quasar | 412693c6a8fa7142d55bdca7f0473ba66582155399b49f7eacee55f4d78dfd7a

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

baritone.exe
Size

502KB
MD5

bf1f011e9664823aeb1c386eeb9e5c90
SHA1

3a15112a330446b895811549a857d0d92763cf1a
SHA256

412693c6a8fa7142d55bdca7f0473ba66582155399b49f7eacee55f4d78dfd7a
SHA512

584dfe97edefc6c8f8d96a3589fbf84701846a16f6c71625772c3a56763bb51303c476c808f9e68c55899f5e61ee2a98f7805f54703b62838b8cc9b65715bb44
SSDEEP

6144:NTEgdc0YxXAGbgiIN2RSBDuZnqUBlh/eKTFwQHocEAAb8F98IHsyzMcTR3u:NTEgdfYtbgvuIA5FwQj+HyzMcdu

Score

10^/10

quasar infectado spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

infectado

elpepemanca.ddns.net:3440

192.168.0.14:3440

Mutex

2d163b2b-eaf2-4077-9c9f-de0b77680d93

Attributes

encryption_key
82A217D42F0FCA4A09032979DC25A2A7FD7E9698
install_name
explorer.exe
log_directory
crash_report
reconnect_delay
3000
startup_key
explorer.exe
subdirectory
windows

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1184-0-0x00000000006C0000-0x0000000000744000-memory.dmp	family_quasar
C:\Windows\system32\windows\explorer.exe	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	explorer.exe

Executes dropped EXE 15 IoCs

Processes:

explorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

pid	process
2828	explorer.exe
4528	explorer.exe
4416	explorer.exe
2384	explorer.exe
3748	explorer.exe
2288	explorer.exe
4120	explorer.exe
1556	explorer.exe
5028	explorer.exe
888	explorer.exe
2592	explorer.exe
4516	explorer.exe
3464	explorer.exe
4560	explorer.exe
1972	explorer.exe

Drops file in System32 directory 31 IoCs

Processes:

explorer.exeexplorer.exebaritone.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	ioc	process
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	baritone.exe
File opened for modification	C:\Windows\system32\windows	baritone.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File created	C:\Windows\system32\windows\explorer.exe	baritone.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe
File opened for modification	C:\Windows\system32\windows\explorer.exe	explorer.exe
File opened for modification	C:\Windows\system32\windows	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
724	PING.EXE
3360	PING.EXE
2384	PING.EXE
4920	PING.EXE
648	PING.EXE
4980	PING.EXE
5100	PING.EXE
2964	PING.EXE
1512	PING.EXE
4388	PING.EXE
4300	PING.EXE
4012	PING.EXE
1932	PING.EXE
2236	PING.EXE
2032	PING.EXE

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

taskmgr.exe

pid	process
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

baritone.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exetaskmgr.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1184	baritone.exe
Token: SeDebugPrivilege	2828	explorer.exe
Token: SeDebugPrivilege	4528	explorer.exe
Token: SeDebugPrivilege	4416	explorer.exe
Token: SeDebugPrivilege	2384	explorer.exe
Token: SeDebugPrivilege	3748	explorer.exe
Token: SeDebugPrivilege	4480	taskmgr.exe
Token: SeSystemProfilePrivilege	4480	taskmgr.exe
Token: SeCreateGlobalPrivilege	4480	taskmgr.exe
Token: SeDebugPrivilege	4120	explorer.exe
Token: 33	4480	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4480	taskmgr.exe
Token: SeDebugPrivilege	1556	explorer.exe
Token: SeDebugPrivilege	5028	explorer.exe
Token: SeDebugPrivilege	888	explorer.exe
Token: SeDebugPrivilege	2592	explorer.exe
Token: SeDebugPrivilege	4516	explorer.exe
Token: SeDebugPrivilege	3464	explorer.exe
Token: SeDebugPrivilege	4560	explorer.exe
Token: SeDebugPrivilege	1972	explorer.exe

Suspicious use of FindShellTrayWindow 39 IoCs

Processes:

taskmgr.exe

pid	process
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe

Suspicious use of SendNotifyMessage 39 IoCs

Processes:

taskmgr.exe

pid	process
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe
4480	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

baritone.exeexplorer.execmd.exeexplorer.execmd.exeexplorer.execmd.exeexplorer.execmd.exeexplorer.execmd.execmd.exeexplorer.execmd.exeexplorer.execmd.exe

description	pid	process	target process
PID 1184 wrote to memory of 2828	1184	baritone.exe	explorer.exe
PID 1184 wrote to memory of 2828	1184	baritone.exe	explorer.exe
PID 2828 wrote to memory of 1440	2828	explorer.exe	cmd.exe
PID 2828 wrote to memory of 1440	2828	explorer.exe	cmd.exe
PID 1440 wrote to memory of 2044	1440	cmd.exe	chcp.com
PID 1440 wrote to memory of 2044	1440	cmd.exe	chcp.com
PID 1440 wrote to memory of 724	1440	cmd.exe	PING.EXE
PID 1440 wrote to memory of 724	1440	cmd.exe	PING.EXE
PID 1440 wrote to memory of 4528	1440	cmd.exe	explorer.exe
PID 1440 wrote to memory of 4528	1440	cmd.exe	explorer.exe
PID 4528 wrote to memory of 1968	4528	explorer.exe	cmd.exe
PID 4528 wrote to memory of 1968	4528	explorer.exe	cmd.exe
PID 1968 wrote to memory of 452	1968	cmd.exe	chcp.com
PID 1968 wrote to memory of 452	1968	cmd.exe	chcp.com
PID 1968 wrote to memory of 4980	1968	cmd.exe	PING.EXE
PID 1968 wrote to memory of 4980	1968	cmd.exe	PING.EXE
PID 1968 wrote to memory of 4416	1968	cmd.exe	explorer.exe
PID 1968 wrote to memory of 4416	1968	cmd.exe	explorer.exe
PID 4416 wrote to memory of 1200	4416	explorer.exe	cmd.exe
PID 4416 wrote to memory of 1200	4416	explorer.exe	cmd.exe
PID 1200 wrote to memory of 2304	1200	cmd.exe	chcp.com
PID 1200 wrote to memory of 2304	1200	cmd.exe	chcp.com
PID 1200 wrote to memory of 1932	1200	cmd.exe	PING.EXE
PID 1200 wrote to memory of 1932	1200	cmd.exe	PING.EXE
PID 1200 wrote to memory of 2384	1200	cmd.exe	explorer.exe
PID 1200 wrote to memory of 2384	1200	cmd.exe	explorer.exe
PID 2384 wrote to memory of 3724	2384	explorer.exe	cmd.exe
PID 2384 wrote to memory of 3724	2384	explorer.exe	cmd.exe
PID 3724 wrote to memory of 4820	3724	cmd.exe	chcp.com
PID 3724 wrote to memory of 4820	3724	cmd.exe	chcp.com
PID 3724 wrote to memory of 4388	3724	cmd.exe	PING.EXE
PID 3724 wrote to memory of 4388	3724	cmd.exe	PING.EXE
PID 3724 wrote to memory of 3748	3724	cmd.exe	explorer.exe
PID 3724 wrote to memory of 3748	3724	cmd.exe	explorer.exe
PID 3748 wrote to memory of 2032	3748	explorer.exe	cmd.exe
PID 3748 wrote to memory of 2032	3748	explorer.exe	cmd.exe
PID 2032 wrote to memory of 2600	2032	cmd.exe	chcp.com
PID 2032 wrote to memory of 2600	2032	cmd.exe	chcp.com
PID 2032 wrote to memory of 4300	2032	cmd.exe	PING.EXE
PID 2032 wrote to memory of 4300	2032	cmd.exe	PING.EXE
PID 2032 wrote to memory of 2288	2032	cmd.exe	explorer.exe
PID 2032 wrote to memory of 2288	2032	cmd.exe	explorer.exe
PID 1724 wrote to memory of 4084	1724	cmd.exe	chcp.com
PID 1724 wrote to memory of 4084	1724	cmd.exe	chcp.com
PID 1724 wrote to memory of 4012	1724	cmd.exe	PING.EXE
PID 1724 wrote to memory of 4012	1724	cmd.exe	PING.EXE
PID 1724 wrote to memory of 4120	1724	cmd.exe	explorer.exe
PID 1724 wrote to memory of 4120	1724	cmd.exe	explorer.exe
PID 4120 wrote to memory of 3216	4120	explorer.exe	cmd.exe
PID 4120 wrote to memory of 3216	4120	explorer.exe	cmd.exe
PID 3216 wrote to memory of 3248	3216	cmd.exe	chcp.com
PID 3216 wrote to memory of 3248	3216	cmd.exe	chcp.com
PID 3216 wrote to memory of 1512	3216	cmd.exe	PING.EXE
PID 3216 wrote to memory of 1512	3216	cmd.exe	PING.EXE
PID 3216 wrote to memory of 1556	3216	cmd.exe	explorer.exe
PID 3216 wrote to memory of 1556	3216	cmd.exe	explorer.exe
PID 1556 wrote to memory of 1136	1556	explorer.exe	cmd.exe
PID 1556 wrote to memory of 1136	1556	explorer.exe	cmd.exe
PID 1136 wrote to memory of 4660	1136	cmd.exe	chcp.com
PID 1136 wrote to memory of 4660	1136	cmd.exe	chcp.com
PID 1136 wrote to memory of 5100	1136	cmd.exe	PING.EXE
PID 1136 wrote to memory of 5100	1136	cmd.exe	PING.EXE
PID 1136 wrote to memory of 5028	1136	cmd.exe	explorer.exe
PID 1136 wrote to memory of 5028	1136	cmd.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\baritone.exe
"C:\Users\Admin\AppData\Local\Temp\baritone.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6xeP5hPGRy85.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:2044

C:\Windows\system32\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:724

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pgGUtJRnKk5C.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:452

C:\Windows\system32\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:4980

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AJPqXaPLQ1gd.bat" "
7⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\system32\chcp.com
chcp 65001
8⤵
PID:2304

C:\Windows\system32\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:1932

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IAEZShmWVYtV.bat" "
9⤵
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\system32\chcp.com
chcp 65001
10⤵
PID:4820

C:\Windows\system32\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:4388

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oM18XswOMLLm.bat" "
11⤵
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\system32\chcp.com
chcp 65001
12⤵
PID:2600

C:\Windows\system32\PING.EXE
ping -n 10 localhost
12⤵
- Runs ping.exe
PID:4300

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
12⤵
- Checks computer location settings
- Executes dropped EXE
PID:2288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\om3hQvhwnDud.bat" "
13⤵
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\system32\chcp.com
chcp 65001
14⤵
PID:4084

C:\Windows\system32\PING.EXE
ping -n 10 localhost
14⤵
- Runs ping.exe
PID:4012

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
14⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BW9P5S1AiNzG.bat" "
15⤵
- Suspicious use of WriteProcessMemory
PID:3216

C:\Windows\system32\chcp.com
chcp 65001
16⤵
PID:3248

C:\Windows\system32\PING.EXE
ping -n 10 localhost
16⤵
- Runs ping.exe
PID:1512

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
16⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GexkVIhK3xXY.bat" "
17⤵
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\system32\chcp.com
chcp 65001
18⤵
PID:4660

C:\Windows\system32\PING.EXE
ping -n 10 localhost
18⤵
- Runs ping.exe
PID:5100

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
18⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ug1YiczenXvZ.bat" "
19⤵
PID:4980

C:\Windows\system32\chcp.com
chcp 65001
20⤵
PID:4936

C:\Windows\system32\PING.EXE
ping -n 10 localhost
20⤵
- Runs ping.exe
PID:2236

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
20⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UfcaJxd0a9oD.bat" "
21⤵
PID:1248

C:\Windows\system32\chcp.com
chcp 65001
22⤵
PID:4244

C:\Windows\system32\PING.EXE
ping -n 10 localhost
22⤵
- Runs ping.exe
PID:2964

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
22⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\swBJ9t4NFXIR.bat" "
23⤵
PID:2912

C:\Windows\system32\chcp.com
chcp 65001
24⤵
PID:4820

C:\Windows\system32\PING.EXE
ping -n 10 localhost
24⤵
- Runs ping.exe
PID:2384

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
24⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sotTpRJzBPzm.bat" "
25⤵
PID:4388

C:\Windows\system32\chcp.com
chcp 65001
26⤵
PID:552

C:\Windows\system32\PING.EXE
ping -n 10 localhost
26⤵
- Runs ping.exe
PID:4920

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
26⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:3464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\obUrJqUq3PuM.bat" "
27⤵
PID:3044

C:\Windows\system32\chcp.com
chcp 65001
28⤵
PID:4940

C:\Windows\system32\PING.EXE
ping -n 10 localhost
28⤵
- Runs ping.exe
PID:2032

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
28⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0GWgT5i7hMZ.bat" "
29⤵
PID:4952

C:\Windows\system32\chcp.com
chcp 65001
30⤵
PID:1668

C:\Windows\system32\PING.EXE
ping -n 10 localhost
30⤵
- Runs ping.exe
PID:648

C:\Windows\system32\windows\explorer.exe
"C:\Windows\system32\windows\explorer.exe"
30⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nGH0A02DbtAN.bat" "
31⤵
PID:4968

C:\Windows\system32\chcp.com
chcp 65001
32⤵
PID:2772

C:\Windows\system32\PING.EXE
ping -n 10 localhost
32⤵
- Runs ping.exe
PID:3360

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\6xeP5hPGRy85.bat

Filesize
199B

MD5
e640829734ffd9bb0f292c98a26f232e

SHA1
6ba46896b8a27342b60e26b85c8f49ded1a11b6a

SHA256
758723483165d598372bf25fe06ce17d12a95d909eea53b2a92818f4af9e6e5e

SHA512
4be09b04835f6b198eca4a51ca6928367d23ce1d470b1cbb30f2908dade7c4249a4d611b5874ab0912de8102590b6a4505a4c6640064f14d4a6f86ceb874212e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AJPqXaPLQ1gd.bat

Filesize
199B

MD5
8db52e238e6218f09582d72cf1ead70d

SHA1
022a91d87a1d6ca747bb3d8e2754cc7e7207a855

SHA256
04b908525f553dc7bc4640fcb2839eaae417f683e520d1fc95c140a43acf4f34

SHA512
ce6a77c62e6de7aee0ae79d33d0e48d004442f3502672a82c1c03df4f1ecdbe28a33c32ba3af841e2029a5583831c3f62ae29e4129121fccee0b735cf5ad6048

Download Submit
C:\Users\Admin\AppData\Local\Temp\BW9P5S1AiNzG.bat

Filesize
199B

MD5
378d314b67d41fb4fb67ab15edfbae82

SHA1
59c29ae9d780d12dde141c7bf481aafbac171645

SHA256
bf6f0d44d70fbc9164499d1a342dd27c83296b4b4e9455a176c584500992cea7

SHA512
da502d6f98449cf9f25a163d93e3fee09e094c89bbe6fbe5afba4fb40594e3592af5bf1063a44bf774e406134c8ac031914a4e3e099ee209c9ed4034d5023486

Download Submit
C:\Users\Admin\AppData\Local\Temp\GexkVIhK3xXY.bat

Filesize
199B

MD5
33241f6dfe1c7f2f0eef27b0021eb6d0

SHA1
611221f589939129dee13f99917cf1b90156fd47

SHA256
be91d0076b6b9391c3b11eee02500947d4882951f9157e2b206316606cc264b1

SHA512
52b649ab47b52509181c3d62a42ad9045e47279de787c1ce20e779beac45168a3a812dfb15c8a8dc400ed80bb7704e31e116d8e1ae36855e37b67ffe4f0f8a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\IAEZShmWVYtV.bat

Filesize
199B

MD5
4a959d594d812f1a7b7fe5d288ccf268

SHA1
3d45358cd0351caa5e5500d1dda094ce263b5271

SHA256
78188abc546f0f3ba27fefeb22330cf174bd2a5e42f1810cae37ba8b8daf7cf7

SHA512
7407aae15ebc6846e3075098752c485e4c32e1751f3b940c17d2b27107fd60e4ed30508f0969b4d932d2dd7ba09e6dd261856ba99343d60822b4c6fe8fd6644d

Download Submit
C:\Users\Admin\AppData\Local\Temp\UfcaJxd0a9oD.bat

Filesize
199B

MD5
33951cb4f940261071a727cdbcd2f58c

SHA1
1adb641d8170b09fee9a02cedab4c8a5d6cdae25

SHA256
f6f1df11af6280a0c5881702ee254495930aa03e074dfc7dedf039e75baf9af6

SHA512
0bb453fa0f74283c68ca1e5604b250daaf7a565e57fe571c40a7b2df96751ebfa553e90a3dc964b4ea01e8954e271ad60d0681d686b234cb1ddb3c97c2fdfda9

Download Submit
C:\Users\Admin\AppData\Local\Temp\a0GWgT5i7hMZ.bat

Filesize
199B

MD5
502e7adc7931ee7f5ce89f56bded3133

SHA1
7c9aaa1459e04b2d4e39b3035ee3ff7b5bee35fe

SHA256
3a5aa178a0920d1fc6146312730a616c3699551ee4aae0da99545afb3edb4b02

SHA512
4b8d6b8f7c9f9c95c365ba16cf01012e846d4017c8eca75652c74921f7b6fe4f97c4cd1bd892c42ea520ac210396fb7c1be424ccca664ffde38a99292f898e8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nGH0A02DbtAN.bat

Filesize
199B

MD5
40475359a453ea0e5365570daf9a4864

SHA1
59118bc6e73fc8e480f541cd02fec840195d8496

SHA256
dcf5486eefb7fef3498801f3faf81581d321f7f0341d71a9b3b69d5d7181c471

SHA512
bddc2581843be4e930b34b0d2a1aea4cda1bed0d28ef4f7046293c27a6e0a6b6c13f3d5de84f4e497c6bf6e0c408d9a4ec271a6a3960fb83f5db39c7d03e3e32

Download Submit
C:\Users\Admin\AppData\Local\Temp\oM18XswOMLLm.bat

Filesize
199B

MD5
c41318e697f601a5c8f09af9c1a7a138

SHA1
3f0d5deba65f3bed3c38e3e95210e4fcc021fc4a

SHA256
2f4afc6e2ddd780752383f166f8880453e3f4c19a4c9b3202b2ea8293cb9575c

SHA512
c2718d177cce1427ceb9c093b2f17ec30d0b90e4ffe34c41f74e8ed549632a7f1a4d2104e64eab1636248048fb9ef95956d68c3a522ce3df0b9f4c4e85287e50

Download Submit
C:\Users\Admin\AppData\Local\Temp\obUrJqUq3PuM.bat

Filesize
199B

MD5
48cee536ff89f3e2aef238d5e4626791

SHA1
ad5a4eec0fd61e314c5c694678519a028726e513

SHA256
aa4cd650fcea3a486c517d7587fc39742b10785426a72f06e24092b74f4ef346

SHA512
b94bd4781747ea344ff30ab5f7b49060c73268b86aab6c50bcff6d318f20a68444aa09906e98d8bf62041f99133d182d0f70795969918cf12395225870a2a14b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pgGUtJRnKk5C.bat

Filesize
199B

MD5
e5602e39c8ea5d37d7f90fefa52fdac2

SHA1
340001fdc7dc51592d0df242eb13c4f1046c24a1

SHA256
30d7f7318eb9b10a5c5f1611989a27778f13550cb1a2e612e1413ebeb8f1e678

SHA512
8fd67c97b87500a7c7a79e1f99eb16aeb48b49997f275a3f0ca8ee26798bd3b5b430b6d010f9ed1c4417ed2724a270ec1b6e671860bd5fb14b990d051b671dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\sotTpRJzBPzm.bat

Filesize
199B

MD5
208060fbf05e5c5b4eb9568dfe887e00

SHA1
52cd760bc1772f26da7bdf0c2ce015cd0c460605

SHA256
b31e86331adf48ed8175524acf3d43df84f807868eece25ab8bc53dbcca7c773

SHA512
aee1a6a1a3f8b18d6dd2b6729cb04b30111d43f825b5c340fbe87aa1e15e81457f5fed36fc489ff7f9c8e5ded4c46472a154a7499fa713fc574514bf11d82e14

Download Submit
C:\Users\Admin\AppData\Local\Temp\swBJ9t4NFXIR.bat

Filesize
199B

MD5
8b0948b5ea703935955cce0ce8868647

SHA1
00da9bc023d5f0556957fe3858db7d57044a483f

SHA256
71effa7e658fd4557bb30bc2142b0b94277816b877c68fdbecd1d015b564edd6

SHA512
54e818d9f28a6993759d0ab143386627ac76a0bf64e73d4966b368ba93b632c0ab11da0b187fb7134384aeb737b6b124a01bc4e46fb7ec776e6abce45b433929

Download Submit
C:\Users\Admin\AppData\Local\Temp\ug1YiczenXvZ.bat

Filesize
199B

MD5
68e5c5372a5880718a7180096d1efc1a

SHA1
0490ae10071d4e2f8023fdbdec5b1ac62d1d8503

SHA256
86acf996b18f940eb8017a2121d095a0c791f72df8ffb6735254c20f34fbc2c5

SHA512
f36913fe51f96ab324a3b567ef40459a1b907fbc0cbc576cba94d075d8b051c06d0ec8f267b24c61ee4cdf24a00324b60efd6c2717a692982e5a3b1a46104177

Download Submit
C:\Windows\system32\windows\explorer.exe

Filesize
502KB

MD5
bf1f011e9664823aeb1c386eeb9e5c90

SHA1
3a15112a330446b895811549a857d0d92763cf1a

SHA256
412693c6a8fa7142d55bdca7f0473ba66582155399b49f7eacee55f4d78dfd7a

SHA512
584dfe97edefc6c8f8d96a3589fbf84701846a16f6c71625772c3a56763bb51303c476c808f9e68c55899f5e61ee2a98f7805f54703b62838b8cc9b65715bb44

Download Submit
memory/1184-0-0x00000000006C0000-0x0000000000744000-memory.dmp

Filesize
528KB

Download
memory/1184-2-0x00007FFF47190000-0x00007FFF47C51000-memory.dmp

Filesize
10.8MB

Download
memory/1184-1-0x00007FFF47193000-0x00007FFF47195000-memory.dmp

Filesize
8KB

Download
memory/1184-9-0x00007FFF47190000-0x00007FFF47C51000-memory.dmp

Filesize
10.8MB

Download
memory/2828-10-0x00007FFF47190000-0x00007FFF47C51000-memory.dmp

Filesize
10.8MB

Download
memory/2828-8-0x00007FFF47190000-0x00007FFF47C51000-memory.dmp

Filesize
10.8MB

Download
memory/2828-17-0x00007FFF47190000-0x00007FFF47C51000-memory.dmp

Filesize
10.8MB

Download
memory/2828-11-0x000000001B640000-0x000000001B690000-memory.dmp

Filesize
320KB

Download
memory/2828-12-0x000000001B750000-0x000000001B802000-memory.dmp

Filesize
712KB

Download
memory/4480-41-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download
memory/4480-48-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download
memory/4480-49-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download
memory/4480-50-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download
memory/4480-51-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download
memory/4480-52-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download
memory/4480-53-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download
memory/4480-47-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download
memory/4480-43-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download
memory/4480-42-0x0000021F08640000-0x0000021F08641000-memory.dmp

Filesize
4KB

Download