quasar | 8cb3a868e43a3476288192bd733619d417e29b3a29cfc17638485bdb9a18a740

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/03/2024, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
STUB-XMONI.exe
Size 3.1MB
Sample240323-stvdnsbe8y
SHA256 272a36238f90f31929a0a7ed21931c441aa77759fc8ee3b5931e4d7dd1370955
MD5 bf80ab7f4c6b4abc9ee0fc7c3ea42443
SHA1 490cc449743fc670a8df0b8520775ad736cb52ef
SHA512 e0c63a0fd603f3c8e23af7dec50081d59eed66f9613d9c8f39ab42d42a5afdf95b150861974aea3b1c136e01c99c22b946456b4640e878c2efb017e4d88cda95
SSDEEP 49152:ivxt62XlaSFNWPjljiFa2RoUYI+S0ebRSLoGdRTHHB72eh2NT:iv762XlaSFNWPjljiFXRoUYI+S0z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

DESKTOP-65LET2M:4782

Mutex

f9ab757a-065d-47c6-9119-97f5176ee58f

Attributes

encryption_key
EEEC5AAC3122A97913C6635406AE314B5AC4B484
install_name
Subdir.exe
log_directory
Logs
reconnect_delay
1
startup_key
Subdir
subdirectory
Subdir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 14 IoCs

resource	yara_rule
behavioral3/memory/1332-0-0x0000000000DD0000-0x00000000010F4000-memory.dmp	family_quasar
behavioral3/files/0x000a00000001227e-6.dat	family_quasar
behavioral3/files/0x000a00000001227e-7.dat	family_quasar
behavioral3/memory/2592-9-0x00000000009F0000-0x0000000000D14000-memory.dmp	family_quasar
behavioral3/files/0x000a00000001227e-22.dat	family_quasar
behavioral3/memory/2500-24-0x0000000000F50000-0x0000000001274000-memory.dmp	family_quasar
behavioral3/memory/1656-38-0x00000000012D0000-0x00000000015F4000-memory.dmp	family_quasar
behavioral3/files/0x000a00000001227e-50.dat	family_quasar
behavioral3/files/0x000a00000001227e-63.dat	family_quasar
behavioral3/memory/2036-64-0x0000000000190000-0x00000000004B4000-memory.dmp	family_quasar
behavioral3/memory/1348-80-0x0000000000A60000-0x0000000000D84000-memory.dmp	family_quasar
behavioral3/memory/2956-93-0x0000000000300000-0x0000000000624000-memory.dmp	family_quasar
behavioral3/memory/2000-108-0x0000000000EF0000-0x0000000001214000-memory.dmp	family_quasar
behavioral3/memory/1704-145-0x00000000010F0000-0x0000000001414000-memory.dmp	family_quasar

Executes dropped EXE 11 IoCs

pid	Process
2592	Subdir.exe
2500	Subdir.exe
1656	Subdir.exe
580	Subdir.exe
2036	Subdir.exe
1348	Subdir.exe
2956	Subdir.exe
2000	Subdir.exe
2444	Subdir.exe
2788	Subdir.exe
1704	Subdir.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File created	C:\Windows\system32\Subdir\Subdir.exe	STUB-XMONI.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	STUB-XMONI.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	STUB-XMONI.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
312	schtasks.exe
884	schtasks.exe
2204	schtasks.exe
1616	schtasks.exe
2816	schtasks.exe
3060	schtasks.exe
2016	schtasks.exe
560	schtasks.exe
2636	schtasks.exe
2820	schtasks.exe
1636	schtasks.exe
2692	schtasks.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
2812	PING.EXE
2420	PING.EXE
1140	PING.EXE
1620	PING.EXE
1564	PING.EXE
2852	PING.EXE
376	PING.EXE
1344	PING.EXE
2440	PING.EXE
2928	PING.EXE
592	PING.EXE

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	STUB-XMONI.exe
Token: SeDebugPrivilege	2592	Subdir.exe
Token: SeDebugPrivilege	2500	Subdir.exe
Token: SeDebugPrivilege	1656	Subdir.exe
Token: SeDebugPrivilege	580	Subdir.exe
Token: SeDebugPrivilege	2036	Subdir.exe
Token: SeDebugPrivilege	1348	Subdir.exe
Token: SeDebugPrivilege	2956	Subdir.exe
Token: SeDebugPrivilege	2000	Subdir.exe
Token: SeDebugPrivilege	2444	Subdir.exe
Token: SeDebugPrivilege	2788	Subdir.exe
Token: SeDebugPrivilege	1704	Subdir.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2592	Subdir.exe
2500	Subdir.exe
1656	Subdir.exe
580	Subdir.exe
2036	Subdir.exe
1348	Subdir.exe
2956	Subdir.exe
2000	Subdir.exe
2444	Subdir.exe
2788	Subdir.exe
1704	Subdir.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3060	1332	STUB-XMONI.exe	28
PID 1332 wrote to memory of 3060	1332	STUB-XMONI.exe	28
PID 1332 wrote to memory of 3060	1332	STUB-XMONI.exe	28
PID 1332 wrote to memory of 2592	1332	STUB-XMONI.exe	30
PID 1332 wrote to memory of 2592	1332	STUB-XMONI.exe	30
PID 1332 wrote to memory of 2592	1332	STUB-XMONI.exe	30
PID 2592 wrote to memory of 2692	2592	Subdir.exe	31
PID 2592 wrote to memory of 2692	2592	Subdir.exe	31
PID 2592 wrote to memory of 2692	2592	Subdir.exe	31
PID 2592 wrote to memory of 2968	2592	Subdir.exe	33
PID 2592 wrote to memory of 2968	2592	Subdir.exe	33
PID 2592 wrote to memory of 2968	2592	Subdir.exe	33
PID 2968 wrote to memory of 2664	2968	cmd.exe	35
PID 2968 wrote to memory of 2664	2968	cmd.exe	35
PID 2968 wrote to memory of 2664	2968	cmd.exe	35
PID 2968 wrote to memory of 2440	2968	cmd.exe	36
PID 2968 wrote to memory of 2440	2968	cmd.exe	36
PID 2968 wrote to memory of 2440	2968	cmd.exe	36
PID 2968 wrote to memory of 2500	2968	cmd.exe	37
PID 2968 wrote to memory of 2500	2968	cmd.exe	37
PID 2968 wrote to memory of 2500	2968	cmd.exe	37
PID 2500 wrote to memory of 2016	2500	Subdir.exe	38
PID 2500 wrote to memory of 2016	2500	Subdir.exe	38
PID 2500 wrote to memory of 2016	2500	Subdir.exe	38
PID 2500 wrote to memory of 2720	2500	Subdir.exe	40
PID 2500 wrote to memory of 2720	2500	Subdir.exe	40
PID 2500 wrote to memory of 2720	2500	Subdir.exe	40
PID 2720 wrote to memory of 2908	2720	cmd.exe	42
PID 2720 wrote to memory of 2908	2720	cmd.exe	42
PID 2720 wrote to memory of 2908	2720	cmd.exe	42
PID 2720 wrote to memory of 2928	2720	cmd.exe	43
PID 2720 wrote to memory of 2928	2720	cmd.exe	43
PID 2720 wrote to memory of 2928	2720	cmd.exe	43
PID 2720 wrote to memory of 1656	2720	cmd.exe	44
PID 2720 wrote to memory of 1656	2720	cmd.exe	44
PID 2720 wrote to memory of 1656	2720	cmd.exe	44
PID 1656 wrote to memory of 312	1656	Subdir.exe	45
PID 1656 wrote to memory of 312	1656	Subdir.exe	45
PID 1656 wrote to memory of 312	1656	Subdir.exe	45
PID 1656 wrote to memory of 1328	1656	Subdir.exe	47
PID 1656 wrote to memory of 1328	1656	Subdir.exe	47
PID 1656 wrote to memory of 1328	1656	Subdir.exe	47
PID 1328 wrote to memory of 600	1328	cmd.exe	49
PID 1328 wrote to memory of 600	1328	cmd.exe	49
PID 1328 wrote to memory of 600	1328	cmd.exe	49
PID 1328 wrote to memory of 592	1328	cmd.exe	50
PID 1328 wrote to memory of 592	1328	cmd.exe	50
PID 1328 wrote to memory of 592	1328	cmd.exe	50
PID 1328 wrote to memory of 580	1328	cmd.exe	53
PID 1328 wrote to memory of 580	1328	cmd.exe	53
PID 1328 wrote to memory of 580	1328	cmd.exe	53
PID 580 wrote to memory of 884	580	Subdir.exe	54
PID 580 wrote to memory of 884	580	Subdir.exe	54
PID 580 wrote to memory of 884	580	Subdir.exe	54
PID 580 wrote to memory of 2104	580	Subdir.exe	56
PID 580 wrote to memory of 2104	580	Subdir.exe	56
PID 580 wrote to memory of 2104	580	Subdir.exe	56
PID 2104 wrote to memory of 1520	2104	cmd.exe	58
PID 2104 wrote to memory of 1520	2104	cmd.exe	58
PID 2104 wrote to memory of 1520	2104	cmd.exe	58
PID 2104 wrote to memory of 2852	2104	cmd.exe	59
PID 2104 wrote to memory of 2852	2104	cmd.exe	59
PID 2104 wrote to memory of 2852	2104	cmd.exe	59
PID 2104 wrote to memory of 2036	2104	cmd.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\STUB-XMONI.exe
"C:\Users\Admin\AppData\Local\Temp\STUB-XMONI.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:3060
- C:\Windows\system32\Subdir\Subdir.exe
  "C:\Windows\system32\Subdir\Subdir.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2692
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\WZ8jeuE2W2sL.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2664
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2440
  - - C:\Windows\system32\Subdir\Subdir.exe
      "C:\Windows\system32\Subdir\Subdir.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:2016
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YzKxHaZvNNY8.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2908
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:2928
      - C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:312
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\rzidkiK2xmKk.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:600
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:592
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:580
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:884
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ICK4bBPAWqnc.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1520
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:2852
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2036
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:2204
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\y6GCINi2FeXd.bat" "
        11⤵
        
        PID:1324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:1140
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1348
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        13⤵
        Creates scheduled task(s)
        
        PID:1616
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zI3tINFpuwAT.bat" "
        13⤵
        
        PID:1056
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:952
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:1620
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2956
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        15⤵
        Creates scheduled task(s)
        
        PID:560
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\B7WsEEKm5ZtG.bat" "
        15⤵
        
        PID:2904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2208
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:1564
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        17⤵
        Creates scheduled task(s)
        
        PID:2636
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AlrqGFS2GZUT.bat" "
        17⤵
        
        PID:2652
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2604
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:2812
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2444
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        19⤵
        Creates scheduled task(s)
        
        PID:2816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\nbrUUxFjF1bO.bat" "
        19⤵
        
        PID:2388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2916
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:2420
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        21⤵
        Creates scheduled task(s)
        
        PID:2820
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\jPfj5mWe3mcC.bat" "
        21⤵
        
        PID:2776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1260
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:376
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        23⤵
        Creates scheduled task(s)
        
        PID:1636
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\84McuhaIyjGm.bat" "
        23⤵
        
        PID:592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:1344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

84McuhaIyjGm.bat

Path C:\Users\Admin\AppData\Local\Temp\84McuhaIyjGm.bat
Size 196B
SHA256 074011c53ef7eaa3764f447377c1ad437ec342589c4fc93f6f05236b18c629db
MD5 0ddc9446f1d3a83108df639eea3f2c4c
SHA1 8661b77925465db98afcebdd743c57ec7d152fa5
SHA512 9488a170b6a4db92689f7bcc2440acad08f06b51a134f4382b2521ac3953eb7ca7d0b100c2c33dd70427b0fbb9e9c505cd2a1c589e45c9e510ba9b79ae1b438b
MD5 SHA1 SHA512

Submit Download

AlrqGFS2GZUT.bat

Path C:\Users\Admin\AppData\Local\Temp\AlrqGFS2GZUT.bat
Size 196B
SHA256 7b0d6248f31992c837151286b494a9f3a5412bb1ebfaec92c44c5861f25aae72
MD5 4f1ae6c3480da1dd5c2f13cd0503df03
SHA1 cd3dad9fe7dfbf6a5709ea9159e7686236e4075c
SHA512 19250096f49c087fc5db3f2a68cf6f7a810fa1a55f43d5e3d535ed60fc733465685a9bdd077200ed6fafd8039e4fc01ea8fa33aab9ee1e29ab8218d382536076
MD5 SHA1 SHA512

Submit Download

B7WsEEKm5ZtG.bat

Path C:\Users\Admin\AppData\Local\Temp\B7WsEEKm5ZtG.bat
Size 196B
SHA256 22daad5cc02be6ddd26f56445d7ec4af1513612bdf771cc0cda0787dcec63544
MD5 85e3f89dea4b894f0242500c4df01dc5
SHA1 95cc49751e83ad92a564f33351276337ea0d5d0d
SHA512 ba2e3a75a4f3b52bee94ceb1087b2d0e7b06642538250b225a6f6faf26c550e90c765f0efe8cbbbc52eacecc8a14ad083c30223d35a517b008d232f5df898247
MD5 SHA1 SHA512

Submit Download

ICK4bBPAWqnc.bat

Path C:\Users\Admin\AppData\Local\Temp\ICK4bBPAWqnc.bat
Size 196B
SHA256 49a10c54f2af928034f63d70affcb391707f9452e69f914ee0904574ab33ea99
MD5 deae58fe2a9ef89d7a7907d7e160d574
SHA1 3f6d33106e0bc85cb6724d00a4e3a3e8571b9169
SHA512 d59c84f7d579b71b103ac7b026f82a986ca665db61d864b28eacffba1d98fd7804f293ed32bd002c2ca58a255515380d73a8064ad386c2551ff35e537cd7786d
MD5 SHA1 SHA512

Submit Download

WZ8jeuE2W2sL.bat

Path C:\Users\Admin\AppData\Local\Temp\WZ8jeuE2W2sL.bat
Size 196B
SHA256 053cd6b533d669af71bb1f590402de9b14402a45d0cdad29c662c3041a91e5ee
MD5 fb141a65552601bd7a6f2da7d69f4d8d
SHA1 a56516ed308c89bb02d8a4e547391039c9b13357
SHA512 819c6f7450223c20f5243fe65f0f54c6fabb7a2d32b321151bb1bcc9756f315cecbdcb8818f1442c7fd99f82d959d03ed3920ec79e2bb04d1014fce2e3b252c3
MD5 SHA1 SHA512

Submit Download

YzKxHaZvNNY8.bat

Path C:\Users\Admin\AppData\Local\Temp\YzKxHaZvNNY8.bat
Size 196B
SHA256 3f4c9f234084c511b11f970361f26b2bba32b66efd89e7d26baa613caaa69f7b
MD5 47cbe568ec82ca21f5db7b0eb31b1617
SHA1 df0eb7ba328e112ee5c3eba5e2ae487959670b51
SHA512 34ce0c1d802fb3d8e50a2e899e1acba9e39a6fde4e410264fc2bc2a22c00a50c6c4374df57b2154d972cc3a28e8b8862ed702441e1b3135eb1a18633fa24fae8
MD5 SHA1 SHA512

Submit Download

jPfj5mWe3mcC.bat

Path C:\Users\Admin\AppData\Local\Temp\jPfj5mWe3mcC.bat
Size 196B
SHA256 2362e0aff0a9f102587bb76a9c0b1ac8328ed2158336e66e379fef1cecba2a48
MD5 826f8e286b195473be57eba5e8b364f2
SHA1 08790f0ce69955c6cf9affb6b835855c12e34644
SHA512 d719e23d2e83bb5def0b031362818efa9613129611230d359a9068ba11b9b1de372f6886eb58da1436967d868d00e283b8cb22ba5111bda85c81d1858e0cb0d6
MD5 SHA1 SHA512

Submit Download

nbrUUxFjF1bO.bat

Path C:\Users\Admin\AppData\Local\Temp\nbrUUxFjF1bO.bat
Size 196B
SHA256 fcb9be76813bdd3607bfefcbdd8a3d705f6eddb23189d75e586c1be01b83dff3
MD5 58426578974e0c5f2a4f5655c015d8e3
SHA1 d1e05581518d6ab1448541e39932e2400ae941a6
SHA512 d8bcfd84be73a998a381006d0ee19db77282ad3893a52cd0924af9e5422da3619392ab8ce4d2fc79b33694437c0f51a1262f957cb6e0a40148e902029670be66
MD5 SHA1 SHA512

Submit Download

rzidkiK2xmKk.bat

Path C:\Users\Admin\AppData\Local\Temp\rzidkiK2xmKk.bat
Size 196B
SHA256 02c9ba57fdb8854b7ea6ce687155ae4d0b41785d9ae20b14e04b7e8c48ae34b0
MD5 2b73e23dc650a76bfbeadbce0f33ef7c
SHA1 153c52f0cc080858a7cbb6654dc9012bd63322bc
SHA512 c9a818447a0043e12ab72431b746275474f2407343677d62f9ea6303e7902172a2a06028aaae9cb26125b185df46125dd58078bd3fb7dc1b38d59d1996658b50
MD5 SHA1 SHA512

Submit Download

y6GCINi2FeXd.bat

Path C:\Users\Admin\AppData\Local\Temp\y6GCINi2FeXd.bat
Size 196B
SHA256 cfa86c9653e69abed5901110564385374e987a7030447f02459ad1bc3c98e2a7
MD5 188886cf3aab235174ec321414de1b33
SHA1 8c7df902a4e59813a240d7dbf825c9e9a3604f7e
SHA512 20984449ded50b4e8ca63dfbb242d67ea49396c1be7226e289402d0b113ced966b37f43de665bb00c548ec69c2f67103c93fc50b1e37f10094b7208dece6595a
MD5 SHA1 SHA512

Submit Download

zI3tINFpuwAT.bat

Path C:\Users\Admin\AppData\Local\Temp\zI3tINFpuwAT.bat
Size 196B
SHA256 cb1f377f594d563e079db5b7770e9289d8bec778773becb9e2ba2880051cb004
MD5 b21993fdb9bb3ca41378834dc88a3cff
SHA1 495931c14647a2a5f995404ef6aaaf93c0ae6da1
SHA512 ed2020cd0386be920a6dbd45fc4ddad46cb55cfe0044176685316d0b17d04a40231792c0bcfcac218b465d4e78d6a36b0c5bd7ff340b036e59148344c9f556e1
MD5 SHA1 SHA512

Submit Download

Subdir.exe

Path C:\Windows\System32\Subdir\Subdir.exe
Size 3.1MB
SHA256 272a36238f90f31929a0a7ed21931c441aa77759fc8ee3b5931e4d7dd1370955
MD5 bf80ab7f4c6b4abc9ee0fc7c3ea42443
SHA1 490cc449743fc670a8df0b8520775ad736cb52ef
SHA512 e0c63a0fd603f3c8e23af7dec50081d59eed66f9613d9c8f39ab42d42a5afdf95b150861974aea3b1c136e01c99c22b946456b4640e878c2efb017e4d88cda95
SSDEEP 49152:ivxt62XlaSFNWPjljiFa2RoUYI+S0ebRSLoGdRTHHB72eh2NT:iv762XlaSFNWPjljiFXRoUYI+S0z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subdir.exe

Path C:\Windows\System32\Subdir\Subdir.exe
Size 832KB
SHA256 e04f1eba48dc2ff6ef49c00978803c4932ad2cd0edf4b3c32edf0212fa660c10
MD5 c5fc0a284fa652f96792b605b821c94c
SHA1 21da318867043c49b44e014d247931a055cc82a1
SHA512 751d32316b0eaa6fa5ce2a7a20cd8ea0b2a0fac0b294cfe000bea156f82f8260343ce91448d378e214bd50ea127c1293d9eb64b58946e21ea9dea0823a47f885
SSDEEP 12288:kvgMzKMZOLNbWHi2EIlOnefLBCmaquy+2gnF3C/kcPkPfSa2:ivSotTaHX2XaSa2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subdir.exe

Path C:\Windows\System32\Subdir\Subdir.exe
Size 2.0MB
SHA256 083ab88ae573a95193f641edf2d2c44ff13f3b93fe7d0fd33e600752b2c354ec
MD5 b8d5dbf11423685f09c98a4071489ef8
SHA1 44cecc8adabe2d72eafba166d1876d3a535774b1
SHA512 f3744cdde28006f0c62050932809368f6c56fe5529ddd2653ef9e3ec83553d60b1f3fd65adece82bf58d5b76feb23e0ddcad6a9d8d1d67301f8d8e6e50d575f2
SSDEEP 24576:ivSotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qrMC1jW5uQ0CTU:ivxt62XlaSFNWPjljiFa2RoUYI+S0F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subdir.exe

Path C:\Windows\System32\Subdir\Subdir.exe
Size 2.2MB
SHA256 76b4b03d9108e284763c7722fbadccf4776952e608975db93befa6318452f3a1
MD5 c24c96b45a3968d3b8bd44533879edff
SHA1 ec21ec5ee042b24be8acb7d22669676e14079e29
SHA512 788d9cdca477b3963959501c8b9824fb09280f6b3426b2f38ce612b14f51bc359c28d36d5ddd4568de0c5d923e745736e4de4c5eba3d95cb3165e3ae9ca9491d
SSDEEP 24576:ivSotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qrMC1jW5uQ0CT1:ivxt62XlaSFNWPjljiFa2RoUYI+S0c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subdir.exe

Path C:\Windows\system32\Subdir\Subdir.exe
Size 1.9MB
SHA256 f5d6e035e66058504c9e182803e659c1a9270cd58e20068108d858aab9beaa17
MD5 8495bd5abac971053180d971bb05d411
SHA1 7b45358d7adfa19d4950adcf1b79189b811667d8
SHA512 7b8cfc06513f72e8b11380f20a4feda4ed114bc69a4f281bd2ef15f5708bd7f7599142019503a44aba161d39cd2a65c83bcca5f0f37a284570267e8db0b0bdd5
SSDEEP 24576:ivSotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qrMC1jW5u6:ivxt62XlaSFNWPjljiFa2RoUYI+8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/580-52-0x000000001B2C0000-0x000000001B340000-memory.dmp

Download

memory/580-51-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/580-62-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/1332-11-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/1332-2-0x000000001B570000-0x000000001B5F0000-memory.dmp

Download

memory/1332-0-0x0000000000DD0000-0x00000000010F4000-memory.dmp

Download

memory/1332-1-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/1348-80-0x0000000000A60000-0x0000000000D84000-memory.dmp

Download

memory/1348-81-0x000000001B260000-0x000000001B2E0000-memory.dmp

Download

memory/1348-91-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/1348-79-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/1656-49-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/1656-39-0x0000000000D00000-0x0000000000D80000-memory.dmp

Download

memory/1656-38-0x00000000012D0000-0x00000000015F4000-memory.dmp

Download

memory/1656-37-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/1704-146-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/1704-145-0x00000000010F0000-0x0000000001414000-memory.dmp

Download

memory/1704-147-0x000000001B380000-0x000000001B400000-memory.dmp

Download

memory/1704-158-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/2000-108-0x0000000000EF0000-0x0000000001214000-memory.dmp

Download

memory/2000-109-0x000000001B2A0000-0x000000001B320000-memory.dmp

Download

memory/2000-119-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/2000-107-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/2036-65-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/2036-77-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/2036-64-0x0000000000190000-0x00000000004B4000-memory.dmp

Download

memory/2036-66-0x000000001B3A0000-0x000000001B420000-memory.dmp

Download

memory/2444-121-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/2444-131-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/2500-35-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/2500-24-0x0000000000F50000-0x0000000001274000-memory.dmp

Download

memory/2500-23-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/2500-25-0x000000001B240000-0x000000001B2C0000-memory.dmp

Download

memory/2592-21-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/2592-10-0x000000001B240000-0x000000001B2C0000-memory.dmp

Download

memory/2592-9-0x00000000009F0000-0x0000000000D14000-memory.dmp

Download

memory/2592-8-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/2788-133-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/2788-143-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download

memory/2956-95-0x000000001B230000-0x000000001B2B0000-memory.dmp

Download

memory/2956-105-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/2956-94-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Download

memory/2956-93-0x0000000000300000-0x0000000000624000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads