quasar | 018f75f18b882044109f250f19da654c0b3bd90430b318fcb03348908a189aae

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

loadervmp.exe
Size

409KB
MD5

14f056491baaed04872533c2d9648d46
SHA1

c48b08d0e9064f2d060f19474bb54cf3c5a25586
SHA256

018f75f18b882044109f250f19da654c0b3bd90430b318fcb03348908a189aae
SHA512

c109b1a9cf40049f8958beab9cff112cb326dd719c56f6dedafda4cf3a64d3faae3912f34cbcc1ee203a0316e40b8f7016624f05a1ad6c93bbaa0bdc9dc79b08
SSDEEP

6144:rMvlpdRJjGq/ldSTTIgiGwo9W0MFMJyb7+Ye0SmxalGcqwL6Ir4H9VI:EpbJjGu/STTIwJWIJgG0jFCRsH9VI

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
ZJpQQkxTrak9Zs9tUOQW
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT 5 IoCs
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Processes:

schtasks.exe

flow ioc

16 ip-api.com
51 ip-api.com
62 ip-api.com
83 ip-api.com
1388 schtasks.exe

flow	ioc
16	ip-api.com
51	ip-api.com
62	ip-api.com
83	ip-api.com
1388	schtasks.exe

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2456-1-0x0000000000510000-0x000000000057C000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 8 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

pid process

2764 Client.exe
1860 Client.exe
2116 Client.exe
2276 Client.exe
2220 Client.exe
4920 Client.exe
1400 Client.exe
2264 Client.exe
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

83 ip-api.com
16 ip-api.com
51 ip-api.com
62 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2764	Client.exe
1860	Client.exe
2116	Client.exe
2276	Client.exe
2220	Client.exe
4920	Client.exe
1400	Client.exe
2264	Client.exe

flow	ioc
83	ip-api.com
16	ip-api.com
51	ip-api.com
62	ip-api.com

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
624	2764	WerFault.exe	Client.exe
2768	1860	WerFault.exe	Client.exe
2660	2116	WerFault.exe	Client.exe
3436	2276	WerFault.exe	Client.exe
3296	2220	WerFault.exe	Client.exe
3596	4920	WerFault.exe	Client.exe
636	1400	WerFault.exe	Client.exe
1124	2264	WerFault.exe	Client.exe

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeSCHTASKS.exeschtasks.exeschtasks.exe

pid	process
1732	schtasks.exe
624	schtasks.exe
2208	schtasks.exe
5092	schtasks.exe
4408	schtasks.exe
3912	schtasks.exe
1388	schtasks.exe
4560	SCHTASKS.exe
1164	schtasks.exe
3580	schtasks.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

1764 PING.EXE
5056 PING.EXE
2948 PING.EXE
4020 PING.EXE
2204 PING.EXE
1684 PING.EXE
4864 PING.EXE
3552 PING.EXE

pid	process
1764	PING.EXE
5056	PING.EXE
2948	PING.EXE
4020	PING.EXE
2204	PING.EXE
1684	PING.EXE
4864	PING.EXE
3552	PING.EXE

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

loadervmp.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	2456	loadervmp.exe
Token: SeDebugPrivilege	2764	Client.exe
Token: SeDebugPrivilege	1860	Client.exe
Token: SeDebugPrivilege	2116	Client.exe
Token: SeDebugPrivilege	2276	Client.exe
Token: SeDebugPrivilege	2220	Client.exe
Token: SeDebugPrivilege	4920	Client.exe
Token: SeDebugPrivilege	1400	Client.exe
Token: SeDebugPrivilege	2264	Client.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

pid process

2764 Client.exe
1860 Client.exe
2116 Client.exe
2276 Client.exe
2220 Client.exe
4920 Client.exe
1400 Client.exe
2264 Client.exe

pid	process
2764	Client.exe
1860	Client.exe
2116	Client.exe
2276	Client.exe
2220	Client.exe
4920	Client.exe
1400	Client.exe
2264	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

loadervmp.exeClient.execmd.exeClient.execmd.exeClient.execmd.exeClient.execmd.exe

description	pid	process	target process
PID 2456 wrote to memory of 1388	2456	loadervmp.exe	schtasks.exe
PID 2456 wrote to memory of 1388	2456	loadervmp.exe	schtasks.exe
PID 2456 wrote to memory of 1388	2456	loadervmp.exe	schtasks.exe
PID 2456 wrote to memory of 2764	2456	loadervmp.exe	Client.exe
PID 2456 wrote to memory of 2764	2456	loadervmp.exe	Client.exe
PID 2456 wrote to memory of 2764	2456	loadervmp.exe	Client.exe
PID 2456 wrote to memory of 4560	2456	loadervmp.exe	SCHTASKS.exe
PID 2456 wrote to memory of 4560	2456	loadervmp.exe	SCHTASKS.exe
PID 2456 wrote to memory of 4560	2456	loadervmp.exe	SCHTASKS.exe
PID 2764 wrote to memory of 1164	2764	Client.exe	schtasks.exe
PID 2764 wrote to memory of 1164	2764	Client.exe	schtasks.exe
PID 2764 wrote to memory of 1164	2764	Client.exe	schtasks.exe
PID 2764 wrote to memory of 3572	2764	Client.exe	cmd.exe
PID 2764 wrote to memory of 3572	2764	Client.exe	cmd.exe
PID 2764 wrote to memory of 3572	2764	Client.exe	cmd.exe
PID 3572 wrote to memory of 656	3572	cmd.exe	chcp.com
PID 3572 wrote to memory of 656	3572	cmd.exe	chcp.com
PID 3572 wrote to memory of 656	3572	cmd.exe	chcp.com
PID 3572 wrote to memory of 3552	3572	cmd.exe	PING.EXE
PID 3572 wrote to memory of 3552	3572	cmd.exe	PING.EXE
PID 3572 wrote to memory of 3552	3572	cmd.exe	PING.EXE
PID 3572 wrote to memory of 1860	3572	cmd.exe	Client.exe
PID 3572 wrote to memory of 1860	3572	cmd.exe	Client.exe
PID 3572 wrote to memory of 1860	3572	cmd.exe	Client.exe
PID 1860 wrote to memory of 1732	1860	Client.exe	schtasks.exe
PID 1860 wrote to memory of 1732	1860	Client.exe	schtasks.exe
PID 1860 wrote to memory of 1732	1860	Client.exe	schtasks.exe
PID 1860 wrote to memory of 2136	1860	Client.exe	cmd.exe
PID 1860 wrote to memory of 2136	1860	Client.exe	cmd.exe
PID 1860 wrote to memory of 2136	1860	Client.exe	cmd.exe
PID 2136 wrote to memory of 820	2136	cmd.exe	chcp.com
PID 2136 wrote to memory of 820	2136	cmd.exe	chcp.com
PID 2136 wrote to memory of 820	2136	cmd.exe	chcp.com
PID 2136 wrote to memory of 1764	2136	cmd.exe	PING.EXE
PID 2136 wrote to memory of 1764	2136	cmd.exe	PING.EXE
PID 2136 wrote to memory of 1764	2136	cmd.exe	PING.EXE
PID 2136 wrote to memory of 2116	2136	cmd.exe	Client.exe
PID 2136 wrote to memory of 2116	2136	cmd.exe	Client.exe
PID 2136 wrote to memory of 2116	2136	cmd.exe	Client.exe
PID 2116 wrote to memory of 3580	2116	Client.exe	schtasks.exe
PID 2116 wrote to memory of 3580	2116	Client.exe	schtasks.exe
PID 2116 wrote to memory of 3580	2116	Client.exe	schtasks.exe
PID 2116 wrote to memory of 4508	2116	Client.exe	cmd.exe
PID 2116 wrote to memory of 4508	2116	Client.exe	cmd.exe
PID 2116 wrote to memory of 4508	2116	Client.exe	cmd.exe
PID 4508 wrote to memory of 1768	4508	cmd.exe	chcp.com
PID 4508 wrote to memory of 1768	4508	cmd.exe	chcp.com
PID 4508 wrote to memory of 1768	4508	cmd.exe	chcp.com
PID 4508 wrote to memory of 5056	4508	cmd.exe	PING.EXE
PID 4508 wrote to memory of 5056	4508	cmd.exe	PING.EXE
PID 4508 wrote to memory of 5056	4508	cmd.exe	PING.EXE
PID 4508 wrote to memory of 2276	4508	cmd.exe	Client.exe
PID 4508 wrote to memory of 2276	4508	cmd.exe	Client.exe
PID 4508 wrote to memory of 2276	4508	cmd.exe	Client.exe
PID 2276 wrote to memory of 624	2276	Client.exe	schtasks.exe
PID 2276 wrote to memory of 624	2276	Client.exe	schtasks.exe
PID 2276 wrote to memory of 624	2276	Client.exe	schtasks.exe
PID 2276 wrote to memory of 3812	2276	Client.exe	cmd.exe
PID 2276 wrote to memory of 3812	2276	Client.exe	cmd.exe
PID 2276 wrote to memory of 3812	2276	Client.exe	cmd.exe
PID 3812 wrote to memory of 3868	3812	cmd.exe	chcp.com
PID 3812 wrote to memory of 3868	3812	cmd.exe	chcp.com
PID 3812 wrote to memory of 3868	3812	cmd.exe	chcp.com
PID 3812 wrote to memory of 2948	3812	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\loadervmp.exe
"C:\Users\Admin\AppData\Local\Temp\loadervmp.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\loadervmp.exe" /rl HIGHEST /f
2⤵
- Quasar RAT
- Creates scheduled task(s)
PID:1388

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1164

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zEDj8q08ZknI.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3572

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:656

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:3552

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:1732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o4VnZ41Hpm8l.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:2136

C:\Windows\SysWOW64\chcp.com
chcp 65001
6⤵
PID:820

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:1764

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:3580

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gtn3ZH1ksvvG.bat" "
7⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\SysWOW64\chcp.com
chcp 65001
8⤵
PID:1768

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:5056

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:624

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g6GCpdswt7Bc.bat" "
9⤵
- Suspicious use of WriteProcessMemory
PID:3812

C:\Windows\SysWOW64\chcp.com
chcp 65001
10⤵
PID:3868

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:2948

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2220

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
11⤵
- Creates scheduled task(s)
PID:5092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3kp1QalHnTsT.bat" "
11⤵
PID:1732

C:\Windows\SysWOW64\chcp.com
chcp 65001
12⤵
PID:4168

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
12⤵
- Runs ping.exe
PID:4020

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4920

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
13⤵
- Creates scheduled task(s)
PID:4408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tgIJhfxoJNcD.bat" "
13⤵
PID:3504

C:\Windows\SysWOW64\chcp.com
chcp 65001
14⤵
PID:888

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
14⤵
- Runs ping.exe
PID:2204

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1400

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
15⤵
- Creates scheduled task(s)
PID:2208

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WzQ5w6hYA0il.bat" "
15⤵
PID:624

C:\Windows\SysWOW64\chcp.com
chcp 65001
16⤵
PID:4844

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
16⤵
- Runs ping.exe
PID:1684

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2264

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
17⤵
- Creates scheduled task(s)
PID:3912

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y0YzCHmdWLIi.bat" "
17⤵
PID:2032

C:\Windows\SysWOW64\chcp.com
chcp 65001
18⤵
PID:1224

C:\Windows\SysWOW64\PING.EXE
ping -n 10 localhost
18⤵
- Runs ping.exe
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 1652
17⤵
- Program crash
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1704
15⤵
- Program crash
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 2492
13⤵
- Program crash
PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 1712
11⤵
- Program crash
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 1640
9⤵
- Program crash
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 1700
7⤵
- Program crash
PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1704
5⤵
- Program crash
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 1972
3⤵
- Program crash
PID:624

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77loadervmp.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\loadervmp.exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2764 -ip 2764
1⤵
PID:1320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1860 -ip 1860
1⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3888 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2116 -ip 2116
1⤵
PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2276 -ip 2276
1⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2220 -ip 2220
1⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4920 -ip 4920
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1400 -ip 1400
1⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2264 -ip 2264
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3kp1QalHnTsT.bat

Filesize
207B

MD5
456bbba91d9b27bcac78413ab8607df4

SHA1
3d3f5ad48c835d206d72507054b0b104a9b61a2f

SHA256
efa804ebe051f5fa5d62cbe19374316b728177c94e6954a389ac38524778899a

SHA512
e288b74178fb23f758335f385d4a2bb0f483771125ba7656f82e92087a00a30a716ba273fbda1fd6f4d9c0433152227f8b27a654bb5f43ee70d037b692d7a820

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gtn3ZH1ksvvG.bat

Filesize
207B

MD5
a504778c1a7c153e7c2502c2fa0f64d0

SHA1
66f95c5c3e5246f3fd50c2245dc4fbc3445fc750

SHA256
3d768395bad47b4445d3325cb51043971acc4da7cf9391a35bb2d223d23280f2

SHA512
1db63ffb1bb2b339dc3e43c62d435a0645002a3434fad8d4869902d70bef5d4fce2df8bd03c800076fb4ae6ae17d86c2c7827901a65cd0e9c2fdc4692fda9d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\WzQ5w6hYA0il.bat

Filesize
207B

MD5
c150ce6ae974e81165126c0ee9098969

SHA1
70bb92d297d2e7b7f3aaca50d3ab1e354c392b75

SHA256
5d20de9db9d924f7b41ca6250a6f64348b8f1f990bd3a01c4ae5e30f70d7de7d

SHA512
53072f39467744edcdda2aa6b720933720b4223d52502c00ab7b151dd6b2d588562829872e5472a97f8405c96b027386abf3f70a2af21e0ac9efa17a53978403

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y0YzCHmdWLIi.bat

Filesize
207B

MD5
52b7aaecd9a7126706024a4176d64407

SHA1
5671c3f7fb4b371058f76c61c97386404cecd0f6

SHA256
be45579658f937e02c5437e1e9394a50bee90b65abecc0bd69a5694c766f0383

SHA512
addd78cac2a08db82aa2e9bdc65fa19e4a83947d7fe68efe0134731239df35fc3ffa8dc8d4491db52fec829869d1e1f5f0db119649f8ce326e3c9173e5450c22

Download Submit
C:\Users\Admin\AppData\Local\Temp\g6GCpdswt7Bc.bat

Filesize
207B

MD5
f4704bff11bfd059a03c096ac2148bf1

SHA1
337f3f7023d5fadf8e8cbc3e1707e7ff31e7ac72

SHA256
ff48049e3ddc81d873c0a0c4f27ca006b47c4f1137fb38f3e27463cf26acd240

SHA512
a9deef5e044821cec8b81211466260a026546d84203cf62447df56846a28ccc4a614bef95eb65a82472a40b0d8866723302e562dc1758ab8c95a6b42dd092f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\o4VnZ41Hpm8l.bat

Filesize
207B

MD5
ddb83e14837a214ccaad63d818b2b443

SHA1
21b5214733b7ffc786d6f0e5f182e8c4c54ec0cd

SHA256
762866bf40cf53175be07951ad5381842ffd676a90107dc6130b422af46cc3da

SHA512
3ac11441c3b5905272f132669e39df28d42fd8c0b02f5b751919ab2d9ad404c45488166c51edc770e02bcb3764e9f0cd69a26a9bffb5c6b50b123175a222b2bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\tgIJhfxoJNcD.bat

Filesize
207B

MD5
2d2ea4853ebd8f3f34cc2944a7ea4094

SHA1
cf03c4c4b459dc0cd0d3a8a6f9a1d1a326a2cbca

SHA256
42d473a5fbb853d85a89c9ed164da2baa49ece64f56950ed2cce6b184437b7db

SHA512
2f0e614e81d8cfa4d7470b27f92394abdada9b4c2a3e339244c45b3d02909a1c6bfb43a1c856d74dc96ec34b1babd7f6fc8e1263f10d713ec4cc44084a1089e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zEDj8q08ZknI.bat

Filesize
207B

MD5
66f2c46c42e4f9ef1815d6fc281226fc

SHA1
eeb5a7522875f448edc1982337a8a5aba5315817

SHA256
4e989d0a5afe1e0b93239e6928164475761de6bd37ed8393b05241a292a3b9ab

SHA512
e0261f0be1b3d908c5defa0f42c1a821877ab579a1661564bf59c7846022ba37a716350abdb19bab7fab69e992564a9d0725efa825771739b790921ccec7d86f

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\05-31-2024

Filesize
224B

MD5
f334426ff95cfe7c314c5e35a0e9cb9c

SHA1
3d4a75114a51dfa116d189b36fae1956eec4b837

SHA256
5294275f65af7cbcd1fa6bbf84b96195fead89cce03ce36c7bf70bc02716d0be

SHA512
41040fa36ef88d6f2257fcde185731aec9b53164edcaacb5da54cde36b936a40dc15a184f29e014ec55240dc82163fd929e51638cbf9b394202dade2d75af198

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\05-31-2024

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\05-31-2024

Filesize
224B

MD5
ecefc43d8410db3338d206de00e4ca5c

SHA1
fb3d728006b5642cdf10e703e6f1a98776843de6

SHA256
de095d1f4dd77d24a4208500fd91fa600b99a1821197c219d44df431b6e3a425

SHA512
5d7b004e6f4c49b482aef08eaa0c0cb3ea2b4a2732283c3cac6869b5f208486dc3d4b68d4a663c17da4f5af1e87d631c82d8126bf44419354f2c790e322f8521

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\05-31-2024

Filesize
224B

MD5
b11c1ca5585ae930a708797a915f7138

SHA1
e5bc3f634977a661c8b5c8a06a8fb7c1c23c4c05

SHA256
625e29dc2a6f76f87317c434a361a423ad6b801cf04a1d260850926b521bdd46

SHA512
64b9751c0211fa9d74895e9fa40dd3fbc77fa643205e9641f4087b301ae75891a1fc6fb321ac47328ce005942fd010d500b0fcbc363f02999717166871e43bd8

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\05-31-2024

Filesize
224B

MD5
90dc5a9ab436e4ff7c51c2faea64bdf7

SHA1
2d41c6e796aa89a5b62a44016f35c9b18744e34b

SHA256
c33411fbc9125a9185645db2f4a9642db15604dfbd5e57c6bb6bc89de6d7ef3c

SHA512
676701180a6ba68fa4880660ce806d8658d4c0798d46d80167ea82d8adcf5ba40ec48d9edbd284cf0d7ae8ec984d10e90fbc63e940fbcdb48316781089ff8d77

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\05-31-2024

Filesize
224B

MD5
b4cafec7e47afbb8726531ca0c6ad113

SHA1
1da72cc0b6754810f395c8aa8af120f4045aaf78

SHA256
7f181340bea073131eaac37a6f4b6a4cdac761499d2756bd8894a4f0dd471d49

SHA512
fcc70d5748db46a35ff32e300db5c28d14eb4be56c845ef1a301e53c9b379055cc904f3770dcbc1fa2dddf95456555cfb87de4d9416de54475b04fcc6dccf45a

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\05-31-2024

Filesize
224B

MD5
66d63bc414ac754fe0757bdbeca292b2

SHA1
fc181415c2ef798aa49dea151f398c58afc9c074

SHA256
02e833ebf879f3cf9661fe6c283b2405ff889a3d620563b25f7979b5d3c72b9a

SHA512
f48ad0cc8da209c86060f82ce21c59468f2c082c60a7ab36e4ab06ed269f60276fd5a7aeeeed9dcb49cd19e1710cd85cef81b19954efd39927bcac4fb44e31a0

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
409KB

MD5
14f056491baaed04872533c2d9648d46

SHA1
c48b08d0e9064f2d060f19474bb54cf3c5a25586

SHA256
018f75f18b882044109f250f19da654c0b3bd90430b318fcb03348908a189aae

SHA512
c109b1a9cf40049f8958beab9cff112cb326dd719c56f6dedafda4cf3a64d3faae3912f34cbcc1ee203a0316e40b8f7016624f05a1ad6c93bbaa0bdc9dc79b08

Download Submit
memory/2456-7-0x0000000006510000-0x000000000654C000-memory.dmp

Filesize
240KB

Download
memory/2456-16-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/2456-0-0x0000000074DCE000-0x0000000074DCF000-memory.dmp

Filesize
4KB

Download
memory/2456-6-0x00000000060D0000-0x00000000060E2000-memory.dmp

Filesize
72KB

Download
memory/2456-5-0x0000000005030000-0x0000000005096000-memory.dmp

Filesize
408KB

Download
memory/2456-4-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/2456-3-0x0000000004F90000-0x0000000005022000-memory.dmp

Filesize
584KB

Download
memory/2456-2-0x0000000005540000-0x0000000005AE4000-memory.dmp

Filesize
5.6MB

Download
memory/2456-1-0x0000000000510000-0x000000000057C000-memory.dmp

Filesize
432KB

Download
memory/2764-23-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/2764-18-0x0000000006D40000-0x0000000006D4A000-memory.dmp

Filesize
40KB

Download
memory/2764-14-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download
memory/2764-13-0x0000000074DC0000-0x0000000075570000-memory.dmp

Filesize
7.7MB

Download