Malware Analysis Report

2024-08-06 11:11

Sample ID 240614-wsajna1dqh
Target SiHost.exe
SHA256 9b87f3813641da8be21f130cdd5cb52c2f8ae5494a408d2303f9770b7f3039d8
Tags
farrag quasar spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9b87f3813641da8be21f130cdd5cb52c2f8ae5494a408d2303f9770b7f3039d8

Threat Level: Known bad

The file SiHost.exe was found to be: Known bad.

Malicious Activity Summary

farrag quasar spyware trojan

Quasar payload

Quasar RAT

Quasar family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Drops file in System32 directory

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Creates scheduled task(s)

Runs ping.exe

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Scheduled Task/Job
T1053
Persistence
TA0003
Scheduled Task/Job
T1053
Privilege Escalation
TA0004
Scheduled Task/Job
T1053
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Remote System Discovery
T1018
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 18:10

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 18:10

Reported

2024-06-14 18:11

Platform

win7-20240220-en

Max time kernel

52s

Max time network

56s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SiHost.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Users\Admin\AppData\Local\Temp\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Users\Admin\AppData\Local\Temp\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost C:\Windows\SysWOW64\SiHost\SiHost.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1620 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 1620 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 1620 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 1620 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 1620 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 1620 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 1620 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 1620 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 2536 wrote to memory of 2516 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2536 wrote to memory of 2516 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2536 wrote to memory of 2516 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2536 wrote to memory of 2516 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\SiHost.exe

"C:\Users\Admin\AppData\Local\Temp\SiHost.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "SiHost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\SiHost.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\SiHost\SiHost.exe

"C:\Windows\SysWOW64\SiHost\SiHost.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "SiHost" /sc ONLOGON /tr "C:\Windows\SysWOW64\SiHost\SiHost.exe" /rl HIGHEST /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 17.ip.gl.ply.gg udp
US 147.185.221.17:33386 17.ip.gl.ply.gg tcp
US 147.185.221.17:33386 17.ip.gl.ply.gg tcp
US 147.185.221.17:33386 17.ip.gl.ply.gg tcp

Files

memory/1620-0-0x000000007413E000-0x000000007413F000-memory.dmp

memory/1620-1-0x00000000008D0000-0x000000000092E000-memory.dmp

memory/1620-2-0x0000000074130000-0x000000007481E000-memory.dmp

\Windows\SysWOW64\SiHost\SiHost.exe

MD5 c6250d3d376c1956627bf8f4f827bbd6
SHA1 7444e248bc182e849556cfa3c2519e30ae8ee82f
SHA256 9b87f3813641da8be21f130cdd5cb52c2f8ae5494a408d2303f9770b7f3039d8
SHA512 8de084cac0e01c8d5b1c8e5443ef97a1412bb4b7ed41d1e4c5e1b5e40750b0bb6d06c9a3b16e325ca8bbe260397ee130560d0d699ff302f2ef5f8196231fa44e

memory/2536-10-0x0000000000DC0000-0x0000000000E1E000-memory.dmp

memory/1620-13-0x0000000074130000-0x000000007481E000-memory.dmp

memory/2536-11-0x0000000074130000-0x000000007481E000-memory.dmp

memory/2536-12-0x0000000074130000-0x000000007481E000-memory.dmp

memory/2536-15-0x0000000074130000-0x000000007481E000-memory.dmp

memory/2536-16-0x0000000074130000-0x000000007481E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 18:10

Reported

2024-06-14 18:11

Platform

win10v2004-20240508-en

Max time kernel

59s

Max time network

63s

Command Line

"C:\Users\Admin\AppData\Local\Temp\SiHost.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\SiHost\SiHost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A api.ipify.org N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Users\Admin\AppData\Local\Temp\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Users\Admin\AppData\Local\Temp\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
File opened for modification C:\Windows\SysWOW64\SiHost C:\Windows\SysWOW64\SiHost\SiHost.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\SiHost\SiHost.exe

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A
N/A N/A C:\Windows\SysWOW64\SiHost\SiHost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2588 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2588 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2588 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2588 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 2588 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 2588 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\SiHost.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 5084 wrote to memory of 3208 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 5084 wrote to memory of 3208 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 5084 wrote to memory of 3208 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 5084 wrote to memory of 4696 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 5084 wrote to memory of 4696 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 5084 wrote to memory of 4696 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 4696 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4696 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4696 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4696 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4696 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4696 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4696 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 4696 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 4696 wrote to memory of 2504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 2504 wrote to memory of 2852 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2504 wrote to memory of 2852 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2504 wrote to memory of 2852 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 2504 wrote to memory of 4552 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 4552 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 4552 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 4552 wrote to memory of 1020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4552 wrote to memory of 1020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4552 wrote to memory of 1020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4552 wrote to memory of 4832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4552 wrote to memory of 4832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4552 wrote to memory of 4832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4552 wrote to memory of 3460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 4552 wrote to memory of 3460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 4552 wrote to memory of 3460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 3460 wrote to memory of 2924 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 3460 wrote to memory of 2924 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 3460 wrote to memory of 2924 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 3460 wrote to memory of 4564 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 3460 wrote to memory of 4564 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 3460 wrote to memory of 4564 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 4564 wrote to memory of 5044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4564 wrote to memory of 5044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4564 wrote to memory of 5044 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4564 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4564 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4564 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4564 wrote to memory of 5116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 4564 wrote to memory of 5116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 4564 wrote to memory of 5116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\SiHost\SiHost.exe
PID 5116 wrote to memory of 3752 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 5116 wrote to memory of 3752 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 5116 wrote to memory of 3752 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\schtasks.exe
PID 5116 wrote to memory of 4676 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 5116 wrote to memory of 4676 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 5116 wrote to memory of 4676 N/A C:\Windows\SysWOW64\SiHost\SiHost.exe C:\Windows\SysWOW64\cmd.exe
PID 4676 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4676 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4676 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4676 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4676 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4676 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\SiHost.exe

"C:\Users\Admin\AppData\Local\Temp\SiHost.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "SiHost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\SiHost.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\SiHost\SiHost.exe

"C:\Windows\SysWOW64\SiHost\SiHost.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "SiHost" /sc ONLOGON /tr "C:\Windows\SysWOW64\SiHost\SiHost.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XKrnl0k8GBSB.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5084 -ip 5084

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 1900

C:\Windows\SysWOW64\SiHost\SiHost.exe

"C:\Windows\SysWOW64\SiHost\SiHost.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "SiHost" /sc ONLOGON /tr "C:\Windows\SysWOW64\SiHost\SiHost.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o8ZKNqSGSdIT.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2504 -ip 2504

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 1632

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\SiHost\SiHost.exe

"C:\Windows\SysWOW64\SiHost\SiHost.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "SiHost" /sc ONLOGON /tr "C:\Windows\SysWOW64\SiHost\SiHost.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BVzvQpHYHkNA.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3460 -ip 3460

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 1608

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\SiHost\SiHost.exe

"C:\Windows\SysWOW64\SiHost\SiHost.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "SiHost" /sc ONLOGON /tr "C:\Windows\SysWOW64\SiHost\SiHost.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bOYLE0ivmpLl.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5116 -ip 5116

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 2176

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 api.ipify.org udp
US 8.8.8.8:53 ip-api.com udp

Files

memory/2588-0-0x00000000746EE000-0x00000000746EF000-memory.dmp

memory/2588-1-0x00000000002A0000-0x00000000002FE000-memory.dmp

memory/2588-2-0x0000000005200000-0x00000000057A4000-memory.dmp

memory/2588-3-0x0000000004D10000-0x0000000004DA2000-memory.dmp

memory/2588-4-0x00000000746E0000-0x0000000074E90000-memory.dmp

memory/2588-5-0x0000000004DD0000-0x0000000004E36000-memory.dmp

memory/2588-6-0x0000000005A10000-0x0000000005A22000-memory.dmp

memory/2588-7-0x00000000746EE000-0x00000000746EF000-memory.dmp

memory/2588-8-0x00000000746E0000-0x0000000074E90000-memory.dmp

C:\Windows\SysWOW64\SiHost\SiHost.exe

MD5 c6250d3d376c1956627bf8f4f827bbd6
SHA1 7444e248bc182e849556cfa3c2519e30ae8ee82f
SHA256 9b87f3813641da8be21f130cdd5cb52c2f8ae5494a408d2303f9770b7f3039d8
SHA512 8de084cac0e01c8d5b1c8e5443ef97a1412bb4b7ed41d1e4c5e1b5e40750b0bb6d06c9a3b16e325ca8bbe260397ee130560d0d699ff302f2ef5f8196231fa44e

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SiHost.exe.log

MD5 8013ca45a4b68a281377f2c7b517ac8a
SHA1 aff79b7c8f408e5ae6f00cf9d83e2fd95d9affc3
SHA256 234381ea204c431d0936c4141a38381629938e4f5d40dd0ef01de6a282abbae7
SHA512 428305df713c12d2165303a9b0433c83a0e3f3088a9551deb6403e9351814c38c2377e7c22ede57bcd23ca764e02fce431c52aba6bf4b998b89a518129fda2d6

memory/5084-17-0x00000000746E0000-0x0000000074E90000-memory.dmp

memory/2588-16-0x00000000746E0000-0x0000000074E90000-memory.dmp

memory/5084-18-0x00000000746E0000-0x0000000074E90000-memory.dmp

memory/5084-20-0x00000000061E0000-0x00000000061EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XKrnl0k8GBSB.bat

MD5 9a179e54e5f42c940f68265b1a010f12
SHA1 a7fbd764dbfb8690e869c77118f170904f735650
SHA256 02d98ead6bd1cc559bfd008615a100dfc6834e431fe38213d57f18113a785009
SHA512 4f692d44c7edfa818f2652abe36a84a881c4f152e991c4fcac2050f4d0fee05e2a1bc50f01d84d5a5704d5dde32d075ee11ca54ab47aeb97b5b1b0f590470837

memory/5084-25-0x00000000746E0000-0x0000000074E90000-memory.dmp

C:\Users\Admin\AppData\Roaming\SiHost\06-14-2024

MD5 5fc8a9e1cd94300dfdcc56daf7f09f6f
SHA1 5ad184e69d7f86bac22bbd4c0ff6d7852875547c
SHA256 b09e643e004e4dff5e018f61cb858004296e0f4fc0d04a392fb9cbbcc996df5f
SHA512 ad9df377782985b88e4c9b46a742d38348833d8707fe9638d8f0eb012e0a79fcafe60c4e2607732e731f5b6e5003f1dd1ba3f616b2e71866d4ff437f0fd3d8ec

C:\Users\Admin\AppData\Local\Temp\o8ZKNqSGSdIT.bat

MD5 bb19e42226c14be82c8646d29d67158f
SHA1 1a40c876ac6aece0c69771847394b0e18a5dab1a
SHA256 0ba3f1e1ed33d974aaf3aa132edad24c3e0612df2b2057e5f435721788f240d1
SHA512 d39a00af4a3e8f3632ab18633a35e76ef7e308454b3bb2fcdcacea562f5e029c16fb40d00c3fb5f0f5ae17e8eb57dfdc2dc51b7d6bc1b790e828275d09024037

C:\Users\Admin\AppData\Roaming\SiHost\06-14-2024

MD5 1b9ffb5305dabaabc6e5caa5e10791ed
SHA1 dfbd1dd0d856ddb793f73ccbdf7330358e0b4a04
SHA256 2b07b6fd046e3a08bda5b2431592c330c0767aa8c44d07a7934c907848772429
SHA512 1a3f13b688ff3a8fc3ac38180a3848a31c20858238546865e459496a5d865d7f3296de73e48d55a7c4da48cb80e91e307fc53ead1f232198bcff9507ba2a35a9

C:\Users\Admin\AppData\Local\Temp\BVzvQpHYHkNA.bat

MD5 7a3145f8fcf844ae3cd8bce488b60685
SHA1 d1ab6a80df2f019ded64338bc98d34edcf3f63f7
SHA256 30a2624ed8c06fc5ecc054a263ceb0fca999b17d1bb489d6af4d4af44d114b0f
SHA512 e3094f16c77ba51b91e18918b965a811052082f6b4cf8bd2d8229273b146110a8f188b0af32068ad95497676f0604bc293b29e8d4cdc44824e5e7b718bed856d

C:\Users\Admin\AppData\Local\Temp\bOYLE0ivmpLl.bat

MD5 56ea296d68eb8828b087eb0711690280
SHA1 e3abc765e1097a5d57315b555286ac108eed1339
SHA256 049a89376aab73510461b36908282bf979269b4720f662544820d1e1c2eb34cb
SHA512 75fcad899ce959f1b6c77ec912239f052774912cb407d0a8eb987d8ca5dba1afed8fd6dde10ef9f189ecc6ef3094c3c87e4aa1525a018fa86bec124eb43a3e5b