Malware Analysis Report

2024-08-06 11:26

Sample ID 240614-239z6atdrj
Target Client-built.exe
SHA256 47f06153275d1f01d1d7410eb5917aead5a79660be5da59bf51f31698343c357
Tags
school quasar spyware trojan persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

47f06153275d1f01d1d7410eb5917aead5a79660be5da59bf51f31698343c357

Threat Level: Known bad

The file Client-built.exe was found to be: Known bad.

Malicious Activity Summary

school quasar spyware trojan persistence

Quasar family

Quasar payload

Quasar RAT

Executes dropped EXE

Adds Run key to start application

Looks up external IP address via web service

Enumerates physical storage devices

Program crash

Unsigned PE

Runs ping.exe

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
System Information Discovery
T1082
Remote System Discovery
T1018
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 23:07

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 23:07

Reported

2024-06-14 23:12

Platform

win10-20240611-en

Max time kernel

275s

Max time network

295s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4756 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SysWOW64\schtasks.exe
PID 4756 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SysWOW64\schtasks.exe
PID 4756 wrote to memory of 4496 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SysWOW64\schtasks.exe
PID 4756 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 4756 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 4756 wrote to memory of 3692 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 3692 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 3692 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 3692 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Client-built.exe

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client-built.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 runderscore00-37568.portmap.host udp
DE 193.161.193.99:37568 runderscore00-37568.portmap.host tcp
US 8.8.8.8:53 99.193.161.193.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp

Files

memory/4756-0-0x000000007341E000-0x000000007341F000-memory.dmp

memory/4756-1-0x0000000000B00000-0x0000000000B6C000-memory.dmp

memory/4756-2-0x0000000005880000-0x0000000005D7E000-memory.dmp

memory/4756-3-0x00000000054A0000-0x0000000005532000-memory.dmp

memory/4756-4-0x0000000073410000-0x0000000073AFE000-memory.dmp

memory/4756-5-0x0000000005400000-0x0000000005466000-memory.dmp

memory/4756-6-0x0000000006140000-0x0000000006152000-memory.dmp

memory/4756-7-0x0000000006530000-0x000000000656E000-memory.dmp

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

MD5 0c84b58a5322284269f3b86e648e1fc8
SHA1 6776c3963a64a3ace4caaff164669364356f72aa
SHA256 47f06153275d1f01d1d7410eb5917aead5a79660be5da59bf51f31698343c357
SHA512 02bc07552096f2b052e064ed2941cde5b70058066b614fa7374dbf7aa2177458a22d9746181b8f88e3468b252adf7e1aa1518ed9085ed78af5b736a02fa297d7

memory/3692-14-0x0000000073410000-0x0000000073AFE000-memory.dmp

memory/4756-15-0x0000000073410000-0x0000000073AFE000-memory.dmp

memory/3692-16-0x0000000073410000-0x0000000073AFE000-memory.dmp

memory/3692-18-0x0000000006090000-0x000000000609A000-memory.dmp

memory/3692-19-0x0000000073410000-0x0000000073AFE000-memory.dmp

memory/3692-20-0x0000000073410000-0x0000000073AFE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 23:07

Reported

2024-06-14 23:12

Platform

win10v2004-20240611-en

Max time kernel

93s

Max time network

286s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1904 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SysWOW64\schtasks.exe
PID 1904 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SysWOW64\schtasks.exe
PID 1904 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SysWOW64\schtasks.exe
PID 1904 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 1904 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 1904 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 4716 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 4716 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 4716 wrote to memory of 4800 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Client-built.exe

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client-built.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 runderscore00-37568.portmap.host udp
DE 193.161.193.99:37568 runderscore00-37568.portmap.host tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 99.193.161.193.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 57.15.31.184.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

memory/1904-0-0x0000000074F9E000-0x0000000074F9F000-memory.dmp

memory/1904-1-0x0000000000D50000-0x0000000000DBC000-memory.dmp

memory/1904-2-0x0000000005E20000-0x00000000063C4000-memory.dmp

memory/1904-3-0x00000000057C0000-0x0000000005852000-memory.dmp

memory/1904-4-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/1904-5-0x0000000005870000-0x00000000058D6000-memory.dmp

memory/1904-6-0x00000000064D0000-0x00000000064E2000-memory.dmp

memory/1904-7-0x0000000006A10000-0x0000000006A4C000-memory.dmp

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

MD5 0c84b58a5322284269f3b86e648e1fc8
SHA1 6776c3963a64a3ace4caaff164669364356f72aa
SHA256 47f06153275d1f01d1d7410eb5917aead5a79660be5da59bf51f31698343c357
SHA512 02bc07552096f2b052e064ed2941cde5b70058066b614fa7374dbf7aa2177458a22d9746181b8f88e3468b252adf7e1aa1518ed9085ed78af5b736a02fa297d7

memory/4716-14-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/1904-15-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/4716-16-0x0000000074F90000-0x0000000075740000-memory.dmp

memory/4716-18-0x0000000006C10000-0x0000000006C1A000-memory.dmp

memory/4716-19-0x0000000074F90000-0x0000000075740000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 23:07

Reported

2024-06-14 23:12

Platform

win11-20240508-en

Max time kernel

296s

Max time network

301s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quasar Client Startup = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\"" C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A api.ipify.org N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5032 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SysWOW64\schtasks.exe
PID 5032 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SysWOW64\schtasks.exe
PID 5032 wrote to memory of 924 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Windows\SysWOW64\schtasks.exe
PID 5032 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 5032 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 5032 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\Client-built.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 908 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 908 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 908 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 908 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 908 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 908 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 2960 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2960 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2960 wrote to memory of 4664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 2960 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2960 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2960 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2960 wrote to memory of 4364 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 2960 wrote to memory of 4364 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 2960 wrote to memory of 4364 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 4364 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 4364 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 4364 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 4364 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 4364 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 4364 wrote to memory of 1104 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 1104 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1104 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1104 wrote to memory of 2788 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1104 wrote to memory of 3428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1104 wrote to memory of 3428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1104 wrote to memory of 3428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1104 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 1104 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 1104 wrote to memory of 2096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 2096 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 2096 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 2096 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 2096 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 3128 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 3128 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3128 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3128 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3128 wrote to memory of 4932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3128 wrote to memory of 4932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3128 wrote to memory of 4932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3128 wrote to memory of 3904 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 3128 wrote to memory of 3904 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 3128 wrote to memory of 3904 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
PID 3904 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 3904 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 3904 wrote to memory of 4168 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\schtasks.exe
PID 3904 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 3904 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 3904 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Roaming\SubDir\Client.exe C:\Windows\SysWOW64\cmd.exe
PID 4872 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4872 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4872 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4872 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4872 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4872 wrote to memory of 2020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4872 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Client-built.exe

"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client-built.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ITXidgLf3wDM.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 908 -ip 908

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 1660

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6RV1y1KfbBWx.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4364 -ip 4364

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1108

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TG4rPdi0Oe7p.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2096 -ip 2096

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 2272

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8hGtOHlJDJ8j.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3904 -ip 3904

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 1728

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hcVLoy2CqDan.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3708 -ip 3708

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 1760

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dEuETeU8S1nM.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2648 -ip 2648

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 1732

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3cMPYfpJMLxj.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3348 -ip 3348

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3348 -s 1744

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NQ7WCX3Ld0rh.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1844 -ip 1844

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 1104

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iOmLSuCCXf9P.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2440 -ip 2440

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 1108

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zhNdKZo97MAS.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1852 -ip 1852

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 1108

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\liHilNzbagRk.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2412 -ip 2412

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 1736

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mOVtZNdrQujw.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1596 -ip 1596

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 2232

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ez63RJvTVuGb.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4624 -ip 4624

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 1748

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 api.ipify.org udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp

Files

memory/5032-0-0x0000000074C0E000-0x0000000074C0F000-memory.dmp

memory/5032-1-0x0000000000220000-0x000000000028C000-memory.dmp

memory/5032-2-0x0000000005370000-0x0000000005916000-memory.dmp

memory/5032-3-0x0000000004DC0000-0x0000000004E52000-memory.dmp

memory/5032-4-0x0000000074C00000-0x00000000753B1000-memory.dmp

memory/5032-5-0x0000000004E60000-0x0000000004EC6000-memory.dmp

memory/5032-6-0x0000000005A60000-0x0000000005A72000-memory.dmp

memory/5032-7-0x0000000074C0E000-0x0000000074C0F000-memory.dmp

memory/5032-8-0x0000000074C00000-0x00000000753B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

MD5 0c84b58a5322284269f3b86e648e1fc8
SHA1 6776c3963a64a3ace4caaff164669364356f72aa
SHA256 47f06153275d1f01d1d7410eb5917aead5a79660be5da59bf51f31698343c357
SHA512 02bc07552096f2b052e064ed2941cde5b70058066b614fa7374dbf7aa2177458a22d9746181b8f88e3468b252adf7e1aa1518ed9085ed78af5b736a02fa297d7

memory/5032-15-0x0000000074C00000-0x00000000753B1000-memory.dmp

memory/908-16-0x0000000074C00000-0x00000000753B1000-memory.dmp

memory/908-17-0x0000000074C00000-0x00000000753B1000-memory.dmp

memory/908-19-0x0000000006DF0000-0x0000000006DFA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ITXidgLf3wDM.bat

MD5 87dab5edf0f14e6c04f57e62ad8dfe28
SHA1 434f6d3777e8e1d43d8503a95eeb68b0d1a006fb
SHA256 ddf4af008d86f62b70b988897f7175d5ee9c72a24cd582daf9d7ab3aaa5186f9
SHA512 5a2587a89f8a52d046a3a59934eea6e01a3ca093b11ae24a9d44ff057d86b6c43a76cbb52ad3ece7fc84fab6d2d6b5a0d389f3b6d23f25bba2a0d4719af78571

memory/908-24-0x0000000074C00000-0x00000000753B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 11752995e2883258657bc2ee956a7032
SHA1 56a371d492dbee954236a3d979c4b81f09b5cf9b
SHA256 13f3dcb1774829d01cf3132cbd2693651746ed52255b956f6762014f299c6b96
SHA512 3280911afb2b9ad0864bb34cb8b07dbcae06920bea85890d9689f5f511b722c2fad8d85f3940fa76353526409729de63cdc41a9bf3860ee450e13b3194a55134

C:\Users\Admin\AppData\Local\Temp\6RV1y1KfbBWx.bat

MD5 ef5ccf6719744b3effa5bcb2493618fc
SHA1 6f009a5f4bd06e4428d0578cd73481fccdc7c1b8
SHA256 8313329f906af451526a939d3a5a2882da4943b484b66945989f4ac5bbfaef02
SHA512 7616fd4cbf11b6243919c7d7859b72041fc2443fd5e1cfcb78fbcc571e6c04d3fea058cb831f91aa0f7a85323f67e34e9644969e9ec05165fa2df21aeb9f36d0

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 9654a1526c5337ce2a00a2a62651f8ed
SHA1 df946d74f1de9f89d9d7413500c50b62b89377cf
SHA256 a178cc3b788797308369fba5e89437abeca365699c803aee59c15ef8d080c9a9
SHA512 221c1705e67bd29fabebbc0e3d30ea77296a9cd7b806c57e26705802bef8e87199c5d689113dca98d85be59f9af6f32ae4fdbeac58f40609ec6e5f6d42aa8980

C:\Users\Admin\AppData\Local\Temp\TG4rPdi0Oe7p.bat

MD5 87c264b13c3aa9e2aa183f33491d7235
SHA1 a7db034da067054edd40aca9e868fb143dd21174
SHA256 d2cee25984fcc8640864757e86f6e09cc60d3bea90979c9e295bc09640a8e373
SHA512 b0a8202e4741cef215e4b74f4a288b9eceae662af898901757861d9ccddf030ceb92bf58ef7d8bcfa15da4f49ba44c20a52662b9e29e0885bfcfd7bc15fb2afd

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 8472909ce840c5eaae1c04a47b2a123d
SHA1 94a66fff0b2ce69ce039d967eb13cf3793a6bd80
SHA256 42edb53d1d1ea2b37e4ba6ace7ca0f1f4a22fbcb94b52269f71d5206f325f8b1
SHA512 97ca7e7a242c88060a209f88df4180be68cae1afa13bffab53ac0dd41764f0f3fad3fcaf510418dba616c8624146cc795f7dc8f3973810b6c792e5d5f27548fb

C:\Users\Admin\AppData\Local\Temp\8hGtOHlJDJ8j.bat

MD5 434a1284222935b9b310d037ba1b1ee1
SHA1 6c542c0a2894891122c3f2f591f002be15216fa5
SHA256 da7651f0701e9df5798ec402ea7f15305626146c742906fcbab4692ff9fe40ac
SHA512 9af2f0fe1dba89061b213e0c5b8bcc7272e70fe2367af0e06188561b9b2d6f98da55278f7b70f7b30dc5043bd2e5ec842b3e664ba09c8b6d1a77476a52d61ebe

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 678b9600c35fa1459192866c47da967d
SHA1 0c88a9663350fef55a0882282b1b222b3f6b36f4
SHA256 71e2129a79458407c87a030b8e36c7c2ab63b8286c51b086301e55e7b896c8f8
SHA512 2d75765bdb3e5d111c4cea3854d5d851811d1cc1d59ba7e56514b55d9b5bb1ad9201003e9c5a40ecb573e74e5f076142490908b7663e4d565a0f2ea4be27aa42

C:\Users\Admin\AppData\Local\Temp\hcVLoy2CqDan.bat

MD5 d74a2e6d32d17cbd45a1428602f44b32
SHA1 2affbab9c11d1500a9eaf5cb2a23a47dacf8571f
SHA256 eb9043ba0ef1a62e867371ff9596b27a1359ef27af0c83605468b6a81a8904ba
SHA512 1eac4a0a65a7c3d6a93c9ecbaa63b790bb880b927a1ba60cea205ddf00bc5010aa90a0f2482abc66f61787c2656d6327af0f804483a4b613c2aa3678b10c12ad

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 00df9d9dbea16fda039939efcd67e5c2
SHA1 92862e70159b2369d729f0f03b933b98d0c977be
SHA256 2dab69c5c3863d74eee7ea750efafd4dea0947c5652fe2763a5af07a24e44e5f
SHA512 f9a9e89d63a572537abba5bad27e5198b978555b5e33c0debe09125782e33548f0bb0128d36b6981bed711ec4ee50793071133e17652284df9be0209b76d469d

C:\Users\Admin\AppData\Local\Temp\dEuETeU8S1nM.bat

MD5 59c0022bb0f0f2cfdf90459b65e75254
SHA1 622d002d1cb7542461bb85b34ea1f7e6db4be7ec
SHA256 9fd6761c553efcaf72ace5ac1c0857f323d8ba655276f81b7eff9127445b80f7
SHA512 e3f42d1020d7c478e1974bd9e5ac9ecbc3fdce9134b0cba6d8774c486e12057ce99fd1366461dd2dd44ccdfc08f3e35b527b81122990856ee398ebb00f7e6a9c

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 ea4a310485364fdf050fb3b9f7198f0f
SHA1 456b971bc2f9c06c8e73a0929b304b35b99afb35
SHA256 1aa144781d7b7f404766e5cb447ef8c9d09ab6c71aceec3558b69497601e979c
SHA512 ee445f520653afa7ed85d8e9e1252783f8869a2f9622f4b2d79d8a8da1a8a76a3f825931a4941c4d2008f3adfcf045ae332b84f860aa19f67b2a3272c6978909

C:\Users\Admin\AppData\Local\Temp\3cMPYfpJMLxj.bat

MD5 c10e402f609c86bc91eccae2756ddc06
SHA1 ca62b2e6b58573493a1fbba31f8c6143e176ba44
SHA256 3662b0d0a71a2d819bcb24b1cf010e8f6e7910a5b366407b5b3800d3348e92b6
SHA512 f7e0f7af4d4df6dfee4b2ff15152cf8975ff96c03e6562363da0bd861b833707357e86c07e2f859b9f0bde09cb0f3a2dc4485f69b4f447b78cb8b42610a96d38

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 0c091f532cbc1eeef4b224cfeadffdc2
SHA1 007901396632dc1f39b477fec240013519645d70
SHA256 527b7d718d7354253470ded1859337309f29927db935961e77306213673474d4
SHA512 3df9ee89f69e58517c09583e4a01ac1357400dd6724cf1857f1b27715e0f631571e61a0c69e7cfc6f89ef412f3a05eaee9a6875e2f6005f5c9bfe5a4c2100209

C:\Users\Admin\AppData\Local\Temp\NQ7WCX3Ld0rh.bat

MD5 bdf42c783d9b7dbfea208cf21cbc2b4c
SHA1 d053d108a81083f9eedcc0b10f058c039e499d1f
SHA256 2b4f71b31e4a2f444451d86272bef3251c687456f8a6036f27e6b670bed9b2e6
SHA512 8d15b7ea4f93fdb5db01b1873d8c41e1c9b8d67e2431694d74281cd0ec89dfd04a33b8b26be6290fc8ab30a8fcdc035ed12f32a92a4673ec5d064b68da95c90b

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 f244e3ef397ed57ee97f41ee4b146c5c
SHA1 a999131ad2fe1b58ddae025b5094057ed754dc90
SHA256 a4da884cd45c8d4ba075591818d27d8c54a00675eaa077dd78e7de2c4c5177a8
SHA512 44cd12f155a34f30c814ddcea2641a04b3ada7737bf8471448990e9146145c1e09cee5113cb100758aeb1b99d13ca0b8575f4b20eb73c2269b39cca562056331

C:\Users\Admin\AppData\Local\Temp\iOmLSuCCXf9P.bat

MD5 0bea4d716f208d94f8a1a93c1af86939
SHA1 6c46fee4662674d5979e147d1593b051d104a01d
SHA256 731038623f963e98dec73620ffac83904711770d8f479d665b8eeb2d897cb89b
SHA512 50c79012ab4da71ba3d58b0f28a454cc9645325ecba4534724ba11ea6193aad888912b211e734230787d78ba7c1c8c2eb5ca7aa841cb0911095edcdf6da0aa11

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 150a920f5452a32cb516ec9489c23bb8
SHA1 beab0ee03a1aa0b59c4171c27453431af45690f5
SHA256 121074d019a16878298a72260cf2b01b1e7944ce0a3af86e95923b1c83e50a24
SHA512 f18ae3ddf2b72707b6d937b57062f95d63d46684a9548d54d3a6f3b9fb084b824dc106b44f4e0ccb0dfd18c042b5b8ccd38239a7655371c8d121a5592ab1cba5

C:\Users\Admin\AppData\Local\Temp\zhNdKZo97MAS.bat

MD5 839d68d216b468009640cb9b20fced52
SHA1 dbab8d76964366067c4feb745f19e427d2931fd2
SHA256 191ea8f5212eaee091088113589ec1418e0b3b6e5db291e10e85805c84329f7a
SHA512 d45c8a8096e1025b0c7f09ada4526ab3eae30e661df73c151006d84562f6906d34dac52ddfb829107b6820586dc1c1da9c6a63093aa163f726840fa81d9456d0

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 c005d5d1996084ec416bce71f28761d8
SHA1 34774283ec324b4227402685ec3e9137e95abfc1
SHA256 9ee3a7358fa3638ecf9b5b1177d7923368a06d6e3352051322a451dd9e4b86fa
SHA512 72dc3e5186bb04a0d334e6c013b25c5d2c7eaad737e8ea95347316f0bcbffc008e994e47cf08bda88ae614ebb50ac29daca7bfb1f7e655515dfcaeabc4b39041

C:\Users\Admin\AppData\Local\Temp\liHilNzbagRk.bat

MD5 4befae6c8680dc7cdc5030de838bdcd7
SHA1 484bab10cefea9cc84fed91a31d9bfa507d32b4c
SHA256 c736d709baa56b377bbb8712e73660ddf67cc0eee937335ab6f8607533536cd9
SHA512 9af4905865fa0147fc511361ddc0813f04160c1de3868d6aaa617cf98ac768bad5e2dd786790734c41f740b8f0bdf466b5274e6947530ed48f8a02d8b90bf1d6

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 598db3e2b7744ef8aebbbff4ccab44fd
SHA1 bec11a7897b82b870247792e39ac0214c1d84947
SHA256 27d2f51b374042aeef11fa12baa3b02ce27ab44748aaf534010fb6c52aa93356
SHA512 8910c99fa9c74468f8c486e525d40cbd678a806f276ec1e143a027914f9fda9a55dca141ddc68e8dfb8a484fd419d7b84d309b8900d141e30c105978d9239e2d

C:\Users\Admin\AppData\Local\Temp\mOVtZNdrQujw.bat

MD5 31a94d049f1ec5983c70787e9c23d976
SHA1 a09375949fff20c08ee16578a38c02bf4b14f4ba
SHA256 2b38bc19ddd479ad5b4da6ce80d7ff2bc0866eb179f43013262b5e950a609fa0
SHA512 dd6cb74f6517a331efed2dbe86744619b010ad169d67240da3515b5f10f6c1e0af553c430a836ba1df56da7a2c24c5e29e3eaaa82eacb35071ead978bd23ed03

C:\Users\Admin\AppData\Roaming\Logs\06-14-2024

MD5 4defc5338757f281d52c47f18958c393
SHA1 15dc3f3e00a85e401d4900b49d7827d3239901be
SHA256 bfffd5dd7f6df860761542f7443319bfbaecc959f06ec94ddba166d78c9c99b8
SHA512 54e1b00fa685d5a89bdd0ca17750f9a8e99c40409347f7089d93b02d2f2f097afc8e6f6936801c16b4f75cbab9e4f87a52e79556ffab7d83099dfc1dd3cc89fa

C:\Users\Admin\AppData\Local\Temp\ez63RJvTVuGb.bat

MD5 99c394429a0f6b13d4226e725dc29981
SHA1 4f6c1e45b0680da51a993bba39071e373df875d8
SHA256 2991fa6d50c709f59b13c170b82cf8af982ab183d2bb6a671fcfce36766a2ce8
SHA512 816f8d7faa8c2fc6ffd41f06c1b97e55f8b5ce3032c52ca2c89523a6307f6f7d6f5a59fc2c7b66cf630919bdd58969bc59407c748f3a24d40b5ed96dfb938586