quasar | a5473ea4c4ef75c217e0d252d1c7d235b781a75810b7e731a97ed78b45646840

Analysis

max time kernel
167s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240419-pkn9hsda2v
SHA256 a5473ea4c4ef75c217e0d252d1c7d235b781a75810b7e731a97ed78b45646840
MD5 2c1fba8d6624adf6c582fb2d5fb43b28
SHA1 bd45ee984e9476d604824f83c6cf6111a9db2467
SHA512 cc85b5f1c2765c49f34c236634dcbfdfd6cc62e0b954b74c12b0d89dc29044dff88a9840e5c02a39e140564283074c78359dd70dfc7f426daefb75f195f14e19
SSDEEP 49152:nvVG42pda6D+/PjlLOlg6yQipV6iRJ67bR3LoGdTqTHHB72eh2NT:nvM42pda6D+/PjlLOlZyQipV6iRJ6ND
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

funlink.ddns.net:4444
quasarhost1.ddns.net:4444

Mutex

c363b2f8-fc6a-4abd-a753-cff1aad2a173

Attributes

encryption_key
CE5FBAC1A56C8C780C74FE8E7CD5CBCF8ABD6C8D
install_name
updale.exe
log_directory
Logs
reconnect_delay
3000
startup_key
windows av startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3508-0-0x0000000000320000-0x0000000000644000-memory.dmp	family_quasar
behavioral2/files/0x000700000002344d-6.dat	family_quasar

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation	updale.exe

Executes dropped EXE 13 IoCs

pid	Process
1572	updale.exe
3488	updale.exe
3100	updale.exe
2388	updale.exe
2404	updale.exe
4020	updale.exe
2520	updale.exe
1804	updale.exe
368	updale.exe
1424	updale.exe
1608	updale.exe
2936	updale.exe
3624	updale.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir\updale.exe	updale.exe
File opened for modification	C:\Windows\system32\SubDir	updale.exe
File opened for modification	C:\Windows\system32\SubDir	updale.exe
File opened for modification	C:\Windows\system32\SubDir\updale.exe	updale.exe
File opened for modification	C:\Windows\system32\SubDir	updale.exe
File opened for modification	C:\Windows\system32\SubDir	updale.exe
File opened for modification	C:\Windows\system32\SubDir	updale.exe
File opened for modification	C:\Windows\system32\SubDir	updale.exe
File opened for modification	C:\Windows\system32\SubDir\updale.exe	updale.exe
File opened for modification	C:\Windows\system32\SubDir	updale.exe
File opened for modification	C:\Windows\system32\SubDir\updale.exe	updale.exe
File opened for modification	C:\Windows\system32\SubDir\updale.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\updale.exe	updale.exe
File opened for modification	C:\Windows\system32\SubDir	updale.exe
File created	C:\Windows\system32\SubDir\updale.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\updale.exe	updale.exe
File opened for modification	C:\Windows\system32\SubDir\updale.exe	updale.exe
File opened for modification	C:\Windows\system32\SubDir	updale.exe
File opened for modification	C:\Windows\system32\SubDir\updale.exe	updale.exe
File opened for modification	C:\Windows\system32\SubDir\updale.exe	updale.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4556	schtasks.exe
3224	schtasks.exe
3972	schtasks.exe
1724	schtasks.exe
4976	schtasks.exe
648	schtasks.exe
3148	schtasks.exe
5084	schtasks.exe
2556	schtasks.exe
2648	schtasks.exe
2040	schtasks.exe
2928	schtasks.exe
2876	schtasks.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
2612	PING.EXE
1552	PING.EXE
4008	PING.EXE
3876	PING.EXE
3420	PING.EXE
3640	PING.EXE
2872	PING.EXE
2108	PING.EXE
4876	PING.EXE
4532	PING.EXE
3648	PING.EXE
3696	PING.EXE

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	Client-built.exe
Token: SeDebugPrivilege	1572	updale.exe
Token: SeDebugPrivilege	3488	updale.exe
Token: SeDebugPrivilege	3100	updale.exe
Token: SeDebugPrivilege	2388	updale.exe
Token: SeDebugPrivilege	2404	updale.exe
Token: SeDebugPrivilege	4020	updale.exe
Token: SeDebugPrivilege	2520	updale.exe
Token: SeDebugPrivilege	1804	updale.exe
Token: SeDebugPrivilege	368	updale.exe
Token: SeDebugPrivilege	1424	updale.exe
Token: SeDebugPrivilege	1608	updale.exe
Token: SeDebugPrivilege	2936	updale.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
1572	updale.exe
3488	updale.exe
3100	updale.exe
2388	updale.exe
2404	updale.exe
4020	updale.exe
2520	updale.exe
1804	updale.exe
368	updale.exe
1424	updale.exe
1608	updale.exe
2936	updale.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1572	updale.exe
3488	updale.exe
3100	updale.exe
2388	updale.exe
2404	updale.exe
4020	updale.exe
2520	updale.exe
1804	updale.exe
368	updale.exe
1424	updale.exe
1608	updale.exe
2936	updale.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 2876	3508	Client-built.exe	87
PID 3508 wrote to memory of 2876	3508	Client-built.exe	87
PID 3508 wrote to memory of 1572	3508	Client-built.exe	89
PID 3508 wrote to memory of 1572	3508	Client-built.exe	89
PID 1572 wrote to memory of 2648	1572	updale.exe	92
PID 1572 wrote to memory of 2648	1572	updale.exe	92
PID 1572 wrote to memory of 4512	1572	updale.exe	94
PID 1572 wrote to memory of 4512	1572	updale.exe	94
PID 4512 wrote to memory of 4864	4512	cmd.exe	96
PID 4512 wrote to memory of 4864	4512	cmd.exe	96
PID 4512 wrote to memory of 1552	4512	cmd.exe	97
PID 4512 wrote to memory of 1552	4512	cmd.exe	97
PID 4512 wrote to memory of 3488	4512	cmd.exe	100
PID 4512 wrote to memory of 3488	4512	cmd.exe	100
PID 3488 wrote to memory of 3224	3488	updale.exe	101
PID 3488 wrote to memory of 3224	3488	updale.exe	101
PID 3488 wrote to memory of 448	3488	updale.exe	103
PID 3488 wrote to memory of 448	3488	updale.exe	103
PID 448 wrote to memory of 1336	448	cmd.exe	105
PID 448 wrote to memory of 1336	448	cmd.exe	105
PID 448 wrote to memory of 4876	448	cmd.exe	106
PID 448 wrote to memory of 4876	448	cmd.exe	106
PID 448 wrote to memory of 3100	448	cmd.exe	107
PID 448 wrote to memory of 3100	448	cmd.exe	107
PID 3100 wrote to memory of 2040	3100	updale.exe	108
PID 3100 wrote to memory of 2040	3100	updale.exe	108
PID 3100 wrote to memory of 4392	3100	updale.exe	110
PID 3100 wrote to memory of 4392	3100	updale.exe	110
PID 4392 wrote to memory of 1616	4392	cmd.exe	112
PID 4392 wrote to memory of 1616	4392	cmd.exe	112
PID 4392 wrote to memory of 4008	4392	cmd.exe	113
PID 4392 wrote to memory of 4008	4392	cmd.exe	113
PID 4392 wrote to memory of 2388	4392	cmd.exe	114
PID 4392 wrote to memory of 2388	4392	cmd.exe	114
PID 2388 wrote to memory of 2928	2388	updale.exe	115
PID 2388 wrote to memory of 2928	2388	updale.exe	115
PID 2388 wrote to memory of 1564	2388	updale.exe	117
PID 2388 wrote to memory of 1564	2388	updale.exe	117
PID 1564 wrote to memory of 2472	1564	cmd.exe	119
PID 1564 wrote to memory of 2472	1564	cmd.exe	119
PID 1564 wrote to memory of 3876	1564	cmd.exe	120
PID 1564 wrote to memory of 3876	1564	cmd.exe	120
PID 1564 wrote to memory of 2404	1564	cmd.exe	122
PID 1564 wrote to memory of 2404	1564	cmd.exe	122
PID 2404 wrote to memory of 4556	2404	updale.exe	123
PID 2404 wrote to memory of 4556	2404	updale.exe	123
PID 2404 wrote to memory of 380	2404	updale.exe	125
PID 2404 wrote to memory of 380	2404	updale.exe	125
PID 380 wrote to memory of 2108	380	cmd.exe	127
PID 380 wrote to memory of 2108	380	cmd.exe	127
PID 380 wrote to memory of 4532	380	cmd.exe	128
PID 380 wrote to memory of 4532	380	cmd.exe	128
PID 380 wrote to memory of 4020	380	cmd.exe	129
PID 380 wrote to memory of 4020	380	cmd.exe	129
PID 4020 wrote to memory of 648	4020	updale.exe	130
PID 4020 wrote to memory of 648	4020	updale.exe	130
PID 4020 wrote to memory of 4480	4020	updale.exe	132
PID 4020 wrote to memory of 4480	4020	updale.exe	132
PID 4480 wrote to memory of 3268	4480	cmd.exe	134
PID 4480 wrote to memory of 3268	4480	cmd.exe	134
PID 4480 wrote to memory of 3420	4480	cmd.exe	135
PID 4480 wrote to memory of 3420	4480	cmd.exe	135
PID 4480 wrote to memory of 2520	4480	cmd.exe	136
PID 4480 wrote to memory of 2520	4480	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2876
- C:\Windows\system32\SubDir\updale.exe
  "C:\Windows\system32\SubDir\updale.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:2648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5zfxQv3P3FOm.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4864
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1552
  - - C:\Windows\system32\SubDir\updale.exe
      "C:\Windows\system32\SubDir\updale.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3488
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:3224
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IByO6bjmGYWG.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:448
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1336
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:4876
      - C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:2040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\11zxtJoZP7ko.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1616
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:4008
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:2928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yRDmMr2oxmgi.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2472
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:3876
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:4556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wN4rgD6N2kKh.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:4532
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        13⤵
        Creates scheduled task(s)
        
        PID:648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mhMyYoXaA1wg.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3268
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:3420
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2520
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        15⤵
        Creates scheduled task(s)
        
        PID:4976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4i38FtXZqQ2V.bat" "
        15⤵
        
        PID:2912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2948
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:3648
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1804
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        17⤵
        Creates scheduled task(s)
        
        PID:3148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kryaRc1hmuL6.bat" "
        17⤵
        
        PID:4076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4392
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:3640
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:368
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        19⤵
        Creates scheduled task(s)
        
        PID:3972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gEPBlnW6GfND.bat" "
        19⤵
        
        PID:4368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2392
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:2872
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1424
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        21⤵
        Creates scheduled task(s)
        
        PID:1724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TswFZMvUadHL.bat" "
        21⤵
        
        PID:4348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1060
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:2108
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1608
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        23⤵
        Creates scheduled task(s)
        
        PID:5084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KB80t4wqmUjA.bat" "
        23⤵
        
        PID:1620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:5080
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:3696
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2936
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windows av startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\updale.exe" /rl HIGHEST /f
        25⤵
        Creates scheduled task(s)
        
        PID:2556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kKaj9oFFIvr6.bat" "
        25⤵
        
        PID:1260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2264
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:2612
        
        C:\Windows\system32\SubDir\updale.exe
        
        "C:\Windows\system32\SubDir\updale.exe"
        26⤵
        Executes dropped EXE
        
        PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

updale.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\updale.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

11zxtJoZP7ko.bat

Path C:\Users\Admin\AppData\Local\Temp\11zxtJoZP7ko.bat
Size 196B
SHA256 251be42dac57bcc39e065e08a20a794cece5736bd48e1e4e35aea15f525d5426
MD5 ef21d4d800901b5e6326eb60981c7cfd
SHA1 918052088e5c867ad07f2a2413cc69c805e2ef3e
SHA512 4a1388ab68b881b605e2ced0f2c7d30a8c0b95d6058e05ff2ffff481e5f8c29a5697cdf757baff053ff9806946951fe56ce9c476b24bd5060a86950c7e940100
MD5 SHA1 SHA512

Submit Download

4i38FtXZqQ2V.bat

Path C:\Users\Admin\AppData\Local\Temp\4i38FtXZqQ2V.bat
Size 196B
SHA256 0dc1deb8996604205abac3e08e77148f513f18421caf005193782211419bdc35
MD5 57cc79d6533121f2bd3b9c6e6acea3cd
SHA1 428db93505bcd17edf2348736b9428630533f45b
SHA512 3ba0c9ba42652bf866713bf09425d2c31afac3ee424f548be721c3e2be15af9f38c5112c91a170daf7dbfaa651525747536448d1f1a5294382ea43f7d9cf77cb
MD5 SHA1 SHA512

Submit Download

5zfxQv3P3FOm.bat

Path C:\Users\Admin\AppData\Local\Temp\5zfxQv3P3FOm.bat
Size 196B
SHA256 f5343c696bb9c52b48b23ac21285635b8377171d8106dce81dfd05382f9cd926
MD5 a42e60a92090c57943662d06f82fde12
SHA1 1cba4c3ff6bcb6c28af628d7723102a863e9d667
SHA512 f7497929932d61f6d0ca8fb8ee193fce055fb823b090b478bad607702c218c6404cf7b10bc5ac5e97bd410ca25db6c7c2f55e8085a180dc7d0a0dd4a6b9f6019
MD5 SHA1 SHA512

Submit Download

IByO6bjmGYWG.bat

Path C:\Users\Admin\AppData\Local\Temp\IByO6bjmGYWG.bat
Size 196B
SHA256 779fc465eba0075657f2b4128e1b1207d65dfc6fb678b5b7af5cd13836c597e9
MD5 cd24b6521d4a01301690019d910098dc
SHA1 7fba29d4989d0a220be7a63472eabadd318e9508
SHA512 8b3a3a025dde91f7dd88580d5be9c257066a0eb9c64aaa954eb50329d59e83f209c4015c730a17590c2e1956658c7c1bc7ede03ac12b341015df0a97be3e8066
MD5 SHA1 SHA512

Submit Download

KB80t4wqmUjA.bat

Path C:\Users\Admin\AppData\Local\Temp\KB80t4wqmUjA.bat
Size 196B
SHA256 9f0d75df246229cff7abb951eb3683774c25bac34603a901449c1e08b99eb54d
MD5 784c5f59cf27858f4eaa696bc66945ea
SHA1 40f8dc1643c4737a7f0d917a05aeb276c5b2fd6c
SHA512 fa6ecedecabae291ebf9be7b3b4a08be13a3e240ed1259754a5733a37726a8547e177f2edfb730cc540a28d9568c78de60b63f65f727874313b6e03e89825d14
MD5 SHA1 SHA512

Submit Download

TswFZMvUadHL.bat

Path C:\Users\Admin\AppData\Local\Temp\TswFZMvUadHL.bat
Size 196B
SHA256 af04d59cca3ac595de7f820d7a402d0cf243a601c44fb7a962865fca48d94323
MD5 7608b75f8543f2566d64404742b0a331
SHA1 e06718e91cb5fe052169eca28604094bdcb423f6
SHA512 6e902ad2443936a18497cb104564bc935a48affb2597a15c1a04c9416c8019f065d2ee00c66b1dad187929dc797fc77358fffac273edce5359d2847fb7ca37bb
MD5 SHA1 SHA512

Submit Download

gEPBlnW6GfND.bat

Path C:\Users\Admin\AppData\Local\Temp\gEPBlnW6GfND.bat
Size 196B
SHA256 e50477f41a9e863036c60fd6f4fc16c54ab6b2b76d7b302e406446842554b985
MD5 21a875d945940a44e1c56f227390de13
SHA1 a2880b5723f4cba3d2184ecdfde37e4f316951b8
SHA512 aaa119f6550868fba834e950083ce6770dd27abf0a74ea536dd301efcfa4d8ab63829db8117422e1fd4f5553d652f746025a878b3d24b65aa81991b157eea5ee
MD5 SHA1 SHA512

Submit Download

kKaj9oFFIvr6.bat

Path C:\Users\Admin\AppData\Local\Temp\kKaj9oFFIvr6.bat
Size 196B
SHA256 9d527194dfd7faf4cd9e36be4d358b769577df462f3d5e41ce796cca47846c3a
MD5 f69793efe6d7c7d1da28bb05c8ff9f34
SHA1 a9b060ea70aeb131d6f53979791417441be53d62
SHA512 8dac41593bcfcf8cd045f7efe5b7fee35464633bef249188f4b6e32fa4a310931642170c36bbaa51dd47be6fdc5cb6d77705e59e5d86e74afec87c4251e5a63a
MD5 SHA1 SHA512

Submit Download

kryaRc1hmuL6.bat

Path C:\Users\Admin\AppData\Local\Temp\kryaRc1hmuL6.bat
Size 196B
SHA256 880a62edb0cb52319e870619a98783dc7c11907968d08493994dbcc266df0ec7
MD5 1a22196a0d0889c1115a7ac87cf1dde5
SHA1 2dc0583d644ed0b186438be68d6d55b449850ada
SHA512 9a62ab9d2459f5087b67e474753d44b6bf68b8cde6fe339c9a09fc926abb78a8b9acc4712335e1c7144c01664132d89f6beb90eb151d7a1c8ce5c2917313d899
MD5 SHA1 SHA512

Submit Download

mhMyYoXaA1wg.bat

Path C:\Users\Admin\AppData\Local\Temp\mhMyYoXaA1wg.bat
Size 196B
SHA256 ef383e51ef1e3fcd36916f5621e4be4417fb63b2f595e8cac699d97c4b93b9d4
MD5 61e7c0963cdeb85568e65a1f8111d92a
SHA1 9e87c2669baa2ca0e0533e649731a175760eb463
SHA512 f13846c8b095057430a68dc787b3e5e2f4d3ba002669a075e1ac19b59b06ce7f20c1c04ebb7f52fe3caf2f9782d04dff89229f70e0fe13b885e3db323ac4035d
MD5 SHA1 SHA512

Submit Download

wN4rgD6N2kKh.bat

Path C:\Users\Admin\AppData\Local\Temp\wN4rgD6N2kKh.bat
Size 196B
SHA256 5b7eca6c154b285568dfd41f904be5e3a67fd925360083477da244c1e27ce08f
MD5 e50fb78689662cbe7f8e7461956e44ea
SHA1 481e12210070a9169bfc4feb7ebde3d970afeb21
SHA512 fc7eb3602054a704f40e2aa9c114a8aa1277dcecd92f26e9d1ad10f55660146616d5b849c6492d482ff98b5e4a41c058b622ed89f47789a5c795b431780241a6
MD5 SHA1 SHA512

Submit Download

yRDmMr2oxmgi.bat

Path C:\Users\Admin\AppData\Local\Temp\yRDmMr2oxmgi.bat
Size 196B
SHA256 8b7c4073a7a4f3b4babf16207f79ccba798444efc246301f4b218b53e1b0fb2f
MD5 b74fe6be7837149660a92f18934d4668
SHA1 970cf47f5baf28659f841b8d6088ffae8dbd6cc4
SHA512 8bee6cf39b351cdf3fa77abe9aa4314b0e83066d5eb30d4b62caa9326e89261ea8d32ae3b4d8bfb0724d6ffcfb1d6725b0aed49af4521d34d4004ea70aa601fa
MD5 SHA1 SHA512

Submit Download

updale.exe

Path C:\Windows\System32\SubDir\updale.exe
Size 3.1MB
SHA256 a5473ea4c4ef75c217e0d252d1c7d235b781a75810b7e731a97ed78b45646840
MD5 2c1fba8d6624adf6c582fb2d5fb43b28
SHA1 bd45ee984e9476d604824f83c6cf6111a9db2467
SHA512 cc85b5f1c2765c49f34c236634dcbfdfd6cc62e0b954b74c12b0d89dc29044dff88a9840e5c02a39e140564283074c78359dd70dfc7f426daefb75f195f14e19
SSDEEP 49152:nvVG42pda6D+/PjlLOlg6yQipV6iRJ67bR3LoGdTqTHHB72eh2NT:nvM42pda6D+/PjlLOlZyQipV6iRJ6ND
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-77-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/368-81-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/1424-90-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/1424-84-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/1424-85-0x000000001BBB0000-0x000000001BBC0000-memory.dmp

Download

memory/1572-11-0x000000001B210000-0x000000001B220000-memory.dmp

Download

memory/1572-12-0x000000001C320000-0x000000001C370000-memory.dmp

Download

memory/1572-9-0x00007FFD7D4B0000-0x00007FFD7DF71000-memory.dmp

Download

memory/1572-19-0x00007FFD7D4B0000-0x00007FFD7DF71000-memory.dmp

Download

memory/1572-13-0x000000001C430000-0x000000001C4E2000-memory.dmp

Download

memory/1608-98-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/1608-92-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/1608-93-0x0000000002F10000-0x0000000002F20000-memory.dmp

Download

memory/1804-74-0x00007FFD7D0B0000-0x00007FFD7DB71000-memory.dmp

Download

memory/1804-70-0x000000001B690000-0x000000001B6A0000-memory.dmp

Download

memory/1804-69-0x00007FFD7D0B0000-0x00007FFD7DB71000-memory.dmp

Download

memory/2388-43-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/2388-39-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/2388-38-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/2404-50-0x00007FFD7CF60000-0x00007FFD7DA21000-memory.dmp

Download

memory/2404-46-0x00007FFD7CF60000-0x00007FFD7DA21000-memory.dmp

Download

memory/2520-62-0x0000000000CF0000-0x0000000000D00000-memory.dmp

Download

memory/2520-61-0x00007FFD7CF60000-0x00007FFD7DA21000-memory.dmp

Download

memory/2520-67-0x00007FFD7CF60000-0x00007FFD7DA21000-memory.dmp

Download

memory/2936-105-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/2936-100-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/3100-36-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/3100-31-0x000000001B940000-0x000000001B950000-memory.dmp

Download

memory/3100-30-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/3488-23-0x000000001BAD0000-0x000000001BAE0000-memory.dmp

Download

memory/3488-22-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/3488-27-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/3508-2-0x000000001B3F0000-0x000000001B400000-memory.dmp

Download

memory/3508-0-0x0000000000320000-0x0000000000644000-memory.dmp

Download

memory/3508-10-0x00007FFD7D4B0000-0x00007FFD7DF71000-memory.dmp

Download

memory/3508-1-0x00007FFD7D4B0000-0x00007FFD7DF71000-memory.dmp

Download

memory/3624-107-0x00007FFD7D830000-0x00007FFD7E2F1000-memory.dmp

Download

memory/4020-54-0x00000000025C0000-0x00000000025D0000-memory.dmp

Download

memory/4020-53-0x00007FFD7CF60000-0x00007FFD7DA21000-memory.dmp

Download

memory/4020-58-0x00007FFD7CF60000-0x00007FFD7DA21000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads