quasar | 3120f15238f08b384ec85504c2ddbbc06a5b8a3f13e5e2551a6f7ad916144e49

Analysis

max time kernel
146s
max time network
144s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
02-06-2024 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

dc3f5eebf8ab3dd6fef8b51610d2c356
SHA1

0847d42da980bafd989804386b0889c1ceb5a869
SHA256

3120f15238f08b384ec85504c2ddbbc06a5b8a3f13e5e2551a6f7ad916144e49
SHA512

03dd71d93e48e195af52d3b51b73e6d8896b2e67d7cb7ced3cdb2db00623032bb7e8e35a71c7c5903d6d473ad057297da0eca8664e48012ebe5e4cf6fe547f7d
SSDEEP

49152:bvCI22SsaNYfdPBldt698dBcjHZKxNESE9k/ikLoGdwTHHB72eh2NT:bvP22SsaNYfdPBldt6+dBcjHAxgq

Score

10^/10

quasar rat - fake incognito spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

RAT - fake incognito

192.168.4.30:4782

Mutex

d94dce9f-b2a7-4e68-b727-6888151a6b4e

Attributes

encryption_key
40B0884053AA1A1D9985C8E042F5C321462F78A6
install_name
Incognito.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Incognito
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2316-1-0x0000000000860000-0x0000000000B84000-memory.dmp	family_quasar
C:\Windows\System32\SubDir\Incognito.exe	family_quasar

Executes dropped EXE 15 IoCs

Processes:

Incognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exe

pid	process
3408	Incognito.exe
4820	Incognito.exe
3600	Incognito.exe
1792	Incognito.exe
2260	Incognito.exe
224	Incognito.exe
3012	Incognito.exe
2484	Incognito.exe
4496	Incognito.exe
3796	Incognito.exe
3360	Incognito.exe
4868	Incognito.exe
2136	Incognito.exe
3412	Incognito.exe
2184	Incognito.exe

Drops file in System32 directory 33 IoCs

Processes:

Incognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeClient-built.exeIncognito.exeIncognito.exe

description	ioc	process
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File created	C:\Windows\system32\SubDir\Incognito.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe
File opened for modification	C:\Windows\system32\SubDir\Incognito.exe	Incognito.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
592	schtasks.exe
4240	schtasks.exe
5112	schtasks.exe
3348	schtasks.exe
3488	schtasks.exe
3140	schtasks.exe
2264	schtasks.exe
3932	schtasks.exe
380	schtasks.exe
4400	schtasks.exe
1220	schtasks.exe
2280	schtasks.exe
3468	schtasks.exe
4708	schtasks.exe
3028	schtasks.exe
2296	schtasks.exe

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid	process
4624	PING.EXE
4828	PING.EXE
828	PING.EXE
2268	PING.EXE
1052	PING.EXE
1232	PING.EXE
3832	PING.EXE
1672	PING.EXE
4860	PING.EXE
2824	PING.EXE
4120	PING.EXE
2892	PING.EXE
3184	PING.EXE
4592	PING.EXE
4236	PING.EXE

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

Client-built.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exe

description	pid	process
Token: SeDebugPrivilege	2316	Client-built.exe
Token: SeDebugPrivilege	3408	Incognito.exe
Token: SeDebugPrivilege	4820	Incognito.exe
Token: SeDebugPrivilege	3600	Incognito.exe
Token: SeDebugPrivilege	1792	Incognito.exe
Token: SeDebugPrivilege	2260	Incognito.exe
Token: SeDebugPrivilege	224	Incognito.exe
Token: SeDebugPrivilege	3012	Incognito.exe
Token: SeDebugPrivilege	2484	Incognito.exe
Token: SeDebugPrivilege	4496	Incognito.exe
Token: SeDebugPrivilege	3796	Incognito.exe
Token: SeDebugPrivilege	3360	Incognito.exe
Token: SeDebugPrivilege	4868	Incognito.exe
Token: SeDebugPrivilege	2136	Incognito.exe
Token: SeDebugPrivilege	3412	Incognito.exe
Token: SeDebugPrivilege	2184	Incognito.exe

Suspicious use of FindShellTrayWindow 15 IoCs

Processes:

Incognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exe

pid	process
3408	Incognito.exe
4820	Incognito.exe
3600	Incognito.exe
1792	Incognito.exe
2260	Incognito.exe
224	Incognito.exe
3012	Incognito.exe
2484	Incognito.exe
4496	Incognito.exe
3796	Incognito.exe
3360	Incognito.exe
4868	Incognito.exe
2136	Incognito.exe
3412	Incognito.exe
2184	Incognito.exe

Suspicious use of SendNotifyMessage 15 IoCs

Processes:

Incognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exeIncognito.exe

pid	process
3408	Incognito.exe
4820	Incognito.exe
3600	Incognito.exe
1792	Incognito.exe
2260	Incognito.exe
224	Incognito.exe
3012	Incognito.exe
2484	Incognito.exe
4496	Incognito.exe
3796	Incognito.exe
3360	Incognito.exe
4868	Incognito.exe
2136	Incognito.exe
3412	Incognito.exe
2184	Incognito.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Client-built.exeIncognito.execmd.exeIncognito.execmd.exeIncognito.execmd.exeIncognito.execmd.exeIncognito.execmd.exeIncognito.execmd.exe

description	pid	process	target process
PID 2316 wrote to memory of 1220	2316	Client-built.exe	schtasks.exe
PID 2316 wrote to memory of 1220	2316	Client-built.exe	schtasks.exe
PID 2316 wrote to memory of 3408	2316	Client-built.exe	Incognito.exe
PID 2316 wrote to memory of 3408	2316	Client-built.exe	Incognito.exe
PID 3408 wrote to memory of 3932	3408	Incognito.exe	schtasks.exe
PID 3408 wrote to memory of 3932	3408	Incognito.exe	schtasks.exe
PID 3408 wrote to memory of 2740	3408	Incognito.exe	cmd.exe
PID 3408 wrote to memory of 2740	3408	Incognito.exe	cmd.exe
PID 2740 wrote to memory of 5068	2740	cmd.exe	chcp.com
PID 2740 wrote to memory of 5068	2740	cmd.exe	chcp.com
PID 2740 wrote to memory of 4624	2740	cmd.exe	PING.EXE
PID 2740 wrote to memory of 4624	2740	cmd.exe	PING.EXE
PID 2740 wrote to memory of 4820	2740	cmd.exe	Incognito.exe
PID 2740 wrote to memory of 4820	2740	cmd.exe	Incognito.exe
PID 4820 wrote to memory of 4708	4820	Incognito.exe	schtasks.exe
PID 4820 wrote to memory of 4708	4820	Incognito.exe	schtasks.exe
PID 4820 wrote to memory of 2084	4820	Incognito.exe	cmd.exe
PID 4820 wrote to memory of 2084	4820	Incognito.exe	cmd.exe
PID 2084 wrote to memory of 3612	2084	cmd.exe	chcp.com
PID 2084 wrote to memory of 3612	2084	cmd.exe	chcp.com
PID 2084 wrote to memory of 4592	2084	cmd.exe	PING.EXE
PID 2084 wrote to memory of 4592	2084	cmd.exe	PING.EXE
PID 2084 wrote to memory of 3600	2084	cmd.exe	Incognito.exe
PID 2084 wrote to memory of 3600	2084	cmd.exe	Incognito.exe
PID 3600 wrote to memory of 5112	3600	Incognito.exe	schtasks.exe
PID 3600 wrote to memory of 5112	3600	Incognito.exe	schtasks.exe
PID 3600 wrote to memory of 2456	3600	Incognito.exe	cmd.exe
PID 3600 wrote to memory of 2456	3600	Incognito.exe	cmd.exe
PID 2456 wrote to memory of 4144	2456	cmd.exe	chcp.com
PID 2456 wrote to memory of 4144	2456	cmd.exe	chcp.com
PID 2456 wrote to memory of 1672	2456	cmd.exe	PING.EXE
PID 2456 wrote to memory of 1672	2456	cmd.exe	PING.EXE
PID 2456 wrote to memory of 1792	2456	cmd.exe	Incognito.exe
PID 2456 wrote to memory of 1792	2456	cmd.exe	Incognito.exe
PID 1792 wrote to memory of 3348	1792	Incognito.exe	schtasks.exe
PID 1792 wrote to memory of 3348	1792	Incognito.exe	schtasks.exe
PID 1792 wrote to memory of 4508	1792	Incognito.exe	cmd.exe
PID 1792 wrote to memory of 4508	1792	Incognito.exe	cmd.exe
PID 4508 wrote to memory of 4376	4508	cmd.exe	chcp.com
PID 4508 wrote to memory of 4376	4508	cmd.exe	chcp.com
PID 4508 wrote to memory of 1052	4508	cmd.exe	PING.EXE
PID 4508 wrote to memory of 1052	4508	cmd.exe	PING.EXE
PID 4508 wrote to memory of 2260	4508	cmd.exe	Incognito.exe
PID 4508 wrote to memory of 2260	4508	cmd.exe	Incognito.exe
PID 2260 wrote to memory of 2280	2260	Incognito.exe	schtasks.exe
PID 2260 wrote to memory of 2280	2260	Incognito.exe	schtasks.exe
PID 2260 wrote to memory of 1960	2260	Incognito.exe	cmd.exe
PID 2260 wrote to memory of 1960	2260	Incognito.exe	cmd.exe
PID 1960 wrote to memory of 2480	1960	cmd.exe	chcp.com
PID 1960 wrote to memory of 2480	1960	cmd.exe	chcp.com
PID 1960 wrote to memory of 1232	1960	cmd.exe	PING.EXE
PID 1960 wrote to memory of 1232	1960	cmd.exe	PING.EXE
PID 1960 wrote to memory of 224	1960	cmd.exe	Incognito.exe
PID 1960 wrote to memory of 224	1960	cmd.exe	Incognito.exe
PID 224 wrote to memory of 3488	224	Incognito.exe	schtasks.exe
PID 224 wrote to memory of 3488	224	Incognito.exe	schtasks.exe
PID 224 wrote to memory of 5056	224	Incognito.exe	cmd.exe
PID 224 wrote to memory of 5056	224	Incognito.exe	cmd.exe
PID 5056 wrote to memory of 1384	5056	cmd.exe	chcp.com
PID 5056 wrote to memory of 1384	5056	cmd.exe	chcp.com
PID 5056 wrote to memory of 4828	5056	cmd.exe	PING.EXE
PID 5056 wrote to memory of 4828	5056	cmd.exe	PING.EXE
PID 5056 wrote to memory of 3012	5056	cmd.exe	Incognito.exe
PID 5056 wrote to memory of 3012	5056	cmd.exe	Incognito.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
2⤵
- Creates scheduled task(s)
PID:1220

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:3932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JN76SdETu3rG.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:5068

C:\Windows\system32\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:4624

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
5⤵
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uU8uJWzQcOM6.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:3612

C:\Windows\system32\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:4592

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3600

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
7⤵
- Creates scheduled task(s)
PID:5112

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rZwmravyStQ5.bat" "
7⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\system32\chcp.com
chcp 65001
8⤵
PID:4144

C:\Windows\system32\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:1672

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
9⤵
- Creates scheduled task(s)
PID:3348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u4KEaWuBHKEf.bat" "
9⤵
- Suspicious use of WriteProcessMemory
PID:4508

C:\Windows\system32\chcp.com
chcp 65001
10⤵
PID:4376

C:\Windows\system32\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:1052

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
11⤵
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ldoxH5Rsb8CP.bat" "
11⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\system32\chcp.com
chcp 65001
12⤵
PID:2480

C:\Windows\system32\PING.EXE
ping -n 10 localhost
12⤵
- Runs ping.exe
PID:1232

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
13⤵
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKm5U8eOMGQA.bat" "
13⤵
- Suspicious use of WriteProcessMemory
PID:5056

C:\Windows\system32\chcp.com
chcp 65001
14⤵
PID:1384

C:\Windows\system32\PING.EXE
ping -n 10 localhost
14⤵
- Runs ping.exe
PID:4828

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3012

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
15⤵
- Creates scheduled task(s)
PID:380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WEuKlRyG4gjg.bat" "
15⤵
PID:1588

C:\Windows\system32\chcp.com
chcp 65001
16⤵
PID:2856

C:\Windows\system32\PING.EXE
ping -n 10 localhost
16⤵
- Runs ping.exe
PID:3832

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2484

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
17⤵
- Creates scheduled task(s)
PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MCs1x98FcSI5.bat" "
17⤵
PID:1576

C:\Windows\system32\chcp.com
chcp 65001
18⤵
PID:4572

C:\Windows\system32\PING.EXE
ping -n 10 localhost
18⤵
- Runs ping.exe
PID:4860

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4496

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
19⤵
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hr3Q3uWaXRM3.bat" "
19⤵
PID:4976

C:\Windows\system32\chcp.com
chcp 65001
20⤵
PID:3900

C:\Windows\system32\PING.EXE
ping -n 10 localhost
20⤵
- Runs ping.exe
PID:2824

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3796

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
21⤵
- Creates scheduled task(s)
PID:3140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GWhgGZY9929P.bat" "
21⤵
PID:3040

C:\Windows\system32\chcp.com
chcp 65001
22⤵
PID:3612

C:\Windows\system32\PING.EXE
ping -n 10 localhost
22⤵
- Runs ping.exe
PID:4120

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3360

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
23⤵
- Creates scheduled task(s)
PID:592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QOIGB96wvuAu.bat" "
23⤵
PID:4432

C:\Windows\system32\chcp.com
chcp 65001
24⤵
PID:4144

C:\Windows\system32\PING.EXE
ping -n 10 localhost
24⤵
- Runs ping.exe
PID:2892

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4868

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
25⤵
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\14FqBe2vi8uk.bat" "
25⤵
PID:1304

C:\Windows\system32\chcp.com
chcp 65001
26⤵
PID:2192

C:\Windows\system32\PING.EXE
ping -n 10 localhost
26⤵
- Runs ping.exe
PID:4236

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2136

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
27⤵
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c5iUU9A9JiBc.bat" "
27⤵
PID:508

C:\Windows\system32\chcp.com
chcp 65001
28⤵
PID:3216

C:\Windows\system32\PING.EXE
ping -n 10 localhost
28⤵
- Runs ping.exe
PID:3184

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3412

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
29⤵
- Creates scheduled task(s)
PID:3468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aUptFhkM2ZOI.bat" "
29⤵
PID:1436

C:\Windows\system32\chcp.com
chcp 65001
30⤵
PID:312

C:\Windows\system32\PING.EXE
ping -n 10 localhost
30⤵
- Runs ping.exe
PID:828

C:\Windows\system32\SubDir\Incognito.exe
"C:\Windows\system32\SubDir\Incognito.exe"
30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2184

C:\Windows\SYSTEM32\schtasks.exe
"schtasks" /create /tn "Incognito" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Incognito.exe" /rl HIGHEST /f
31⤵
- Creates scheduled task(s)
PID:4240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cvyONHTJxvOO.bat" "
31⤵
PID:3084

C:\Windows\system32\chcp.com
chcp 65001
32⤵
PID:1068

C:\Windows\system32\PING.EXE
ping -n 10 localhost
32⤵
- Runs ping.exe
PID:2268

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Incognito.exe.log
Filesize
2KB

MD5
1dcda70572487b230bb9e47148a0946d

SHA1
06f9b414b54eb9a816d9b37a2b54c82a94197a05

SHA256
9e6e954e3f620c078e96da9f741090719a3b6b282704a1e54942b683223de4ed

SHA512
7de9c424f82129e049ca6830c6ae1f23489738d487999e773f1593494f1caddc9dd9c77f85c3a01e05ee37653de3ab17da8c3fdf75adc0c0c2fb38a938246179

Download Submit
C:\Users\Admin\AppData\Local\Temp\14FqBe2vi8uk.bat
Filesize
199B

MD5
2456f2015140fe9ad47400c3c750bc9f

SHA1
eaa9d81da0f432f90e07e1b442cd73feb244f575

SHA256
f1ed222bfdee0ed3d826461e9e4928d5d08f45c731b78489ae4f9f028c4987ca

SHA512
f3199976879f97bf2d48ce4d3aecc6d792bfc8ea32a19d1c31867245197faccfeebcb4c23df83b3482cb63511c5b8ec2128cea2d52aba1e66329b02aa261fb89

Download Submit
C:\Users\Admin\AppData\Local\Temp\GWhgGZY9929P.bat
Filesize
199B

MD5
ded5b017c12f4a3da1da96bea3909044

SHA1
d5276cd206cb4b8496f23672df5f70c61bfa50d2

SHA256
30022e1850da2caee917d799fba1afeba3aba2ca74e853bc266cf4f20e755973

SHA512
c46c135f997143af5eece2e6ce014af66c276360ed3c6255ad60d157f6de407c1aedd8b06be881398021996fed5eac3688690777c1057bbeafefdfb9f98d8f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hr3Q3uWaXRM3.bat
Filesize
199B

MD5
71d476072ef9a503b55819c54ef85884

SHA1
fdf58f72424e4701fc40f9d431d727f97048daac

SHA256
25127509dfe01f0b6cbd0827acb7c18e91261160dc070d3d4825c6602cedefbe

SHA512
02d010678722b7ccba9b36a311abafdadc19d8a2f06b2b598061e3a8641a8350c5bca7a117c2e942fad793ce8b3d69e84da143c829e26a20c4cdafe9887372d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\JN76SdETu3rG.bat
Filesize
199B

MD5
6f34412a1507bf3e811ce9f4542501b5

SHA1
2b01f444ef505e59ea864425ce9781d1c7962db9

SHA256
cf576bfe4cfe5cea789d2bf989544a64cd132fdb4cfbb6c4dc7ec68b2cdf1588

SHA512
36fec24f0bc7dca603548a7d9a99713b91bc7b4ef71ee192fb4163e0d59ccd19d810945deb492adc87545000e9eb14271287ae92788fff890b03c0ab67d03576

Download Submit
C:\Users\Admin\AppData\Local\Temp\MCs1x98FcSI5.bat
Filesize
199B

MD5
eef7ae56bceedb458c9aa324107cf88a

SHA1
8ffaea14f707086f7f39844a7f1dc04a5762c802

SHA256
db9a06cb059fa284461aeba912b1350a1c62e619a8d17eb19f6a54850e9f576c

SHA512
4714e7d3f5bcfccd872b4148d27ce52ae789e7e2f5b043196a95f36ee683dce8a206bf885ec19170de9b5d880a8e2c8c22aff734dc757ba270dbc98bba38a843

Download Submit
C:\Users\Admin\AppData\Local\Temp\PKm5U8eOMGQA.bat
Filesize
199B

MD5
82dbf5ed21566f38df8698e975145411

SHA1
32c1e5ad77c16de95d62138f6c5ae7d543e726fe

SHA256
c3ddc63a3d44794ab566d34efa9f361ef145564812e82ac72a11e8fa4ac60eaa

SHA512
e98a159ec4cfa9d0b62b47b9bb8c192aba09418aa276c1ffdd596b45e64910e555e88d83cdd3296a2c8f794c86bb69c9670834ee85b54a732111f8300e6016a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\QOIGB96wvuAu.bat
Filesize
199B

MD5
96c666dfeb9c797eae923ccf5852bc52

SHA1
d93afa1eff095a1b6cf2a067fb14240cae3ecb52

SHA256
4eb8eaee573b1d7ef7b45fd568f300559e76b1ae71fd50ded04be9d2764b1a40

SHA512
6addce310c750432fb2af3751b9c9e5b06d33d63239285f9757d76f78a8b6c3908eca740af80fd44c8d8efb59bca0cfc220d35e602a490c95e68aed1694bc7a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WEuKlRyG4gjg.bat
Filesize
199B

MD5
c9a49878c2d8c0ecbe5a226780e36b32

SHA1
b53b887321cd5fa1a37527ae7340ad1eed077508

SHA256
0d574cd18a9210e94ea931ab7bab13ca4a1c7b65c857b2b2ee84bcbe40927b9e

SHA512
7d3e9af6c4c0ad38b3cd0491f941ff60314160e73c807a90bbdf705876ce514e3b662f3f51ea09bdfad8032f334b2498521c7a52f58269115e7e0d15dbd1e397

Download Submit
C:\Users\Admin\AppData\Local\Temp\aUptFhkM2ZOI.bat
Filesize
199B

MD5
9477f353ea72085be9e1f944b5f59dfb

SHA1
81587ba8f8a35828c186c5fdf1b654117efb9527

SHA256
6e6b20209d22038d52b391e5169c6a065e41e2e45df80e9f4b1068c6cc695a05

SHA512
14453fb2c35595824835f6b47403b5c8f49ed0152c5921e4f2d027053e1dd3c361919dee22b344c5e25706dd270515ed816298f013039b64a11f18c8bcea7164

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5iUU9A9JiBc.bat
Filesize
199B

MD5
d561d26c518e04c0a2d2007f4ef727e7

SHA1
02f6cabda68b9d632e24fed4b4b251809502e6d4

SHA256
2905f20474cbcca1b3e13cfe2340596e7d86d0e79ffde3ee76796d877705ebb5

SHA512
c0a45fad92b34c387b4dc7f130a6e3be82e1ed341abf36796f7f8a2d4faf2389890d8159564fd56320895429a3a7c1d036e5c63256ab858c868f5dec221eb703

Download Submit
C:\Users\Admin\AppData\Local\Temp\cvyONHTJxvOO.bat
Filesize
199B

MD5
e3801bdb0045358360734c11069a7750

SHA1
84dc5fae11f6fc4fa9e13b6d278cf8bfb350c301

SHA256
17d2cd44f92816b8ce47961c51c6566ae082b0f3413fad55232edca9d8484d27

SHA512
9fddcf9109774c2bbc21808ba2f8fcde13d41f3be119030407d995dfc557948ba3da86cb97a55ad2efcd6b8841c2ee3412cfe5764c99db2ca4b4208a837405fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\ldoxH5Rsb8CP.bat
Filesize
199B

MD5
97dd9795f630dcbd9c7e17c82ebd231b

SHA1
c99449614a4000eefedf4430c0e97b4749229ea2

SHA256
fd41e812cc7c887f003065f8fed2eae016d978587402489949f6246f36f0f37d

SHA512
f203a500f9c05a1fc794d3c5d908f7ceb7ede93f65a2db22f2d35b0dfafdadd38f155a67836af3bb169f664659c67a6a9edba410edabef5b1b7019e0978e9646

Download Submit
C:\Users\Admin\AppData\Local\Temp\rZwmravyStQ5.bat
Filesize
199B

MD5
ac681b3d7ecf2047746a642f39a5e64e

SHA1
359d7b99e43d75da1cc2b30cdd17e89c6f00f853

SHA256
c5d5d9b7fd875ca88273b31270d5da2ed32baf436c77cd99e0624a657949e110

SHA512
d0b295fadc8bcd4c442e9046db744a112f811b8298e05d7183b5582377538d26682923022efdae3f1b75b70d7892d2722740ae13cd7d6a8f4557c9bfd7ab4eb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4KEaWuBHKEf.bat
Filesize
199B

MD5
42f74ef0b19ca2fcaa54ad47e998f583

SHA1
8db04b51c09ac19ae9c52e672eaa6b9a46ab264f

SHA256
f15b04f9e8e84f6d954cf01ae6bd112aab13583521045810f595c127188913ad

SHA512
35df20e29d605cecc4bf4e61d27e3bd5961636facd961a04797d7ac99b216a5be456aa77b9279060f0f30a430d6c6658026c816055d7d9c7a9258f7ef57f6f72

Download Submit
C:\Users\Admin\AppData\Local\Temp\uU8uJWzQcOM6.bat
Filesize
199B

MD5
032dc191235036487ba2543329a00117

SHA1
aacd41842131d6ba8666a56b6d6272dbba29fa41

SHA256
d5e4410b60de0518b73363f2bc190e4f3289a1fa219e940d5a6be856419f0c00

SHA512
f6d6f6b11ec1913675e26ac9ff8dc937e7c63a3c50ce915540a59fc5dca6aae2a1966aef427d99a6df7a19ef41db534f892687f773877daa03c78e455297493b

Download Submit
C:\Windows\System32\SubDir\Incognito.exe
Filesize
3.1MB

MD5
dc3f5eebf8ab3dd6fef8b51610d2c356

SHA1
0847d42da980bafd989804386b0889c1ceb5a869

SHA256
3120f15238f08b384ec85504c2ddbbc06a5b8a3f13e5e2551a6f7ad916144e49

SHA512
03dd71d93e48e195af52d3b51b73e6d8896b2e67d7cb7ced3cdb2db00623032bb7e8e35a71c7c5903d6d473ad057297da0eca8664e48012ebe5e4cf6fe547f7d

Download Submit
memory/2316-0-0x00007FF99A1F3000-0x00007FF99A1F4000-memory.dmp

Filesize
4KB

Download
memory/2316-9-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmp

Filesize
9.9MB

Download
memory/2316-2-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmp

Filesize
9.9MB

Download
memory/2316-1-0x0000000000860000-0x0000000000B84000-memory.dmp

Filesize
3.1MB

Download
memory/3408-19-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmp

Filesize
9.9MB

Download
memory/3408-13-0x000000001C200000-0x000000001C2B2000-memory.dmp

Filesize
712KB

Download
memory/3408-12-0x000000001C0F0000-0x000000001C140000-memory.dmp

Filesize
320KB

Download
memory/3408-11-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmp

Filesize
9.9MB

Download
memory/3408-10-0x00007FF99A1F0000-0x00007FF99ABDC000-memory.dmp

Filesize
9.9MB

Download