quasar | ed097795acee8f6fce5f80e71d2ed3cf6e27cbb3203673b6c1fc034bd3cee538

Analysis

max time kernel
274s
max time network
287s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-01-2023 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BitcoinFakeTransaction/BitcoinFakeTransaction.exe
Size

997KB
MD5

4fe10e794eb25820b63890cfa0abca42
SHA1

321ecd39644a864a47cc3d431be53c8035acf59f
SHA256

5cc80ef8d5cd9c1fffb5660dd739177ae9043cc13a022a8e8e2c696fa5fcf59e
SHA512

728e83d4782347f8959c528579e504ec38fb8c5c18ebacceb106c46d5462ed731a685be3db0450d0dc5eb08f3f9ead13d5080ce244408e3d371e760dd159d70e
SSDEEP

12288:1UTyp3ZXSXsy8p4pymXXOZ4z2im3eyOYZ/w4FGVIa9A30xT5uUPDP:1UTSo/Bpu4qim3nZ/wB9+wT5fP

Score

10^/10

quasar venomrat windows securityy evasion persistence rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

windows securityy

192.253.245.243:7812

Mutex

VNM_MUTEX_Lwt9GYx0ZlES09069Z

Attributes

encryption_key
AhFntNS40ejah7Nv2cWL
install_name
Window Security Health Service.exe
log_directory
Logs
reconnect_delay
3000
startup_key
window update
subdirectory
windows Service32

Signatures

Contains code to disable Windows Defender 8 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral3/memory/1912-80-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral3/memory/1912-81-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral3/memory/1912-83-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral3/memory/1912-90-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral3/memory/1912-84-0x0000000000486C9E-mapping.dmp	disable_win_def
behavioral3/memory/1912-94-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def
behavioral3/memory/1616-110-0x0000000000486C9E-mapping.dmp	disable_win_def
behavioral3/memory/840-141-0x0000000000486C9E-mapping.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

Aimtxznnlqlhr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Aimtxznnlqlhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Aimtxznnlqlhr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Aimtxznnlqlhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Aimtxznnlqlhr.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 8 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1912-80-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral3/memory/1912-81-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral3/memory/1912-83-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral3/memory/1912-90-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral3/memory/1912-84-0x0000000000486C9E-mapping.dmp	family_quasar
behavioral3/memory/1912-94-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar
behavioral3/memory/1616-110-0x0000000000486C9E-mapping.dmp	family_quasar
behavioral3/memory/840-141-0x0000000000486C9E-mapping.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat

Executes dropped EXE 10 IoCs

Processes:

Mvjdejeez.exeAimtxznnlqlhr.exeAimtxznnlqlhr.exeAimtxznnlqlhr.exeMvjdejeez.exeWindow Security Health Service.exeWindow Security Health Service.exeAimtxznnlqlhr.exeAimtxznnlqlhr.exeAimtxznnlqlhr.exe

pid	process
1320	Mvjdejeez.exe
1752	Aimtxznnlqlhr.exe
1544	Aimtxznnlqlhr.exe
1912	Aimtxznnlqlhr.exe
1152	Mvjdejeez.exe
540	Window Security Health Service.exe
1616	Window Security Health Service.exe
2020	Aimtxznnlqlhr.exe
1732	Aimtxznnlqlhr.exe
840	Aimtxznnlqlhr.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

532 cmd.exe
Loads dropped DLL 7 IoCs

Processes:

Aimtxznnlqlhr.exeMvjdejeez.exeAimtxznnlqlhr.execmd.exeAimtxznnlqlhr.exe

pid process

1752 Aimtxznnlqlhr.exe
1320 Mvjdejeez.exe
1752 Aimtxznnlqlhr.exe
1912 Aimtxznnlqlhr.exe
1712 cmd.exe
2020 Aimtxznnlqlhr.exe
2020 Aimtxznnlqlhr.exe

