quasar | 8cb3a868e43a3476288192bd733619d417e29b3a29cfc17638485bdb9a18a740

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23/03/2024, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
STUB-XMONI.exe
Size 3.1MB
Sample240323-stvdnsbe8y
SHA256 272a36238f90f31929a0a7ed21931c441aa77759fc8ee3b5931e4d7dd1370955
MD5 bf80ab7f4c6b4abc9ee0fc7c3ea42443
SHA1 490cc449743fc670a8df0b8520775ad736cb52ef
SHA512 e0c63a0fd603f3c8e23af7dec50081d59eed66f9613d9c8f39ab42d42a5afdf95b150861974aea3b1c136e01c99c22b946456b4640e878c2efb017e4d88cda95
SSDEEP 49152:ivxt62XlaSFNWPjljiFa2RoUYI+S0ebRSLoGdRTHHB72eh2NT:iv762XlaSFNWPjljiFXRoUYI+S0z
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

DESKTOP-65LET2M:4782

Mutex

f9ab757a-065d-47c6-9119-97f5176ee58f

Attributes

encryption_key
EEEC5AAC3122A97913C6635406AE314B5AC4B484
install_name
Subdir.exe
log_directory
Logs
reconnect_delay
1
startup_key
Subdir
subdirectory
Subdir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral4/memory/488-0-0x00000000001D0000-0x00000000004F4000-memory.dmp	family_quasar
behavioral4/files/0x0007000000023223-6.dat	family_quasar
behavioral4/files/0x0007000000023223-37.dat	family_quasar
behavioral4/files/0x0007000000023223-76.dat	family_quasar
behavioral4/files/0x0007000000023223-84.dat	family_quasar

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	Subdir.exe

Executes dropped EXE 11 IoCs

pid	Process
2292	Subdir.exe
2488	Subdir.exe
840	Subdir.exe
3392	Subdir.exe
1584	Subdir.exe
2968	Subdir.exe
4552	Subdir.exe
3376	Subdir.exe
2296	Subdir.exe
1152	Subdir.exe
2688	Subdir.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	STUB-XMONI.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	STUB-XMONI.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File created	C:\Windows\system32\Subdir\Subdir.exe	STUB-XMONI.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe
File opened for modification	C:\Windows\system32\Subdir\Subdir.exe	Subdir.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3900	schtasks.exe
440	schtasks.exe
4744	schtasks.exe
1440	schtasks.exe
3712	schtasks.exe
4084	schtasks.exe
1604	schtasks.exe
1116	schtasks.exe
752	schtasks.exe
4744	schtasks.exe
3300	schtasks.exe
1704	schtasks.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
400	PING.EXE
948	PING.EXE
4188	PING.EXE
1824	PING.EXE
976	PING.EXE
1596	PING.EXE
4972	PING.EXE
2076	PING.EXE
4896	PING.EXE
4952	PING.EXE
4420	PING.EXE

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	488	STUB-XMONI.exe
Token: SeDebugPrivilege	2292	Subdir.exe
Token: SeDebugPrivilege	2488	Subdir.exe
Token: SeDebugPrivilege	840	Subdir.exe
Token: SeDebugPrivilege	3392	Subdir.exe
Token: SeDebugPrivilege	1584	Subdir.exe
Token: SeDebugPrivilege	2968	Subdir.exe
Token: SeDebugPrivilege	4552	Subdir.exe
Token: SeDebugPrivilege	3376	Subdir.exe
Token: SeDebugPrivilege	2296	Subdir.exe
Token: SeDebugPrivilege	1152	Subdir.exe
Token: SeDebugPrivilege	2688	Subdir.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2292	Subdir.exe
2488	Subdir.exe
840	Subdir.exe
3392	Subdir.exe
1584	Subdir.exe
2968	Subdir.exe
4552	Subdir.exe
3376	Subdir.exe
2296	Subdir.exe
1152	Subdir.exe
2688	Subdir.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 440	488	STUB-XMONI.exe	87
PID 488 wrote to memory of 440	488	STUB-XMONI.exe	87
PID 488 wrote to memory of 2292	488	STUB-XMONI.exe	90
PID 488 wrote to memory of 2292	488	STUB-XMONI.exe	90
PID 2292 wrote to memory of 1116	2292	Subdir.exe	94
PID 2292 wrote to memory of 1116	2292	Subdir.exe	94
PID 2292 wrote to memory of 116	2292	Subdir.exe	102
PID 2292 wrote to memory of 116	2292	Subdir.exe	102
PID 116 wrote to memory of 3384	116	cmd.exe	104
PID 116 wrote to memory of 3384	116	cmd.exe	104
PID 116 wrote to memory of 2076	116	cmd.exe	105
PID 116 wrote to memory of 2076	116	cmd.exe	105
PID 116 wrote to memory of 2488	116	cmd.exe	109
PID 116 wrote to memory of 2488	116	cmd.exe	109
PID 2488 wrote to memory of 752	2488	Subdir.exe	110
PID 2488 wrote to memory of 752	2488	Subdir.exe	110
PID 2488 wrote to memory of 948	2488	Subdir.exe	112
PID 2488 wrote to memory of 948	2488	Subdir.exe	112
PID 948 wrote to memory of 3044	948	cmd.exe	114
PID 948 wrote to memory of 3044	948	cmd.exe	114
PID 948 wrote to memory of 4896	948	cmd.exe	115
PID 948 wrote to memory of 4896	948	cmd.exe	115
PID 948 wrote to memory of 840	948	cmd.exe	117
PID 948 wrote to memory of 840	948	cmd.exe	117
PID 840 wrote to memory of 4744	840	Subdir.exe	118
PID 840 wrote to memory of 4744	840	Subdir.exe	118
PID 840 wrote to memory of 2800	840	Subdir.exe	120
PID 840 wrote to memory of 2800	840	Subdir.exe	120
PID 2800 wrote to memory of 4872	2800	cmd.exe	122
PID 2800 wrote to memory of 4872	2800	cmd.exe	122
PID 2800 wrote to memory of 1824	2800	cmd.exe	123
PID 2800 wrote to memory of 1824	2800	cmd.exe	123
PID 2800 wrote to memory of 3392	2800	cmd.exe	131
PID 2800 wrote to memory of 3392	2800	cmd.exe	131
PID 3392 wrote to memory of 4744	3392	Subdir.exe	132
PID 3392 wrote to memory of 4744	3392	Subdir.exe	132
PID 3392 wrote to memory of 1580	3392	Subdir.exe	134
PID 3392 wrote to memory of 1580	3392	Subdir.exe	134
PID 1580 wrote to memory of 3560	1580	cmd.exe	136
PID 1580 wrote to memory of 3560	1580	cmd.exe	136
PID 1580 wrote to memory of 976	1580	cmd.exe	137
PID 1580 wrote to memory of 976	1580	cmd.exe	137
PID 1580 wrote to memory of 1584	1580	cmd.exe	138
PID 1580 wrote to memory of 1584	1580	cmd.exe	138
PID 1584 wrote to memory of 3300	1584	Subdir.exe	139
PID 1584 wrote to memory of 3300	1584	Subdir.exe	139
PID 1584 wrote to memory of 4592	1584	Subdir.exe	141
PID 1584 wrote to memory of 4592	1584	Subdir.exe	141
PID 4592 wrote to memory of 2032	4592	cmd.exe	143
PID 4592 wrote to memory of 2032	4592	cmd.exe	143
PID 4592 wrote to memory of 4952	4592	cmd.exe	144
PID 4592 wrote to memory of 4952	4592	cmd.exe	144
PID 4592 wrote to memory of 2968	4592	cmd.exe	145
PID 4592 wrote to memory of 2968	4592	cmd.exe	145
PID 2968 wrote to memory of 1440	2968	Subdir.exe	146
PID 2968 wrote to memory of 1440	2968	Subdir.exe	146
PID 2968 wrote to memory of 2836	2968	Subdir.exe	149
PID 2968 wrote to memory of 2836	2968	Subdir.exe	149
PID 2836 wrote to memory of 4408	2836	cmd.exe	151
PID 2836 wrote to memory of 4408	2836	cmd.exe	151
PID 2836 wrote to memory of 1596	2836	cmd.exe	152
PID 2836 wrote to memory of 1596	2836	cmd.exe	152
PID 2836 wrote to memory of 4552	2836	cmd.exe	153
PID 2836 wrote to memory of 4552	2836	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\STUB-XMONI.exe
"C:\Users\Admin\AppData\Local\Temp\STUB-XMONI.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:440
- C:\Windows\system32\Subdir\Subdir.exe
  "C:\Windows\system32\Subdir\Subdir.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gD1W3ifArHVv.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3384
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2076
  - - C:\Windows\system32\Subdir\Subdir.exe
      "C:\Windows\system32\Subdir\Subdir.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UFL7Ja6MfX6u.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:948
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3044
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:4896
      - C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:4744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5xsQjS70w9JM.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4872
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:1824
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:4744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wfkP0FZIoDXQ.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3560
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:976
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:3300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tSkwLJ05gQHY.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2032
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:4952
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        13⤵
        Creates scheduled task(s)
        
        PID:1440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BJIOkYsN3JqA.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4408
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:1596
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4552
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        15⤵
        Creates scheduled task(s)
        
        PID:1704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CEEp6yMSmbBd.bat" "
        15⤵
        
        PID:2996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4320
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:4420
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3376
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        17⤵
        Creates scheduled task(s)
        
        PID:3712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gHRlDnJE2Dff.bat" "
        17⤵
        
        PID:1424
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3300
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:4972
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        19⤵
        Creates scheduled task(s)
        
        PID:4084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6ztjcgQhDT6r.bat" "
        19⤵
        
        PID:4760
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:5068
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:400
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1152
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        21⤵
        Creates scheduled task(s)
        
        PID:3900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MFfbzS9PbLuV.bat" "
        21⤵
        
        PID:2180
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:972
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:948
        
        C:\Windows\system32\Subdir\Subdir.exe
        
        "C:\Windows\system32\Subdir\Subdir.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2688
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Subdir" /sc ONLOGON /tr "C:\Windows\system32\Subdir\Subdir.exe" /rl HIGHEST /f
        23⤵
        Creates scheduled task(s)
        
        PID:1604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UT8ZK7nuFjPS.bat" "
        23⤵
        
        PID:3600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1696
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Subdir.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Subdir.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

5xsQjS70w9JM.bat

Path C:\Users\Admin\AppData\Local\Temp\5xsQjS70w9JM.bat
Size 196B
SHA256 81739e91cb2f0654bef1e35f2baedb7ea7659ed6127d87c546a811351f4d3404
MD5 01ce1cf3305e3471a7ef193e952c2f95
SHA1 b2076e350ea968417675cfd7128899143422e1cd
SHA512 b114014468827740b6b0101d0f67bbf53364c5d9aa8d3ed276f06a7d42b6189a3d36fa1b67f14fc89e1b1334feb4dab32195663b987a8f5801c55c2acfb321d2
MD5 SHA1 SHA512

Submit Download

6ztjcgQhDT6r.bat

Path C:\Users\Admin\AppData\Local\Temp\6ztjcgQhDT6r.bat
Size 196B
SHA256 a1380467b9fc093c6d0b7949d719cdc94811eb906f5faa8a4628752b7316999a
MD5 6fbc09d4540aabf454485e2f562a4eec
SHA1 09a65fef44e1811f4318fa70756a742b9d4052b6
SHA512 2517bb35d35fd2298442989935e7b0c610bce9061f0634eb0958ed4affac6070da9968e9f0a2eea65af86940d405e0fcbf65200f6ecb8fbc1ffaa3bb142b3a67
MD5 SHA1 SHA512

Submit Download

BJIOkYsN3JqA.bat

Path C:\Users\Admin\AppData\Local\Temp\BJIOkYsN3JqA.bat
Size 196B
SHA256 3aa6437784cdf2ec17042ea4dc0743d5f91a9f8e71c1af2101b5a8d667e08005
MD5 16422b6fcb7e6d375914f76b155bb9ff
SHA1 15801b9aa69098d2a7331733efaf59929c052aba
SHA512 4660a06acd4bcc2400fb6cfabb9d13aa2b644010726710167acf356eb2f48d8718237de730ff1bc71012fbe54c19298cb003e9cb63508851d199958b52972237
MD5 SHA1 SHA512

Submit Download

CEEp6yMSmbBd.bat

Path C:\Users\Admin\AppData\Local\Temp\CEEp6yMSmbBd.bat
Size 196B
SHA256 a9df6f98fe08659a5ff77d35a27da327ebac56e7657b83cd06865b8f5427d6e8
MD5 1ce19ee08a1c4ca89c2d88c04e68dca7
SHA1 162629f8af1e0f260664246927dc9412a2c731b3
SHA512 03ed4dd88631f1c8101e3d6d31a9fd9c267114030b83703eddb25e151c2e6f9c1f66b4833387492857b3e95c98c86da67afb9dfb1ba9f067b9ace5cf8c68035a
MD5 SHA1 SHA512

Submit Download

MFfbzS9PbLuV.bat

Path C:\Users\Admin\AppData\Local\Temp\MFfbzS9PbLuV.bat
Size 196B
SHA256 851729f30b431419e319c5e033f3b173e2fa2376e0db2f07666c7a4ccfff6b8f
MD5 009ea241edd01e2bdd004e028e48e8ea
SHA1 5e252b148134eaa91fb410463ec96c0537661afc
SHA512 bee12f2c86a12d9fb9f6b6732ba9fbea914244f1f1f65e3b95d58c20a9bfb850c705688dfc533153ba89ede2404701216f64d30f3f590530989945079885ff49
MD5 SHA1 SHA512

Submit Download

UFL7Ja6MfX6u.bat

Path C:\Users\Admin\AppData\Local\Temp\UFL7Ja6MfX6u.bat
Size 196B
SHA256 b5d4f5c58c2673a50e710bf2793c0970dfd9ca22e067b35bb0bbca61310f6677
MD5 ed3b37d153d740580acb08cc0959a93e
SHA1 308adabecd12eebe1fdd5bd098a1b443ec12008d
SHA512 5a0e57b063f149e6cd6f37ba4b77b77a33767744bb306bbd91e2b41326e70d844fa9e53eb2c37fe615591cecdcd6b8f91d3e3802addeffe8a00fce3883013999
MD5 SHA1 SHA512

Submit Download

UT8ZK7nuFjPS.bat

Path C:\Users\Admin\AppData\Local\Temp\UT8ZK7nuFjPS.bat
Size 196B
SHA256 e0bd28eacdd0ad03388a70a4f57fc3bed88b337635adead14023025f731077e4
MD5 0d82e84486a28dd2dba7aabc6135aec3
SHA1 35102e6141f7e616acd045e8961a70ab3de73162
SHA512 ba8575f02e68841649a773f9168e59599aeb7bd64ddcf86d52d74fdc27d47c981715e5e5ab199d7f05561623673d774901c03c872e2b6307f99054d075e73f5b
MD5 SHA1 SHA512

Submit Download

gD1W3ifArHVv.bat

Path C:\Users\Admin\AppData\Local\Temp\gD1W3ifArHVv.bat
Size 196B
SHA256 8a2fd6eccbb3b7d6c972fc6d04c7057e13e8b2dfec5a0325cf60ad9752ee3413
MD5 9cadfa4661dab9a87e0c6a6fb0a0f3da
SHA1 7fdbd349c41aab2240b674be4985c7a10b6fbd73
SHA512 2bdbf11e7049c3e778a6736624e2f695c396950eecea0967f8f2064cadde95677edbce69f301314116c8117a42ce49daed4b3035329ca80ba8c594ae2bb2e3e1
MD5 SHA1 SHA512

Submit Download

gHRlDnJE2Dff.bat

Path C:\Users\Admin\AppData\Local\Temp\gHRlDnJE2Dff.bat
Size 196B
SHA256 ddf50885180491ba051574d73ce4d6534e865c7e3686dedd4f411f618e354850
MD5 7bab0ac6c1b3368de550377e53dc6dda
SHA1 4ffeae150a3e51df19eb313b419131469efc8c70
SHA512 61cdb73672232d3c19887e93ca718a85d6b9b66420cb3e4fd061d82d2264103d1497b42a39a38aa1f7d771b1e02e6426c9db117d30b2ae20f5825fbfffcf1435
MD5 SHA1 SHA512

Submit Download

tSkwLJ05gQHY.bat

Path C:\Users\Admin\AppData\Local\Temp\tSkwLJ05gQHY.bat
Size 196B
SHA256 0e0893728addea0b0fb98caba1398b583fa3b2fb8eaf66fb54575ae85175ceae
MD5 d36467a5ff916dde982da3991ea69bc7
SHA1 73a7e6600cbf5a71fe8eb704db8b2e1c4231e7ae
SHA512 6341f98b12e7c344b28ea3b2cdfb736860b5227772566b9a908d542578a7122c2c174eda8c69ee88d5f4ca2a12cff4e6f092ad12f4466e0c16fd8fbc066c69cc
MD5 SHA1 SHA512

Submit Download

wfkP0FZIoDXQ.bat

Path C:\Users\Admin\AppData\Local\Temp\wfkP0FZIoDXQ.bat
Size 196B
SHA256 23939c7a16a28f52588577d23f19a5468a4ebde2cbfa193b322a4e029d2b569f
MD5 3517bb421c83f782f3928b94d21ce853
SHA1 d55867decd4f914d330f20e3e0d7a6ea370e7a0e
SHA512 0eb8152350c367ed8d325c096eef088f181d5c11db637fc8635890e089f5002636c162d79d1ba66aa6da5970c36caacc0ced4e1178ec1d28c641914bbd4c0172
MD5 SHA1 SHA512

Submit Download

Subdir.exe

Path C:\Windows\System32\Subdir\Subdir.exe
Size 1.8MB
SHA256 8eef1509a2a5c43fb70e285f7fa6ca2fc0355375de0e4e6e689d212223fa0bc6
MD5 eb5a65bf39333da633767859328f0711
SHA1 63dd07c9047882f791744dd2c3e51bd4f298a057
SHA512 b6048dff057ea182799c2db1998babf685a56cf93cbf8e889f9268d382e15933adfe2cd345988d68a7668153701996c4d2be0e31823e30c1ac81d3f1353cb66d
SSDEEP 24576:ivSotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qrMC1jW5z:ivxt62XlaSFNWPjljiFa2RoUYI+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subdir.exe

Path C:\Windows\System32\Subdir\Subdir.exe
Size 3.1MB
SHA256 272a36238f90f31929a0a7ed21931c441aa77759fc8ee3b5931e4d7dd1370955
MD5 bf80ab7f4c6b4abc9ee0fc7c3ea42443
SHA1 490cc449743fc670a8df0b8520775ad736cb52ef
SHA512 e0c63a0fd603f3c8e23af7dec50081d59eed66f9613d9c8f39ab42d42a5afdf95b150861974aea3b1c136e01c99c22b946456b4640e878c2efb017e4d88cda95
SSDEEP 49152:ivxt62XlaSFNWPjljiFa2RoUYI+S0ebRSLoGdRTHHB72eh2NT:iv762XlaSFNWPjljiFXRoUYI+S0z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subdir.exe

Path C:\Windows\System32\Subdir\Subdir.exe
Size 2.1MB
SHA256 ba4d619a06d645cc07da7b487fba7a96b085bd4bb3a2e5f3d64535e04289d63e
MD5 5d7b362cba2c694b97dc1fd3730b0427
SHA1 a3a7bb53ee471f235144560d30280fece3f2a474
SHA512 f5e6ebf4fe7d0af87167e6e333adb0bc858775b5b8f99a2924428219c17b7a8bb6468553e65f50ff3b3e05dc7562c57c86daa4907668bd9a39971d405d3cd162
SSDEEP 24576:ivSotTaHX2XaSaSFNNgPjluEiFFo2AKoUX3Y3YN3qrMC1jW5uQ0CTg:ivxt62XlaSFNWPjljiFa2RoUYI+S0Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subdir.exe

Path C:\Windows\System32\Subdir\Subdir.exe
Size 3.1MB
SHA256 a44cfbc89dcb6929b500c5d4b7fc5788fb2ed4a1b42977eef822f3f7c67361d2
MD5 0a5cffe3e148157dcf6691f056d18037
SHA1 446a05144db0a9ecc49c2e6514e2b52e69539f62
SHA512 3f5b29650d7de8b4a99c5c24afa1321cea9bea689158dfbe09ebe23315dd0e9193e2ae8c2de847d3653b10d51441ae7328e5d19df2416960caa3be66adb07106
SSDEEP 49152:ivxt62XlaSFNWPjljiFa2RoUYI+S0ebRSLoGdRTHHB72eh2NTe:iv762XlaSFNWPjljiFXRoUYI+S0zf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/488-9-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/488-2-0x0000000000D10000-0x0000000000D20000-memory.dmp

Download

memory/488-0-0x00000000001D0000-0x00000000004F4000-memory.dmp

Download

memory/488-1-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/840-35-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/840-31-0x000000001B140000-0x000000001B150000-memory.dmp

Download

memory/840-30-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/1152-85-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/1152-86-0x000000001B710000-0x000000001B720000-memory.dmp

Download

memory/1152-90-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/1584-47-0x000000001B5E0000-0x000000001B5F0000-memory.dmp

Download

memory/1584-46-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/1584-52-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2292-11-0x000000001B790000-0x000000001B7A0000-memory.dmp

Download

memory/2292-18-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2292-13-0x000000001BFA0000-0x000000001C052000-memory.dmp

Download

memory/2292-10-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2292-12-0x000000001BE90000-0x000000001BEE0000-memory.dmp

Download

memory/2296-78-0x00000000019F0000-0x0000000001A00000-memory.dmp

Download

memory/2296-77-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2296-83-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2488-28-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2488-23-0x000000001B4D0000-0x000000001B4E0000-memory.dmp

Download

memory/2488-22-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2688-93-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2688-98-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2968-58-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/2968-54-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/3376-69-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/3376-70-0x000000001B1A0000-0x000000001B1B0000-memory.dmp

Download

memory/3376-74-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/3392-38-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/3392-39-0x000000001B5A0000-0x000000001B5B0000-memory.dmp

Download

memory/3392-43-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/4552-66-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

memory/4552-62-0x000000001B7A0000-0x000000001B7B0000-memory.dmp

Download

memory/4552-61-0x00007FFCED8A0000-0x00007FFCEE361000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads