quasar | ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

Analysis

max time kernel
104s
max time network
96s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-05-2022 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
Size

618KB
MD5

813f353b1285bcaea41f868746ab9fdd
SHA1

301209445bdfd758b1f647bdbcf1609ee07296e7
SHA256

ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982
SHA512

1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Score

10^/10

quasar venomrat windows defender security evasion persistence rat rootkit spyware stealer suricata trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Windows Defender Security

vilvaraj-32652.portmap.io:32652

Mutex

VNM_MUTEX_XoAJ77Kcpkuyjz4MJK

Attributes

encryption_key
5nIMwmTRG5wyVhouaxGb
install_name
Windows Defender Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Defender Security
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 9 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1684-60-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/1684-63-0x0000000000486CFE-mapping.dmp	disable_win_def
behavioral1/memory/1684-62-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/1684-61-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/1684-65-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/1684-67-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/1816-83-0x0000000000486CFE-mapping.dmp	disable_win_def
behavioral1/memory/1488-107-0x0000000000486CFE-mapping.dmp	disable_win_def
behavioral1/memory/2012-127-0x0000000000486CFE-mapping.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Quasar Payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1684-60-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/1684-63-0x0000000000486CFE-mapping.dmp	family_quasar
behavioral1/memory/1684-62-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/1684-61-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/1684-65-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/1684-67-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/1816-83-0x0000000000486CFE-mapping.dmp	family_quasar
behavioral1/memory/1488-107-0x0000000000486CFE-mapping.dmp	family_quasar
behavioral1/memory/2012-127-0x0000000000486CFE-mapping.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata

Executes dropped EXE 5 IoCs

Processes:

Windows Defender Security.exeWindows Defender Security.exeWindows Defender Security.exeWindows Defender Security.exeWindows Defender Security.exe

pid	Process
1544	Windows Defender Security.exe
1964	Windows Defender Security.exe
1816	Windows Defender Security.exe
1504	Windows Defender Security.exe
1488	Windows Defender Security.exe

Loads dropped DLL 6 IoCs

Processes:

ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exeWerFault.exe

pid	Process
1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
1616	WerFault.exe
1616	WerFault.exe
1616	WerFault.exe
1616	WerFault.exe
1616	WerFault.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exece140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\YmExSBNzQt = "C:\\Users\\Admin\\AppData\\Roaming\\fPKDAorSBW\\aTTSPgNpLj.exe"	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Security = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe\""	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exeWindows Defender Security.exeWindows Defender Security.exece140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe

description	pid	Process	procid_target
PID 480 set thread context of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 1544 set thread context of 1816	1544	Windows Defender Security.exe	36
PID 1504 set thread context of 1488	1504	Windows Defender Security.exe	45
PID 1992 set thread context of 2012	1992	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	54

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1616	1816	WerFault.exe	36

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exe

pid	Process
1316	schtasks.exe
1040	schtasks.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXE

pid	Process
1292	PING.EXE
1724	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

Windows Defender Security.exepowershell.exeWindows Defender Security.exece140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exece140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe

pid	Process
1544	Windows Defender Security.exe
1544	Windows Defender Security.exe
1536	powershell.exe
1488	Windows Defender Security.exe
1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
2012	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exeWindows Defender Security.exeWindows Defender Security.exepowershell.exeWindows Defender Security.exece140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe

description	pid	Process
Token: SeDebugPrivilege	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
Token: SeDebugPrivilege	1544	Windows Defender Security.exe
Token: SeDebugPrivilege	1816	Windows Defender Security.exe
Token: SeDebugPrivilege	1816	Windows Defender Security.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1488	Windows Defender Security.exe
Token: SeDebugPrivilege	2012	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Windows Defender Security.exe

pid	Process
1816	Windows Defender Security.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exece140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exeWindows Defender Security.exeWindows Defender Security.exeWindows Defender Security.execmd.exe

description	pid	Process	procid_target
PID 480 wrote to memory of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 480 wrote to memory of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 480 wrote to memory of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 480 wrote to memory of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 480 wrote to memory of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 480 wrote to memory of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 480 wrote to memory of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 480 wrote to memory of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 480 wrote to memory of 1684	480	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	28
PID 1684 wrote to memory of 1316	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	30
PID 1684 wrote to memory of 1316	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	30
PID 1684 wrote to memory of 1316	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	30
PID 1684 wrote to memory of 1316	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	30
PID 1684 wrote to memory of 1544	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	32
PID 1684 wrote to memory of 1544	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	32
PID 1684 wrote to memory of 1544	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	32
PID 1684 wrote to memory of 1544	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	32
PID 1684 wrote to memory of 1536	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	33
PID 1684 wrote to memory of 1536	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	33
PID 1684 wrote to memory of 1536	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	33
PID 1684 wrote to memory of 1536	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	33
PID 1544 wrote to memory of 1964	1544	Windows Defender Security.exe	34
PID 1544 wrote to memory of 1964	1544	Windows Defender Security.exe	34
PID 1544 wrote to memory of 1964	1544	Windows Defender Security.exe	34
PID 1544 wrote to memory of 1964	1544	Windows Defender Security.exe	34
PID 1544 wrote to memory of 1816	1544	Windows Defender Security.exe	36
PID 1544 wrote to memory of 1816	1544	Windows Defender Security.exe	36
PID 1544 wrote to memory of 1816	1544	Windows Defender Security.exe	36
PID 1544 wrote to memory of 1816	1544	Windows Defender Security.exe	36
PID 1544 wrote to memory of 1816	1544	Windows Defender Security.exe	36
PID 1544 wrote to memory of 1816	1544	Windows Defender Security.exe	36
PID 1544 wrote to memory of 1816	1544	Windows Defender Security.exe	36
PID 1544 wrote to memory of 1816	1544	Windows Defender Security.exe	36
PID 1544 wrote to memory of 1816	1544	Windows Defender Security.exe	36
PID 1816 wrote to memory of 1040	1816	Windows Defender Security.exe	37
PID 1816 wrote to memory of 1040	1816	Windows Defender Security.exe	37
PID 1816 wrote to memory of 1040	1816	Windows Defender Security.exe	37
PID 1816 wrote to memory of 1040	1816	Windows Defender Security.exe	37
PID 1816 wrote to memory of 1552	1816	Windows Defender Security.exe	39
PID 1816 wrote to memory of 1552	1816	Windows Defender Security.exe	39
PID 1816 wrote to memory of 1552	1816	Windows Defender Security.exe	39
PID 1816 wrote to memory of 1552	1816	Windows Defender Security.exe	39
PID 1816 wrote to memory of 1616	1816	Windows Defender Security.exe	41
PID 1816 wrote to memory of 1616	1816	Windows Defender Security.exe	41
PID 1816 wrote to memory of 1616	1816	Windows Defender Security.exe	41
PID 1816 wrote to memory of 1616	1816	Windows Defender Security.exe	41
PID 1504 wrote to memory of 1488	1504	Windows Defender Security.exe	45
PID 1504 wrote to memory of 1488	1504	Windows Defender Security.exe	45
PID 1504 wrote to memory of 1488	1504	Windows Defender Security.exe	45
PID 1504 wrote to memory of 1488	1504	Windows Defender Security.exe	45
PID 1504 wrote to memory of 1488	1504	Windows Defender Security.exe	45
PID 1504 wrote to memory of 1488	1504	Windows Defender Security.exe	45
PID 1504 wrote to memory of 1488	1504	Windows Defender Security.exe	45
PID 1504 wrote to memory of 1488	1504	Windows Defender Security.exe	45
PID 1504 wrote to memory of 1488	1504	Windows Defender Security.exe	45
PID 1684 wrote to memory of 888	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	46
PID 1684 wrote to memory of 888	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	46
PID 1684 wrote to memory of 888	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	46
PID 1684 wrote to memory of 888	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	46
PID 888 wrote to memory of 548	888	cmd.exe	48
PID 888 wrote to memory of 548	888	cmd.exe	48
PID 888 wrote to memory of 548	888	cmd.exe	48
PID 888 wrote to memory of 548	888	cmd.exe	48
PID 1684 wrote to memory of 1748	1684	ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe	49

C:\Users\Admin\AppData\Local\Temp\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
"C:\Users\Admin\AppData\Local\Temp\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:480
- C:\Users\Admin\AppData\Local\Temp\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
  "C:\Users\Admin\AppData\Local\Temp\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe"
  2⤵
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows Defender Security" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1316
- - C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"
      4⤵
      Executes dropped EXE
      PID:1964
  - - C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows Defender Security" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1040
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\gbXB4Nm2vFt0.bat" "
        5⤵
        
        PID:1552
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1712
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:1292
      - C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1488
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 1496
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\oqzN6mCAD4OK.bat" "
    3⤵
    PID:1748
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
      "C:\Users\Admin\AppData\Local\Temp\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oqzN6mCAD4OK.bat

Filesize
261B

MD5
64404fb92a7a66b9224a427a51e10af6

SHA1
053fa3e8ee13411f16e377d8012656c3f5ea4863

SHA256
36bd3c0ee014c52b8e89821adb8e50ac0910d2b82318b881874dfadc6dcae2cd

SHA512
c3654fc8b9c4b1a66132d153bf6f7c0ca5cb933a1d928f8c71a9302c4f9c0b7c4661bc8e2582186f174cf996c359bc5371c20acd235c5fdcbcd9101473d6763f

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
\Users\Admin\AppData\Roaming\SubDir\Windows Defender Security.exe

Filesize
618KB

MD5
813f353b1285bcaea41f868746ab9fdd

SHA1
301209445bdfd758b1f647bdbcf1609ee07296e7

SHA256
ce140c5a412462747256fb0c54a6d4ffd98a891fba26164a62fd2349c3f44982

SHA512
1ef96e09c43a7c71395112c2a867e60259483585deeb60c122482d4e943b7eef7f432196eb62387655d819d29e8c64c98cf49b04623ff185924135b8aa128d38

Download Submit
memory/480-55-0x0000000075941000-0x0000000075943000-memory.dmp

Filesize
8KB

Download
memory/480-56-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/480-54-0x0000000000EC0000-0x0000000000F62000-memory.dmp

Filesize
648KB

Download
memory/548-115-0x0000000000000000-mapping.dmp

Download
memory/888-114-0x0000000000000000-mapping.dmp

Download
memory/1040-91-0x0000000000000000-mapping.dmp

Download
memory/1316-69-0x0000000000000000-mapping.dmp

Download
memory/1488-107-0x0000000000486CFE-mapping.dmp

Download
memory/1536-75-0x0000000000000000-mapping.dmp

Download
memory/1536-92-0x000000006EE20000-0x000000006F3CB000-memory.dmp

Filesize
5.7MB

Download
memory/1544-74-0x0000000001010000-0x00000000010B2000-memory.dmp

Filesize
648KB

Download
memory/1544-71-0x0000000000000000-mapping.dmp

Download
memory/1552-93-0x0000000000000000-mapping.dmp

Download
memory/1616-94-0x0000000000000000-mapping.dmp

Download
memory/1684-63-0x0000000000486CFE-mapping.dmp

Download
memory/1684-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1684-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1684-57-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1684-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1684-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1684-67-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1684-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1724-119-0x0000000000000000-mapping.dmp

Download
memory/1748-116-0x0000000000000000-mapping.dmp

Download
memory/1816-83-0x0000000000486CFE-mapping.dmp

Download
memory/1972-118-0x0000000000000000-mapping.dmp

Download
memory/1992-120-0x0000000000000000-mapping.dmp

Download
memory/2012-127-0x0000000000486CFE-mapping.dmp

Download