quasar | 6f36e1bf1595da615e4e90c26d960419240c69c162be3ef623e15f454f13fd4d

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2024, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240301-vqc2bsaf86
SHA256 6f36e1bf1595da615e4e90c26d960419240c69c162be3ef623e15f454f13fd4d
MD5 7a6e03571f190e83e070090e1eb4ca89
SHA1 86f0b01155802d00d74d5ce1d990df9ce9c6d6e2
SHA512 dca5f1ba1cc1d56390732bb15af009d19ab9264fbaeced2a98048160e6af2c416056f90099485d92aeb34633cec8fe369c268336f3efca3616a87caeec83692f
SSDEEP 49152:evst62XlaSFNWPjljiFa2RoUYIuFtSooGdgTHHB72eh2NT:evQ62XlaSFNWPjljiFXRoUYIuFtd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

0.tcp.eu.ngrok.io:15015:4782

Mutex

4b954fab-7429-499a-ab6b-df9c5e3096d7

Attributes

encryption_key
D75601A171551C23C0EEACEE58E7D707A2C948C8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
TestWindows
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 7 IoCs

resource	yara_rule
behavioral2/memory/4108-0-0x0000000000670000-0x0000000000994000-memory.dmp	family_quasar
behavioral2/files/0x0009000000023263-5.dat	family_quasar
behavioral2/files/0x0009000000023263-7.dat	family_quasar
behavioral2/files/0x0009000000023263-19.dat	family_quasar
behavioral2/files/0x0009000000023263-28.dat	family_quasar
behavioral2/files/0x0009000000023263-36.dat	family_quasar
behavioral2/files/0x0009000000023263-44.dat	family_quasar