pid	process
532	cmd.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

Aimtxznnlqlhr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	Aimtxznnlqlhr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Aimtxznnlqlhr.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Aimtxznnlqlhr.exeMvjdejeez.exeAimtxznnlqlhr.exeWindow Security Health Service.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\tSSBpQMZcW = "C:\\Users\\Admin\\AppData\\Roaming\\eWTPJijJLE\\WbFBTiQzDg.exe"	Aimtxznnlqlhr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dSHXtPBWwq = "C:\\Users\\Admin\\AppData\\Roaming\\yMRJBwKnFT\\iYAZWtRxTK.exe"	Mvjdejeez.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\window update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Aimtxznnlqlhr.exe\""	Aimtxznnlqlhr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\window update = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows Service32\\Window Security Health Service.exe\""	Window Security Health Service.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com

flow	ioc
4	ip-api.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

Mvjdejeez.exeAimtxznnlqlhr.exeWindow Security Health Service.exeAimtxznnlqlhr.exe

description	pid	process	target process
PID 1320 set thread context of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1752 set thread context of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 540 set thread context of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 2020 set thread context of 840	2020	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

920 schtasks.exe
1780 schtasks.exe

pid	process
920	schtasks.exe
1780	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Aimtxznnlqlhr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Aimtxznnlqlhr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Aimtxznnlqlhr.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

876 PING.EXE

pid	process
876	PING.EXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

Aimtxznnlqlhr.exepowershell.exeAimtxznnlqlhr.exeAimtxznnlqlhr.exeAimtxznnlqlhr.exe

pid	process
1752	Aimtxznnlqlhr.exe
1752	Aimtxznnlqlhr.exe
1724	powershell.exe
1912	Aimtxznnlqlhr.exe
1912	Aimtxznnlqlhr.exe
1912	Aimtxznnlqlhr.exe
1912	Aimtxznnlqlhr.exe
1912	Aimtxznnlqlhr.exe
1912	Aimtxznnlqlhr.exe
1912	Aimtxznnlqlhr.exe
2020	Aimtxznnlqlhr.exe
2020	Aimtxznnlqlhr.exe
840	Aimtxznnlqlhr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

Aimtxznnlqlhr.exeAimtxznnlqlhr.exeWindow Security Health Service.exepowershell.exeAimtxznnlqlhr.exeAimtxznnlqlhr.exe

description	pid	process
Token: SeDebugPrivilege	1752	Aimtxznnlqlhr.exe
Token: SeDebugPrivilege	1912	Aimtxznnlqlhr.exe
Token: SeDebugPrivilege	1616	Window Security Health Service.exe
Token: SeDebugPrivilege	1616	Window Security Health Service.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	2020	Aimtxznnlqlhr.exe
Token: SeDebugPrivilege	840	Aimtxznnlqlhr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Window Security Health Service.exe

pid process

1616 Window Security Health Service.exe

pid	process
1616	Window Security Health Service.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

BitcoinFakeTransaction.exeAimtxznnlqlhr.exeMvjdejeez.exeAimtxznnlqlhr.exeWindow Security Health Service.exeWindow Security Health Service.exe

description	pid	process	target process
PID 1340 wrote to memory of 1320	1340	BitcoinFakeTransaction.exe	Mvjdejeez.exe
PID 1340 wrote to memory of 1320	1340	BitcoinFakeTransaction.exe	Mvjdejeez.exe
PID 1340 wrote to memory of 1320	1340	BitcoinFakeTransaction.exe	Mvjdejeez.exe
PID 1340 wrote to memory of 1320	1340	BitcoinFakeTransaction.exe	Mvjdejeez.exe
PID 1340 wrote to memory of 1320	1340	BitcoinFakeTransaction.exe	Mvjdejeez.exe
PID 1340 wrote to memory of 1320	1340	BitcoinFakeTransaction.exe	Mvjdejeez.exe
PID 1340 wrote to memory of 1320	1340	BitcoinFakeTransaction.exe	Mvjdejeez.exe
PID 1340 wrote to memory of 1752	1340	BitcoinFakeTransaction.exe	Aimtxznnlqlhr.exe
PID 1340 wrote to memory of 1752	1340	BitcoinFakeTransaction.exe	Aimtxznnlqlhr.exe
PID 1340 wrote to memory of 1752	1340	BitcoinFakeTransaction.exe	Aimtxznnlqlhr.exe
PID 1340 wrote to memory of 1752	1340	BitcoinFakeTransaction.exe	Aimtxznnlqlhr.exe
PID 1752 wrote to memory of 1544	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1752 wrote to memory of 1544	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1752 wrote to memory of 1544	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1752 wrote to memory of 1544	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1752 wrote to memory of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1752 wrote to memory of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1752 wrote to memory of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1752 wrote to memory of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1752 wrote to memory of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1752 wrote to memory of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1752 wrote to memory of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1752 wrote to memory of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1320 wrote to memory of 1152	1320	Mvjdejeez.exe	Mvjdejeez.exe
PID 1752 wrote to memory of 1912	1752	Aimtxznnlqlhr.exe	Aimtxznnlqlhr.exe
PID 1912 wrote to memory of 920	1912	Aimtxznnlqlhr.exe	schtasks.exe
PID 1912 wrote to memory of 920	1912	Aimtxznnlqlhr.exe	schtasks.exe
PID 1912 wrote to memory of 920	1912	Aimtxznnlqlhr.exe	schtasks.exe
PID 1912 wrote to memory of 920	1912	Aimtxznnlqlhr.exe	schtasks.exe
PID 1912 wrote to memory of 540	1912	Aimtxznnlqlhr.exe	Window Security Health Service.exe
PID 1912 wrote to memory of 540	1912	Aimtxznnlqlhr.exe	Window Security Health Service.exe
PID 1912 wrote to memory of 540	1912	Aimtxznnlqlhr.exe	Window Security Health Service.exe
PID 1912 wrote to memory of 540	1912	Aimtxznnlqlhr.exe	Window Security Health Service.exe
PID 540 wrote to memory of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 540 wrote to memory of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 540 wrote to memory of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 540 wrote to memory of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 540 wrote to memory of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 540 wrote to memory of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 540 wrote to memory of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 540 wrote to memory of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 540 wrote to memory of 1616	540	Window Security Health Service.exe	Window Security Health Service.exe
PID 1616 wrote to memory of 1780	1616	Window Security Health Service.exe	schtasks.exe
PID 1616 wrote to memory of 1780	1616	Window Security Health Service.exe	schtasks.exe
PID 1616 wrote to memory of 1780	1616	Window Security Health Service.exe	schtasks.exe
PID 1616 wrote to memory of 1780	1616	Window Security Health Service.exe	schtasks.exe
PID 1912 wrote to memory of 1724	1912	Aimtxznnlqlhr.exe	powershell.exe
PID 1912 wrote to memory of 1724	1912	Aimtxznnlqlhr.exe	powershell.exe
PID 1912 wrote to memory of 1724	1912	Aimtxznnlqlhr.exe	powershell.exe
PID 1912 wrote to memory of 1724	1912	Aimtxznnlqlhr.exe	powershell.exe
PID 1912 wrote to memory of 732	1912	Aimtxznnlqlhr.exe	cmd.exe
PID 1912 wrote to memory of 732	1912	Aimtxznnlqlhr.exe	cmd.exe
PID 1912 wrote to memory of 732	1912	Aimtxznnlqlhr.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\BitcoinFakeTransaction\BitcoinFakeTransaction.exe
"C:\Users\Admin\AppData\Local\Temp\BitcoinFakeTransaction\BitcoinFakeTransaction.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe
  "C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe
    "C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe"
    3⤵
    - Executes dropped EXE
    PID:1152
- C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe
  "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe
    "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe"
    3⤵
    - Executes dropped EXE
    PID:1544
- - C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe
    "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Adds Run key to start application
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "window update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:920
  - - C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe
      "C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:540
    - - C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe
        
        "C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1616
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "window update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe" /rl HIGHEST /f
        6⤵
        Creates scheduled task(s)
        
        PID:1780
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1724
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
      4⤵
      PID:732
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
        5⤵
        Deletes itself
        
        PID:532
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\d59EM6nNJaRx.bat" "
      4⤵
      Loads dropped DLL
      PID:1712
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1328
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe"
        6⤵
        Executes dropped EXE
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\d59EM6nNJaRx.bat

Filesize
210B

MD5
5d7de00bbf1c5916eabcea0e8c062fad

SHA1
8cd6e10e019e099fb352bee547ea9b20f2568958

SHA256
d7460522046f4c5c27777f26ef621f6faf392a790f0a86df5f9a159aacaa5d13

SHA512
35203ea5896e7432db082d63bc6525f80a47ef698d969c24a170f559868af921d7e49bd74db6d4bc8d4922aaf5a936b9c79194a8edcd4d4f12dfc406c92b84bf

Download Submit
C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
C:\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
\Users\Admin\AppData\Local\Temp\Aimtxznnlqlhr.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
\Users\Admin\AppData\Local\Temp\Mvjdejeez.exe

Filesize
206KB

MD5
01af6f42da188981c1a00494199fdfbc

SHA1
3147729b4e4df80628e658ae173bb6b8c7fd4479

SHA256
4b128169df80bba5f09ca7fb7aefdc03ccca3b7c4ef3f5af5af582af217f3b50

SHA512
d73233fde28540b5203484e5303453322cdeaadfec1373745d3c6d9569d511387ddcb882f261f76825673ce5608d628432ea5066da384bac8d2c2e4a067222e0

Download Submit
\Users\Admin\AppData\Roaming\windows Service32\Window Security Health Service.exe

Filesize
665KB

MD5
a9a1e7fecf84681f351d9d84c9a0b93d

SHA1
b82971b2c422e29a3062d42d38151926a84b2d50

SHA256
8172ce0605bb35ab5d7e2fab3f9dd3918e246e782797f9e7439527fd197623da

SHA512
ad1c5efac370054da119f85d4aae453df26673fe4b28a8e0157166d233659ce5690270731ac482a8948b82c908dbf7dfde3d46cf3c547272567063379531a435

Download Submit
memory/532-123-0x0000000000000000-mapping.dmp

Download
memory/540-103-0x00000000000F0000-0x000000000019C000-memory.dmp

Filesize
688KB

Download
memory/540-100-0x0000000000000000-mapping.dmp

Download
memory/732-122-0x0000000000000000-mapping.dmp

Download
memory/840-141-0x0000000000486C9E-mapping.dmp

Download
memory/876-127-0x0000000000000000-mapping.dmp

Download
memory/920-98-0x0000000000000000-mapping.dmp

Download
memory/1152-91-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1152-69-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1152-70-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1152-75-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1152-78-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1152-95-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1152-85-0x0000000000403CFE-mapping.dmp

Download
memory/1152-82-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1320-62-0x0000000000100000-0x000000000013A000-memory.dmp

Filesize
232KB

Download
memory/1320-64-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1320-66-0x0000000000280000-0x000000000028A000-memory.dmp

Filesize
40KB

Download
memory/1320-56-0x0000000000000000-mapping.dmp

Download
memory/1328-126-0x0000000000000000-mapping.dmp

Download
memory/1340-54-0x0000000000B20000-0x0000000000C20000-memory.dmp

Filesize
1024KB

Download
memory/1340-55-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmp

Filesize
8KB

Download
memory/1616-110-0x0000000000486C9E-mapping.dmp

Download
memory/1712-124-0x0000000000000000-mapping.dmp

Download
memory/1724-121-0x000000006F100000-0x000000006F6AB000-memory.dmp

Filesize
5.7MB

Download
memory/1724-120-0x000000006F100000-0x000000006F6AB000-memory.dmp

Filesize
5.7MB

Download
memory/1724-118-0x0000000000000000-mapping.dmp

Download
memory/1752-63-0x0000000000C80000-0x0000000000D2C000-memory.dmp

Filesize
688KB

Download
memory/1752-59-0x0000000000000000-mapping.dmp

Download
memory/1780-117-0x0000000000000000-mapping.dmp

Download
memory/1912-90-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1912-94-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1912-80-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1912-81-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1912-84-0x0000000000486C9E-mapping.dmp

Download
memory/1912-77-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1912-83-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/1912-74-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/2020-129-0x0000000000000000-mapping.dmp

Download
memory/2020-131-0x0000000000D80000-0x0000000000E2C000-memory.dmp

Filesize
688KB

Download