quasar | 412693c6a8fa7142d55bdca7f0473ba66582155399b49f7eacee55f4d78dfd7a

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-05-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baritone.exe
Size

502KB
MD5

bf1f011e9664823aeb1c386eeb9e5c90
SHA1

3a15112a330446b895811549a857d0d92763cf1a
SHA256

412693c6a8fa7142d55bdca7f0473ba66582155399b49f7eacee55f4d78dfd7a
SHA512

584dfe97edefc6c8f8d96a3589fbf84701846a16f6c71625772c3a56763bb51303c476c808f9e68c55899f5e61ee2a98f7805f54703b62838b8cc9b65715bb44
SSDEEP

6144:NTEgdc0YxXAGbgiIN2RSBDuZnqUBlh/eKTFwQHocEAAb8F98IHsyzMcTR3u:NTEgdfYtbgvuIA5FwQj+HyzMcdu

Score

10^/10

quasar infectado spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

infectado

elpepemanca.ddns.net:3440

192.168.0.14:3440

Mutex

2d163b2b-eaf2-4077-9c9f-de0b77680d93

Attributes

encryption_key
82A217D42F0FCA4A09032979DC25A2A7FD7E9698
install_name
explorer.exe
log_directory
crash_report
reconnect_delay
3000
startup_key
explorer.exe
subdirectory
windows

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2336-1-0x00000000000A0000-0x0000000000124000-memory.dmp	family_quasar
C:\Windows\System32\windows\explorer.exe	family_quasar
behavioral1/memory/2128-7-0x0000000000EE0000-0x0000000000F64000-memory.dmp	family_quasar
behavioral1/memory/920-74-0x0000000000200000-0x0000000000284000-memory.dmp	family_quasar
behavioral1/memory/1124-85-0x0000000000E00000-0x0000000000E84000-memory.dmp	family_quasar
behavioral1/memory/1244-107-0x0000000000260000-0x00000000002E4000-memory.dmp	family_quasar
behavioral1/memory/2524-118-0x0000000000F80000-0x0000000001004000-memory.dmp	family_quasar
behavioral1/memory/2836-140-0x0000000000210000-0x0000000000294000-memory.dmp	family_quasar
behavioral1/memory/2764-151-0x0000000000220000-0x00000000002A4000-memory.dmp	family_quasar
behavioral1/memory/2904-173-0x0000000000290000-0x0000000000314000-memory.dmp	family_quasar

Executes dropped EXE 16 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
2128	explorer.exe
2592	explorer.exe
1620	explorer.exe
2472	explorer.exe
2856	explorer.exe
1816	explorer.exe
920	explorer.exe
1124	explorer.exe
756	explorer.exe
1244	explorer.exe
2524	explorer.exe
2444	explorer.exe
2836	explorer.exe
2764	explorer.exe
1492	explorer.exe
2904	explorer.exe

Drops file in System32 directory 33 IoCs

Processes:

baritone.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
File opened for modification	C:\Windows\system32\windows	baritone.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	baritone.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File created	C:\Windows\system32\windows\explorer.exe	baritone.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
1632	PING.EXE
2780	PING.EXE
2024	PING.EXE
1568	PING.EXE
2500	PING.EXE
2688	PING.EXE
2396	PING.EXE
1804	PING.EXE
2736	PING.EXE
1772	PING.EXE
332	PING.EXE
2432	PING.EXE
2284	PING.EXE
2336	PING.EXE
3004	PING.EXE

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

baritone.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2336	baritone.exe
Token: SeDebugPrivilege	2128	explorer.exe
Token: SeDebugPrivilege	2592	explorer.exe
Token: SeDebugPrivilege	1620	explorer.exe
Token: SeDebugPrivilege	2472	explorer.exe
Token: SeDebugPrivilege	2856	explorer.exe
Token: SeDebugPrivilege	1816	explorer.exe
Token: SeDebugPrivilege	920	explorer.exe
Token: SeDebugPrivilege	1124	explorer.exe
Token: SeDebugPrivilege	756	explorer.exe
Token: SeDebugPrivilege	1244	explorer.exe
Token: SeDebugPrivilege	2524	explorer.exe
Token: SeDebugPrivilege	2444	explorer.exe
Token: SeDebugPrivilege	2836	explorer.exe
Token: SeDebugPrivilege	2764	explorer.exe
Token: SeDebugPrivilege	1492	explorer.exe
Token: SeDebugPrivilege	2904	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

baritone.exeexplorer.execmd.exeexplorer.execmd.exeexplorer.execmd.exeexplorer.execmd.exeexplorer.execmd.exeexplorer.exe

description	pid	process	target process
PID 2336 wrote to memory of 2128	2336	baritone.exe	explorer.exe
PID 2336 wrote to memory of 2128	2336	baritone.exe	explorer.exe
PID 2336 wrote to memory of 2128	2336	baritone.exe	explorer.exe
PID 2128 wrote to memory of 2688	2128	explorer.exe	cmd.exe
PID 2128 wrote to memory of 2688	2128	explorer.exe	cmd.exe
PID 2128 wrote to memory of 2688	2128	explorer.exe	cmd.exe
PID 2688 wrote to memory of 2684	2688	cmd.exe	chcp.com
PID 2688 wrote to memory of 2684	2688	cmd.exe	chcp.com
PID 2688 wrote to memory of 2684	2688	cmd.exe	chcp.com
PID 2688 wrote to memory of 2736	2688	cmd.exe	PING.EXE
PID 2688 wrote to memory of 2736	2688	cmd.exe	PING.EXE
PID 2688 wrote to memory of 2736	2688	cmd.exe	PING.EXE
PID 2688 wrote to memory of 2592	2688	cmd.exe	explorer.exe
PID 2688 wrote to memory of 2592	2688	cmd.exe	explorer.exe
PID 2688 wrote to memory of 2592	2688	cmd.exe	explorer.exe
PID 2592 wrote to memory of 2432	2592	explorer.exe	cmd.exe
PID 2592 wrote to memory of 2432	2592	explorer.exe	cmd.exe
PID 2592 wrote to memory of 2432	2592	explorer.exe	cmd.exe
PID 2432 wrote to memory of 2508	2432	cmd.exe	chcp.com
PID 2432 wrote to memory of 2508	2432	cmd.exe	chcp.com
PID 2432 wrote to memory of 2508	2432	cmd.exe	chcp.com
PID 2432 wrote to memory of 1632	2432	cmd.exe	PING.EXE
PID 2432 wrote to memory of 1632	2432	cmd.exe	PING.EXE
PID 2432 wrote to memory of 1632	2432	cmd.exe	PING.EXE
PID 2432 wrote to memory of 1620	2432	cmd.exe	explorer.exe
PID 2432 wrote to memory of 1620	2432	cmd.exe	explorer.exe
PID 2432 wrote to memory of 1620	2432	cmd.exe	explorer.exe
PID 1620 wrote to memory of 2964	1620	explorer.exe	cmd.exe
PID 1620 wrote to memory of 2964	1620	explorer.exe	cmd.exe
PID 1620 wrote to memory of 2964	1620	explorer.exe	cmd.exe
PID 2964 wrote to memory of 3000	2964	cmd.exe	chcp.com
PID 2964 wrote to memory of 3000	2964	cmd.exe	chcp.com
PID 2964 wrote to memory of 3000	2964	cmd.exe	chcp.com
PID 2964 wrote to memory of 2780	2964	cmd.exe	PING.EXE
PID 2964 wrote to memory of 2780	2964	cmd.exe	PING.EXE
PID 2964 wrote to memory of 2780	2964	cmd.exe	PING.EXE
PID 2964 wrote to memory of 2472	2964	cmd.exe	explorer.exe
PID 2964 wrote to memory of 2472	2964	cmd.exe	explorer.exe
PID 2964 wrote to memory of 2472	2964	cmd.exe	explorer.exe
PID 2472 wrote to memory of 1940	2472	explorer.exe	cmd.exe
PID 2472 wrote to memory of 1940	2472	explorer.exe	cmd.exe
PID 2472 wrote to memory of 1940	2472	explorer.exe	cmd.exe
PID 1940 wrote to memory of 2652	1940	cmd.exe	chcp.com
PID 1940 wrote to memory of 2652	1940	cmd.exe	chcp.com
PID 1940 wrote to memory of 2652	1940	cmd.exe	chcp.com
PID 1940 wrote to memory of 2500	1940	cmd.exe	PING.EXE
PID 1940 wrote to memory of 2500	1940	cmd.exe	PING.EXE
PID 1940 wrote to memory of 2500	1940	cmd.exe	PING.EXE
PID 1940 wrote to memory of 2856	1940	cmd.exe	explorer.exe
PID 1940 wrote to memory of 2856	1940	cmd.exe	explorer.exe
PID 1940 wrote to memory of 2856	1940	cmd.exe	explorer.exe
PID 2856 wrote to memory of 1392	2856	explorer.exe	cmd.exe
PID 2856 wrote to memory of 1392	2856	explorer.exe	cmd.exe
PID 2856 wrote to memory of 1392	2856	explorer.exe	cmd.exe
PID 1392 wrote to memory of 2040	1392	cmd.exe	chcp.com
PID 1392 wrote to memory of 2040	1392	cmd.exe	chcp.com
PID 1392 wrote to memory of 2040	1392	cmd.exe	chcp.com
PID 1392 wrote to memory of 2284	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 2284	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 2284	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 1816	1392	cmd.exe	explorer.exe
PID 1392 wrote to memory of 1816	1392	cmd.exe	explorer.exe
PID 1392 wrote to memory of 1816	1392	cmd.exe	explorer.exe
PID 1816 wrote to memory of 588	1816	explorer.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\baritone.exe
"C:\Users\Admin\AppData\Local\Temp\baritone.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\windows\explorer.exe
  "C:\Windows\system32\windows\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\QC9xjLs41zjq.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2684
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:2736
  - - C:\Windows\system32\windows\explorer.exe
      "C:\Windows\system32\windows\explorer.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2592
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\IhjBepQV3P2b.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2432
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2508
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:1632
      - C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\2WDIH3Dcdu3l.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:2780
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\vci9OhXmrwAj.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2652
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:2500
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\3eiRMPRTnoe1.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2040
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:2284
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\mjO4ArB37AiE.bat" "
        13⤵
        
        PID:588
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2068
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:1772
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\xO93c3M7GdFV.bat" "
        15⤵
        
        PID:1880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:332
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\0txJM9jyBxCS.bat" "
        17⤵
        
        PID:2256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2032
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:2024
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:756
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CI0AP1NCXYK5.bat" "
        19⤵
        
        PID:3052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:1568
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\o9u5RY1jw1GG.bat" "
        21⤵
        
        PID:2576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2172
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:2336
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2524
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ZPdhGLwdXWaK.bat" "
        23⤵
        
        PID:360
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2696
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:2688
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2444
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\keW6G087wMno.bat" "
        25⤵
        
        PID:876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2464
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:2432
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\DQCkABatEuKt.bat" "
        27⤵
        
        PID:3020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2972
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        Runs ping.exe
        
        PID:3004
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QGa1taBqcDav.bat" "
        29⤵
        
        PID:2668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2500
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        Runs ping.exe
        
        PID:2396
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\cWv8Fpn8yQOZ.bat" "
        31⤵
        
        PID:2012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:1336
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        Runs ping.exe
        
        PID:1804
        
        C:\Windows\system32\windows\explorer.exe
        
        "C:\Windows\system32\windows\explorer.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0txJM9jyBxCS.bat

Filesize
199B

MD5
95809f975cfb497271de8fe79d45e945

SHA1
3c1c83c559f37742f2b53b263c3a02ea1ba79f7a

SHA256
839e297a7a89dba19fff46505baccb447601c32483eb11f6db343d7ed94b605b

SHA512
5eeb1579e08129514fafc8819df4de96b2553378c22814d46e039a643431481f7a45e6bce3f3d00025c2ef182b92273e546fb3e233d896c2601e1aa164c6025f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2WDIH3Dcdu3l.bat

Filesize
199B

MD5
12f74db4c4e4e7fc11a62aac8885f499

SHA1
75d9146eddc3a716a8b94f578e06466d37c5d988

SHA256
bfb119d99e254ef485362dbf1573a963a15a0960d55c85df6fdcd68c18134e68

SHA512
1ab9db4ac4213ef70c79434b855a59816ce34da5618f2746373a8b3b72e0781636ccff09b343dcaa71b5ef5286dbbe869fcba299419deec46ad5fd689ff6fa59

Download Submit
C:\Users\Admin\AppData\Local\Temp\3eiRMPRTnoe1.bat

Filesize
199B

MD5
53e5f28121b3efc1e8e814c38f8ced9b

SHA1
38f8ed2f4224cb05a6369fd6df15bb7b8c072090

SHA256
6684f39d84caafcdf62a6ad306d5b0aa6af72da04ae2b162d8d3caeca0487123

SHA512
7750ab275d3eb7e90fbf4bf23e1c3ffe7511a5281bd8a45fd6905d80544c971d94d1b2ad4d08fa12e4416c92647286f75ebea515d655e9a906239b322fd470c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CI0AP1NCXYK5.bat

Filesize
199B

MD5
150c0d5985bc3aadd2c7cbe6e89ec682

SHA1
0b4abeeb8f79cc2ecfa89f3cecfb93d929599cb5

SHA256
d8f184c5b2d685211cc554b509efdf55f1178963a03ca55c49e39e2e1608007a

SHA512
9c72d7761e5115046d96057a3c4adad5b68b4595becbdb28e2db9ac6a15fab8a467c3f2a238371e287f46fdc434a660593d634fadd6255822c8664a3c45138d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\DQCkABatEuKt.bat

Filesize
199B

MD5
349f7e7b227866772ea3159c7cf79a58

SHA1
df2781dad1d1bca53a9fa71855e0eda10e1c2ecc

SHA256
d69194be5681cb3aaae1773b269857e1ffd8ce95308621d60905de6714b3b878

SHA512
43f3913e847f95cb4f2f26b29b1116f44272c5954f9a9d6535d24407028884acbd6e7514dc899205f4837c092f0798db8e395e1a2d008c39e66a290089dc4d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IhjBepQV3P2b.bat

Filesize
199B

MD5
96a75fd0633362e7aba29d8d458cc6bc

SHA1
fcc9fab4629d38d314bea6611faf5d121996f8ed

SHA256
d09bacc85ae5395daaa9e06aa4dd026a24812e7dba848fcceb7faadec55a936b

SHA512
4ec4ad2d55c4c1189d9687260dc009807382ffdfee3eeba3fd383bda9fa4d704d6ea18691015926fb16be7b4e5b43b2492700867ca6bb1baf13e2fe52f05c2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\QC9xjLs41zjq.bat

Filesize
199B

MD5
4a1036bcb436cced079065e1d993a0f8

SHA1
3c2a0b9fb9e1b82f914a9c7f4797338dde30164a

SHA256
867721d642b3ebdd12e2ce5e5c184d17789aaef83dc97883c4f91ebcc982a25c

SHA512
34a97a2484742f0d2f12de07804bc76bbd3ac6114dbd25e8c4236a329b9f990faf67e9b7795fe307b5a80e810e44633bf6ee251eaa00b76b4078ea037a78d650

Download Submit
C:\Users\Admin\AppData\Local\Temp\QGa1taBqcDav.bat

Filesize
199B

MD5
82ee29a1ee7f7090e7a8279276f7f5b8

SHA1
658087607264a2804fe2369de92f4838e454060b

SHA256
e7c14d0b36aab2fb56e0136882fe2f1b80a3fc75a6acc305112d3dd27fb394f7

SHA512
de895065964dc286f5c220e0da0fda51af6c4328581785e8c18d2d08481eb15a992f0ccd29a0d41b6997c30de2be830f859304f38e663706a5003e56ce917dff

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZPdhGLwdXWaK.bat

Filesize
199B

MD5
4b9dec432acf4a9ec707ea457a3d464d

SHA1
0b6a04a3479908e910f70c33702c9d9715f32db5

SHA256
b1f22e530c846f9d7de5fc0badf79cc1e30b989ed77be0bbf3ad743731cdc2f1

SHA512
c82b32b22cc9294d022c55371e458d50c4daf221a1ee39377f62196e50ef28182347181558a98764db089017c6459ce974ab8a2310cba2b621675155883b346e

Download Submit
C:\Users\Admin\AppData\Local\Temp\cWv8Fpn8yQOZ.bat

Filesize
199B

MD5
1264a95dbae308a96c1eda906308e765

SHA1
83d1cbbd1b2439ceda61af822b68ee5bdb9ab4cf

SHA256
d0f96fb9c0728c70f93c4d40245db37d10afbe83883d46b8d22b6813c8d980cb

SHA512
0a14273900bff1cd797351f4702b9ab9dddc835d369e9a1e8caf5f02d8c1b4dce260cfd38099049b8c431cf05e8dc948a89df028546d5429b496fd2cfdf5d887

Download Submit
C:\Users\Admin\AppData\Local\Temp\keW6G087wMno.bat

Filesize
199B

MD5
15d0ca8bc5695e714efd9d0a635c892a

SHA1
7419d83870716938b63a819076ea211ce8521456

SHA256
3c1897ae873c78cc3519d4e7514d554a306beb6404cfab24be559991e2d569e5

SHA512
3bdbd632586fd49a470a8b5c8fb50a2b4d7dcd333af4dda4d5f05e93f2e9553879e24382a57aad3f33b06f50618d3ae398cc10ac9cf0c4920ef109cbb7440ca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mjO4ArB37AiE.bat

Filesize
199B

MD5
7b287c867cb9d7f637eaa966a879fcda

SHA1
7546a43e49e9eb1c9b53da68c6e98d60b692a6b5

SHA256
bc88dfb3a70df7c1a2d69b0204b8f03b50ace7bee008e0434b80b359d25e6b4c

SHA512
f896e3639cee6f9d3ffc00a2adf9af3209f5d4331b856bc5ff560edda232bb436fe242da3de49f03cb5dcb090351138c9786c791ec9b23e31762d249b45bede1

Download Submit
C:\Users\Admin\AppData\Local\Temp\o9u5RY1jw1GG.bat

Filesize
199B

MD5
265ad064da7a3b5b40e060a06dbb6029

SHA1
87dcd9a870d8a97ec7d531f364f3f060dbe12b14

SHA256
d49529adea6f7a9c4673b1b4ef82ecf4772a234d0f65113b8bd676c7f3bf8960

SHA512
1a44f83327db3126d60eab09a67661292eadd095e07617b03ac9654790f2ac75c9c3d2d25972e44418e9dd4f6ad61c7cdb381a1789fe390d3e0526d67b5eaa7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\vci9OhXmrwAj.bat

Filesize
199B

MD5
ce5ad17d3d129d30055c2b8e1a3126ad

SHA1
232977098ec9dbc2fd47df4fc725d9df37432f03

SHA256
68babdc44ec9c4e89ed8d9af3c3bd5ed3b85f8a806a2ee0ec15b3c692464b42a

SHA512
f5a4290ab92afcf14607d6cfa9ead993736f45978d9d26af55f3843294e32356b24ab3b02cd3d1f39c3ad05b52b1727b8b915d13072f3cbcf020cf02fcee69db

Download Submit
C:\Users\Admin\AppData\Local\Temp\xO93c3M7GdFV.bat

Filesize
199B

MD5
7b9e5daf36e689fd73185861f8cc1cde

SHA1
8723c4e801bd493e721cdfe234d4df9df81f34ce

SHA256
f164cd615ed3a91b7de8fff16efcca2cfb1cc6e0c80fbe6decb081f904519077

SHA512
52b085d20908da066a83f1153561c7ca189ea33cfebab9943fcb29c955cc9ef2a73f7444161d068a642151fe304dd5427c5c2e44131a22294463ef44d62a430e

Download Submit
C:\Windows\System32\windows\explorer.exe

Filesize
502KB

MD5
bf1f011e9664823aeb1c386eeb9e5c90

SHA1
3a15112a330446b895811549a857d0d92763cf1a

SHA256
412693c6a8fa7142d55bdca7f0473ba66582155399b49f7eacee55f4d78dfd7a

SHA512
584dfe97edefc6c8f8d96a3589fbf84701846a16f6c71625772c3a56763bb51303c476c808f9e68c55899f5e61ee2a98f7805f54703b62838b8cc9b65715bb44

Download Submit
\??\PIPE\lsarpc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/920-74-0x0000000000200000-0x0000000000284000-memory.dmp

Filesize
528KB

Download
memory/1124-85-0x0000000000E00000-0x0000000000E84000-memory.dmp

Filesize
528KB

Download
memory/1244-107-0x0000000000260000-0x00000000002E4000-memory.dmp

Filesize
528KB

Download
memory/2128-7-0x0000000000EE0000-0x0000000000F64000-memory.dmp

Filesize
528KB

Download
memory/2128-20-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2128-9-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2128-8-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-10-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-0-0x000007FEF5F83000-0x000007FEF5F84000-memory.dmp

Filesize
4KB

Download
memory/2336-2-0x000007FEF5F80000-0x000007FEF696C000-memory.dmp

Filesize
9.9MB

Download
memory/2336-1-0x00000000000A0000-0x0000000000124000-memory.dmp

Filesize
528KB

Download
memory/2524-118-0x0000000000F80000-0x0000000001004000-memory.dmp

Filesize
528KB

Download
memory/2764-151-0x0000000000220000-0x00000000002A4000-memory.dmp

Filesize
528KB

Download
memory/2836-140-0x0000000000210000-0x0000000000294000-memory.dmp

Filesize
528KB

Download
memory/2904-173-0x0000000000290000-0x0000000000314000-memory.dmp

Filesize
528KB

Download