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 13 IoCs

pid	Process
400	Client.exe
3220	Client.exe
2776	Client.exe
3776	Client.exe
4564	Client.exe
3764	Client.exe
3256	Client.exe
904	Client.exe
3756	Client.exe
3968	Client.exe
2076	Client.exe
760	Client.exe
4284	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1684	schtasks.exe
3980	schtasks.exe
3564	schtasks.exe
3256	schtasks.exe
4944	schtasks.exe
3140	schtasks.exe
824	schtasks.exe
4268	schtasks.exe
1420	schtasks.exe
4136	schtasks.exe
1976	schtasks.exe
2088	schtasks.exe
4336	schtasks.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
1460	PING.EXE
4652	PING.EXE
4308	PING.EXE
4788	PING.EXE
2092	PING.EXE
3060	PING.EXE
1256	PING.EXE
4100	PING.EXE
2144	PING.EXE
2924	PING.EXE
3820	PING.EXE
3996	PING.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4108	Client-built.exe
Token: SeDebugPrivilege	400	Client.exe
Token: SeDebugPrivilege	3220	Client.exe
Token: SeDebugPrivilege	2776	Client.exe
Token: SeDebugPrivilege	3776	Client.exe
Token: SeDebugPrivilege	4564	Client.exe
Token: SeDebugPrivilege	3764	Client.exe
Token: SeDebugPrivilege	3256	Client.exe
Token: SeDebugPrivilege	904	Client.exe
Token: SeDebugPrivilege	3756	Client.exe
Token: SeDebugPrivilege	3968	Client.exe
Token: SeDebugPrivilege	2076	Client.exe
Token: SeDebugPrivilege	760	Client.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
400	Client.exe
3220	Client.exe
2776	Client.exe
3776	Client.exe
4564	Client.exe
3764	Client.exe
3256	Client.exe
904	Client.exe
3756	Client.exe
3968	Client.exe
2076	Client.exe
760	Client.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
400	Client.exe
3220	Client.exe
2776	Client.exe
3776	Client.exe
4564	Client.exe
3764	Client.exe
3256	Client.exe
904	Client.exe
3756	Client.exe
3968	Client.exe
2076	Client.exe
760	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4336	4108	Client-built.exe	95
PID 4108 wrote to memory of 4336	4108	Client-built.exe	95
PID 4108 wrote to memory of 400	4108	Client-built.exe	97
PID 4108 wrote to memory of 400	4108	Client-built.exe	97
PID 400 wrote to memory of 1976	400	Client.exe	100
PID 400 wrote to memory of 1976	400	Client.exe	100
PID 400 wrote to memory of 1304	400	Client.exe	102
PID 400 wrote to memory of 1304	400	Client.exe	102
PID 1304 wrote to memory of 932	1304	cmd.exe	104
PID 1304 wrote to memory of 932	1304	cmd.exe	104
PID 1304 wrote to memory of 4788	1304	cmd.exe	105
PID 1304 wrote to memory of 4788	1304	cmd.exe	105
PID 1304 wrote to memory of 3220	1304	cmd.exe	106
PID 1304 wrote to memory of 3220	1304	cmd.exe	106
PID 3220 wrote to memory of 3564	3220	Client.exe	107
PID 3220 wrote to memory of 3564	3220	Client.exe	107
PID 3220 wrote to memory of 4564	3220	Client.exe	109
PID 3220 wrote to memory of 4564	3220	Client.exe	109
PID 4564 wrote to memory of 1420	4564	cmd.exe	111
PID 4564 wrote to memory of 1420	4564	cmd.exe	111
PID 4564 wrote to memory of 3820	4564	cmd.exe	112
PID 4564 wrote to memory of 3820	4564	cmd.exe	112
PID 4564 wrote to memory of 2776	4564	cmd.exe	115
PID 4564 wrote to memory of 2776	4564	cmd.exe	115
PID 2776 wrote to memory of 4136	2776	Client.exe	116
PID 2776 wrote to memory of 4136	2776	Client.exe	116
PID 2776 wrote to memory of 2172	2776	Client.exe	118
PID 2776 wrote to memory of 2172	2776	Client.exe	118
PID 2172 wrote to memory of 2708	2172	cmd.exe	120
PID 2172 wrote to memory of 2708	2172	cmd.exe	120
PID 2172 wrote to memory of 2092	2172	cmd.exe	121
PID 2172 wrote to memory of 2092	2172	cmd.exe	121
PID 2172 wrote to memory of 3776	2172	cmd.exe	122
PID 2172 wrote to memory of 3776	2172	cmd.exe	122
PID 3776 wrote to memory of 3256	3776	Client.exe	124
PID 3776 wrote to memory of 3256	3776	Client.exe	124
PID 3776 wrote to memory of 3264	3776	Client.exe	126
PID 3776 wrote to memory of 3264	3776	Client.exe	126
PID 3264 wrote to memory of 4208	3264	cmd.exe	128
PID 3264 wrote to memory of 4208	3264	cmd.exe	128
PID 3264 wrote to memory of 1460	3264	cmd.exe	129
PID 3264 wrote to memory of 1460	3264	cmd.exe	129
PID 3264 wrote to memory of 4564	3264	cmd.exe	131
PID 3264 wrote to memory of 4564	3264	cmd.exe	131
PID 4564 wrote to memory of 1684	4564	Client.exe	132
PID 4564 wrote to memory of 1684	4564	Client.exe	132
PID 4564 wrote to memory of 1548	4564	Client.exe	134
PID 4564 wrote to memory of 1548	4564	Client.exe	134
PID 1548 wrote to memory of 2708	1548	cmd.exe	136
PID 1548 wrote to memory of 2708	1548	cmd.exe	136
PID 1548 wrote to memory of 4652	1548	cmd.exe	137
PID 1548 wrote to memory of 4652	1548	cmd.exe	137
PID 1548 wrote to memory of 3764	1548	cmd.exe	138
PID 1548 wrote to memory of 3764	1548	cmd.exe	138
PID 3764 wrote to memory of 4944	3764	Client.exe	139
PID 3764 wrote to memory of 4944	3764	Client.exe	139
PID 3764 wrote to memory of 3528	3764	Client.exe	141
PID 3764 wrote to memory of 3528	3764	Client.exe	141
PID 3528 wrote to memory of 4752	3528	cmd.exe	143
PID 3528 wrote to memory of 4752	3528	cmd.exe	143
PID 3528 wrote to memory of 3996	3528	cmd.exe	144
PID 3528 wrote to memory of 3996	3528	cmd.exe	144
PID 3528 wrote to memory of 3256	3528	cmd.exe	145
PID 3528 wrote to memory of 3256	3528	cmd.exe	145

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:4336
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9sNCA8aRbGUT.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:932
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:4788
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:3564
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jlTtjjFNo3LQ.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4564
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1420
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:3820
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:4136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\huJ5WwgflLXR.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2708
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:2092
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:3256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5JoJsOWfiXT9.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4208
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:1460
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:1684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\smeKTElcXxLN.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2708
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:4652
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Creates scheduled task(s)
        
        PID:4944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Z9fBw6VCJf4f.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:3996
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3256
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Creates scheduled task(s)
        
        PID:3140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\msRPojENtk2i.bat" "
        15⤵
        
        PID:1768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3820
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:3060
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:904
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Creates scheduled task(s)
        
        PID:824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nVXCex7rlQYz.bat" "
        17⤵
        
        PID:3548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:1256
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3756
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Creates scheduled task(s)
        
        PID:3980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lvRFHVBsx0cd.bat" "
        19⤵
        
        PID:4752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:4100
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Creates scheduled task(s)
        
        PID:4268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4BjzRlUgVBs8.bat" "
        21⤵
        
        PID:4516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1104
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:2144
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2076
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Creates scheduled task(s)
        
        PID:1420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\let9lY9qEfQ7.bat" "
        23⤵
        
        PID:1976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1732
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:2924
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:760
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Creates scheduled task(s)
        
        PID:2088
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MKx6dv4FVPoy.bat" "
        25⤵
        
        PID:1960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:4308
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        
        PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:3504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

4BjzRlUgVBs8.bat

Path C:\Users\Admin\AppData\Local\Temp\4BjzRlUgVBs8.bat
Size 207B
SHA256 72f7efe627702a9a3d043b2df9d1f52428eed4b1c0e9771702f1d4070794cc33
MD5 225a5f4562289f5a112a936c71e7684e
SHA1 3a5cb49ac3f8f40a93cd7b7fc5d37de8a5a4a1dd
SHA512 46d6ccf99f2314590786307d95b96d250c8a5e7de95df695859c0bfc194ab14056eb39d71c57ee1095e3bd091a9a6beb46cd0f5f42dbd8dff6b4bb03cb1d3ba8
MD5 SHA1 SHA512

Submit Download

5JoJsOWfiXT9.bat

Path C:\Users\Admin\AppData\Local\Temp\5JoJsOWfiXT9.bat
Size 207B
SHA256 e266116418aa6936e8dfbd19e89ca4465f7b08df9855f2b79840b7d09768f153
MD5 1aa408f4120ed3b19e02c72ff276a1e4
SHA1 8d9b37297167358213becba660a139195879d3a7
SHA512 08224a4edc3203c461d7c8e544cd7e38f56f0db75e0ea2af8b6405f467ac0fb34bb665a7ecb3b1db91bd4ec663b92dc71325ac5cf7ee376cad6e6060a5055171
MD5 SHA1 SHA512

Submit Download

9sNCA8aRbGUT.bat

Path C:\Users\Admin\AppData\Local\Temp\9sNCA8aRbGUT.bat
Size 207B
SHA256 38a59c12043f447c765bb3636fc190b253ece87678d61b171aae4e9a99955226
MD5 fca35e59dbbaaa95c91e8c54af750d7e
SHA1 5ae4ee461412cf9e7930cd1b1be783ebfe3490f4
SHA512 1b9baecc86480486380278bfe60e2ef4412d017607b355c7360288e1f3d265dfc1c9a6e04d6e3c465816369b8cb2fb5589a469a2a30765fe9dcbfd5b69326bad
MD5 SHA1 SHA512

Submit Download

MKx6dv4FVPoy.bat

Path C:\Users\Admin\AppData\Local\Temp\MKx6dv4FVPoy.bat
Size 207B
SHA256 04adbb1c68c90f242d1f78f1e53d7f621e9e860eaf3fd78340f34b711fe4ae02
MD5 fd726a4482c9701ef4e50304c0b1ebd1
SHA1 ed84f1403c70a2599d57ba82c54a56824f16ed55
SHA512 157f4b03dd261871d9bcf8c779f26d0abc6a067323eca0617849bf7cb3a8c5b5a353a4d535c08e730ab3cc7e78ce25c8f0875837ac1c9a00e9a6ab0f7c95a203
MD5 SHA1 SHA512

Submit Download

Z9fBw6VCJf4f.bat

Path C:\Users\Admin\AppData\Local\Temp\Z9fBw6VCJf4f.bat
Size 207B
SHA256 d5ccddf1565e90a22e4086a2d7d5c02ad77a6c86efdd740f414a296886dd52cf
MD5 2e9946344a569bc335c971c39a4325ab
SHA1 571bab01984af9881bd18550ae694af2f0f0332b
SHA512 d577fcd0fe6fb316ba4fc852873d1fa15a50cb4ecdfc94c0c194b82d54c193b4adf0ff11e4f156cc300475fe0687014fd6bbd7c5cc40483de16687e9b6a031e7
MD5 SHA1 SHA512

Submit Download

huJ5WwgflLXR.bat

Path C:\Users\Admin\AppData\Local\Temp\huJ5WwgflLXR.bat
Size 207B
SHA256 31dd000e6f607f179c28d1e110902adb520c1888801c8e5e9ab99b5dc59cff58
MD5 652b4b8d3c27d75deaeeacb5722630a6
SHA1 7952c16b17cdb32108bdc6ac7fc3e36911e2cdfc
SHA512 c855a3da561e79aea80fdc524e81caed6eb7f3b9dadfb8a0a6c9c05d3a48e5eacf57aee520097d8424b4ad635436b430c8a25c87d6430f9f7375a0c01d44b232
MD5 SHA1 SHA512

Submit Download

jlTtjjFNo3LQ.bat

Path C:\Users\Admin\AppData\Local\Temp\jlTtjjFNo3LQ.bat
Size 207B
SHA256 b0425a44e49d037c2c445c83d335002ff35562a95993f5a1be7d675f87a5789d
MD5 753468e097b942d2abc9c40d52957c69
SHA1 657a97e36cced4a9236d112c42839c14d40369f2
SHA512 90751d79b09619b6580a9203068a6ba7759c73f5324663ce2fe8a22212e56f1208dab0d18158f7f7328ec4c45539d13aedacfc9d35ed4cfb1f720d7bf61aab6f
MD5 SHA1 SHA512

Submit Download

let9lY9qEfQ7.bat

Path C:\Users\Admin\AppData\Local\Temp\let9lY9qEfQ7.bat
Size 207B
SHA256 b7674e566cb910fc6e9adf5608ce38b0aff66d5a1eaad73f6a1969d6c8681a07
MD5 33c1c0eb45aedab2dbface75d722c56e
SHA1 641dcfb025441a8cbbbd612ce4bd1e6e6de688a6
SHA512 c8720a193cbe1e370e52a036e7a1844a38f54e8cb839e5943ccf8dc898cf97b4ed1e5746beebaa76ae00a63f4b72aca15b70750ec670e08fd7a6a2a07991b1c0
MD5 SHA1 SHA512

Submit Download

lvRFHVBsx0cd.bat

Path C:\Users\Admin\AppData\Local\Temp\lvRFHVBsx0cd.bat
Size 207B
SHA256 4ecc12140075ffb812f19da19b6d041b515801a105247bd7a6fcf40a2ad964cf
MD5 fc0510ab0f60419137b38879a639447e
SHA1 2b88a7c86a45db056ca43e2932b7f69b383a16fd
SHA512 5bb7d2597da88085d5963e89d276c46d7722d0b21fd164de210df1db3bc5a8c13064773aec9a932ab2201bb988bfa92174d36c8a60ffea3b9b5e10941f847c45
MD5 SHA1 SHA512

Submit Download

msRPojENtk2i.bat

Path C:\Users\Admin\AppData\Local\Temp\msRPojENtk2i.bat
Size 207B
SHA256 21f9dbf1eec9d8c80b5a78eb5c693afbd722a9b1b389764471e6dd53049a99d9
MD5 e11375e65048850525c6c0f14263fb9b
SHA1 21035b72951d9bfee7c0dbd154de7bdebbff4304
SHA512 bac3c64d2246ecdf0e3a58d7ea6eea84ffe550cc391cea6668cc669221ff27a3ed0e955cd3af6a6ba2ef90530b3b10166ca62bdf31604df839788fbb5472c32e
MD5 SHA1 SHA512

Submit Download

nVXCex7rlQYz.bat

Path C:\Users\Admin\AppData\Local\Temp\nVXCex7rlQYz.bat
Size 207B
SHA256 565d62e098053df76c92436a37ca06db417be9ee18de75a657d32fda16ed8eed
MD5 9abf9e901377130ba017839f6057ea2b
SHA1 5285f8144d43c93e70ec11115eabb26c22361707
SHA512 1d9cf8b1c5bb7912176342fb0a59ace1b0386b855445560b4bdefaafefec79f74c0576a0b1c33421147e18d5d1921dd540650f2902bda0e6f6ca4926c1607dba
MD5 SHA1 SHA512

Submit Download

smeKTElcXxLN.bat

Path C:\Users\Admin\AppData\Local\Temp\smeKTElcXxLN.bat
Size 207B
SHA256 293a8777fde749db321507036aa87fa2a3cda79d1a6bf679c88b979a0fe10e6a
MD5 92281155969e8b397f95b0de4601ec90
SHA1 db9b7799d0d10609893816b7163d9123c8901ede
SHA512 11ab5893e79878ddfae46029ade4f24594b102d1f7bad4cd84a545f6f06a169bcb101656bc1bc81fc6f315958776b934bd0791e194d6f33baa4b5d7f6896c5f0
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 1.5MB
SHA256 2d0ea22735c920dc7c57eab6e756c8a93ac219abc390260feb1f3905ff609cf9
MD5 6fe388afdf86955d9542bc1ad9fd3638
SHA1 26d6c6a90e419c18e21c5edd737c35ff4a197770
SHA512 9ee8ebbd2d5c7927ebd47c9cf459e26072d60008266a40991bc98479b15b982e8ec2da64750e0c95e2708dc92545008d9587c23e5300d196f899b1223fe7eb04
SSDEEP 24576:evTotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qgK:evst62XlaSFNWPjljiFa2RoUYIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 768KB
SHA256 db190569e58bda222f1f967ee3d349160e5551c5fcc401aef6a212c9ba3ddd0f
MD5 af857d8ea75f7613c6c89f1e6c4d7ca2
SHA1 955a9d69cccfafebacbcf92887a62ff725ac8aa1
SHA512 fdac732b818dc8d8996a07bfd3b3fa207d5d1b4d0c60d7a8ae20481294519f4a67f4504aec55b25873a3223e3bf4a7ba7317b951987836d03373e9d550ddb0b7
SSDEEP 12288:AvgMzKMZjLNbWHi2EIlOnefLBCmaquy+2gnF3C/kcPC:evTotTaHX2Xi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 6f36e1bf1595da615e4e90c26d960419240c69c162be3ef623e15f454f13fd4d
MD5 7a6e03571f190e83e070090e1eb4ca89
SHA1 86f0b01155802d00d74d5ce1d990df9ce9c6d6e2
SHA512 dca5f1ba1cc1d56390732bb15af009d19ab9264fbaeced2a98048160e6af2c416056f90099485d92aeb34633cec8fe369c268336f3efca3616a87caeec83692f
SSDEEP 49152:evst62XlaSFNWPjljiFa2RoUYIuFtSooGdgTHHB72eh2NT:evQ62XlaSFNWPjljiFXRoUYIuFtd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 715KB
SHA256 b96f589d0970f6c7527177f78e53db5c11959d01a0394d8b849ed86c59ed06f0
MD5 789916a73e31e4af879cf3e8d1536ccc
SHA1 007f8b816fabe0e2458578f9f3c4c2b4e59ebe63
SHA512 3de799834900d6db4389169f11a8cd404bda2304b3e20fd8418ba5f5b962d407120bae6f03210826184f1555390856c5e45daf4518fb84185132cbad40eccc18
SSDEEP 12288:AvgMzKMZjLNbWHi2EIlOnefLBCmaquy+2gnF3C/y:evTotTaHX2Xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 246KB
SHA256 14d25a42278568194bab31742e39cab564a73785fb477ecce64dc937520cdac1
MD5 420dd595eb0d35d65410b1de7cb4e60c
SHA1 f3466a9a5c187d464c46c4a3a1360632090ecb3e
SHA512 7cdefad90e9f44addb3fdec6a4f77e378c3ebe6a432d4a27b82c6711b0bc1b94ab785eca1dd103ff19f9c1705142c41251d8ef7a24e0ce777091ccb3a8049bd4
SSDEEP 6144:LcvgMzKM4oIeTjLNbWHP6MFptEPIjlOnefR:AvgMzKMZjLNbWHi2EIlOnefR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 2.6MB
SHA256 3d2a50261ea49d02251e2298c628c8b0be8600b30639b990926c59c912b38524
MD5 3098482a9892d3963debeeb5a25f9510
SHA1 015866dfb269a3a8ca1c532096726691f29c91a2
SHA512 de654aea00288e4a4796f6be7d1ace137473aa0ae54d9c50553dc84285ae55b362bc6bc25d5a4c099219a3a607a54d3516e779c0e3d4b4eb90e1cfead984984d
SSDEEP 49152:evst62XlaSFNWPjljiFa2RoUYIuFtSooGdW:evQ62XlaSFNWPjljiFXRoUYIuFtdm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 2.9MB
SHA256 de52ab5244bda8c666ee5cd8829a4ddb7966f4e7f8190a37f40ed55e8426caa4
MD5 3782d5f55f783c9fec463d42b1084f1d
SHA1 1206a115956ab0611afb51d97188358c6ec1920a
SHA512 f2ccb61434091f724701c16399a137666e7d801ceee81ed26d22735cc679aa8b173b222fa6ee5d64ba48a5e126c6b3040377f2d5b44ee94642165a06d256c809
SSDEEP 49152:evst62XlaSFNWPjljiFa2RoUYIuFtSooGdgTHHBR:evQ62XlaSFNWPjljiFXRoUYIuFtdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-10-0x000000001B4B0000-0x000000001B4C0000-memory.dmp

Download

memory/400-18-0x00007FFFD5FB0000-0x00007FFFD6A71000-memory.dmp

Download

memory/400-12-0x000000001C270000-0x000000001C322000-memory.dmp

Download

memory/400-11-0x000000001C160000-0x000000001C1B0000-memory.dmp

Download

memory/400-8-0x00007FFFD5FB0000-0x00007FFFD6A71000-memory.dmp

Download

memory/760-102-0x000000001BCE0000-0x000000001BCF0000-memory.dmp

Download

memory/760-101-0x00007FFFD67E0000-0x00007FFFD72A1000-memory.dmp

Download

memory/760-107-0x00007FFFD67E0000-0x00007FFFD72A1000-memory.dmp

Download

memory/904-69-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/904-70-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/904-74-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/2076-94-0x000000001B420000-0x000000001B430000-memory.dmp

Download

memory/2076-93-0x00007FFFD67E0000-0x00007FFFD72A1000-memory.dmp

Download

memory/2076-99-0x00007FFFD67E0000-0x00007FFFD72A1000-memory.dmp

Download

memory/2776-34-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/2776-29-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/2776-30-0x000000001B640000-0x000000001B650000-memory.dmp

Download

memory/3220-26-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3220-22-0x0000000002740000-0x0000000002750000-memory.dmp

Download

memory/3220-21-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3256-61-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3256-62-0x000000001BE20000-0x000000001BE30000-memory.dmp

Download

memory/3256-67-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3756-82-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3756-77-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3756-78-0x000000001BA20000-0x000000001BA30000-memory.dmp

Download

memory/3764-59-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3764-54-0x000000001BDD0000-0x000000001BDE0000-memory.dmp

Download

memory/3764-53-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3776-43-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3776-37-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3776-38-0x000000001B770000-0x000000001B780000-memory.dmp

Download

memory/3968-85-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/3968-86-0x00000000028A0000-0x00000000028B0000-memory.dmp

Download

memory/3968-91-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/4108-9-0x00007FFFD5FB0000-0x00007FFFD6A71000-memory.dmp

Download

memory/4108-0-0x0000000000670000-0x0000000000994000-memory.dmp

Download

memory/4108-2-0x000000001B7C0000-0x000000001B7D0000-memory.dmp

Download

memory/4108-1-0x00007FFFD5FB0000-0x00007FFFD6A71000-memory.dmp

Download

memory/4284-109-0x00007FFFD67E0000-0x00007FFFD72A1000-memory.dmp

Download

memory/4284-110-0x000000001BD00000-0x000000001BD10000-memory.dmp

Download

memory/4564-45-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

memory/4564-46-0x0000000002760000-0x0000000002770000-memory.dmp

Download

memory/4564-51-0x00007FFFD6020000-0x00007FFFD6AE1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads