windows Defender Security Host.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Defender Security Host
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 8 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/276-60-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/276-61-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/276-62-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/276-63-0x0000000000486CAE-mapping.dmp	disable_win_def
behavioral1/memory/276-65-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/276-67-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/1016-83-0x0000000000486CAE-mapping.dmp	disable_win_def
behavioral1/memory/952-104-0x0000000000486CAE-mapping.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Quasar Payload 8 IoCs

resource	yara_rule
behavioral1/memory/276-60-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/276-61-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/276-62-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/276-63-0x0000000000486CAE-mapping.dmp	family_quasar
behavioral1/memory/276-65-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/276-67-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/1016-83-0x0000000000486CAE-mapping.dmp	family_quasar
behavioral1/memory/952-104-0x0000000000486CAE-mapping.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata

Executes dropped EXE 3 IoCs

pid	Process
1036	Windows Defender Security Host.exe
1336	Windows Defender Security Host.exe
1016	Windows Defender Security Host.exe

Loads dropped DLL 1 IoCs

pid	Process
276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zHRMiXKHpW = "C:\\Users\\Admin\\AppData\\Roaming\\LbFPJdQtDA\\ZmFSAqsNCM.exe"	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security Host = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe\""	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 1036 set thread context of 1016	1036	Windows Defender Security Host.exe	34
PID 1688 set thread context of 952	1688	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	44

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1700	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1380	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1036	Windows Defender Security Host.exe
1036	Windows Defender Security Host.exe
1648	powershell.exe
276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
952	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
952	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
Token: SeDebugPrivilege	1036	Windows Defender Security Host.exe
Token: SeDebugPrivilege	1648	powershell.exe
Token: SeDebugPrivilege	952	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 2020 wrote to memory of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 2020 wrote to memory of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 2020 wrote to memory of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 2020 wrote to memory of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 2020 wrote to memory of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 2020 wrote to memory of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 2020 wrote to memory of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 2020 wrote to memory of 276	2020	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	27
PID 276 wrote to memory of 1700	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	29
PID 276 wrote to memory of 1700	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	29
PID 276 wrote to memory of 1700	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	29
PID 276 wrote to memory of 1700	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	29
PID 276 wrote to memory of 1036	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	31
PID 276 wrote to memory of 1036	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	31
PID 276 wrote to memory of 1036	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	31
PID 276 wrote to memory of 1036	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	31
PID 1036 wrote to memory of 1336	1036	Windows Defender Security Host.exe	32
PID 1036 wrote to memory of 1336	1036	Windows Defender Security Host.exe	32
PID 1036 wrote to memory of 1336	1036	Windows Defender Security Host.exe	32
PID 1036 wrote to memory of 1336	1036	Windows Defender Security Host.exe	32
PID 1036 wrote to memory of 1016	1036	Windows Defender Security Host.exe	34
PID 1036 wrote to memory of 1016	1036	Windows Defender Security Host.exe	34
PID 1036 wrote to memory of 1016	1036	Windows Defender Security Host.exe	34
PID 1036 wrote to memory of 1016	1036	Windows Defender Security Host.exe	34
PID 1036 wrote to memory of 1016	1036	Windows Defender Security Host.exe	34
PID 1036 wrote to memory of 1016	1036	Windows Defender Security Host.exe	34
PID 276 wrote to memory of 1648	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	33
PID 276 wrote to memory of 1648	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	33
PID 276 wrote to memory of 1648	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	33
PID 276 wrote to memory of 1648	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	33
PID 1036 wrote to memory of 1016	1036	Windows Defender Security Host.exe	34
PID 1036 wrote to memory of 1016	1036	Windows Defender Security Host.exe	34
PID 1036 wrote to memory of 1016	1036	Windows Defender Security Host.exe	34
PID 276 wrote to memory of 1104	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	36
PID 276 wrote to memory of 1104	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	36
PID 276 wrote to memory of 1104	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	36
PID 276 wrote to memory of 1104	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	36
PID 1104 wrote to memory of 988	1104	cmd.exe	38
PID 1104 wrote to memory of 988	1104	cmd.exe	38
PID 1104 wrote to memory of 988	1104	cmd.exe	38
PID 1104 wrote to memory of 988	1104	cmd.exe	38
PID 276 wrote to memory of 1528	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	39
PID 276 wrote to memory of 1528	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	39
PID 276 wrote to memory of 1528	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	39
PID 276 wrote to memory of 1528	276	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	39
PID 1528 wrote to memory of 1540	1528	cmd.exe	41
PID 1528 wrote to memory of 1540	1528	cmd.exe	41
PID 1528 wrote to memory of 1540	1528	cmd.exe	41
PID 1528 wrote to memory of 1540	1528	cmd.exe	41
PID 1528 wrote to memory of 1380	1528	cmd.exe	42
PID 1528 wrote to memory of 1380	1528	cmd.exe	42
PID 1528 wrote to memory of 1380	1528	cmd.exe	42
PID 1528 wrote to memory of 1380	1528	cmd.exe	42
PID 1528 wrote to memory of 1688	1528	cmd.exe	43
PID 1528 wrote to memory of 1688	1528	cmd.exe	43
PID 1528 wrote to memory of 1688	1528	cmd.exe	43
PID 1528 wrote to memory of 1688	1528	cmd.exe	43
PID 1688 wrote to memory of 952	1688	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	44
PID 1688 wrote to memory of 952	1688	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	44
PID 1688 wrote to memory of 952	1688	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	44
PID 1688 wrote to memory of 952	1688	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	44
PID 1688 wrote to memory of 952	1688	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	44
PID 1688 wrote to memory of 952	1688	8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe	44

C:\Users\Admin\AppData\Local\Temp\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
"C:\Users\Admin\AppData\Local\Temp\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
  "C:\Users\Admin\AppData\Local\Temp\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe"
  2⤵
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Defender Security Host" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1700
- - C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe"
      4⤵
      Executes dropped EXE
      PID:1336
  - - C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe"
      4⤵
      Executes dropped EXE
      PID:1016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\g6y0ASXYmC0g.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1528
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
      "C:\Users\Admin\AppData\Local\Temp\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1688
    - - C:\Users\Admin\AppData\Local\Temp\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\g6y0ASXYmC0g.bat

Filesize
261B

MD5
46530d655e77cc6c47e0c96d20c61914

SHA1
5116da87413c5485a6bce82094155f25d23b7068

SHA256
67f0daf1429a3c32d47008cdcaaa2b957d70f50097e0084339a2b7f9c9d2e92d

SHA512
7e1527e517bbb8ec4f3de3ac281f82b784cbee7e69f061cf8cd6134e932e00f3c6e80081858bdceace361874c5c218daedd0c7e35c1c96b61bfab789d584ca45

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe

Filesize
618KB

MD5
b4a017055a4928d2c8d7261285f9bda9

SHA1
4987b49f51a86f302d77f48c542e270952242b13

SHA256
8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2

SHA512
c75306c8514ebe0ccb10c2d31c0323d4c1d0cce98f3e20c30bf18e965bf040c0237c9d1afee38f79ee8d62b16839c6b67dfe35753a77ae046211eadc808dad2c

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe

Filesize
618KB

MD5
b4a017055a4928d2c8d7261285f9bda9

SHA1
4987b49f51a86f302d77f48c542e270952242b13

SHA256
8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2

SHA512
c75306c8514ebe0ccb10c2d31c0323d4c1d0cce98f3e20c30bf18e965bf040c0237c9d1afee38f79ee8d62b16839c6b67dfe35753a77ae046211eadc808dad2c

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe

Filesize
618KB

MD5
b4a017055a4928d2c8d7261285f9bda9

SHA1
4987b49f51a86f302d77f48c542e270952242b13

SHA256
8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2

SHA512
c75306c8514ebe0ccb10c2d31c0323d4c1d0cce98f3e20c30bf18e965bf040c0237c9d1afee38f79ee8d62b16839c6b67dfe35753a77ae046211eadc808dad2c

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe

Filesize
618KB

MD5
b4a017055a4928d2c8d7261285f9bda9

SHA1
4987b49f51a86f302d77f48c542e270952242b13

SHA256
8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2

SHA512
c75306c8514ebe0ccb10c2d31c0323d4c1d0cce98f3e20c30bf18e965bf040c0237c9d1afee38f79ee8d62b16839c6b67dfe35753a77ae046211eadc808dad2c

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security Host.exe

Filesize
618KB

MD5
b4a017055a4928d2c8d7261285f9bda9

SHA1
4987b49f51a86f302d77f48c542e270952242b13

SHA256
8349f7ac2a0e0f0b8da7bf7121cc0a4f6c235136ec0a491972aaacb5803bc8a2

SHA512
c75306c8514ebe0ccb10c2d31c0323d4c1d0cce98f3e20c30bf18e965bf040c0237c9d1afee38f79ee8d62b16839c6b67dfe35753a77ae046211eadc808dad2c

Download Submit
memory/276-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/276-57-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/276-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/276-67-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/276-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/276-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/276-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1036-74-0x0000000000A90000-0x0000000000B32000-memory.dmp

Filesize
648KB

Download
memory/1648-90-0x000000006F4F0000-0x000000006FA9B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-56-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2020-54-0x0000000001360000-0x0000000001402000-memory.dmp

Filesize
648KB

Download
memory/2020-55-0x0000000075DB1000-0x0000000075DB3000-memory.dmp

Filesize
8KB

Download