quasar | c4f4b783e9b152a00d5cac8b82d2ae0c74fa848aaa4a524dc5cb81b1576aaab5

Analysis

max time kernel
300s
max time network
287s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02-06-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uni/Uni - Copy (4).exe
Size

409KB
MD5

b70fdac25a99501e3cae11f1b775249e
SHA1

3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71
SHA256

51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246
SHA512

43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44
SSDEEP

12288:gpbJjGut6AoE3hVVdFaC/eZPTMTDlpgfJCKuMsVs:oVaurMLcDlpRKai

Score

10^/10

quasar seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SeroXen

panel-slave.gl.at.ply.gg:57059

panel-slave.gl.at.ply.gg:27892

Mutex

$Sxr-rpL8EItHN3pqIQQVy2

Attributes

encryption_key
Lme7VBS3l58VwLM69PNM
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SeroXen
subdirectory
SubDir

Signatures

Quasar RAT 3 IoCs
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Processes:

schtasks.exe

pid process

4640 schtasks.exe
11 ip-api.com
32 api.ipify.org

pid	process
4640	schtasks.exe
11	ip-api.com
32	api.ipify.org

Quasar payload 2 IoCs

Processes:

resource	yara_rule
behavioral6/memory/4004-1-0x00000000000C0000-0x000000000012C000-memory.dmp	family_quasar
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe	family_quasar

Executes dropped EXE 2 IoCs

Processes:

Client.exeQryyugsr8iE8.exe

pid process

752 Client.exe
3360 Qryyugsr8iE8.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 ip-api.com
32 api.ipify.org
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeSCHTASKS.exeschtasks.exeSCHTASKS.exe

pid process

4640 schtasks.exe
4532 SCHTASKS.exe
4396 schtasks.exe
5608 SCHTASKS.exe

pid	process
752	Client.exe
3360	Qryyugsr8iE8.exe

flow	ioc
11	ip-api.com
32	api.ipify.org

pid	process
4640	schtasks.exe
4532	SCHTASKS.exe
4396	schtasks.exe
5608	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133617831691869687"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

chrome.exe

pid process

3492 chrome.exe
3492 chrome.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

3492 chrome.exe
3492 chrome.exe
3492 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Uni - Copy (4).exeClient.exeAUDIODG.EXEchrome.exe

description	pid	process
Token: SeDebugPrivilege	4004	Uni - Copy (4).exe
Token: SeDebugPrivilege	752	Client.exe
Token: 33	1220	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1220	AUDIODG.EXE
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe
Token: SeShutdownPrivilege	3492	chrome.exe
Token: SeCreatePagefilePrivilege	3492	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

Processes:

chrome.exe

pid	process
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

chrome.exe

pid	process
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe
3492	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Client.exeQryyugsr8iE8.exe

pid process

752 Client.exe
3360 Qryyugsr8iE8.exe

pid	process
752	Client.exe
3360	Qryyugsr8iE8.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Uni - Copy (4).exeClient.exechrome.exe

description	pid	process	target process
PID 4004 wrote to memory of 4640	4004	Uni - Copy (4).exe	schtasks.exe
PID 4004 wrote to memory of 4640	4004	Uni - Copy (4).exe	schtasks.exe
PID 4004 wrote to memory of 4640	4004	Uni - Copy (4).exe	schtasks.exe
PID 4004 wrote to memory of 752	4004	Uni - Copy (4).exe	Client.exe
PID 4004 wrote to memory of 752	4004	Uni - Copy (4).exe	Client.exe
PID 4004 wrote to memory of 752	4004	Uni - Copy (4).exe	Client.exe
PID 4004 wrote to memory of 4532	4004	Uni - Copy (4).exe	SCHTASKS.exe
PID 4004 wrote to memory of 4532	4004	Uni - Copy (4).exe	SCHTASKS.exe
PID 4004 wrote to memory of 4532	4004	Uni - Copy (4).exe	SCHTASKS.exe
PID 752 wrote to memory of 4396	752	Client.exe	schtasks.exe
PID 752 wrote to memory of 4396	752	Client.exe	schtasks.exe
PID 752 wrote to memory of 4396	752	Client.exe	schtasks.exe
PID 752 wrote to memory of 3360	752	Client.exe	Qryyugsr8iE8.exe
PID 752 wrote to memory of 3360	752	Client.exe	Qryyugsr8iE8.exe
PID 752 wrote to memory of 3360	752	Client.exe	Qryyugsr8iE8.exe
PID 3492 wrote to memory of 1072	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1072	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1436	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2580	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 2580	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe
PID 3492 wrote to memory of 1844	3492	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (4).exe
"C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (4).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (4).exe" /rl HIGHEST /f
2⤵
- Quasar RAT
- Creates scheduled task(s)
PID:4640

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\schtasks.exe
"schtasks" /create /tn "SeroXen" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:4396

C:\Users\Admin\AppData\Local\Temp\Qryyugsr8iE8.exe
"C:\Users\Admin\AppData\Local\Temp\Qryyugsr8iE8.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3360

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Client.exe" /tr "'C:\Users\Admin\AppData\Roaming\SubDir\Client.exe'" /sc onlogon /rl HIGHEST
3⤵
- Creates scheduled task(s)
PID:5608

C:\Windows\SysWOW64\SCHTASKS.exe
"SCHTASKS.exe" /create /tn "$77Uni - Copy (4).exe" /tr "'C:\Users\Admin\AppData\Local\Temp\uni\Uni - Copy (4).exe'" /sc onlogon /rl HIGHEST
2⤵
- Creates scheduled task(s)
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4360,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:8
1⤵
PID:3900

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x378 0x49c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb3f4dab58,0x7ffb3f4dab68,0x7ffb3f4dab78
2⤵
PID:1072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:2
2⤵
PID:1436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1948 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:2580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2308 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:1844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:1
2⤵
PID:1416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:1
2⤵
PID:2108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4356 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:1880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4456 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:1
2⤵
PID:2160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4500 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:4160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4756 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:3872

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4324 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:4696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:3564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:5016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2588 --field-trial-handle=2008,i,1580672597891552275,15398720926961147460,131072 /prefetch:8
2⤵
PID:5936

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:384

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
20439c833975468d54a45774a734ced8

SHA1
ee23111ec66b309493e191b06a42fcf0826716cb

SHA256
fdf7b477977117a62c37ac98e9dc35693332fc226ec54714a81c9938d6f73539

SHA512
402a8427270101eeaa110167c99b4ea0bfb9e42b7312bd91df9c41254c42a831522cd8a9f28738b044fe6ce7aefc70f4e0ffb61d386962e7cb92234730f8a89c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
356B

MD5
2086ceeb1b7c5b7948014682f9799036

SHA1
b15b07c9d0c2d08d26caeb702c25dbd6fc3f1380

SHA256
5ffb360dee227024ed84cd67fb44dff7ec4e949a9069e12b6a4abd88e2e2a5f7

SHA512
7082908be5fc86f52546102f3b921e21b74361681aa8dddf9ad4dd57cd51ff6f077f98c6bdbe52565a62c7957432aa878068408fdd2714b4464e720850e3552c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
bc0bea8f3e16d422b0550711cebbd2d2

SHA1
0b6ed428bd45c7eadd3b138818048a0ece361e1f

SHA256
140fb01baa7fe20d4162e70f434fd2469369204404c606042684547b914be6f3

SHA512
9c45e5d770989f92c5cba5562f8de8f33fa6bdc48fdc675b85c2bcf95281640dacb0bf570f7b60ad9ba08c1efc44aeb4522f41799e1f9e05c5d4452817501e03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
8e310df8bbb5c7356841da3541441478

SHA1
4cc163fbab3a2f7cab91f54037e38bffbc1550cb

SHA256
3a004dad029632915e7328dec77e980c74c7b459f32f31e94a4067dcd8967b73

SHA512
89e06a1f72b9e52786eb3c17a3dd37815d035069c35113bfcdafdd6c14d8ef6aba4535d28dcb99e76e2790975f04d958a46e8cc23bb5c6c556f522ffe14ad161

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
e32703bbed75245ea8495355415aa9c3

SHA1
959b4fa3c2881b28b6c0eb17c39127d2b7caa6cf

SHA256
755241df0cdcdc1a9a21bccd193b1de170b56ac8898543b62c954f4503699f41

SHA512
1bd1b296317dc092050e4d5588e963d0dc2566b2a44e6b68d09b7f0a3b5c3e957f7fd3e458dda59332bc5d63d4b30a0969db4b016d21a386c66debfb3f0024a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
e7b0320be8d5beb6952773d484435b67

SHA1
874f59d315a82afb22eee7e5e6f2f9958ca7088d

SHA256
41a3b7f14abd141cacea3d0c4defbf98dd64e6219a96eff95ebe5d9df45d086a

SHA512
bdd2ce1ce096da8a9bb0796b159eac82458ba031aa183b9e532b610bc1b21e5083b285df6674b8effabcb03bd985df22651a0a0b6a55b910d4b95cb530dfae97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
16KB

MD5
bc7fe7edc5699bf85647992d27e6d6f5

SHA1
9e5168def91ecbe1caa4fa35deadd592f49f2cf5

SHA256
21fced691bb2da2802222903eb5230c68046db7d598462db4089de7cf4fc7e57

SHA512
e369dc57fe7eea1e04015b6e5e157033693dd723431979ea60b9aabc8571c4c22eed9ee864769ea7214d9e9ec02f0690a3e445dcf1b5f94225ee150757081430

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
261KB

MD5
c6629b998bb3ca12dfd70f32fb3a4545

SHA1
7f34bd76ae823f8b20e79dc033f50915f9bfcb95

SHA256
ecb561a387c0ed27c2dc27f846939d130a0cc2c08dfb00a4ea7432475277831f

SHA512
8928cce144a376c31d7d2aca00b4dfdd7f8a1d311d2bbde9158180545e805e89af523108d4edf84729b06a4211bf3986a9f09e3ab3f9ed78bd20ef657b9306e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
89KB

MD5
bcce3e6949e65c22aef504d0f3e774aa

SHA1
a824a10775f7bce9bd94e56c90bbc0dd49a66ce7

SHA256
a57e605c1f7740fff52d41a97ad9a3c374f166ef96a52cd15dac87e5a1005a73

SHA512
d5e6eb8e63c9f6cffcea2b04e234713f9952d9c146fa1f8bef98524513c7b4514709c151abf4f9f8ec33916ab57cf9edf36dbebed7214e736878f03a960b4a33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5c8ad3.TMP
Filesize
89KB

MD5
ec5fac4311bb56d83e54e0b09437053e

SHA1
d2ce969b84620ac1c15f25a3fa442d3a6e7cf349

SHA256
f492db83afaca451efce41d7c48e42772f1864150b645040225a0b6daa79d407

SHA512
32d9d015e9eedc04b448d4b268a715b55b169001a703654564f5258070e0cdaa4249201167acb53d7a5bffdfc224e54aae0ce9be6eeb608b04c29eb8fbb7f771

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qryyugsr8iE8.exe
Filesize
277KB

MD5
dac0c5b2380cbdd93b46763427c9f8df

SHA1
038089e1a0ac8375be797fc3ce7ae719abc72834

SHA256
d02538788fb57f568ece292f5fc20e9775c86d504de67f57e22534f84adc73c6

SHA512
05cc1f6bf25a6545a06c735ae7a4a7fc25489bdb9fbc8d5797be623982662c4a93cba2d20bfe14313ef1548eaaa691e55fabdd8e3d3e45de9ab42dc62f9a7023

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Filesize
409KB

MD5
b70fdac25a99501e3cae11f1b775249e

SHA1
3c59226479bfdcd1b2927bcfb1a7516d4cb8dd71

SHA256
51ff3eb450a786c1aaa75ff889f2fd256412a7b75d04277fdf9fcccc20e57246

SHA512
43f0d5d6e5f0d5febba537c109ffdbc250bbb6e9725e635a43ec975b0353048eaeee50b6e9274cd5e072ea6b0cea32439bd37408b2528832f467f2075f74ca44

Download Submit
\??\pipe\crashpad_3492_RDKUBQRQOARKBDCZ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/752-19-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/752-20-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/752-18-0x0000000006CA0000-0x0000000006CAA000-memory.dmp

Filesize
40KB

Download
memory/752-16-0x00000000067E0000-0x000000000681C000-memory.dmp

Filesize
240KB

Download
memory/752-140-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/752-13-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/752-12-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/4004-0-0x00000000748BE000-0x00000000748BF000-memory.dmp

Filesize
4KB

Download
memory/4004-15-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/4004-6-0x0000000005090000-0x00000000050A2000-memory.dmp

Filesize
72KB

Download
memory/4004-5-0x0000000004CA0000-0x0000000004D06000-memory.dmp

Filesize
408KB

Download
memory/4004-4-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/4004-3-0x0000000004B90000-0x0000000004C22000-memory.dmp

Filesize
584KB

Download
memory/4004-2-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download
memory/4004-1-0x00000000000C0000-0x000000000012C000-memory.dmp

Filesize
432KB

Download