quasar | 777aa9e8c28b2488da49ffa429fb03677c02a94f4e0d8574a90ad0c4bce208a5

Analysis

max time kernel
148s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 3.1MB
Sample240623-e8nb1szfla
SHA256 777aa9e8c28b2488da49ffa429fb03677c02a94f4e0d8574a90ad0c4bce208a5
MD5 552dd04907af2fa00817e5996dfe760b
SHA1 24658391a4fd6e98309d50acd85f40076f61681f
SHA512 1230c59168c66144ea977b27b7035ef6d01f82541a11f8860755600f4aa0b1559e7950419eb1e91669edcca58e3bdd132e6be081806d07ee1a1e8780731f9dda
SSDEEP 49152:3vvI22SsaNYfdPBldt698dBcjHIGbhoGdqTHHB72eh2NT:3vg22SsaNYfdPBldt6+dBcjHIGV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar hi spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

care-somewhere.gl.at.ply.gg:38177:38177

Mutex

1e96fc68-3845-4d50-9a21-431f60029a14

Attributes

encryption_key
D9185A099F336661ED8D6035D739C63B5B34E3D8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Update
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4064-1-0x0000000000550000-0x0000000000874000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023547-6.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 15 IoCs

pid	Process
2352	Client.exe
2104	Client.exe
2980	Client.exe
4196	Client.exe
3244	Client.exe
4484	Client.exe
1236	Client.exe
2248	Client.exe
4836	Client.exe
4640	Client.exe
1896	Client.exe
1768	Client.exe
3624	Client.exe
4164	Client.exe
888	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
4472	PING.EXE
2868	PING.EXE
1600	PING.EXE
4516	PING.EXE
5112	PING.EXE
4368	PING.EXE
4844	PING.EXE
3384	PING.EXE
5104	PING.EXE
3036	PING.EXE
2452	PING.EXE
4868	PING.EXE
4888	PING.EXE
3184	PING.EXE
2196	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3084	schtasks.exe
2324	schtasks.exe
3592	schtasks.exe
1984	schtasks.exe
3952	schtasks.exe
584	schtasks.exe
3236	schtasks.exe
4204	schtasks.exe
4416	schtasks.exe
3780	schtasks.exe
5096	schtasks.exe
532	schtasks.exe
4068	schtasks.exe
1264	schtasks.exe
4808	schtasks.exe
2068	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4064	Client.exe
Token: SeDebugPrivilege	2352	Client.exe
Token: SeDebugPrivilege	2104	Client.exe
Token: SeDebugPrivilege	2980	Client.exe
Token: SeDebugPrivilege	4196	Client.exe
Token: SeDebugPrivilege	3244	Client.exe
Token: SeDebugPrivilege	4484	Client.exe
Token: SeDebugPrivilege	1236	Client.exe
Token: SeDebugPrivilege	2248	Client.exe
Token: SeDebugPrivilege	4836	Client.exe
Token: SeDebugPrivilege	4640	Client.exe
Token: SeDebugPrivilege	1896	Client.exe
Token: SeDebugPrivilege	1768	Client.exe
Token: SeDebugPrivilege	3624	Client.exe
Token: SeDebugPrivilege	4164	Client.exe
Token: SeDebugPrivilege	888	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2352	Client.exe
2104	Client.exe
2980	Client.exe
4196	Client.exe
3244	Client.exe
4484	Client.exe
1236	Client.exe
2248	Client.exe
4836	Client.exe
4640	Client.exe
1896	Client.exe
1768	Client.exe
3624	Client.exe
4164	Client.exe
888	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2352	Client.exe
2104	Client.exe
2980	Client.exe
4196	Client.exe
3244	Client.exe
4484	Client.exe
1236	Client.exe
2248	Client.exe
4836	Client.exe
4640	Client.exe
1896	Client.exe
1768	Client.exe
3624	Client.exe
4164	Client.exe
888	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3084	4064	Client.exe	88
PID 4064 wrote to memory of 3084	4064	Client.exe	88
PID 4064 wrote to memory of 2352	4064	Client.exe	90
PID 4064 wrote to memory of 2352	4064	Client.exe	90
PID 2352 wrote to memory of 3236	2352	Client.exe	91
PID 2352 wrote to memory of 3236	2352	Client.exe	91
PID 2352 wrote to memory of 2580	2352	Client.exe	93
PID 2352 wrote to memory of 2580	2352	Client.exe	93
PID 2580 wrote to memory of 2720	2580	cmd.exe	95
PID 2580 wrote to memory of 2720	2580	cmd.exe	95
PID 2580 wrote to memory of 5104	2580	cmd.exe	96
PID 2580 wrote to memory of 5104	2580	cmd.exe	96
PID 2580 wrote to memory of 2104	2580	cmd.exe	105
PID 2580 wrote to memory of 2104	2580	cmd.exe	105
PID 2104 wrote to memory of 2324	2104	Client.exe	106
PID 2104 wrote to memory of 2324	2104	Client.exe	106
PID 2104 wrote to memory of 2076	2104	Client.exe	108
PID 2104 wrote to memory of 2076	2104	Client.exe	108
PID 2076 wrote to memory of 3220	2076	cmd.exe	110
PID 2076 wrote to memory of 3220	2076	cmd.exe	110
PID 2076 wrote to memory of 3036	2076	cmd.exe	111
PID 2076 wrote to memory of 3036	2076	cmd.exe	111
PID 2076 wrote to memory of 2980	2076	cmd.exe	112
PID 2076 wrote to memory of 2980	2076	cmd.exe	112
PID 2980 wrote to memory of 5096	2980	Client.exe	113
PID 2980 wrote to memory of 5096	2980	Client.exe	113
PID 2980 wrote to memory of 1552	2980	Client.exe	115
PID 2980 wrote to memory of 1552	2980	Client.exe	115
PID 1552 wrote to memory of 996	1552	cmd.exe	117
PID 1552 wrote to memory of 996	1552	cmd.exe	117
PID 1552 wrote to memory of 4888	1552	cmd.exe	118
PID 1552 wrote to memory of 4888	1552	cmd.exe	118
PID 1552 wrote to memory of 4196	1552	cmd.exe	121
PID 1552 wrote to memory of 4196	1552	cmd.exe	121
PID 4196 wrote to memory of 4204	4196	Client.exe	122
PID 4196 wrote to memory of 4204	4196	Client.exe	122
PID 4196 wrote to memory of 4768	4196	Client.exe	124
PID 4196 wrote to memory of 4768	4196	Client.exe	124
PID 4768 wrote to memory of 3580	4768	cmd.exe	126
PID 4768 wrote to memory of 3580	4768	cmd.exe	126
PID 4768 wrote to memory of 3184	4768	cmd.exe	127
PID 4768 wrote to memory of 3184	4768	cmd.exe	127
PID 4768 wrote to memory of 3244	4768	cmd.exe	128
PID 4768 wrote to memory of 3244	4768	cmd.exe	128
PID 3244 wrote to memory of 532	3244	Client.exe	129
PID 3244 wrote to memory of 532	3244	Client.exe	129
PID 3244 wrote to memory of 3180	3244	Client.exe	131
PID 3244 wrote to memory of 3180	3244	Client.exe	131
PID 3180 wrote to memory of 2372	3180	cmd.exe	133
PID 3180 wrote to memory of 2372	3180	cmd.exe	133
PID 3180 wrote to memory of 4472	3180	cmd.exe	134
PID 3180 wrote to memory of 4472	3180	cmd.exe	134
PID 3180 wrote to memory of 4484	3180	cmd.exe	135
PID 3180 wrote to memory of 4484	3180	cmd.exe	135
PID 4484 wrote to memory of 4068	4484	Client.exe	136
PID 4484 wrote to memory of 4068	4484	Client.exe	136
PID 4484 wrote to memory of 3612	4484	Client.exe	138
PID 4484 wrote to memory of 3612	4484	Client.exe	138
PID 3612 wrote to memory of 4944	3612	cmd.exe	140
PID 3612 wrote to memory of 4944	3612	cmd.exe	140
PID 3612 wrote to memory of 2196	3612	cmd.exe	141
PID 3612 wrote to memory of 2196	3612	cmd.exe	141
PID 3612 wrote to memory of 1236	3612	cmd.exe	142
PID 3612 wrote to memory of 1236	3612	cmd.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3084
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jekGgsPhx5mj.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2720
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:5104
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2104
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2324
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lHQw1orrAnhc.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2076
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3220
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:3036
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NlIhIuHvYYDX.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:996
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:4888
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ECFVEJQ6u7y8.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3580
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:3184
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6VNiGzrdDh7P.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2372
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:4472
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dKbDuigkYXWQ.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:2196
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1236
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1YKnwSnBGXaH.bat" "
        15⤵
        
        PID:400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3252
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:3384
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2248
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d2slB50l4VkG.bat" "
        17⤵
        
        PID:4900
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1612
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:2452
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4836
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u3eNRaZ8po8H.bat" "
        19⤵
        
        PID:752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:2868
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4640
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dxmybZ581CLI.bat" "
        21⤵
        
        PID:4472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2392
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:1600
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1896
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C30TFYZavqTJ.bat" "
        23⤵
        
        PID:3116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:4516
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1768
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ju4yG5Ve0KV7.bat" "
        25⤵
        
        PID:2608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4204
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:4868
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3624
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3592
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E5BSVGDMNQvh.bat" "
        27⤵
        
        PID:3236
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:3048
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        Runs ping.exe
        
        PID:5112
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4164
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nLpmT9FKZSd1.bat" "
        29⤵
        
        PID:5032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3152
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        Runs ping.exe
        
        PID:4368
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:888
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7h5ywcWb2Vqf.bat" "
        31⤵
        
        PID:2756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:180
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        Runs ping.exe
        
        PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3984,i,13281073920029625837,8253721632651544158,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
1⤵
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
MD5 SHA1 SHA512

Submit Download

1YKnwSnBGXaH.bat

Path C:\Users\Admin\AppData\Local\Temp\1YKnwSnBGXaH.bat
Size 207B
SHA256 cfa1e3d82e5e11f2c1e29071b0a5f57973047e060419efd8ead7c12be80f3712
MD5 249a15e9568b38ef4d42c00ab8ff4df9
SHA1 33f98c4c7334df706460a0f8d8884d289f44257a
SHA512 72fd419bba4bee9042f999271a23d0bb500d72919aef06c57b456bd27d9bffb2d6f27573b653f10276e6d41708f6ad14935e789bee177897b7fc64e29b020276
MD5 SHA1 SHA512

Submit Download

6VNiGzrdDh7P.bat

Path C:\Users\Admin\AppData\Local\Temp\6VNiGzrdDh7P.bat
Size 207B
SHA256 180935f2215edfa83344720e0b9b5e6c97fd6fb187d2c0ae2892f20dce63f53e
MD5 f8911b8c786da9937556112c1bd85385
SHA1 f9d5131771dc38d9f116d4fdcd910a23168b0aaf
SHA512 ce8458bcff471b782af5d814d0a099491be60eb0b713369aa89322a6a2641e8ecc47ae2862a97997f19d122a5b719c694835cbcd7db11dfe0fca53f03cf0ae27
MD5 SHA1 SHA512

Submit Download

7h5ywcWb2Vqf.bat

Path C:\Users\Admin\AppData\Local\Temp\7h5ywcWb2Vqf.bat
Size 207B
SHA256 a6cb6055148ae28bd531b220ebed715f400db4846bebfddea730aa8210edbca3
MD5 4b9adcc57042e988f49e2be7c2c4e117
SHA1 1c4c37178d978ddb338050a197c806c10630a99d
SHA512 81a85ad120237282f94e1c6f8dc044099157ecc1d585c73b76b99a33247ab8dae5a1254036827d766408425b5dd16653848e4ffdf69415a001dd3700251462db
MD5 SHA1 SHA512

Submit Download

C30TFYZavqTJ.bat

Path C:\Users\Admin\AppData\Local\Temp\C30TFYZavqTJ.bat
Size 207B
SHA256 01f910911cb482c52fc1a145944caef19b684a9f9468db47109874b4c733acb4
MD5 13e2ee027455948474e6836ecda050e1
SHA1 419f5ca2b337d8f9f65ffa51a2eb764f032baa5f
SHA512 2147f69e619a69a5efab2e951708c25efc84ed373c859a183f869d5efe224492e14797ff0b47d5887d003a027585c8f8b2d7b900375f40721a0ae521e52810a8
MD5 SHA1 SHA512

Submit Download

E5BSVGDMNQvh.bat

Path C:\Users\Admin\AppData\Local\Temp\E5BSVGDMNQvh.bat
Size 207B
SHA256 f8c1527a2f56d269a6c9385cfe37b466fc9066a705afefd38b7d40ec533dedec
MD5 6c5e2b3f413e8ad5dddfd64d61a6deae
SHA1 e54916ef08d4899886dff15fcb349f9ed8b19090
SHA512 132d14e64d6d8effed81559fa241547764827bb929210aacb26954ea1106d776386db6b4f4802a94a887969fee588b1e0f9f7e5ebe1ab1af02959df6ed8b36b1
MD5 SHA1 SHA512

Submit Download

ECFVEJQ6u7y8.bat

Path C:\Users\Admin\AppData\Local\Temp\ECFVEJQ6u7y8.bat
Size 207B
SHA256 2855d2200357a87ae97646b2cb04fee5957d5729e7dbeab8c92a5685d4209c6c
MD5 fecc37decdcaf6c040e97a0228c5d1c1
SHA1 cfc80d6b97ff293dacb7cb1544724f3a858d1f3b
SHA512 f98d3edc5720bc6bee51040e3d07ad0c12e4496e198c0112eb97f9e1efafdd3c3ccc20f5413b3305c3bc4e8694192e5eb872aaf2e666b7165e723afc08da55ca
MD5 SHA1 SHA512

Submit Download

NlIhIuHvYYDX.bat

Path C:\Users\Admin\AppData\Local\Temp\NlIhIuHvYYDX.bat
Size 207B
SHA256 c8f5bae41ff601320be3b7e9c4f47252c9006f83487d33d1ba26fc06da4d870a
MD5 a1748245cd13686bb4978c8955d68a47
SHA1 6e7c041223c8ef8baa7df49e4bd2c699c1f30f92
SHA512 7bbb1c22ef1f910910cdbacdac8153f66054864e9c0f1dca514675a393091d281ac629ec6afd467e325da11f4464d17ce4edfc405531553bfa29c1ea5c67cde5
MD5 SHA1 SHA512

Submit Download

d2slB50l4VkG.bat

Path C:\Users\Admin\AppData\Local\Temp\d2slB50l4VkG.bat
Size 207B
SHA256 d3260f0449da04438689170bce133baad283b4cd47ea4fc82b40683c1c349d28
MD5 e90dade2b6c20d72efe16772bdbc7344
SHA1 6236796c667501a6c3ace05491a1b6a99e48c9ed
SHA512 4e02830eb0afff2124dd475d11d9af985e98515afca8fbb4bb468121b6cfbf713a95235e25d45ea011ff393e45558869059d6ad8ed12bf6198e9cd3833a1cedf
MD5 SHA1 SHA512

Submit Download

dKbDuigkYXWQ.bat

Path C:\Users\Admin\AppData\Local\Temp\dKbDuigkYXWQ.bat
Size 207B
SHA256 55481e2655f19064756519d660b5c2e6713f5c8ec847065ea0ead3b888545ffb
MD5 ae57982f6674780fb00616381016a3f1
SHA1 8a09ffbef45e6af247e564648948f4c4359494e8
SHA512 e3c9d5b357f9a48fb1fa6fe82baba6f4d751266ede4cb10368c346ab56131649db79da6684be681feefd60cef1f89feff499efeef77b20a67ebc6230d1e5df9c
MD5 SHA1 SHA512

Submit Download

dxmybZ581CLI.bat

Path C:\Users\Admin\AppData\Local\Temp\dxmybZ581CLI.bat
Size 207B
SHA256 c95bb66d9776e21f94dc3def2576cb0af37878d88ba8a4cb6f02a0bf6de98ab7
MD5 c8568d015e0eebdc168bb172c66896cc
SHA1 16e6518171f080e2bef5002fd14e18cd13da1f04
SHA512 0aa827dc2db86d934ebae1033adb30ed6a5de9e7f8a742345ad028d8ebfdb57772dd13db12d0d2ef1868dd049860d319b87fc49eaaa8b2c841a6596358cb7744
MD5 SHA1 SHA512

Submit Download

jekGgsPhx5mj.bat

Path C:\Users\Admin\AppData\Local\Temp\jekGgsPhx5mj.bat
Size 207B
SHA256 4aac1faaf9c5c651e0c0ddfdb581a35fbed44415a1b185668182b80ceedb998d
MD5 0f57132eeaf1695c047c293ff3684c57
SHA1 6e8d7833c09b053589942ef1cf55bc7a572f2b37
SHA512 f252967958b931c238952d8683c7cc0cfd576ca719010ad16c2f0a61630e9955f9c5f68360bc496af5f4c8d353e9f6a42b239db22014a901952cea75832f3804
MD5 SHA1 SHA512

Submit Download

ju4yG5Ve0KV7.bat

Path C:\Users\Admin\AppData\Local\Temp\ju4yG5Ve0KV7.bat
Size 207B
SHA256 32d792b164e64320917e4fe3795e208842aeb589cee05a22052665f845985b64
MD5 ec96b5128c72de91bb293c84145dbc1f
SHA1 c996f446f52389d70a45136aadb9ddd9c6825932
SHA512 d1d3deb5a8fd625ee897500def7835a51d5db8e099f607c0a5e5407bcc8a88ee1659cb3eca13089b49dcf9034d0acf7d2775c0f68731cd8f730b7d98bb19e381
MD5 SHA1 SHA512

Submit Download

lHQw1orrAnhc.bat

Path C:\Users\Admin\AppData\Local\Temp\lHQw1orrAnhc.bat
Size 207B
SHA256 01eeb9c9b0203adde7d365526a63a513c8dbb1cc6b76bdae20de3942085e5940
MD5 7f3f459bea03e1e811ba0d9c080c9038
SHA1 d81bb1cd64ed88657c1fbca0b7f9cd1d19576a68
SHA512 b7ecc08f9947925d4172815fbb208fed0b68d701d0b2aa2d0ee1f0b74145713b837f0424460062a2bbe2f4213a09ebe4a8edf0eb0b9558527a0154856bafc39d
MD5 SHA1 SHA512

Submit Download

nLpmT9FKZSd1.bat

Path C:\Users\Admin\AppData\Local\Temp\nLpmT9FKZSd1.bat
Size 207B
SHA256 e25e7c85888ec8cc23861f960a0d81facc2bf0949e9b140bcf231e8cec6562ee
MD5 85c34bb949e8f45aedf959c999757d35
SHA1 4418ec61c15befb4ea2a23d00a1b2998ad157807
SHA512 af13fa7243bd120a26ed449e6829e2bb00f7e9d624b7f31c3d751a60782dfab0be7ccf3bb7b6e2078ab0edce89f820cd9a2cd0f74bff633fdaa6d433f10fab62
MD5 SHA1 SHA512

Submit Download

u3eNRaZ8po8H.bat

Path C:\Users\Admin\AppData\Local\Temp\u3eNRaZ8po8H.bat
Size 207B
SHA256 a48799177e9cac2a8e76923fe574ba758d0297ae9ade7d6d43632330adf79aa3
MD5 c512e813f72551c82743b1458ba7de6c
SHA1 8ef1d83fa19f8efd989d6081773ea15f21475d58
SHA512 5dc8c43df0669aa84514e2cdf27c18993d91e1535ecf7c49e28af6fde0acea168419f37830264cea4a58e2a8a63d772b8818d9d403a2b17ce8b9e75e9aa0d074
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 777aa9e8c28b2488da49ffa429fb03677c02a94f4e0d8574a90ad0c4bce208a5
MD5 552dd04907af2fa00817e5996dfe760b
SHA1 24658391a4fd6e98309d50acd85f40076f61681f
SHA512 1230c59168c66144ea977b27b7035ef6d01f82541a11f8860755600f4aa0b1559e7950419eb1e91669edcca58e3bdd132e6be081806d07ee1a1e8780731f9dda
SSDEEP 49152:3vvI22SsaNYfdPBldt698dBcjHIGbhoGdqTHHB72eh2NT:3vg22SsaNYfdPBldt6+dBcjHIGV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2352-17-0x00007FFE86A90000-0x00007FFE87551000-memory.dmp

Download

memory/2352-12-0x000000001C1F0000-0x000000001C2A2000-memory.dmp

Download

memory/2352-11-0x000000001C0E0000-0x000000001C130000-memory.dmp

Download

memory/2352-10-0x00007FFE86A90000-0x00007FFE87551000-memory.dmp

Download

memory/2352-8-0x00007FFE86A90000-0x00007FFE87551000-memory.dmp

Download

memory/4064-0-0x00007FFE86A93000-0x00007FFE86A95000-memory.dmp

Download

memory/4064-9-0x00007FFE86A90000-0x00007FFE87551000-memory.dmp

Download

memory/4064-2-0x00007FFE86A90000-0x00007FFE87551000-memory.dmp

Download

memory/4064-1-0x0000000000550000-0x0000000000874000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads