quasar | 6f36e1bf1595da615e4e90c26d960419240c69c162be3ef623e15f454f13fd4d

Analysis

max time kernel
144s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
01/03/2024, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240301-vqc2bsaf86
SHA256 6f36e1bf1595da615e4e90c26d960419240c69c162be3ef623e15f454f13fd4d
MD5 7a6e03571f190e83e070090e1eb4ca89
SHA1 86f0b01155802d00d74d5ce1d990df9ce9c6d6e2
SHA512 dca5f1ba1cc1d56390732bb15af009d19ab9264fbaeced2a98048160e6af2c416056f90099485d92aeb34633cec8fe369c268336f3efca3616a87caeec83692f
SSDEEP 49152:evst62XlaSFNWPjljiFa2RoUYIuFtSooGdgTHHB72eh2NT:evQ62XlaSFNWPjljiFXRoUYIuFtd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

0.tcp.eu.ngrok.io:15015:4782

Mutex

4b954fab-7429-499a-ab6b-df9c5e3096d7

Attributes

encryption_key
D75601A171551C23C0EEACEE58E7D707A2C948C8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
TestWindows
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral3/memory/3204-0-0x0000000000580000-0x00000000008A4000-memory.dmp	family_quasar
behavioral3/files/0x000200000002a7a9-5.dat	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
3512	Client.exe
3448	Client.exe
2224	Client.exe
4904	Client.exe
2252	Client.exe
2484	Client.exe
4504	Client.exe
424	Client.exe
3332	Client.exe
228	Client.exe
2280	Client.exe
2192	Client.exe
1568	Client.exe
1816	Client.exe
4808	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2848	schtasks.exe
2436	schtasks.exe
3600	schtasks.exe
1708	schtasks.exe
3760	schtasks.exe
2176	schtasks.exe
3332	schtasks.exe
4804	schtasks.exe
3212	schtasks.exe
2208	schtasks.exe
1008	schtasks.exe
3508	schtasks.exe
3608	schtasks.exe
2172	schtasks.exe
4756	schtasks.exe
1980	schtasks.exe

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
1476	PING.EXE
1796	PING.EXE
4744	PING.EXE
756	PING.EXE
412	PING.EXE
1504	PING.EXE
3932	PING.EXE
4208	PING.EXE
2620	PING.EXE
4292	PING.EXE
5112	PING.EXE
2148	PING.EXE
3596	PING.EXE
4880	PING.EXE
1992	PING.EXE

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3204	Client-built.exe
Token: SeDebugPrivilege	3512	Client.exe
Token: SeDebugPrivilege	3448	Client.exe
Token: SeDebugPrivilege	2224	Client.exe
Token: SeDebugPrivilege	4904	Client.exe
Token: SeDebugPrivilege	2252	Client.exe
Token: SeDebugPrivilege	2484	Client.exe
Token: SeDebugPrivilege	4504	Client.exe
Token: SeDebugPrivilege	424	Client.exe
Token: SeDebugPrivilege	3332	Client.exe
Token: SeDebugPrivilege	228	Client.exe
Token: SeDebugPrivilege	2280	Client.exe
Token: SeDebugPrivilege	2192	Client.exe
Token: SeDebugPrivilege	1568	Client.exe
Token: SeDebugPrivilege	1816	Client.exe
Token: SeDebugPrivilege	4808	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
3512	Client.exe
3448	Client.exe
2224	Client.exe
4904	Client.exe
2252	Client.exe
2484	Client.exe
4504	Client.exe
424	Client.exe
3332	Client.exe
228	Client.exe
2280	Client.exe
2192	Client.exe
1568	Client.exe
1816	Client.exe
4808	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
3512	Client.exe
3448	Client.exe
2224	Client.exe
4904	Client.exe
2252	Client.exe
2484	Client.exe
4504	Client.exe
424	Client.exe
3332	Client.exe
228	Client.exe
2280	Client.exe
2192	Client.exe
1568	Client.exe
1816	Client.exe
4808	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 3332	3204	Client-built.exe	78
PID 3204 wrote to memory of 3332	3204	Client-built.exe	78
PID 3204 wrote to memory of 3512	3204	Client-built.exe	80
PID 3204 wrote to memory of 3512	3204	Client-built.exe	80
PID 3512 wrote to memory of 4804	3512	Client.exe	81
PID 3512 wrote to memory of 4804	3512	Client.exe	81
PID 3512 wrote to memory of 3024	3512	Client.exe	83
PID 3512 wrote to memory of 3024	3512	Client.exe	83
PID 3024 wrote to memory of 3208	3024	cmd.exe	85
PID 3024 wrote to memory of 3208	3024	cmd.exe	85
PID 3024 wrote to memory of 756	3024	cmd.exe	86
PID 3024 wrote to memory of 756	3024	cmd.exe	86
PID 3024 wrote to memory of 3448	3024	cmd.exe	87
PID 3024 wrote to memory of 3448	3024	cmd.exe	87
PID 3448 wrote to memory of 3508	3448	Client.exe	88
PID 3448 wrote to memory of 3508	3448	Client.exe	88
PID 3448 wrote to memory of 3124	3448	Client.exe	90
PID 3448 wrote to memory of 3124	3448	Client.exe	90
PID 3124 wrote to memory of 1180	3124	cmd.exe	92
PID 3124 wrote to memory of 1180	3124	cmd.exe	92
PID 3124 wrote to memory of 4208	3124	cmd.exe	93
PID 3124 wrote to memory of 4208	3124	cmd.exe	93
PID 3124 wrote to memory of 2224	3124	cmd.exe	94
PID 3124 wrote to memory of 2224	3124	cmd.exe	94
PID 2224 wrote to memory of 3608	2224	Client.exe	95
PID 2224 wrote to memory of 3608	2224	Client.exe	95
PID 2224 wrote to memory of 720	2224	Client.exe	97
PID 2224 wrote to memory of 720	2224	Client.exe	97
PID 720 wrote to memory of 1956	720	cmd.exe	99
PID 720 wrote to memory of 1956	720	cmd.exe	99
PID 720 wrote to memory of 1476	720	cmd.exe	100
PID 720 wrote to memory of 1476	720	cmd.exe	100
PID 720 wrote to memory of 4904	720	cmd.exe	101
PID 720 wrote to memory of 4904	720	cmd.exe	101
PID 4904 wrote to memory of 2436	4904	Client.exe	102
PID 4904 wrote to memory of 2436	4904	Client.exe	102
PID 4904 wrote to memory of 4616	4904	Client.exe	104
PID 4904 wrote to memory of 4616	4904	Client.exe	104
PID 4616 wrote to memory of 4516	4616	cmd.exe	106
PID 4616 wrote to memory of 4516	4616	cmd.exe	106
PID 4616 wrote to memory of 1992	4616	cmd.exe	107
PID 4616 wrote to memory of 1992	4616	cmd.exe	107
PID 4616 wrote to memory of 2252	4616	cmd.exe	108
PID 4616 wrote to memory of 2252	4616	cmd.exe	108
PID 2252 wrote to memory of 4756	2252	Client.exe	109
PID 2252 wrote to memory of 4756	2252	Client.exe	109
PID 2252 wrote to memory of 772	2252	Client.exe	111
PID 2252 wrote to memory of 772	2252	Client.exe	111
PID 772 wrote to memory of 624	772	cmd.exe	113
PID 772 wrote to memory of 624	772	cmd.exe	113
PID 772 wrote to memory of 1796	772	cmd.exe	114
PID 772 wrote to memory of 1796	772	cmd.exe	114
PID 772 wrote to memory of 2484	772	cmd.exe	115
PID 772 wrote to memory of 2484	772	cmd.exe	115
PID 2484 wrote to memory of 3212	2484	Client.exe	116
PID 2484 wrote to memory of 3212	2484	Client.exe	116
PID 2484 wrote to memory of 1652	2484	Client.exe	118
PID 2484 wrote to memory of 1652	2484	Client.exe	118
PID 1652 wrote to memory of 2408	1652	cmd.exe	120
PID 1652 wrote to memory of 2408	1652	cmd.exe	120
PID 1652 wrote to memory of 2620	1652	cmd.exe	121
PID 1652 wrote to memory of 2620	1652	cmd.exe	121
PID 1652 wrote to memory of 4504	1652	cmd.exe	122
PID 1652 wrote to memory of 4504	1652	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3332
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6iz1bxmZhLZR.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3208
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:756
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3448
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:3508
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QInsHlDsytwv.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3124
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1180
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:4208
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:3608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QN3qiUWlOvOf.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:720
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1956
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:1476
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:2436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x9FfeidtxSBl.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4516
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:1992
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:4756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rjyRcZovso0P.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:624
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:1796
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Creates scheduled task(s)
        
        PID:3212
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9WjAwXhrMFIW.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2408
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:2620
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4504
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Creates scheduled task(s)
        
        PID:3600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YV3P4TRtG9KI.bat" "
        15⤵
        
        PID:1968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2624
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:1504
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:424
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Creates scheduled task(s)
        
        PID:1708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kwVfQEBG2LR5.bat" "
        17⤵
        
        PID:2780
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:4292
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3332
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Creates scheduled task(s)
        
        PID:2848
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qNr7EuasKKqO.bat" "
        19⤵
        
        PID:5108
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:5088
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:5112
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:228
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Creates scheduled task(s)
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ylQp9KyZAfLs.bat" "
        21⤵
        
        PID:276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:476
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:2148
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2280
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Creates scheduled task(s)
        
        PID:2172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SOKrTtc7EsEf.bat" "
        23⤵
        
        PID:2884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:848
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:3932
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2192
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Creates scheduled task(s)
        
        PID:3760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j3gem6uMtMQy.bat" "
        25⤵
        
        PID:1976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4088
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:4744
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1568
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Creates scheduled task(s)
        
        PID:2208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jTb7O05T0Soq.bat" "
        27⤵
        
        PID:5048
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1492
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        Runs ping.exe
        
        PID:3596
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1816
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Creates scheduled task(s)
        
        PID:2176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TqCaLxE1K4t9.bat" "
        29⤵
        
        PID:1040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        Runs ping.exe
        
        PID:412
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4808
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "TestWindows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Creates scheduled task(s)
        
        PID:1008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tp9CwQK1AHtT.bat" "
        31⤵
        
        PID:3660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:1384
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        Runs ping.exe
        
        PID:4880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 45030bd997f50bb52c481f7bc86fac5f375d08911bcc106b98d9d8f0c2ce9778
MD5 15eab799098760706ed95d314e75449d
SHA1 273fb07e40148d5c267ca53f958c5075d24c4444
SHA512 50c125e2a98740db0a0122d7f4de97c50d84623e800b3d3e173049c8e28ff0fbe4add7677bc56cb2228f78ed17522f67ae8f1b85f62824012414ce38ce0b500c
MD5 SHA1 SHA512

Submit Download

6iz1bxmZhLZR.bat

Path C:\Users\Admin\AppData\Local\Temp\6iz1bxmZhLZR.bat
Size 207B
SHA256 bbcd7e6d8f6ca7a64c0eaf0027f220828d1ba96fd6778897c587f7c22a134610
MD5 57d4715bd817d789728fc86c3b46c585
SHA1 d7b20cc26dbac992febccda5c156cf01fabf3135
SHA512 898b7060aa747f6056c77b1da92de1f34b659da9847d2ca7a9906882e56562e68f384ff7df3031283cf3215a03de6b60448fa79cd7ad4079e9c471b84f222997
MD5 SHA1 SHA512

Submit Download

9WjAwXhrMFIW.bat

Path C:\Users\Admin\AppData\Local\Temp\9WjAwXhrMFIW.bat
Size 207B
SHA256 e3266279de760d97bdc61c8901cd6b6c9b458e43abb183bfabc8bbf60248c695
MD5 a80bd9b16338246ffde442b59be2f7a9
SHA1 94c5b974f1825bfc25f77723de8e02aff1671233
SHA512 88b93f24e0018651b46fab502f5713893adc697a49188a88e9ee810b23e3b5906e274cceb16025d8ffdec44fb959600f450b90357eb7d763316065af2f48b001
MD5 SHA1 SHA512

Submit Download

QInsHlDsytwv.bat

Path C:\Users\Admin\AppData\Local\Temp\QInsHlDsytwv.bat
Size 207B
SHA256 f72e1b285cce264e16b5b0e887bd1ee0d496807b59f13f3ef5bfbba138323488
MD5 28a9b91c1cb10308abc7bba8e4edba68
SHA1 d3713eb0c6b3fcce523f18f5061033dffbb3cfa1
SHA512 3f44cb0c0b040a8a0faafa07c929272ada8cdb2ac1b5afb85057a2aabeeb3df71d09b78dfbf5bb06f784f2d24c1a35cad4df85af56060b8981540c446a41a167
MD5 SHA1 SHA512

Submit Download

QN3qiUWlOvOf.bat

Path C:\Users\Admin\AppData\Local\Temp\QN3qiUWlOvOf.bat
Size 207B
SHA256 46bc922a1983072eeb22808257e89183c29c67e7f45fcb0781b2eaf37f2fc3ed
MD5 00fef7a2f813ed7364d0b5776c2e88dc
SHA1 c8551350c94d880254d15626e90a14ba973cf8cd
SHA512 daafbd18f9ecc7d5ef7198d43905bb05fdf02a74515d73eaf7c33a6cbd070eb96a9908e24df778fdcc9cab2a8e0728439757fe8a59b60a093ed7a472ebf01707
MD5 SHA1 SHA512

Submit Download

SOKrTtc7EsEf.bat

Path C:\Users\Admin\AppData\Local\Temp\SOKrTtc7EsEf.bat
Size 207B
SHA256 8170ac30dd5e0bcf3a19371c2d63b4c16ee4b00454b6b3b6412512617be9a28f
MD5 a7e6381bfddc2905a9b79c58f3b0022d
SHA1 6bc46202effb2f93fd4b0ce72711e61914432b3a
SHA512 cffd2d861ec719546d32c8a2f0be00152ff00cf8183ce5bb2b056018cc21ea9c85c3b8aa32ad82d9661e240d810088c2e14afdf43deb7853c670ece290578e7a
MD5 SHA1 SHA512

Submit Download

TqCaLxE1K4t9.bat

Path C:\Users\Admin\AppData\Local\Temp\TqCaLxE1K4t9.bat
Size 207B
SHA256 b5a6a5f9d3b2100db1ac625127f8797a0d42ccf3f8c92f2fb377b554c017f1e6
MD5 c11b73a0b867910e819ea6d8739fb2ac
SHA1 0ecf7432848d12f1fd11409de0afebe329a2f5a4
SHA512 6035bb8354ccfc2237f1a42ef5e5ab5333aff5f1110f403c346e5d73c8109be33d425c2803a54df60c536d1fefd2c0e793a8ee490f852ce8c9da1f13b26ac78f
MD5 SHA1 SHA512

Submit Download

YV3P4TRtG9KI.bat

Path C:\Users\Admin\AppData\Local\Temp\YV3P4TRtG9KI.bat
Size 207B
SHA256 7472bbdc96c970b090529802b20161a7865a540a79a7646cb8b0855e91ba49a1
MD5 7da95eadb261fdb94663c567bd4af5d5
SHA1 f3dd92d4eff171598da95d27644f0dbd7433bc80
SHA512 8e59fcd05ce06ea332622ef6ec6c01e61647d3be79ec348bffce9bf59ca5aaf9d64e8b305d057fa867b8bd619aca3a70e47bc19aec5ed71c4b5a740a9ec9e762
MD5 SHA1 SHA512

Submit Download

j3gem6uMtMQy.bat

Path C:\Users\Admin\AppData\Local\Temp\j3gem6uMtMQy.bat
Size 207B
SHA256 d163b42aead4b3dd6b1290983d1d79dae3fecaaccbc9a9ce06ee55f61aa03826
MD5 661385bbc66e9e76d65dec12fc4da954
SHA1 68e768b5e62d40690319050e445c939082723879
SHA512 4069a9f066900251523ea2211f728e984ee582a4413be4d10795caf087148933a1eea7c68ef7bc20fddf5e72c319787c28466d06883bb955c86e00b96a1a7321
MD5 SHA1 SHA512

Submit Download

jTb7O05T0Soq.bat

Path C:\Users\Admin\AppData\Local\Temp\jTb7O05T0Soq.bat
Size 207B
SHA256 bb71a99631a051883615a94ee36f9fbc08818929bf7fe3e0a070c156251a270a
MD5 f5d2a8d4178ef0affb54db4b74a9d171
SHA1 615343fc3e5ae7b7fca2572adbf3db34e025702d
SHA512 6022854164e14377e12c23ac5c398cd87ed62760b23da68e406bf81dc83dafadccf48e2bbe3d78c3ef0f18eed1b64e0e4017e0a232dec16c43c5396b8f0dcd48
MD5 SHA1 SHA512

Submit Download

kwVfQEBG2LR5.bat

Path C:\Users\Admin\AppData\Local\Temp\kwVfQEBG2LR5.bat
Size 207B
SHA256 7666f6e707f308607df1778cca47b03de11e8aeab05764ac2d893860af3e3970
MD5 e93d31a5df194ce5240feaf71ef0a557
SHA1 1336d3a0863c2098f6c83e74c5ec1ffa9a01b46d
SHA512 86d1e439c7ea56d12c9040b85fab16ceadbbb5d74f06ca238cc2f677790269c3c52d7e9d3093eba581be59fd2ea9432ac66daf1ebdffff60a8967cf2d0af8e29
MD5 SHA1 SHA512

Submit Download

qNr7EuasKKqO.bat

Path C:\Users\Admin\AppData\Local\Temp\qNr7EuasKKqO.bat
Size 207B
SHA256 9ea19a36aeb7489d937d2338d331a42c84fffd60e209887ba7835c893bff7ec5
MD5 0dd776dcd2b254da2b51a12a045f587a
SHA1 6ab9a8498ab573aff04eb8d9b592c5650ef87d15
SHA512 94649f20b4cc4ca39bff39beee54962933886c1d350f101b9710fb88d0131bfcfe93605a9728f9ba80ac62b9561c1ce6e89e0f936436b2b30888927d8a92a4fa
MD5 SHA1 SHA512

Submit Download

rjyRcZovso0P.bat

Path C:\Users\Admin\AppData\Local\Temp\rjyRcZovso0P.bat
Size 207B
SHA256 fc97ae2d048dd74aeadc4517ffc1f57a9dbf2ed31d9c039b8cb8a08f64a6d782
MD5 80186fe2404132af2dc9bbf6cefb87bf
SHA1 05abeea0ad6db08ea0c254d75da4cbfe4c1bb0fa
SHA512 e216fdb48a55d3d042ce79c66e4d600381001cdbc02180641a7644524357dc5a78aa31da05cce9f7fa40eb51c557aefaa8b381cb666d63b19e2d453f52f7053d
MD5 SHA1 SHA512

Submit Download

tp9CwQK1AHtT.bat

Path C:\Users\Admin\AppData\Local\Temp\tp9CwQK1AHtT.bat
Size 207B
SHA256 cdcea188bcfab4fe980e46bd15999b12d3c3ed4348c8349ba88295af20156d6e
MD5 93db2ea9bc1ca02146a368550c1603e3
SHA1 988c8b101af1907104eb98e0234e21489f9da813
SHA512 c226a09cded8e153d78a3a69a29178063272e4acc4e8868754dc98169f32a68c0938a477f20066b6fa945376624b6bed683331d48632752ad27ba7f3aa6adad3
MD5 SHA1 SHA512

Submit Download

x9FfeidtxSBl.bat

Path C:\Users\Admin\AppData\Local\Temp\x9FfeidtxSBl.bat
Size 207B
SHA256 7caf61c7b0028517d376c37863d62d858790cc1328a3e49f292a2bab03fa8268
MD5 22b09e997296e581b5ba76d3f4d2baff
SHA1 f67794c6c5f78b581aa5e3ea3cef36048e844423
SHA512 ec75901f7791c5b45d8a258231c86f61ae0b7644eeae858cdea7c8168d503b75448f0a627adc2a9ae64cfc4cb03b91ffdc886cb72908263af708e7824c346579
MD5 SHA1 SHA512

Submit Download

ylQp9KyZAfLs.bat

Path C:\Users\Admin\AppData\Local\Temp\ylQp9KyZAfLs.bat
Size 207B
SHA256 05499e88f345c726f2a8edcd4d9b1bdc3320d947c0df0d579d3a3525af28542c
MD5 fef627bedc73505a29d1e85daba45de1
SHA1 2c0afcbab0d58dcf4a34a4f3d19dbdef18cd4d7c
SHA512 9730773773a9d62fccd96e59efd752a3f7ea8883e5c092633929bf5399c9dbeca391286ad32db5f1c825f5dcd637ffa3bc38d1386bccd783df01709028267d27
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 6f36e1bf1595da615e4e90c26d960419240c69c162be3ef623e15f454f13fd4d
MD5 7a6e03571f190e83e070090e1eb4ca89
SHA1 86f0b01155802d00d74d5ce1d990df9ce9c6d6e2
SHA512 dca5f1ba1cc1d56390732bb15af009d19ab9264fbaeced2a98048160e6af2c416056f90099485d92aeb34633cec8fe369c268336f3efca3616a87caeec83692f
SSDEEP 49152:evst62XlaSFNWPjljiFa2RoUYIuFtSooGdgTHHB72eh2NT:evQ62XlaSFNWPjljiFXRoUYIuFtd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-85-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/228-90-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/228-86-0x0000000001860000-0x0000000001870000-memory.dmp

Download

memory/424-75-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/424-70-0x000000001B230000-0x000000001B240000-memory.dmp

Download

memory/424-69-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/1568-114-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/1568-109-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/1568-110-0x00000000032A0000-0x00000000032B0000-memory.dmp

Download

memory/1816-117-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/1816-118-0x000000001B710000-0x000000001B720000-memory.dmp

Download

memory/1816-122-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2192-101-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2192-102-0x0000000002B80000-0x0000000002B90000-memory.dmp

Download

memory/2192-106-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2224-30-0x0000000002620000-0x0000000002630000-memory.dmp

Download

memory/2224-29-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2224-34-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2252-45-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2252-50-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2252-46-0x000000001BB30000-0x000000001BB40000-memory.dmp

Download

memory/2280-94-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/2280-98-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2280-93-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2484-58-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2484-53-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/2484-54-0x0000000002D00000-0x0000000002D10000-memory.dmp

Download

memory/3204-0-0x0000000000580000-0x00000000008A4000-memory.dmp

Download

memory/3204-8-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/3204-2-0x000000001B730000-0x000000001B740000-memory.dmp

Download

memory/3204-1-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/3332-78-0x000000001B960000-0x000000001B970000-memory.dmp

Download

memory/3332-77-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/3332-82-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/3448-26-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/3448-21-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/3448-22-0x000000001B830000-0x000000001B840000-memory.dmp

Download

memory/3512-17-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/3512-9-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/3512-12-0x000000001C9E0000-0x000000001CA92000-memory.dmp

Download

memory/3512-11-0x000000001C8D0000-0x000000001C920000-memory.dmp

Download

memory/3512-10-0x000000001BAC0000-0x000000001BAD0000-memory.dmp

Download

memory/4504-61-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/4504-62-0x000000001B460000-0x000000001B470000-memory.dmp

Download

memory/4504-67-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/4808-126-0x000000001B680000-0x000000001B690000-memory.dmp

Download

memory/4808-125-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/4808-130-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/4904-38-0x000000001BAC0000-0x000000001BAD0000-memory.dmp

Download

memory/4904-37-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

memory/4904-42-0x00007FFA01730000-0x00007FFA021F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads