Malware Analysis Report

2024-10-19 06:33

Sample ID 240527-ceernscc5z
Target b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd
SHA256 b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd
Tags
controlhost quasar spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd

Threat Level: Known bad

The file b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd was found to be: Known bad.

Malicious Activity Summary

controlhost quasar spyware trojan

Quasar RAT

Detects executables containing common artifacts observed in infostealers

Detects Windows executables referencing non-Windows User-Agents

Quasar family

Quasar payload

Detects Windows executables referencing non-Windows User-Agents

Detects executables containing common artifacts observed in infostealers

Checks computer location settings

Looks up external IP address via web service

Enumerates physical storage devices

Program crash

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-27 01:59

Signatures

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing common artifacts observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-27 01:59

Reported

2024-05-27 02:01

Platform

win7-20240508-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing common artifacts observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2400 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2400 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2400 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2400 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2400 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\WerFault.exe
PID 2400 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\WerFault.exe
PID 2400 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\WerFault.exe
PID 2400 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\WerFault.exe
PID 2596 wrote to memory of 2428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2596 wrote to memory of 2428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2596 wrote to memory of 2428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2596 wrote to memory of 2428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2596 wrote to memory of 2448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2596 wrote to memory of 2448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2596 wrote to memory of 2448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2596 wrote to memory of 2448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2596 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 2596 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 2596 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 2596 wrote to memory of 1484 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\x3Lid85K0rQq.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1464

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
CN 121.43.158.106:4782 tcp
US 8.8.8.8:53 yc01h.11ychos.xyz udp

Files

memory/2400-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

memory/2400-1-0x00000000000B0000-0x000000000013C000-memory.dmp

memory/2400-2-0x0000000074C60000-0x000000007534E000-memory.dmp

memory/2400-4-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

memory/2400-5-0x0000000074C60000-0x000000007534E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\x3Lid85K0rQq.bat

MD5 1ff0e8236a1065cfde659e7e0fd99814
SHA1 ec3f3e108dc0b4f03720981cf24cea010154cc65
SHA256 bfcd187bfeeb9e3818c176962d12f5c11e9fc013926c2e3d33281eaa6aebbf81
SHA512 66a2ef46b9203b33d958f5cf1e0949b95c5e18c2aac9328daee1b4d26153d74af4ae8dd5988d8fcad0809af403d52d607b14048a09d00d2ee4ba829831d47765

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-27 01:59

Reported

2024-05-27 02:01

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"

Signatures

Quasar RAT

trojan spyware quasar
Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing common artifacts observed in infostealers

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4400 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 4400 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 4400 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 4604 wrote to memory of 3156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4604 wrote to memory of 3156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4604 wrote to memory of 3156 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4604 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4604 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4604 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4604 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 4604 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 4604 wrote to memory of 2468 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 2468 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2468 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 4412 wrote to memory of 4500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4412 wrote to memory of 4500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4412 wrote to memory of 4500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4412 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4412 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4412 wrote to memory of 1108 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4412 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 4412 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 4412 wrote to memory of 452 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 452 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 452 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 452 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 4576 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4576 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4576 wrote to memory of 2444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4576 wrote to memory of 4556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4576 wrote to memory of 4556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4576 wrote to memory of 4556 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4576 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 4576 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 4576 wrote to memory of 1380 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 1380 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 1380 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe C:\Windows\SysWOW64\cmd.exe
PID 2064 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2064 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2064 wrote to memory of 4992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2064 wrote to memory of 4444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2064 wrote to memory of 4444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2064 wrote to memory of 4444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2064 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 2064 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe
PID 2064 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3772,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EHh1Q4esfuPG.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4400 -ip 4400

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4400 -s 2116

C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UVRbVt1O94sx.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2468 -ip 2468

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 2088

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DH6w4DvF07f7.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 452 -ip 452

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 2316

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sKjbqxzRbT0w.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1380 -ip 1380

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 2308

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe

"C:\Users\Admin\AppData\Local\Temp\b923f253757397be0e1b86c92a0854d0eef612fcc3c99fd5be8f96e309d8d5fd.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
CN 121.43.158.106:4782 tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 yc01h.11ychos.xyz udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
CN 121.43.158.106:4782 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 yc01h.11ychos.xyz udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
CN 121.43.158.106:4782 tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 yc01h.11ychos.xyz udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
CN 121.43.158.106:4782 tcp
US 8.8.8.8:53 yc01h.11ychos.xyz udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
CN 121.43.158.106:4782 tcp

Files

memory/4400-0-0x000000007458E000-0x000000007458F000-memory.dmp

memory/4400-1-0x0000000000C00000-0x0000000000C8C000-memory.dmp

memory/4400-2-0x0000000005D40000-0x00000000062E4000-memory.dmp

memory/4400-3-0x00000000056B0000-0x0000000005742000-memory.dmp

memory/4400-4-0x0000000074580000-0x0000000074D30000-memory.dmp

memory/4400-5-0x0000000005790000-0x00000000057F6000-memory.dmp

memory/4400-6-0x00000000064F0000-0x0000000006502000-memory.dmp

memory/4400-7-0x0000000006B70000-0x0000000006BAC000-memory.dmp

memory/4400-8-0x0000000007480000-0x0000000007A98000-memory.dmp

memory/4400-9-0x0000000006F20000-0x0000000006F70000-memory.dmp

memory/4400-10-0x0000000006EF0000-0x0000000006EFA000-memory.dmp

memory/4400-11-0x0000000007320000-0x000000000733A000-memory.dmp

memory/4400-12-0x0000000007AA0000-0x0000000007B52000-memory.dmp

memory/4400-14-0x000000007458E000-0x000000007458F000-memory.dmp

memory/4400-15-0x0000000074580000-0x0000000074D30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\EHh1Q4esfuPG.bat

MD5 5156073719ee8d89bb1f9dae1f69d665
SHA1 d843de8b844ece33ca02a487a968d69cd5ad12fd
SHA256 bad92167a1161d9bd4eb9a87c55f8ca74b9a0fece7f91f007f09a1a37351f489
SHA512 a278b23afc497909d61942f8ba743eac7815c3942b61d4549e7b85c04269d4c2cfb9b76aeb95f70a28d76bd516bb63c208db31c9fdecdedeccc2f070ec3ff621

memory/4400-20-0x0000000074580000-0x0000000074D30000-memory.dmp

memory/2468-21-0x0000000074550000-0x00000000745FB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Logs\05-27-2024

MD5 e16591a18c3fe3e815e34e769f800474
SHA1 f91521a294b8864bc7442eadb7dbe5b59592a748
SHA256 2a6c089e0bc141f993ffa1cffcdcb70703b46a15c9b6277e077181d69183455a
SHA512 65b555975dbecc2a028bbf75cecc450dbd39ce7d0329c0af7b1aaa684fa74085533347cfaa49d7e7be086366f6a7735daa851e94e4223b43c2a1050c6ccbc7d6

memory/2468-24-0x0000000074550000-0x00000000745FB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\UVRbVt1O94sx.bat

MD5 b0e70bf44be90f9fddfe7c1943217b00
SHA1 d9a39368b3402d415c7f3fef19149ab15e2ed403
SHA256 6b19b9a3e373010accf4cd66906da98bc8a2c9d9b0a5611ddf0df5982c80daf3
SHA512 8581e00a77ab18b2c97b976265cf317b19f82ec8a51011ffdaaac933aeae49139c4c95c75a6399fd7aefd5663f03874eedf08d5fec46a480e538df4de580dcbb

memory/2468-29-0x0000000074550000-0x00000000745FB000-memory.dmp

C:\Users\Admin\AppData\Roaming\Logs\05-27-2024

MD5 3962498ccfc3fc205f9a3c0bd4b138a6
SHA1 79595531b0a3bf4a2dd4ef83998cfa536e02e082
SHA256 1f6eaaf1ae9440fafbbdc292178dfdf5fdf31be07c7cb9ee2a5bc9113a14a43b
SHA512 65e15d306786909b6d84f72a62fe2d91345a3629b73fc29c0c643527bc7a9ce79b02ee666ee77d04fffdd69310d37c04f82c3ac214c86b85c8979332d32995a1

C:\Users\Admin\AppData\Local\Temp\DH6w4DvF07f7.bat

MD5 9285bb39cc34c39435f48165ceb668aa
SHA1 7f7eea270489ce558bc4c8aa5207ba4f90322780
SHA256 b2b2504f8e06369a84d9d4ffe68dc0838f7198b0d95ce4dc2463c1fbf48c5572
SHA512 bbeba74c7bd6ecdceed289ca6c727f1152de01356011127b19411caed0dab7d29cf7f3c77b1eade19e55adb46c413ff1a6832889863d81812a6ea8012cc202c6

C:\Users\Admin\AppData\Roaming\Logs\05-27-2024

MD5 ff8c82f07f523e5841fa29bdc135ddf5
SHA1 18e9adc5191af43d0709a6452c435511b2539d74
SHA256 039f8261c299769ea234eb54306d2c2137266071caa4a669f9fca946f7bd6b9e
SHA512 d361bce22a102d583b5ea4787cff955b2d5c5f7e784a196055066c5c20c52a5d11a5bcba7f396895fba2536f651eafd97e1bc4b5f88c23a38c60613aee5738ae

C:\Users\Admin\AppData\Local\Temp\sKjbqxzRbT0w.bat

MD5 9e92ca615a3e11cd51c58330f82c35db
SHA1 7166c2498f91a914f0b6b2304bda349ab8fac1c0
SHA256 9b86a6f4ff914906de83e819cace55c47f27482cd47153c2d67374e7907f5288
SHA512 3d872676a7b4fc4ac39b4e78e9eaf8a0f4a848213f2707c94352f654668b6dbdb28e26be576503607380f8715da82ed949441e1997e841f9709b2b7bf938b975

C:\Users\Admin\AppData\Roaming\Logs\05-27-2024

MD5 c08cfba081e1420da4894cff7a847c4b
SHA1 dee944abe812697c5a7aa307b12ce8fbc0b561f2
SHA256 b1e83ed8d369d9110a4bffb93c96c23b33855ab95bfea2290640d39cfacc6f35
SHA512 0ba8b3070af4b1f5c28e42b6f5c0adb33593f6a2ca62fa9f94769c29d74247b5c7e4cbdc042502fa1e28b818bce3b5216525020523e5a5c9da2dfd66cd900779