quasar | 0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

Analysis

max time kernel
105s
max time network
162s
platform
windows7_x64
resource
win7-20220414-en
submitted
12-05-2022 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
Size

602KB
MD5

f78e8fdb5c76c784818c1ea7ba8217cd
SHA1

9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d
SHA256

0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c
SHA512

9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Score

10^/10

quasar venomrat windows security evasion persistence rat rootkit spyware stealer suricata trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

windows security

vilvaraj-32652.portmap.io:32652

Mutex

VNM_MUTEX_XaCO2YtLAsadylDHBP

Attributes

encryption_key
eKgGUbCubcSIafuOAN5V
install_name
windows security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
windows security
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 8 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/924-65-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/924-67-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/924-63-0x0000000000486C9E-mapping.dmp	disable_win_def
behavioral1/memory/924-62-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/924-61-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/924-60-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral1/memory/1492-81-0x0000000000486C9E-mapping.dmp	disable_win_def
behavioral1/memory/1600-116-0x0000000000486C9E-mapping.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Quasar Payload 8 IoCs

resource	yara_rule
behavioral1/memory/924-65-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/924-67-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/924-63-0x0000000000486C9E-mapping.dmp	family_quasar
behavioral1/memory/924-62-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/924-61-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/924-60-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral1/memory/1492-81-0x0000000000486C9E-mapping.dmp	family_quasar
behavioral1/memory/1600-116-0x0000000000486C9E-mapping.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata

Executes dropped EXE 2 IoCs

pid	Process
1916	windows security.exe
1492	windows security.exe

Loads dropped DLL 6 IoCs

pid	Process
924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
1688	WerFault.exe
1688	WerFault.exe
1688	WerFault.exe
1688	WerFault.exe
1688	WerFault.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows security = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe\""	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\windows security = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\windows security.exe\""	windows security.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1684 set thread context of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 1916 set thread context of 1492	1916	windows security.exe	33
PID 1256 set thread context of 1600	1256	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	51

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1688	1492	WerFault.exe	33

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
268	schtasks.exe
1928	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1604	PING.EXE
1364	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1616	powershell.exe
924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
1600	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
Token: SeDebugPrivilege	1492	windows security.exe
Token: SeDebugPrivilege	1492	windows security.exe
Token: SeDebugPrivilege	1616	powershell.exe
Token: SeDebugPrivilege	1600	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1492	windows security.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 1684 wrote to memory of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 1684 wrote to memory of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 1684 wrote to memory of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 1684 wrote to memory of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 1684 wrote to memory of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 1684 wrote to memory of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 1684 wrote to memory of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 1684 wrote to memory of 924	1684	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	28
PID 924 wrote to memory of 268	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	30
PID 924 wrote to memory of 268	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	30
PID 924 wrote to memory of 268	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	30
PID 924 wrote to memory of 268	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	30
PID 924 wrote to memory of 1916	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	32
PID 924 wrote to memory of 1916	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	32
PID 924 wrote to memory of 1916	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	32
PID 924 wrote to memory of 1916	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	32
PID 1916 wrote to memory of 1492	1916	windows security.exe	33
PID 1916 wrote to memory of 1492	1916	windows security.exe	33
PID 1916 wrote to memory of 1492	1916	windows security.exe	33
PID 1916 wrote to memory of 1492	1916	windows security.exe	33
PID 1916 wrote to memory of 1492	1916	windows security.exe	33
PID 1916 wrote to memory of 1492	1916	windows security.exe	33
PID 1916 wrote to memory of 1492	1916	windows security.exe	33
PID 1916 wrote to memory of 1492	1916	windows security.exe	33
PID 1916 wrote to memory of 1492	1916	windows security.exe	33
PID 1492 wrote to memory of 1928	1492	windows security.exe	34
PID 1492 wrote to memory of 1928	1492	windows security.exe	34
PID 1492 wrote to memory of 1928	1492	windows security.exe	34
PID 1492 wrote to memory of 1928	1492	windows security.exe	34
PID 924 wrote to memory of 1616	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	36
PID 924 wrote to memory of 1616	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	36
PID 924 wrote to memory of 1616	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	36
PID 924 wrote to memory of 1616	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	36
PID 1492 wrote to memory of 956	1492	windows security.exe	38
PID 1492 wrote to memory of 956	1492	windows security.exe	38
PID 1492 wrote to memory of 956	1492	windows security.exe	38
PID 1492 wrote to memory of 956	1492	windows security.exe	38
PID 956 wrote to memory of 1580	956	cmd.exe	40
PID 956 wrote to memory of 1580	956	cmd.exe	40
PID 956 wrote to memory of 1580	956	cmd.exe	40
PID 956 wrote to memory of 1580	956	cmd.exe	40
PID 956 wrote to memory of 1604	956	cmd.exe	41
PID 956 wrote to memory of 1604	956	cmd.exe	41
PID 956 wrote to memory of 1604	956	cmd.exe	41
PID 956 wrote to memory of 1604	956	cmd.exe	41
PID 1492 wrote to memory of 1688	1492	windows security.exe	42
PID 1492 wrote to memory of 1688	1492	windows security.exe	42
PID 1492 wrote to memory of 1688	1492	windows security.exe	42
PID 1492 wrote to memory of 1688	1492	windows security.exe	42
PID 924 wrote to memory of 1884	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	43
PID 924 wrote to memory of 1884	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	43
PID 924 wrote to memory of 1884	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	43
PID 924 wrote to memory of 1884	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	43
PID 1884 wrote to memory of 1100	1884	cmd.exe	45
PID 1884 wrote to memory of 1100	1884	cmd.exe	45
PID 1884 wrote to memory of 1100	1884	cmd.exe	45
PID 1884 wrote to memory of 1100	1884	cmd.exe	45
PID 924 wrote to memory of 1712	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	46
PID 924 wrote to memory of 1712	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	46
PID 924 wrote to memory of 1712	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	46
PID 924 wrote to memory of 1712	924	0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe	46
PID 1712 wrote to memory of 1968	1712	cmd.exe	48
PID 1712 wrote to memory of 1968	1712	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
"C:\Users\Admin\AppData\Local\Temp\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
  "C:\Users\Admin\AppData\Local\Temp\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe"
  2⤵
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "windows security" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:268
- - C:\Users\Admin\AppData\Roaming\SubDir\windows security.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\windows security.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Users\Admin\AppData\Roaming\SubDir\windows security.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\windows security.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "windows security" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\windows security.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:1928
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\L938PigSap1o.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:956
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1580
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:1604
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 1488
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1688
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      PID:1100
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\6j6GSYRIa6B1.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1364
  - - C:\Users\Admin\AppData\Local\Temp\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
      "C:\Users\Admin\AppData\Local\Temp\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe"
      4⤵
      Suspicious use of SetThreadContext
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6j6GSYRIa6B1.bat

Filesize
261B

MD5
ad9bc946160af0bff36cd484d1eb65b0

SHA1
7c28c98dee707951009d5c9f7f46ebd126cf2ca2

SHA256
d1cad1fe088f3e27a0600481d350a6dc90f8bc854da8a7429d0a10816dd744d4

SHA512
9aa7bcadceeffd8db4af06d61442bd5a95d9bbcdb0c3a9f285b31d4a5bf859badbdbf7d43bb68dc9d4bc6766d71fbef97f1323061d4303d55aea2c49e31560b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\L938PigSap1o.bat

Filesize
217B

MD5
e07b13a98ad5a6c1709f45c78e30203e

SHA1
415dbf8dbbab1ad1ced630db22ecc2383e50f4ff

SHA256
8366de71475f92ea65646749a82febb2aadfb28549e7a2573ea0239ae7e9c62e

SHA512
b1e7b4e70c727db76e9e615c398d64f150bbb5bc3dd0f010ab8c8a677913bfe27b9b395ec319cd2fdf6f86aa4cde3c5e3f3f5cfff4eabd5149001bda36f2d524

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\windows security.exe

Filesize
602KB

MD5
f78e8fdb5c76c784818c1ea7ba8217cd

SHA1
9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d

SHA256
0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

SHA512
9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\windows security.exe

Filesize
602KB

MD5
f78e8fdb5c76c784818c1ea7ba8217cd

SHA1
9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d

SHA256
0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

SHA512
9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\windows security.exe

Filesize
602KB

MD5
f78e8fdb5c76c784818c1ea7ba8217cd

SHA1
9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d

SHA256
0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

SHA512
9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Download Submit
\Users\Admin\AppData\Roaming\SubDir\windows security.exe

Filesize
602KB

MD5
f78e8fdb5c76c784818c1ea7ba8217cd

SHA1
9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d

SHA256
0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

SHA512
9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Download Submit
\Users\Admin\AppData\Roaming\SubDir\windows security.exe

Filesize
602KB

MD5
f78e8fdb5c76c784818c1ea7ba8217cd

SHA1
9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d

SHA256
0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

SHA512
9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Download Submit
\Users\Admin\AppData\Roaming\SubDir\windows security.exe

Filesize
602KB

MD5
f78e8fdb5c76c784818c1ea7ba8217cd

SHA1
9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d

SHA256
0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

SHA512
9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Download Submit
\Users\Admin\AppData\Roaming\SubDir\windows security.exe

Filesize
602KB

MD5
f78e8fdb5c76c784818c1ea7ba8217cd

SHA1
9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d

SHA256
0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

SHA512
9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Download Submit
\Users\Admin\AppData\Roaming\SubDir\windows security.exe

Filesize
602KB

MD5
f78e8fdb5c76c784818c1ea7ba8217cd

SHA1
9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d

SHA256
0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

SHA512
9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Download Submit
\Users\Admin\AppData\Roaming\SubDir\windows security.exe

Filesize
602KB

MD5
f78e8fdb5c76c784818c1ea7ba8217cd

SHA1
9a3ca4ab923d8b93b49f5d46c6b449845ca94c6d

SHA256
0e0a586e4c7a3d6508de4cffe0c78050c01dda128441853127ef10e1e3c7e25c

SHA512
9fc70809bac9189e693af1ccd10f35af84fe295b048ed609262a90bf071157b0a23ff2672c57f424fbcd56fc816c1400b6a9a09cd30e12619d785518151d62b3

Download Submit
memory/924-58-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/924-57-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/924-65-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/924-60-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/924-67-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/924-61-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/924-62-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1256-109-0x0000000001030000-0x00000000010CC000-memory.dmp

Filesize
624KB

Download
memory/1616-101-0x000000006EED0000-0x000000006F47B000-memory.dmp

Filesize
5.7MB

Download
memory/1684-56-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/1684-55-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download
memory/1684-54-0x0000000000F70000-0x000000000100C000-memory.dmp

Filesize
624KB

Download
memory/1916-74-0x0000000001080000-0x000000000111C000-memory.dmp

Filesize
624KB

Download