quasar | 1896024ae3d7c4103e00ea13b19a601a894ea480414f43c46c133cbb429a3750

Analysis

max time kernel
144s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-bueeeeeilt.exe
Size 3.1MB
Sample240607-yzq64acf4v
SHA256 1896024ae3d7c4103e00ea13b19a601a894ea480414f43c46c133cbb429a3750
MD5 80f4a94a29ccec2b4f929b966c733856
SHA1 a4c05ba2c73ca26b92d7ab3b3ebdec3c48f53b06
SHA512 ff4467701e38acc83e32c97bb4a551677347bafa7072210ff0a90ad3832269c1f3a373ebe8613d87bf6c3c1e54a42d36fbccd010c8796466535bc9a63d4f0e09
SSDEEP 49152:vvbI22SsaNYfdPBldt698dBcjHdZ90ABxDhoGd2THHB72eh2NT:vvk22SsaNYfdPBldt6+dBcjHdj0K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

147.185.221.19:60312:60312

Mutex

7e12675d-1220-4eb4-be9d-8c8589d2e180

Attributes

encryption_key
1273BC96F067EC4AA34581E6528B50F1DE868338
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/1068-1-0x0000000000700000-0x0000000000A24000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Client-bueeeeeilt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
1684	PING.EXE
2056	PING.EXE
3272	PING.EXE
4300	PING.EXE
784	PING.EXE
3648	PING.EXE
6040	PING.EXE
4860	PING.EXE
4620	PING.EXE
4492	PING.EXE
3380	PING.EXE
6016	PING.EXE
2396	PING.EXE
896	PING.EXE
2268	PING.EXE

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	2168	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	3776	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	1640	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	1516	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	2912	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	4504	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	5432	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	4176	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	4628	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	3160	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	4068	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	3716	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	5736	Client-bueeeeeilt.exe
Token: SeDebugPrivilege	5628	Client-bueeeeeilt.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
1068	Client-bueeeeeilt.exe
2168	Client-bueeeeeilt.exe
3776	Client-bueeeeeilt.exe
1640	Client-bueeeeeilt.exe
1516	Client-bueeeeeilt.exe
2912	Client-bueeeeeilt.exe
4504	Client-bueeeeeilt.exe
5432	Client-bueeeeeilt.exe
4176	Client-bueeeeeilt.exe
4628	Client-bueeeeeilt.exe
3160	Client-bueeeeeilt.exe
4068	Client-bueeeeeilt.exe
3716	Client-bueeeeeilt.exe
5736	Client-bueeeeeilt.exe
5628	Client-bueeeeeilt.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
1068	Client-bueeeeeilt.exe
2168	Client-bueeeeeilt.exe
3776	Client-bueeeeeilt.exe
1640	Client-bueeeeeilt.exe
1516	Client-bueeeeeilt.exe
2912	Client-bueeeeeilt.exe
4504	Client-bueeeeeilt.exe
5432	Client-bueeeeeilt.exe
4176	Client-bueeeeeilt.exe
4628	Client-bueeeeeilt.exe
3160	Client-bueeeeeilt.exe
4068	Client-bueeeeeilt.exe
3716	Client-bueeeeeilt.exe
5736	Client-bueeeeeilt.exe
5628	Client-bueeeeeilt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 5348	1068	Client-bueeeeeilt.exe	84
PID 1068 wrote to memory of 5348	1068	Client-bueeeeeilt.exe	84
PID 5348 wrote to memory of 5940	5348	cmd.exe	86
PID 5348 wrote to memory of 5940	5348	cmd.exe	86
PID 5348 wrote to memory of 4300	5348	cmd.exe	87
PID 5348 wrote to memory of 4300	5348	cmd.exe	87
PID 5348 wrote to memory of 2168	5348	cmd.exe	95
PID 5348 wrote to memory of 2168	5348	cmd.exe	95
PID 2168 wrote to memory of 4996	2168	Client-bueeeeeilt.exe	96
PID 2168 wrote to memory of 4996	2168	Client-bueeeeeilt.exe	96
PID 4996 wrote to memory of 3388	4996	cmd.exe	98
PID 4996 wrote to memory of 3388	4996	cmd.exe	98
PID 4996 wrote to memory of 3380	4996	cmd.exe	99
PID 4996 wrote to memory of 3380	4996	cmd.exe	99
PID 4996 wrote to memory of 3776	4996	cmd.exe	100
PID 4996 wrote to memory of 3776	4996	cmd.exe	100
PID 3776 wrote to memory of 548	3776	Client-bueeeeeilt.exe	101
PID 3776 wrote to memory of 548	3776	Client-bueeeeeilt.exe	101
PID 548 wrote to memory of 5744	548	cmd.exe	103
PID 548 wrote to memory of 5744	548	cmd.exe	103
PID 548 wrote to memory of 6016	548	cmd.exe	104
PID 548 wrote to memory of 6016	548	cmd.exe	104
PID 548 wrote to memory of 1640	548	cmd.exe	106
PID 548 wrote to memory of 1640	548	cmd.exe	106
PID 1640 wrote to memory of 3284	1640	Client-bueeeeeilt.exe	107
PID 1640 wrote to memory of 3284	1640	Client-bueeeeeilt.exe	107
PID 3284 wrote to memory of 1880	3284	cmd.exe	109
PID 3284 wrote to memory of 1880	3284	cmd.exe	109
PID 3284 wrote to memory of 1684	3284	cmd.exe	110
PID 3284 wrote to memory of 1684	3284	cmd.exe	110
PID 3284 wrote to memory of 1516	3284	cmd.exe	111
PID 3284 wrote to memory of 1516	3284	cmd.exe	111
PID 1516 wrote to memory of 2336	1516	Client-bueeeeeilt.exe	112
PID 1516 wrote to memory of 2336	1516	Client-bueeeeeilt.exe	112
PID 2336 wrote to memory of 4100	2336	cmd.exe	114
PID 2336 wrote to memory of 4100	2336	cmd.exe	114
PID 2336 wrote to memory of 784	2336	cmd.exe	115
PID 2336 wrote to memory of 784	2336	cmd.exe	115
PID 2336 wrote to memory of 2912	2336	cmd.exe	116
PID 2336 wrote to memory of 2912	2336	cmd.exe	116
PID 2912 wrote to memory of 4720	2912	Client-bueeeeeilt.exe	117
PID 2912 wrote to memory of 4720	2912	Client-bueeeeeilt.exe	117
PID 4720 wrote to memory of 4180	4720	cmd.exe	119
PID 4720 wrote to memory of 4180	4720	cmd.exe	119
PID 4720 wrote to memory of 3648	4720	cmd.exe	120
PID 4720 wrote to memory of 3648	4720	cmd.exe	120
PID 4720 wrote to memory of 4504	4720	cmd.exe	121
PID 4720 wrote to memory of 4504	4720	cmd.exe	121
PID 4504 wrote to memory of 5448	4504	Client-bueeeeeilt.exe	122
PID 4504 wrote to memory of 5448	4504	Client-bueeeeeilt.exe	122
PID 5448 wrote to memory of 2124	5448	cmd.exe	124
PID 5448 wrote to memory of 2124	5448	cmd.exe	124
PID 5448 wrote to memory of 896	5448	cmd.exe	125
PID 5448 wrote to memory of 896	5448	cmd.exe	125
PID 5448 wrote to memory of 5432	5448	cmd.exe	126
PID 5448 wrote to memory of 5432	5448	cmd.exe	126
PID 5432 wrote to memory of 2248	5432	Client-bueeeeeilt.exe	127
PID 5432 wrote to memory of 2248	5432	Client-bueeeeeilt.exe	127
PID 2248 wrote to memory of 3856	2248	cmd.exe	129
PID 2248 wrote to memory of 3856	2248	cmd.exe	129
PID 2248 wrote to memory of 2268	2248	cmd.exe	130
PID 2248 wrote to memory of 2268	2248	cmd.exe	130
PID 2248 wrote to memory of 4176	2248	cmd.exe	131
PID 2248 wrote to memory of 4176	2248	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
"C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e1DjhDqe0Rkx.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5940
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0hIVTewzrEOz.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3388
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3776
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a09thkdepECC.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:5744
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\544qcTExu48D.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1880
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Omcyxn8cQdv2.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4100
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fJsC8lXjuyMF.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:4180
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vWbdav0CDMfG.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:5448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2124
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LjElBVQ6oX0u.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:3856
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zSz6muBG9H6Z.bat" "
        18⤵
        
        PID:3024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:5400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        Runs ping.exe
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vNVipw5me0Qd.bat" "
        20⤵
        
        PID:1756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4844
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vj6iDUXjDHKO.bat" "
        22⤵
        
        PID:5196
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:5308
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MbyOUPBURvCQ.bat" "
        24⤵
        
        PID:2136
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:5536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        Runs ping.exe
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\emlz1aQLfgKx.bat" "
        26⤵
        
        PID:1476
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:6124
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        Runs ping.exe
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TAIRK1WDOow8.bat" "
        28⤵
        
        PID:4708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:2400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        Runs ping.exe
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-bueeeeeilt.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6bv8I42ADOq5.bat" "
        30⤵
        
        PID:5724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:5960
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        31⤵
        Runs ping.exe
        
        PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client-bueeeeeilt.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-bueeeeeilt.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

0hIVTewzrEOz.bat

Path C:\Users\Admin\AppData\Local\Temp\0hIVTewzrEOz.bat
Size 214B
SHA256 eaeafaec197c9d7a04c45128324c7e0c42e7ab3a3ee7f7f34aea90ab697a581f
MD5 adc43d3e05da04220c321df03aeff807
SHA1 aa1bb9ccc7711f130fc0a1c2135b5c7fce45dd75
SHA512 8e9fd07b25f0e8c64a076cbb0c0d223cce3dc3727cdba633bcff17888a07062219c56500133d7775b16ad257b8c4f37ec90c21e56fb2ba2f6d34c8c4060ca444
MD5 SHA1 SHA512

Submit Download

544qcTExu48D.bat

Path C:\Users\Admin\AppData\Local\Temp\544qcTExu48D.bat
Size 214B
SHA256 420742734f250ce7d60c4684c5bd4e25ede6d5fef0f64971a0d30cbf416dd34f
MD5 ac189f7a64eed3685c940b9231e6fb17
SHA1 6aefb6e148cfe3ae978d4fac1ff9186f5c78cd30
SHA512 3f3f59bacc4988dd5371b04339c69ebe95232ab2cfe82eef711c0d23545b892006c16cf051ad1acbf20051859aa3dc7109d50e60bb47a490d4f4e21da55c9059
MD5 SHA1 SHA512

Submit Download

6bv8I42ADOq5.bat

Path C:\Users\Admin\AppData\Local\Temp\6bv8I42ADOq5.bat
Size 214B
SHA256 5b4fff6bbb3527e721389516cb633d9181361344b1cc659ca56438232a2ef7a9
MD5 218375e7baaf15d070e55286c2aab318
SHA1 f4f0e9f0266b704489bfb9033d34090652d1eb64
SHA512 57ee883fdba0621a5b5c60c8975def4907f46c4728d344f3464057c99899dfa64820df933c2b78933216273890b6d9a58bab93d4b2a27c079f67d1626093f567
MD5 SHA1 SHA512

Submit Download

LjElBVQ6oX0u.bat

Path C:\Users\Admin\AppData\Local\Temp\LjElBVQ6oX0u.bat
Size 214B
SHA256 b91590a528588af4df1425f2897e50fb05ac11ca284a27c83512e0a14872f6c8
MD5 638242984844888bb7f8ac8b55d54314
SHA1 d64ddcd1a9525bd86b2041426cfc877ac206171f
SHA512 58414484f072e69a9e3d52084de85dac033c3ca4c96e08761592bb664ef76891a22280674c90a9353d24d7d38a7382812df162ed352208e6e927b186c0082d11
MD5 SHA1 SHA512

Submit Download

MbyOUPBURvCQ.bat

Path C:\Users\Admin\AppData\Local\Temp\MbyOUPBURvCQ.bat
Size 214B
SHA256 8845eb2347ee644f9a369da4ca4de59b4b572eb1eb8854fde7b574df4a80e66d
MD5 bafa78954f68e9d53bf0e2fbf0f3acef
SHA1 19116e86057dcd0292791c72e71d87f211155543
SHA512 8ae314d555763207febcd41a9bfd28f1b9e58a3964cee985d1972d5cf017742fe14978985607f5d2f88266671a25e374ab1476ae390fc444ac934da8d7c8b9dc
MD5 SHA1 SHA512

Submit Download

Omcyxn8cQdv2.bat

Path C:\Users\Admin\AppData\Local\Temp\Omcyxn8cQdv2.bat
Size 214B
SHA256 ac3ccaa627f401b5d12d0a0aab8f7b74fa0b744a421002c1b6ad809c00be8586
MD5 42251c8d2a18432c04dcf61810b0d4d6
SHA1 351a77aa32d6ddfe9af5bf10d21c6f1e2e877e1a
SHA512 c1c981a3c315eb95980f81235ce21fbf741ccd1db717e75d12c70ab78eebc2cab705219fc194c5ced742499e6ffa91f773b15dab5fcd2243212fc1596f328dcb
MD5 SHA1 SHA512

Submit Download

TAIRK1WDOow8.bat

Path C:\Users\Admin\AppData\Local\Temp\TAIRK1WDOow8.bat
Size 214B
SHA256 00c80ea97d7509b0ce7177b6bfb51c9836488200ece9a897f9178d97a7b945b4
MD5 dc5491cd5d2baa7bad5f251c95701106
SHA1 d3059768335921f59da66b661b9b487530367546
SHA512 bd25de54e2d6dc728596786b5f24b3062893b73fd62ea410652570fe81d05e1944a25626411f69aab59323b23d148629b90616239346aad73683710d263a62fe
MD5 SHA1 SHA512

Submit Download

a09thkdepECC.bat

Path C:\Users\Admin\AppData\Local\Temp\a09thkdepECC.bat
Size 214B
SHA256 40997d140c9181bdfb60d6d9c63e3dac4cb7bcd072c67d590cd73c97a0ddebee
MD5 9e777b9e9c207ea131c6c6c9bb0eaec9
SHA1 8a654774abf6ef9ec9434f8d223841cc5ac325ea
SHA512 74175651fa10a98f377246f883474b254f8a7b7ad1da3c37d6290a3473b9688467d4f0eb7cccaef05abcf71b3be329334c3adc01db72c5cb308aa0112f71f8c2
MD5 SHA1 SHA512

Submit Download

e1DjhDqe0Rkx.bat

Path C:\Users\Admin\AppData\Local\Temp\e1DjhDqe0Rkx.bat
Size 214B
SHA256 c051366f039f4332123d131fd1282fd946349f3288c32b01034a76dd8ab6ee6f
MD5 147eee4fbd7120a41a3e8a83952f3d84
SHA1 318a543ef37c7700f2970f0322fe06d94b30d3f0
SHA512 4eeb400704a61afcd53b29590a53925f895a91b23ea658766b6d4415bdcfd3f7156418ce9c0c328393f26e2886f120bda214114364eec3c67f18acf403488a14
MD5 SHA1 SHA512

Submit Download

emlz1aQLfgKx.bat

Path C:\Users\Admin\AppData\Local\Temp\emlz1aQLfgKx.bat
Size 214B
SHA256 264b67f93e21db44bedba28b6d5b501a08b425206522949bf73cc41ae7b94b4d
MD5 54588400c7661b26a5fd77f0492dab5c
SHA1 6b817227bcf1ec899a4eeb27b8ba25ea4c61725d
SHA512 48d0fcdf9f9af646179abcaaa6089dea296d1e27ee3c36d5c0411021ef3e1a5f46b542154cd90bf47d02fea5760d706cc08e943e4ff2b5bbd1b03c1fb14c70d1
MD5 SHA1 SHA512

Submit Download

fJsC8lXjuyMF.bat

Path C:\Users\Admin\AppData\Local\Temp\fJsC8lXjuyMF.bat
Size 214B
SHA256 48f41d961d47fdc718ddeaca8c072e8efc2604542ea9f4cf60b9a47203f43c9f
MD5 d358d3195cf4eb18217ccbc358b8dd97
SHA1 c441e79518daf57cc7dd64b4c98182c7e6aaf779
SHA512 264f1ec610e18ed8d49806ddd7c3de49e63ce078bf911ddfdad25ea92599b813329fb9e30fe8486727f2ac35875c48e88648151c773d020130c75e272f55ebb9
MD5 SHA1 SHA512

Submit Download

vNVipw5me0Qd.bat

Path C:\Users\Admin\AppData\Local\Temp\vNVipw5me0Qd.bat
Size 214B
SHA256 ed7b18a53f26d2b62ccfc88bb1b8148cf3c3c69ddd74084d9118358ac1cfb0f1
MD5 23ecdf3291d82f429964701cab19ce5e
SHA1 3e72659f7bd469f865b5bfb82269d8f3dae6ccc0
SHA512 26714c8a8cae447ba368bf61309fb30e11ec14f7cd0bc0f5b9019942edd0a08895e74d8c56e6f42a1ff59bd1d770dbd39e702f90da495a5d9b6b1f15643d4b32
MD5 SHA1 SHA512

Submit Download

vWbdav0CDMfG.bat

Path C:\Users\Admin\AppData\Local\Temp\vWbdav0CDMfG.bat
Size 214B
SHA256 e0a53aba556715171e842efb9c45a454e187cd3b775de6f417fa6135906063df
MD5 010d845821265c6b27301da42ae1d27d
SHA1 c08fc77d084f80b47ab2d927a8f89a69744ebc4a
SHA512 42912cd30cbd4382bbb9ccc9ae8ad2d35f3a523c67eb1aac21fbc1945517538c4e972a74d0eb9892817f667ec046b9038fddcdc63a081b6d2ace5f5954185eea
MD5 SHA1 SHA512

Submit Download

vj6iDUXjDHKO.bat

Path C:\Users\Admin\AppData\Local\Temp\vj6iDUXjDHKO.bat
Size 214B
SHA256 2b81aa153347c6e8d56ae13c4afb95650936269b17cb34094a9107b31daad457
MD5 69baacc4baa998b95b7a71a17134ef11
SHA1 d8fc8e06e3e2181b2db063e365ab2c398a6112c1
SHA512 12de4499a935fde70ada9507cda99e35e2822428ce633c9fd19c0d4ba87bd531f776548567985075742f6a36b51d8d2489c21c8bbee13c84bda3a53ec6e6390f
MD5 SHA1 SHA512

Submit Download

zSz6muBG9H6Z.bat

Path C:\Users\Admin\AppData\Local\Temp\zSz6muBG9H6Z.bat
Size 214B
SHA256 25050c5730201a809c6291d6d257b413df2fce9e298b51c51a54741cd2c87b7a
MD5 3b27525dd375f684c17360ac0e0099c1
SHA1 46128faba02251d16af7ed863c846c9e690c02d1
SHA512 50df4492aad5001c17554e062c659aa43701eb5426d141c4f0fbd2052956082b462d1f88d0469c23903b9a6ba919e9b4cc4b89c899731858346d157373cf26d8
MD5 SHA1 SHA512

Submit Download

memory/1068-9-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

Download

memory/1068-0-0x00007FFAA59E3000-0x00007FFAA59E5000-memory.dmp

Download

memory/1068-4-0x000000001C230000-0x000000001C2E2000-memory.dmp

Download

memory/1068-3-0x000000001C120000-0x000000001C170000-memory.dmp

Download

memory/1068-2-0x00007FFAA59E0000-0x00007FFAA64A1000-memory.dmp

Download

memory/1068-1-0x0000000000700000-0x0000000000A24000-memory.dmp

Download

memory/2168-17-0x00007FFAA56C0000-0x00007FFAA6181000-memory.dmp

Download

memory/2168-12-0x00007FFAA56C0000-0x00007FFAA6181000-memory.dmp

Download

memory/2168-13-0x00007FFAA56C0000-0x00007FFAA6181000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads