quasar | f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827

Analysis

max time kernel
160s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe
Size

8.0MB
MD5

003663017d3ef845190636d56c4477fb
SHA1

fc8967e75ea99849ee703c262df58301933a89d7
SHA256

f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827
SHA512

15ebd16f8f64fe0a57a1bf819653817363a5bbcc665839e4f5dd0819204f502009bda12e938d3cf8f368c84a0b26b4a892f2c9f5fe9546f97fc80ab937c306b1

Score

10^/10

quasar trade bootkit discovery evasion persistence spyware suricata trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

trade

wrz.ddns.net:5700

Mutex

QSR_MUTEX_HQ4Y5Dn1t3ivwyhc79

Attributes

encryption_key
jlIbt3DTqIrhsELlJ19e
install_name
swctlsrv.exe
log_directory
Logs
reconnect_delay
3000
startup_key
microsoft_update_tool
subdirectory
SubDir

Signatures

Quasar Payload 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4708-152-0x00000000007E0000-0x0000000000B98000-memory.dmp	family_quasar
behavioral2/memory/4708-154-0x00000000007E0000-0x0000000000B98000-memory.dmp	family_quasar
behavioral2/memory/5028-171-0x0000000000650000-0x0000000000A08000-memory.dmp	family_quasar
behavioral2/memory/5028-172-0x0000000000650000-0x0000000000A08000-memory.dmp	family_quasar
behavioral2/memory/2340-181-0x0000000000650000-0x0000000000A08000-memory.dmp	family_quasar
behavioral2/memory/2340-182-0x0000000000650000-0x0000000000A08000-memory.dmp	family_quasar

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata: ET MALWARE Common RAT Connectivity Check Observed
suricata
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Executes dropped EXE 9 IoCs

Processes:

syshost.exesvchst.exeswchst.execmifw.execmifw.exeswctlsrv.exeswctlsrv.execmifw.execmifw.exe

pid process

2268 syshost.exe
4588 svchst.exe
4708 swchst.exe
4520 cmifw.exe
1208 cmifw.exe
5028 swctlsrv.exe
2340 swctlsrv.exe
1380 cmifw.exe
2832 cmifw.exe

pid	process
2268	syshost.exe
4588	svchst.exe
4708	swchst.exe
4520	cmifw.exe
1208	cmifw.exe
5028	swctlsrv.exe
2340	swctlsrv.exe
1380	cmifw.exe
2832	cmifw.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cmifw.exeswctlsrv.exeswchst.execmifw.execmifw.exesyshost.exeswctlsrv.execmifw.exesvchst.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmifw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmifw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	swctlsrv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	swchst.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmifw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmifw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	swchst.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmifw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	syshost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmifw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	swctlsrv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cmifw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchst.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchst.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	swctlsrv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cmifw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	syshost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	swctlsrv.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

swctlsrv.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	swctlsrv.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

syshost.exesvchst.exeswctlsrv.exeswchst.execmifw.execmifw.exeswctlsrv.execmifw.execmifw.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	syshost.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	svchst.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	swctlsrv.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	swchst.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	cmifw.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	cmifw.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	swctlsrv.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	cmifw.exe
Key opened	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Wine	cmifw.exe

Modifies file permissions 1 TTPs 3 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exe

pid process

1592 icacls.exe
4428 icacls.exe
2768 icacls.exe

pid	process
1592	icacls.exe
4428	icacls.exe
2768	icacls.exe

Checks whether UAC is enabled 1 TTPs 9 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

swctlsrv.exeswctlsrv.execmifw.exesvchst.exesyshost.exeswchst.execmifw.execmifw.execmifw.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	swctlsrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	swctlsrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmifw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchst.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	syshost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	swchst.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmifw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmifw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cmifw.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ip-api.com

flow	ioc
20	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

syshost.exeswchst.exeswctlsrv.exeswctlsrv.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	syshost.exe
File opened for modification	\??\PhysicalDrive0	swchst.exe
File opened for modification	\??\PhysicalDrive0	swctlsrv.exe
File opened for modification	\??\PhysicalDrive0	swctlsrv.exe

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/4588-144-0x0000000000CC0000-0x00000000010BD000-memory.dmp	autoit_exe
behavioral2/memory/4520-161-0x0000000000CC0000-0x00000000010BD000-memory.dmp	autoit_exe
behavioral2/memory/1208-162-0x0000000000CC0000-0x00000000010BD000-memory.dmp	autoit_exe
behavioral2/memory/1380-186-0x0000000000CC0000-0x00000000010BD000-memory.dmp	autoit_exe
behavioral2/memory/2832-189-0x0000000000CC0000-0x00000000010BD000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

svchst.exesyshost.exeswchst.execmifw.execmifw.exeswctlsrv.exeswctlsrv.execmifw.execmifw.exe

pid process

4588 svchst.exe
2268 syshost.exe
4708 swchst.exe
4520 cmifw.exe
1208 cmifw.exe
5028 swctlsrv.exe
2340 swctlsrv.exe
1380 cmifw.exe
2832 cmifw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4980 5028 WerFault.exe swctlsrv.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3924 schtasks.exe
3420 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

4876 timeout.exe
1944 timeout.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3212 PING.EXE

pid	pid_target	process	target process
4980	5028	WerFault.exe	swctlsrv.exe

pid	process
3924	schtasks.exe
3420	schtasks.exe

pid	process
4876	timeout.exe
1944	timeout.exe

pid	process
3212	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchst.exesyshost.exeswchst.execmifw.execmifw.exe

pid	process
4588	svchst.exe
4588	svchst.exe
2268	syshost.exe
2268	syshost.exe
4708	swchst.exe
4708	swchst.exe
4520	cmifw.exe
4520	cmifw.exe
1208	cmifw.exe
1208	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe
4520	cmifw.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

swchst.exeswctlsrv.exe

description pid process

Token: SeDebugPrivilege 4708 swchst.exe
Token: SeDebugPrivilege 5028 swctlsrv.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

swctlsrv.exe

pid process

5028 swctlsrv.exe

description	pid	process
Token: SeDebugPrivilege	4708	swchst.exe
Token: SeDebugPrivilege	5028	swctlsrv.exe

pid	process
5028	swctlsrv.exe

Suspicious use of WriteProcessMemory 51 IoCs

Processes:

f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.execmd.exesvchst.execmd.exeswchst.exeswctlsrv.execmd.exe

description	pid	process	target process
PID 3572 wrote to memory of 2268	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	syshost.exe
PID 3572 wrote to memory of 2268	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	syshost.exe
PID 3572 wrote to memory of 2268	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	syshost.exe
PID 3572 wrote to memory of 4588	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	svchst.exe
PID 3572 wrote to memory of 4588	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	svchst.exe
PID 3572 wrote to memory of 4588	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	svchst.exe
PID 3572 wrote to memory of 4708	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	swchst.exe
PID 3572 wrote to memory of 4708	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	swchst.exe
PID 3572 wrote to memory of 4708	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	swchst.exe
PID 3572 wrote to memory of 736	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	cmd.exe
PID 3572 wrote to memory of 736	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	cmd.exe
PID 3572 wrote to memory of 736	3572	f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe	cmd.exe
PID 736 wrote to memory of 1944	736	cmd.exe	timeout.exe
PID 736 wrote to memory of 1944	736	cmd.exe	timeout.exe
PID 736 wrote to memory of 1944	736	cmd.exe	timeout.exe
PID 736 wrote to memory of 4876	736	cmd.exe	timeout.exe
PID 736 wrote to memory of 4876	736	cmd.exe	timeout.exe
PID 736 wrote to memory of 4876	736	cmd.exe	timeout.exe
PID 4588 wrote to memory of 1472	4588	svchst.exe	cmd.exe
PID 4588 wrote to memory of 1472	4588	svchst.exe	cmd.exe
PID 4588 wrote to memory of 1472	4588	svchst.exe	cmd.exe
PID 1472 wrote to memory of 1592	1472	cmd.exe	icacls.exe
PID 1472 wrote to memory of 1592	1472	cmd.exe	icacls.exe
PID 1472 wrote to memory of 1592	1472	cmd.exe	icacls.exe
PID 1472 wrote to memory of 4428	1472	cmd.exe	icacls.exe
PID 1472 wrote to memory of 4428	1472	cmd.exe	icacls.exe
PID 1472 wrote to memory of 4428	1472	cmd.exe	icacls.exe
PID 1472 wrote to memory of 2768	1472	cmd.exe	icacls.exe
PID 1472 wrote to memory of 2768	1472	cmd.exe	icacls.exe
PID 1472 wrote to memory of 2768	1472	cmd.exe	icacls.exe
PID 4708 wrote to memory of 3420	4708	swchst.exe	schtasks.exe
PID 4708 wrote to memory of 3420	4708	swchst.exe	schtasks.exe
PID 4708 wrote to memory of 3420	4708	swchst.exe	schtasks.exe
PID 4708 wrote to memory of 5028	4708	swchst.exe	swctlsrv.exe
PID 4708 wrote to memory of 5028	4708	swchst.exe	swctlsrv.exe
PID 4708 wrote to memory of 5028	4708	swchst.exe	swctlsrv.exe
PID 5028 wrote to memory of 3924	5028	swctlsrv.exe	schtasks.exe
PID 5028 wrote to memory of 3924	5028	swctlsrv.exe	schtasks.exe
PID 5028 wrote to memory of 3924	5028	swctlsrv.exe	schtasks.exe
PID 5028 wrote to memory of 4024	5028	swctlsrv.exe	cmd.exe
PID 5028 wrote to memory of 4024	5028	swctlsrv.exe	cmd.exe
PID 5028 wrote to memory of 4024	5028	swctlsrv.exe	cmd.exe
PID 4024 wrote to memory of 1540	4024	cmd.exe	chcp.com
PID 4024 wrote to memory of 1540	4024	cmd.exe	chcp.com
PID 4024 wrote to memory of 1540	4024	cmd.exe	chcp.com
PID 4024 wrote to memory of 3212	4024	cmd.exe	PING.EXE
PID 4024 wrote to memory of 3212	4024	cmd.exe	PING.EXE
PID 4024 wrote to memory of 3212	4024	cmd.exe	PING.EXE
PID 4024 wrote to memory of 2340	4024	cmd.exe	swctlsrv.exe
PID 4024 wrote to memory of 2340	4024	cmd.exe	swctlsrv.exe
PID 4024 wrote to memory of 2340	4024	cmd.exe	swctlsrv.exe

C:\Users\Admin\AppData\Local\Temp\f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe
"C:\Users\Admin\AppData\Local\Temp\f92a19e7f5b0235930f036e99d938d443e513cf8c3ae8c552589dfb31f11e827.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572

C:\Users\Admin\AppData\Roaming\syshost.exe
C:\Users\Admin\AppData\Roaming\syshost.exe
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2268

C:\Users\Admin\AppData\Roaming\svchst.exe
C:\Users\Admin\AppData\Roaming\svchst.exe
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4588

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c icacls "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce" /inheritance:e /deny "Admin:(R,REA,RA,RD)"
3⤵
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
4⤵
- Modifies file permissions
PID:1592

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
4⤵
- Modifies file permissions
PID:4428

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce" /inheritance:e /deny "Admin:(R,REA,RA,RD)"
4⤵
- Modifies file permissions
PID:2768

C:\Users\Admin\AppData\Roaming\swchst.exe
C:\Users\Admin\AppData\Roaming\swchst.exe
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "microsoft_update_tool" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\swchst.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:3420

C:\Users\Admin\AppData\Roaming\SubDir\swctlsrv.exe
"C:\Users\Admin\AppData\Roaming\SubDir\swctlsrv.exe"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "microsoft_update_tool" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\swctlsrv.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:3924

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4iQ1Tlsvl715.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\SysWOW64\chcp.com
chcp 65001
5⤵
PID:1540

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
5⤵
- Runs ping.exe
PID:3212

C:\Users\Admin\AppData\Roaming\SubDir\swctlsrv.exe
"C:\Users\Admin\AppData\Roaming\SubDir\swctlsrv.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 2052
4⤵
- Program crash
PID:4980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\F92A19~1.EXE"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\F92A19~1.EXE" exit)
2⤵
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\SysWOW64\timeout.exe
timeout /t 0
3⤵
- Delays execution with timeout.exe
PID:1944

C:\Windows\SysWOW64\timeout.exe
timeout /t 0
3⤵
- Delays execution with timeout.exe
PID:4876

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4520

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5028 -ip 5028
1⤵
PID:3752

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1380

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Bootkit

T1067

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mntemp
Filesize
16B

MD5
723d8391974df8e696604e614b4ee920

SHA1
aa526cf27940b598b6a8ba4a5464fa2c0f85c55f

SHA256
b42a23871cf89b0bc1c8878bc3c001b0ebd95cd1f658579c09d9395bc901f38c

SHA512
7348cb81f8711222ab37d07e970dd804ddc46e1f44bc0a9056361f89bd460ada312791a602e8786b3988d332ae6dbe8c65a849f9d433b931334633b8e28beecf

Download Submit
C:\Users\Admin\AppData\Local\Temp\4iQ1Tlsvl715.bat
Filesize
209B

MD5
c6e8b361dd1895971900f514acdd3b21

SHA1
0e220a56fad0c8dac309fb83343f8573ca80d896

SHA256
358086ac2b8da39b6614a0fa05292557fad210f075f96eb34dd248aeae65d656

SHA512
6b79cef761cf0e15e3fdafed079a43a2a7dd8f1a54e01468ad13680966426c35cfeced6bc8e49e7432bbc310fff865a993c4860022c606209d7a3f33e79158f4

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\swctlsrv.exe
Filesize
1.6MB

MD5
6ffcb6f30bdb7c5f47d2b9a7cf0802d7

SHA1
b3bf06b3db7f811d472ccb6026a6d45365f6d871

SHA256
93db04a938ac856a671c62a0033e4334081b7ee1f039b8c7698601210ed32d9a

SHA512
83c7e9276300a54099c02ab41528f5bb4458c256b59cb3589dcc5fee2f36e3da5e5417f679fef5ec0c07c48ef93be84c065cef3a195f3e69d83c35c43fa8619a

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\swctlsrv.exe
Filesize
1.6MB

MD5
6ffcb6f30bdb7c5f47d2b9a7cf0802d7

SHA1
b3bf06b3db7f811d472ccb6026a6d45365f6d871

SHA256
93db04a938ac856a671c62a0033e4334081b7ee1f039b8c7698601210ed32d9a

SHA512
83c7e9276300a54099c02ab41528f5bb4458c256b59cb3589dcc5fee2f36e3da5e5417f679fef5ec0c07c48ef93be84c065cef3a195f3e69d83c35c43fa8619a

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\swctlsrv.exe
Filesize
1.6MB

MD5
6ffcb6f30bdb7c5f47d2b9a7cf0802d7

SHA1
b3bf06b3db7f811d472ccb6026a6d45365f6d871

SHA256
93db04a938ac856a671c62a0033e4334081b7ee1f039b8c7698601210ed32d9a

SHA512
83c7e9276300a54099c02ab41528f5bb4458c256b59cb3589dcc5fee2f36e3da5e5417f679fef5ec0c07c48ef93be84c065cef3a195f3e69d83c35c43fa8619a

Download Submit
C:\Users\Admin\AppData\Roaming\svchst.exe
Filesize
1.8MB

MD5
703434861057ed7634a5e5ef4164cd3e

SHA1
0ad8fa7ba4f7b6aa04a9cf8aa6ed11145b5846ae

SHA256
e780952b3dc7a7621814d4598ab82c74f60c8d7f7bd19853b3ae0756b9eb15f1

SHA512
98e978874a6626ba1c64d2dd28a0df7233aed973e6b64278803ef22cd75de0fa8ad1aa094cda597f6b62b08b73253d6e4248b4fac5af2ebc5a53ec6ca409d114

Download Submit
C:\Users\Admin\AppData\Roaming\svchst.exe
Filesize
1.8MB

MD5
703434861057ed7634a5e5ef4164cd3e

SHA1
0ad8fa7ba4f7b6aa04a9cf8aa6ed11145b5846ae

SHA256
e780952b3dc7a7621814d4598ab82c74f60c8d7f7bd19853b3ae0756b9eb15f1

SHA512
98e978874a6626ba1c64d2dd28a0df7233aed973e6b64278803ef22cd75de0fa8ad1aa094cda597f6b62b08b73253d6e4248b4fac5af2ebc5a53ec6ca409d114

Download Submit
C:\Users\Admin\AppData\Roaming\swchst.exe
Filesize
1.6MB

MD5
6ffcb6f30bdb7c5f47d2b9a7cf0802d7

SHA1
b3bf06b3db7f811d472ccb6026a6d45365f6d871

SHA256
93db04a938ac856a671c62a0033e4334081b7ee1f039b8c7698601210ed32d9a

SHA512
83c7e9276300a54099c02ab41528f5bb4458c256b59cb3589dcc5fee2f36e3da5e5417f679fef5ec0c07c48ef93be84c065cef3a195f3e69d83c35c43fa8619a

Download Submit
C:\Users\Admin\AppData\Roaming\swchst.exe
Filesize
1.6MB

MD5
6ffcb6f30bdb7c5f47d2b9a7cf0802d7

SHA1
b3bf06b3db7f811d472ccb6026a6d45365f6d871

SHA256
93db04a938ac856a671c62a0033e4334081b7ee1f039b8c7698601210ed32d9a

SHA512
83c7e9276300a54099c02ab41528f5bb4458c256b59cb3589dcc5fee2f36e3da5e5417f679fef5ec0c07c48ef93be84c065cef3a195f3e69d83c35c43fa8619a

Download Submit
C:\Users\Admin\AppData\Roaming\syshost.exe
Filesize
1.6MB

MD5
eed9348f0146e0b4c4d6f54cc98cfd0e

SHA1
ffdf9491b21e3fed32ae90aa1e594934e1fbd339

SHA256
1fe17e478f59195cec8ade2f79596aeff8930a3f575a8d9ad7a48306a817082e

SHA512
eb8a57d6d8a25ac0aa90dad6716a632cec03eb0be7eb25c1c210e5c0eb59e415513cf5895c3d91f0f1ff781c175f941670a5663c045c2a7f78db173f95829705

Download Submit
C:\Users\Admin\AppData\Roaming\syshost.exe
Filesize
1.6MB

MD5
eed9348f0146e0b4c4d6f54cc98cfd0e

SHA1
ffdf9491b21e3fed32ae90aa1e594934e1fbd339

SHA256
1fe17e478f59195cec8ade2f79596aeff8930a3f575a8d9ad7a48306a817082e

SHA512
eb8a57d6d8a25ac0aa90dad6716a632cec03eb0be7eb25c1c210e5c0eb59e415513cf5895c3d91f0f1ff781c175f941670a5663c045c2a7f78db173f95829705

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
Filesize
1.8MB

MD5
703434861057ed7634a5e5ef4164cd3e

SHA1
0ad8fa7ba4f7b6aa04a9cf8aa6ed11145b5846ae

SHA256
e780952b3dc7a7621814d4598ab82c74f60c8d7f7bd19853b3ae0756b9eb15f1

SHA512
98e978874a6626ba1c64d2dd28a0df7233aed973e6b64278803ef22cd75de0fa8ad1aa094cda597f6b62b08b73253d6e4248b4fac5af2ebc5a53ec6ca409d114

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
Filesize
1.8MB

MD5
703434861057ed7634a5e5ef4164cd3e

SHA1
0ad8fa7ba4f7b6aa04a9cf8aa6ed11145b5846ae

SHA256
e780952b3dc7a7621814d4598ab82c74f60c8d7f7bd19853b3ae0756b9eb15f1

SHA512
98e978874a6626ba1c64d2dd28a0df7233aed973e6b64278803ef22cd75de0fa8ad1aa094cda597f6b62b08b73253d6e4248b4fac5af2ebc5a53ec6ca409d114

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
Filesize
1.8MB

MD5
703434861057ed7634a5e5ef4164cd3e

SHA1
0ad8fa7ba4f7b6aa04a9cf8aa6ed11145b5846ae

SHA256
e780952b3dc7a7621814d4598ab82c74f60c8d7f7bd19853b3ae0756b9eb15f1

SHA512
98e978874a6626ba1c64d2dd28a0df7233aed973e6b64278803ef22cd75de0fa8ad1aa094cda597f6b62b08b73253d6e4248b4fac5af2ebc5a53ec6ca409d114

Download Submit
C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\cmifw.exe
Filesize
1.8MB

MD5
703434861057ed7634a5e5ef4164cd3e

SHA1
0ad8fa7ba4f7b6aa04a9cf8aa6ed11145b5846ae

SHA256
e780952b3dc7a7621814d4598ab82c74f60c8d7f7bd19853b3ae0756b9eb15f1

SHA512
98e978874a6626ba1c64d2dd28a0df7233aed973e6b64278803ef22cd75de0fa8ad1aa094cda597f6b62b08b73253d6e4248b4fac5af2ebc5a53ec6ca409d114

Download Submit
memory/736-138-0x0000000000000000-mapping.dmp

Download
memory/1208-160-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/1208-162-0x0000000000CC0000-0x00000000010BD000-memory.dmp

Filesize
4.0MB

Download
memory/1380-186-0x0000000000CC0000-0x00000000010BD000-memory.dmp

Filesize
4.0MB

Download
memory/1380-185-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/1472-147-0x0000000000000000-mapping.dmp

Download
memory/1540-177-0x0000000000000000-mapping.dmp

Download
memory/1592-148-0x0000000000000000-mapping.dmp

Download
memory/1944-139-0x0000000000000000-mapping.dmp

Download
memory/2268-145-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/2268-130-0x0000000000000000-mapping.dmp

Download
memory/2268-151-0x0000000000EC0000-0x0000000001280000-memory.dmp

Filesize
3.8MB

Download
memory/2268-153-0x0000000000EC0000-0x0000000001280000-memory.dmp

Filesize
3.8MB

Download
memory/2340-183-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/2340-182-0x0000000000650000-0x0000000000A08000-memory.dmp

Filesize
3.7MB

Download
memory/2340-181-0x0000000000650000-0x0000000000A08000-memory.dmp

Filesize
3.7MB

Download
memory/2340-179-0x0000000000000000-mapping.dmp

Download
memory/2768-150-0x0000000000000000-mapping.dmp

Download
memory/2832-188-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/2832-189-0x0000000000CC0000-0x00000000010BD000-memory.dmp

Filesize
4.0MB

Download
memory/3212-178-0x0000000000000000-mapping.dmp

Download
memory/3420-166-0x0000000000000000-mapping.dmp

Download
memory/3924-173-0x0000000000000000-mapping.dmp

Download
memory/4024-175-0x0000000000000000-mapping.dmp

Download
memory/4428-149-0x0000000000000000-mapping.dmp

Download
memory/4520-159-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/4520-161-0x0000000000CC0000-0x00000000010BD000-memory.dmp

Filesize
4.0MB

Download
memory/4588-133-0x0000000000000000-mapping.dmp

Download
memory/4588-143-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/4588-144-0x0000000000CC0000-0x00000000010BD000-memory.dmp

Filesize
4.0MB

Download
memory/4708-152-0x00000000007E0000-0x0000000000B98000-memory.dmp

Filesize
3.7MB

Download
memory/4708-164-0x0000000006540000-0x0000000006552000-memory.dmp

Filesize
72KB

Download
memory/4708-163-0x0000000005920000-0x0000000005986000-memory.dmp

Filesize
408KB

Download
memory/4708-165-0x0000000006980000-0x00000000069BC000-memory.dmp

Filesize
240KB

Download
memory/4708-156-0x0000000005780000-0x0000000005812000-memory.dmp

Filesize
584KB

Download
memory/4708-155-0x0000000005C10000-0x00000000061B4000-memory.dmp

Filesize
5.6MB

Download
memory/4708-154-0x00000000007E0000-0x0000000000B98000-memory.dmp

Filesize
3.7MB

Download
memory/4708-135-0x0000000000000000-mapping.dmp

Download
memory/4708-146-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/4876-142-0x0000000000000000-mapping.dmp

Download
memory/5028-167-0x0000000000000000-mapping.dmp

Download
memory/5028-170-0x00000000778A0000-0x0000000077A43000-memory.dmp

Filesize
1.6MB

Download
memory/5028-174-0x0000000006C40000-0x0000000006C4A000-memory.dmp

Filesize
40KB

Download
memory/5028-171-0x0000000000650000-0x0000000000A08000-memory.dmp

Filesize
3.7MB

Download
memory/5028-172-0x0000000000650000-0x0000000000A08000-memory.dmp

Filesize
3.7MB

Download