Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02-06-2024 21:27
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240404-en
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
dc3f5eebf8ab3dd6fef8b51610d2c356
-
SHA1
0847d42da980bafd989804386b0889c1ceb5a869
-
SHA256
3120f15238f08b384ec85504c2ddbbc06a5b8a3f13e5e2551a6f7ad916144e49
-
SHA512
03dd71d93e48e195af52d3b51b73e6d8896b2e67d7cb7ced3cdb2db00623032bb7e8e35a71c7c5903d6d473ad057297da0eca8664e48012ebe5e4cf6fe547f7d
-
SSDEEP
49152:bvCI22SsaNYfdPBldt698dBcjHZKxNESE9k/ikLoGdwTHHB72eh2NT:bvP22SsaNYfdPBldt6+dBcjHAxgq
Malware Config
Extracted
quasar
1.4.1
RAT - fake incognito
192.168.4.30:4782
d94dce9f-b2a7-4e68-b727-6888151a6b4e
-
encryption_key
40B0884053AA1A1D9985C8E042F5C321462F78A6
-
install_name
Incognito.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Incognito
-
subdirectory
SubDir
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2316-1-0x0000000000860000-0x0000000000B84000-memory.dmp family_quasar C:\Windows\System32\SubDir\Incognito.exe family_quasar -
Executes dropped EXE 15 IoCs
Processes:
Incognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exepid process 3408 Incognito.exe 4820 Incognito.exe 3600 Incognito.exe 1792 Incognito.exe 2260 Incognito.exe 224 Incognito.exe 3012 Incognito.exe 2484 Incognito.exe 4496 Incognito.exe 3796 Incognito.exe 3360 Incognito.exe 4868 Incognito.exe 2136 Incognito.exe 3412 Incognito.exe 2184 Incognito.exe -
Drops file in System32 directory 33 IoCs
Processes:
Incognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeClient-built.exeIncognito.exeIncognito.exedescription ioc process File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File created C:\Windows\system32\SubDir\Incognito.exe Client-built.exe File opened for modification C:\Windows\system32\SubDir Client-built.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Client-built.exe File opened for modification C:\Windows\system32\SubDir Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe File opened for modification C:\Windows\system32\SubDir\Incognito.exe Incognito.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 16 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 592 schtasks.exe 4240 schtasks.exe 5112 schtasks.exe 3348 schtasks.exe 3488 schtasks.exe 3140 schtasks.exe 2264 schtasks.exe 3932 schtasks.exe 380 schtasks.exe 4400 schtasks.exe 1220 schtasks.exe 2280 schtasks.exe 3468 schtasks.exe 4708 schtasks.exe 3028 schtasks.exe 2296 schtasks.exe -
Runs ping.exe 1 TTPs 15 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 4624 PING.EXE 4828 PING.EXE 828 PING.EXE 2268 PING.EXE 1052 PING.EXE 1232 PING.EXE 3832 PING.EXE 1672 PING.EXE 4860 PING.EXE 2824 PING.EXE 4120 PING.EXE 2892 PING.EXE 3184 PING.EXE 4592 PING.EXE 4236 PING.EXE -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
Client-built.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exedescription pid process Token: SeDebugPrivilege 2316 Client-built.exe Token: SeDebugPrivilege 3408 Incognito.exe Token: SeDebugPrivilege 4820 Incognito.exe Token: SeDebugPrivilege 3600 Incognito.exe Token: SeDebugPrivilege 1792 Incognito.exe Token: SeDebugPrivilege 2260 Incognito.exe Token: SeDebugPrivilege 224 Incognito.exe Token: SeDebugPrivilege 3012 Incognito.exe Token: SeDebugPrivilege 2484 Incognito.exe Token: SeDebugPrivilege 4496 Incognito.exe Token: SeDebugPrivilege 3796 Incognito.exe Token: SeDebugPrivilege 3360 Incognito.exe Token: SeDebugPrivilege 4868 Incognito.exe Token: SeDebugPrivilege 2136 Incognito.exe Token: SeDebugPrivilege 3412 Incognito.exe Token: SeDebugPrivilege 2184 Incognito.exe -
Suspicious use of FindShellTrayWindow 15 IoCs
Processes:
Incognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exepid process 3408 Incognito.exe 4820 Incognito.exe 3600 Incognito.exe 1792 Incognito.exe 2260 Incognito.exe 224 Incognito.exe 3012 Incognito.exe 2484 Incognito.exe 4496 Incognito.exe 3796 Incognito.exe 3360 Incognito.exe 4868 Incognito.exe 2136 Incognito.exe 3412 Incognito.exe 2184 Incognito.exe -
Suspicious use of SendNotifyMessage 15 IoCs
Processes:
Incognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exepid process 3408 Incognito.exe 4820 Incognito.exe 3600 Incognito.exe 1792 Incognito.exe 2260 Incognito.exe 224 Incognito.exe 3012 Incognito.exe 2484 Incognito.exe 4496 Incognito.exe 3796 Incognito.exe 3360 Incognito.exe 4868 Incognito.exe 2136 Incognito.exe 3412 Incognito.exe 2184 Incognito.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Client-built.exeIncognito.execmd.exeIncognito.execmd.exeIncognito.execmd.exeIncognito.execmd.exeIncognito.execmd.exeIncognito.execmd.exedescription pid process target process PID 2316 wrote to memory of 1220 2316 Client-built.exe schtasks.exe PID 2316 wrote to memory of 1220 2316 Client-built.exe schtasks.exe PID 2316 wrote to memory of 3408 2316 Client-built.exe Incognito.exe PID 2316 wrote to memory of 3408 2316 Client-built.exe Incognito.exe PID 3408 wrote to memory of 3932 3408 Incognito.exe schtasks.exe PID 3408 wrote to memory of 3932 3408 Incognito.exe schtasks.exe PID 3408 wrote to memory of 2740 3408 Incognito.exe cmd.exe PID 3408 wrote to memory of 2740 3408 Incognito.exe cmd.exe PID 2740 wrote to memory of 5068 2740 cmd.exe chcp.com PID 2740 wrote to memory of 5068 2740 cmd.exe chcp.com PID 2740 wrote to memory of 4624 2740 cmd.exe PING.EXE PID 2740 wrote to memory of 4624 2740 cmd.exe PING.EXE PID 2740 wrote to memory of 4820 2740 cmd.exe Incognito.exe PID 2740 wrote to memory of 4820 2740 cmd.exe Incognito.exe PID 4820 wrote to memory of 4708 4820 Incognito.exe schtasks.exe PID 4820 wrote to memory of 4708 4820 Incognito.exe schtasks.exe PID 4820 wrote to memory of 2084 4820 Incognito.exe cmd.exe PID 4820 wrote to memory of 2084 4820 Incognito.exe cmd.exe PID 2084 wrote to memory of 3612 2084 cmd.exe chcp.com PID 2084 wrote to memory of 3612 2084 cmd.exe chcp.com PID 2084 wrote to memory of 4592 2084 cmd.exe PING.EXE PID 2084 wrote to memory of 4592 2084 cmd.exe PING.EXE PID 2084 wrote to memory of 3600 2084 cmd.exe Incognito.exe PID 2084 wrote to memory of 3600 2084 cmd.exe Incognito.exe PID 3600 wrote to memory of 5112 3600 Incognito.exe schtasks.exe PID 3600 wrote to memory of 5112 3600 Incognito.exe schtasks.exe PID 3600 wrote to memory of 2456 3600 Incognito.exe cmd.exe PID 3600 wrote to memory of 2456 3600 Incognito.exe cmd.exe PID 2456 wrote to memory of 4144 2456 cmd.exe chcp.com PID 2456 wrote to memory of 4144 2456 cmd.exe chcp.com PID 2456 wrote to memory of 1672 2456 cmd.exe PING.EXE PID 2456 wrote to memory of 1672 2456 cmd.exe PING.EXE PID 2456 wrote to memory of 1792 2456 cmd.exe Incognito.exe PID 2456 wrote to memory of 1792 2456 cmd.exe Incognito.exe PID 1792 wrote to memory of 3348 1792 Incognito.exe schtasks.exe PID 1792 wrote to memory of 3348 1792 Incognito.exe schtasks.exe PID 1792 wrote to memory of 4508 1792 Incognito.exe cmd.exe PID 1792 wrote to memory of 4508 1792 Incognito.exe cmd.exe PID 4508 wrote to memory of 4376 4508 cmd.exe chcp.com PID 4508 wrote to memory of 4376 4508 cmd.exe chcp.com PID 4508 wrote to memory of 1052 4508 cmd.exe PING.EXE PID 4508 wrote to memory of 1052 4508 cmd.exe PING.EXE PID 4508 wrote to memory of 2260 4508 cmd.exe Incognito.exe PID 4508 wrote to memory of 2260 4508 cmd.exe Incognito.exe PID 2260 wrote to memory of 2280 2260 Incognito.exe schtasks.exe PID 2260 wrote to memory of 2280 2260 Incognito.exe schtasks.exe PID 2260 wrote to memory of 1960 2260 Incognito.exe cmd.exe PID 2260 wrote to memory of 1960 2260 Incognito.exe cmd.exe PID 1960 wrote to memory of 2480 1960 cmd.exe chcp.com PID 1960 wrote to memory of 2480 1960 cmd.exe chcp.com PID 1960 wrote to memory of 1232 1960 cmd.exe PING.EXE PID 1960 wrote to memory of 1232 1960 cmd.exe PING.EXE PID 1960 wrote to memory of 224 1960 cmd.exe Incognito.exe PID 1960 wrote to memory of 224 1960 cmd.exe Incognito.exe PID 224 wrote to memory of 3488 224 Incognito.exe schtasks.exe PID 224 wrote to memory of 3488 224 Incognito.exe schtasks.exe PID 224 wrote to memory of 5056 224 Incognito.exe cmd.exe PID 224 wrote to memory of 5056 224 Incognito.exe cmd.exe PID 5056 wrote to memory of 1384 5056 cmd.exe chcp.com PID 5056 wrote to memory of 1384 5056 cmd.exe chcp.com PID 5056 wrote to memory of 4828 5056 cmd.exe PING.EXE PID 5056 wrote to memory of 4828 5056 cmd.exe PING.EXE PID 5056 wrote to memory of 3012 5056 cmd.exe Incognito.exe PID 5056 wrote to memory of 3012 5056 cmd.exe Incognito.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JN76SdETu3rG.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uU8uJWzQcOM6.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f7⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rZwmravyStQ5.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f9⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u4KEaWuBHKEf.bat" "9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f11⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldoxH5Rsb8CP.bat" "11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f13⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKm5U8eOMGQA.bat" "13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f15⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WEuKlRyG4gjg.bat" "15⤵
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f17⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MCs1x98FcSI5.bat" "17⤵
-
C:\Windows\system32\chcp.comchcp 6500118⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f19⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hr3Q3uWaXRM3.bat" "19⤵
-
C:\Windows\system32\chcp.comchcp 6500120⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f21⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GWhgGZY9929P.bat" "21⤵
-
C:\Windows\system32\chcp.comchcp 6500122⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f23⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QOIGB96wvuAu.bat" "23⤵
-
C:\Windows\system32\chcp.comchcp 6500124⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost24⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f25⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\14FqBe2vi8uk.bat" "25⤵
-
C:\Windows\system32\chcp.comchcp 6500126⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost26⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f27⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c5iUU9A9JiBc.bat" "27⤵
-
C:\Windows\system32\chcp.comchcp 6500128⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost28⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f29⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aUptFhkM2ZOI.bat" "29⤵
-
C:\Windows\system32\chcp.comchcp 6500130⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost30⤵
- Runs ping.exe
-
C:\Windows\system32\SubDir\Incognito.exe"C:\Windows\system32\SubDir\Incognito.exe"30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f31⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cvyONHTJxvOO.bat" "31⤵
-
C:\Windows\system32\chcp.comchcp 6500132⤵
-
C:\Windows\system32\PING.EXEping -n 10 localhost32⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Incognito.exe.logFilesize
2KB
MD51dcda70572487b230bb9e47148a0946d
SHA106f9b414b54eb9a816d9b37a2b54c82a94197a05
SHA2569e6e954e3f620c078e96da9f741090719a3b6b282704a1e54942b683223de4ed
SHA5127de9c424f82129e049ca6830c6ae1f23489738d487999e773f1593494f1caddc9dd9c77f85c3a01e05ee37653de3ab17da8c3fdf75adc0c0c2fb38a938246179
-
C:\Users\Admin\AppData\Local\Temp\14FqBe2vi8uk.batFilesize
199B
MD52456f2015140fe9ad47400c3c750bc9f
SHA1eaa9d81da0f432f90e07e1b442cd73feb244f575
SHA256f1ed222bfdee0ed3d826461e9e4928d5d08f45c731b78489ae4f9f028c4987ca
SHA512f3199976879f97bf2d48ce4d3aecc6d792bfc8ea32a19d1c31867245197faccfeebcb4c23df83b3482cb63511c5b8ec2128cea2d52aba1e66329b02aa261fb89
-
C:\Users\Admin\AppData\Local\Temp\GWhgGZY9929P.batFilesize
199B
MD5ded5b017c12f4a3da1da96bea3909044
SHA1d5276cd206cb4b8496f23672df5f70c61bfa50d2
SHA25630022e1850da2caee917d799fba1afeba3aba2ca74e853bc266cf4f20e755973
SHA512c46c135f997143af5eece2e6ce014af66c276360ed3c6255ad60d157f6de407c1aedd8b06be881398021996fed5eac3688690777c1057bbeafefdfb9f98d8f9a
-
C:\Users\Admin\AppData\Local\Temp\Hr3Q3uWaXRM3.batFilesize
199B
MD571d476072ef9a503b55819c54ef85884
SHA1fdf58f72424e4701fc40f9d431d727f97048daac
SHA25625127509dfe01f0b6cbd0827acb7c18e91261160dc070d3d4825c6602cedefbe
SHA51202d010678722b7ccba9b36a311abafdadc19d8a2f06b2b598061e3a8641a8350c5bca7a117c2e942fad793ce8b3d69e84da143c829e26a20c4cdafe9887372d7
-
C:\Users\Admin\AppData\Local\Temp\JN76SdETu3rG.batFilesize
199B
MD56f34412a1507bf3e811ce9f4542501b5
SHA12b01f444ef505e59ea864425ce9781d1c7962db9
SHA256cf576bfe4cfe5cea789d2bf989544a64cd132fdb4cfbb6c4dc7ec68b2cdf1588
SHA51236fec24f0bc7dca603548a7d9a99713b91bc7b4ef71ee192fb4163e0d59ccd19d810945deb492adc87545000e9eb14271287ae92788fff890b03c0ab67d03576
-
C:\Users\Admin\AppData\Local\Temp\MCs1x98FcSI5.batFilesize
199B
MD5eef7ae56bceedb458c9aa324107cf88a
SHA18ffaea14f707086f7f39844a7f1dc04a5762c802
SHA256db9a06cb059fa284461aeba912b1350a1c62e619a8d17eb19f6a54850e9f576c
SHA5124714e7d3f5bcfccd872b4148d27ce52ae789e7e2f5b043196a95f36ee683dce8a206bf885ec19170de9b5d880a8e2c8c22aff734dc757ba270dbc98bba38a843
-
C:\Users\Admin\AppData\Local\Temp\PKm5U8eOMGQA.batFilesize
199B
MD582dbf5ed21566f38df8698e975145411
SHA132c1e5ad77c16de95d62138f6c5ae7d543e726fe
SHA256c3ddc63a3d44794ab566d34efa9f361ef145564812e82ac72a11e8fa4ac60eaa
SHA512e98a159ec4cfa9d0b62b47b9bb8c192aba09418aa276c1ffdd596b45e64910e555e88d83cdd3296a2c8f794c86bb69c9670834ee85b54a732111f8300e6016a8
-
C:\Users\Admin\AppData\Local\Temp\QOIGB96wvuAu.batFilesize
199B
MD596c666dfeb9c797eae923ccf5852bc52
SHA1d93afa1eff095a1b6cf2a067fb14240cae3ecb52
SHA2564eb8eaee573b1d7ef7b45fd568f300559e76b1ae71fd50ded04be9d2764b1a40
SHA5126addce310c750432fb2af3751b9c9e5b06d33d63239285f9757d76f78a8b6c3908eca740af80fd44c8d8efb59bca0cfc220d35e602a490c95e68aed1694bc7a3
-
C:\Users\Admin\AppData\Local\Temp\WEuKlRyG4gjg.batFilesize
199B
MD5c9a49878c2d8c0ecbe5a226780e36b32
SHA1b53b887321cd5fa1a37527ae7340ad1eed077508
SHA2560d574cd18a9210e94ea931ab7bab13ca4a1c7b65c857b2b2ee84bcbe40927b9e
SHA5127d3e9af6c4c0ad38b3cd0491f941ff60314160e73c807a90bbdf705876ce514e3b662f3f51ea09bdfad8032f334b2498521c7a52f58269115e7e0d15dbd1e397
-
C:\Users\Admin\AppData\Local\Temp\aUptFhkM2ZOI.batFilesize
199B
MD59477f353ea72085be9e1f944b5f59dfb
SHA181587ba8f8a35828c186c5fdf1b654117efb9527
SHA2566e6b20209d22038d52b391e5169c6a065e41e2e45df80e9f4b1068c6cc695a05
SHA51214453fb2c35595824835f6b47403b5c8f49ed0152c5921e4f2d027053e1dd3c361919dee22b344c5e25706dd270515ed816298f013039b64a11f18c8bcea7164
-
C:\Users\Admin\AppData\Local\Temp\c5iUU9A9JiBc.batFilesize
199B
MD5d561d26c518e04c0a2d2007f4ef727e7
SHA102f6cabda68b9d632e24fed4b4b251809502e6d4
SHA2562905f20474cbcca1b3e13cfe2340596e7d86d0e79ffde3ee76796d877705ebb5
SHA512c0a45fad92b34c387b4dc7f130a6e3be82e1ed341abf36796f7f8a2d4faf2389890d8159564fd56320895429a3a7c1d036e5c63256ab858c868f5dec221eb703
-
C:\Users\Admin\AppData\Local\Temp\cvyONHTJxvOO.batFilesize
199B
MD5e3801bdb0045358360734c11069a7750
SHA184dc5fae11f6fc4fa9e13b6d278cf8bfb350c301
SHA25617d2cd44f92816b8ce47961c51c6566ae082b0f3413fad55232edca9d8484d27
SHA5129fddcf9109774c2bbc21808ba2f8fcde13d41f3be119030407d995dfc557948ba3da86cb97a55ad2efcd6b8841c2ee3412cfe5764c99db2ca4b4208a837405fd
-
C:\Users\Admin\AppData\Local\Temp\ldoxH5Rsb8CP.batFilesize
199B
MD597dd9795f630dcbd9c7e17c82ebd231b
SHA1c99449614a4000eefedf4430c0e97b4749229ea2
SHA256fd41e812cc7c887f003065f8fed2eae016d978587402489949f6246f36f0f37d
SHA512f203a500f9c05a1fc794d3c5d908f7ceb7ede93f65a2db22f2d35b0dfafdadd38f155a67836af3bb169f664659c67a6a9edba410edabef5b1b7019e0978e9646
-
C:\Users\Admin\AppData\Local\Temp\rZwmravyStQ5.batFilesize
199B
MD5ac681b3d7ecf2047746a642f39a5e64e
SHA1359d7b99e43d75da1cc2b30cdd17e89c6f00f853
SHA256c5d5d9b7fd875ca88273b31270d5da2ed32baf436c77cd99e0624a657949e110
SHA512d0b295fadc8bcd4c442e9046db744a112f811b8298e05d7183b5582377538d26682923022efdae3f1b75b70d7892d2722740ae13cd7d6a8f4557c9bfd7ab4eb6
-
C:\Users\Admin\AppData\Local\Temp\u4KEaWuBHKEf.batFilesize
199B
MD542f74ef0b19ca2fcaa54ad47e998f583
SHA18db04b51c09ac19ae9c52e672eaa6b9a46ab264f
SHA256f15b04f9e8e84f6d954cf01ae6bd112aab13583521045810f595c127188913ad
SHA51235df20e29d605cecc4bf4e61d27e3bd5961636facd961a04797d7ac99b216a5be456aa77b9279060f0f30a430d6c6658026c816055d7d9c7a9258f7ef57f6f72
-
C:\Users\Admin\AppData\Local\Temp\uU8uJWzQcOM6.batFilesize
199B
MD5032dc191235036487ba2543329a00117
SHA1aacd41842131d6ba8666a56b6d6272dbba29fa41
SHA256d5e4410b60de0518b73363f2bc190e4f3289a1fa219e940d5a6be856419f0c00
SHA512f6d6f6b11ec1913675e26ac9ff8dc937e7c63a3c50ce915540a59fc5dca6aae2a1966aef427d99a6df7a19ef41db534f892687f773877daa03c78e455297493b
-
C:\Windows\System32\SubDir\Incognito.exeFilesize
3.1MB
MD5dc3f5eebf8ab3dd6fef8b51610d2c356
SHA10847d42da980bafd989804386b0889c1ceb5a869
SHA2563120f15238f08b384ec85504c2ddbbc06a5b8a3f13e5e2551a6f7ad916144e49
SHA51203dd71d93e48e195af52d3b51b73e6d8896b2e67d7cb7ced3cdb2db00623032bb7e8e35a71c7c5903d6d473ad057297da0eca8664e48012ebe5e4cf6fe547f7d
-
memory/2316-0-0x00007FF99A1F3000-0x00007FF99A1F4000-memory.dmpFilesize
4KB
-
memory/2316-9-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmpFilesize
9.9MB
-
memory/2316-2-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmpFilesize
9.9MB
-
memory/2316-1-0x0000000000860000-0x0000000000B84000-memory.dmpFilesize
3.1MB
-
memory/3408-19-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmpFilesize
9.9MB
-
memory/3408-13-0x000000001C200000-0x000000001C2B2000-memory.dmpFilesize
712KB
-
memory/3408-12-0x000000001C0F0000-0x000000001C140000-memory.dmpFilesize
320KB
-
memory/3408-11-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmpFilesize
9.9MB
-
memory/3408-10-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmpFilesize
9.9MB