Malware Analysis Report

2024-10-19 06:32

Sample ID 240628-xkrzeayglc
Target Loader.exe
SHA256 90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962
Tags
seroxen quasar spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

90a58064c6df293fc564fa5b616c737f6fd31f6288433da2030ec56d6dc46962

Threat Level: Known bad

The file Loader.exe was found to be: Known bad.

Malicious Activity Summary

seroxen quasar spyware trojan

Quasar payload

Quasar RAT

Quasar family

Checks computer location settings

Looks up external IP address via web service

Unsigned PE

Program crash

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-28 18:55

Signatures

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-28 18:55

Reported

2024-06-28 18:57

Platform

win7-20240221-en

Max time kernel

141s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1888 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 1888 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 1888 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 1888 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe" /rl HIGHEST /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 feel-barcelona.gl.at.ply.gg udp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp
US 147.185.221.20:47655 feel-barcelona.gl.at.ply.gg tcp

Files

memory/1888-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

memory/1888-1-0x0000000001310000-0x000000000137C000-memory.dmp

memory/1888-2-0x00000000744D0000-0x0000000074BBE000-memory.dmp

memory/1888-4-0x00000000744DE000-0x00000000744DF000-memory.dmp

memory/1888-5-0x00000000744D0000-0x0000000074BBE000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-28 18:55

Reported

2024-06-28 18:57

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

Signatures

Quasar RAT

trojan spyware quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A api.ipify.org N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2304 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 2304 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 2304 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 2304 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 3956 wrote to memory of 3240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3956 wrote to memory of 3240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3956 wrote to memory of 3240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 3956 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3956 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3956 wrote to memory of 2088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3956 wrote to memory of 3256 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 3956 wrote to memory of 3256 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 3956 wrote to memory of 3256 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 3256 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 3256 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 3256 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 3256 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 3256 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 3256 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 4296 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4296 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4296 wrote to memory of 4596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4296 wrote to memory of 4760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4296 wrote to memory of 4760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4296 wrote to memory of 4760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4296 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 4296 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 4296 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 4132 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 4132 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 4132 wrote to memory of 4156 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 4132 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 4132 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 4132 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 1484 wrote to memory of 4000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1484 wrote to memory of 4000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1484 wrote to memory of 4000 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1484 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1484 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1484 wrote to memory of 3884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1484 wrote to memory of 2392 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 1484 wrote to memory of 2392 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 1484 wrote to memory of 2392 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 2392 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 2392 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 2392 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 2392 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe
PID 4516 wrote to memory of 4476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4516 wrote to memory of 4476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4516 wrote to memory of 4476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 4516 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4516 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4516 wrote to memory of 4440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4516 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 4516 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 4516 wrote to memory of 1060 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\Loader.exe
PID 1060 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 1060 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 1060 wrote to memory of 4608 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\schtasks.exe
PID 1060 wrote to memory of 1356 N/A C:\Users\Admin\AppData\Local\Temp\Loader.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JhrUKLnSUCN8.bat" "

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2304 -ip 2304

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 2256

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yhtFvMHgLWsq.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3256 -ip 3256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3256 -s 1092

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\usAtBPAZzyaD.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4132 -ip 4132

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 2200

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x3XtlcQuW9mK.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2392 -ip 2392

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 2196

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mTl23LRA4x7s.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1060 -ip 1060

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 1660

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IMBlgJYkB3r3.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3408 -ip 3408

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 2252

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rHPE70peoxI8.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3260 -ip 3260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 1092

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Windows Defender Anti-Malware Disable Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Loader.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2YO3QB7yM2vN.bat" "

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2584 -ip 2584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 2236

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\Loader.exe

"C:\Users\Admin\AppData\Local\Temp\Loader.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 api.ipify.org udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 freegeoip.net udp
US 8.8.8.8:53 ip-api.com udp

Files

memory/2304-0-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

memory/2304-1-0x0000000000BB0000-0x0000000000C1C000-memory.dmp

memory/2304-2-0x0000000005BB0000-0x0000000006154000-memory.dmp

memory/2304-3-0x00000000056F0000-0x0000000005782000-memory.dmp

memory/2304-4-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/2304-5-0x0000000005670000-0x00000000056D6000-memory.dmp

memory/2304-6-0x0000000005B80000-0x0000000005B92000-memory.dmp

memory/2304-7-0x0000000074BAE000-0x0000000074BAF000-memory.dmp

memory/2304-8-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/2304-10-0x0000000007060000-0x000000000706A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\JhrUKLnSUCN8.bat

MD5 ee5a39a8274383c60d9b283d173f5b2a
SHA1 bbd728b9fec353267f912c375177fde45461e0a9
SHA256 8d268bb5ea76b2e75b857b48f8a499e3f1b8f60860f879a563b9703cdebd6c0d
SHA512 f22eadfe3fbd04f9455eae9b4d2a966940743538a8c2b3f3c7061b5a20683152dee91b681114da0c7131d87f5cd79eb35a03e96393f5da41aab9f680eb8e967f

memory/2304-15-0x0000000074BA0000-0x0000000075350000-memory.dmp

memory/3256-16-0x0000000074B00000-0x00000000752B0000-memory.dmp

memory/3256-17-0x0000000074B00000-0x00000000752B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Logs\06-28-2024

MD5 10feba0c13e74144d1767b2e58e7aff6
SHA1 36bdd53da2b743379a3c0e47a407f3e2df9c365c
SHA256 9234e6186d47a5a9b5b77f2c6c2c7609db853a8044f61dc0ebb781c4d5f79598
SHA512 36270f074e11ed4e087918232554a2e539599cfcde290fd32e84efc08f92018ba99bba64be9901a97712a4c9d8c8e9c8b1cf06d3486450249909068901d546fe

C:\Users\Admin\AppData\Local\Temp\yhtFvMHgLWsq.bat

MD5 ff2e0c324266a6a1ef6cea0897318e13
SHA1 90cf49c62796fa03190fbb1b955308ed54b3cfc2
SHA256 fab7bc958ad09d981ce53723f3c39304828ccbf031e5640818bc16000fdcc1f1
SHA512 bf9eff9cdca137308dd1a0c4691428c090bf1f7ed3859d1bbdae572603614fe2b7c9975e161d187151821e043508797c9ce37f26386015f65d02181b0ea77f4a

memory/3256-24-0x0000000074B00000-0x00000000752B0000-memory.dmp

C:\Users\Admin\AppData\Roaming\Logs\06-28-2024

MD5 e8eadafcbd4e733a824c659ebe4fa2ed
SHA1 02f2e9070a10c30703b5f52709e17f8be338f0d7
SHA256 f95ab45510524f42e946f3cb1f83affe0018cd8841e5e4cd01956b98793612e3
SHA512 654a5b399571123fb9a0590b244694ebce69fde6e79ec67ed745e61664870c91d792b67db4268e88953f0edd67d97168807adb542d83059b58dd50a83066f2b9

C:\Users\Admin\AppData\Local\Temp\usAtBPAZzyaD.bat

MD5 da2fd876ff5597a69690379944889a51
SHA1 050a2c23bea19e8c6d9909299aab50dbbf526721
SHA256 18f37376c084f572b4663d6089c0851d2764205069217150c15e74499f11bb25
SHA512 f79318c7c146dd28fcaed00f8f3d4b906878ae884efc7d95f6701a229422169d2be3a05444398c8ed214d551a706517655e18655cb6293cf773d4f14f42bd266

C:\Users\Admin\AppData\Roaming\Logs\06-28-2024

MD5 722ec9b01ba496ef5c5edba01c5bf787
SHA1 a19046c6ac35bb7a1100e83d0a87b2b6ec81bb97
SHA256 2ec1d153426e366c31d9065b78d3200bb3fa1ccfc474b9c965d506a19ee91511
SHA512 e4e471ccf5afa6ad9cd26025d0cd6eb228bff77e40256b411a77c8afe34867501845d04c7a51fd7f37485bb767639e4c30fed492ee7916fa52aee06086438bb4

C:\Users\Admin\AppData\Local\Temp\x3XtlcQuW9mK.bat

MD5 1293875a0e1ec9af6cdc54f5ca375d90
SHA1 54983ec2df7544deca7619c00fd1a2606051dda8
SHA256 f11a53e220e98a53bcfaa55aec676f5c0d5102f9ff1ecb802aa783c8fd462ec2
SHA512 17f7cad7bb14acf76140d29056cd1cc2f88086b70a0760d6257893890ef4db05c4922eeefd3e5ccd8a0210b255a37668036af55f7a80527cdf310f505e7e8688

C:\Users\Admin\AppData\Roaming\Logs\06-28-2024

MD5 a22c7f928fa1a0b48fb881cff97e83e9
SHA1 0ef246f550bb4aed7967a117db7be40ab2002f67
SHA256 01bf75599efdb5b395d6ec7997830e4b43d127d903e3eaeb837557011344df4a
SHA512 27f27c25f8855298b28f131fda15b85339ca7c71e39c38105f9763ee4619a294a70230af363b6c4a2a58333b5072dcacdb41b8245ed3dba228eebfe99192a39d

C:\Users\Admin\AppData\Local\Temp\mTl23LRA4x7s.bat

MD5 92eec7c197b415d464a2b140b8979242
SHA1 d936708a6191408e63881043fb8bc40ee24761c1
SHA256 95d7cf35433deab5ccd974a2a7173f5c81b3860ceabcb37389732f4a55a71c22
SHA512 1a942b7429cb92abb3a38c4e873ff0b7335276f615e7ce6259e44065f1ebc02418eb25320800f8bd7c9900cb09b46149449ac356b94a28e0af66bfb2cb5e240a

C:\Users\Admin\AppData\Roaming\Logs\06-28-2024

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\IMBlgJYkB3r3.bat

MD5 9e3280350318a1192c0dccf48cf96c00
SHA1 72ab48cce69851af164ded84d65bac4ff23aced5
SHA256 023811907336af3f0af07258bc97741898eafd4b8f16ceb2042799d07f5a847b
SHA512 852940d77d8471a80c4a3a8b7d34f7a496b5c2659bcc8284707641dd9348de080838eaae2c9bb364d99f221f1206cbb98f298e49d8b7f82e08d25452af2fd84f

C:\Users\Admin\AppData\Local\Temp\rHPE70peoxI8.bat

MD5 653980b559c2f0a19e66d01427c75303
SHA1 78158bd6dd8ae5dfe29b398a0a3b7177bb1a41ce
SHA256 eec5ec3062b81d5c72239498217a3594a7431b4c06abf42d99d8c51f5854ac61
SHA512 62a2b72f9a25fea75b15778c7d20575f9a3c680379e79ac58898a88330865cec76f21cc3c764211b531f7cd88b15b421c48c9c11c33163bac85fcc0cf7837335

C:\Users\Admin\AppData\Roaming\Logs\06-28-2024

MD5 a421b2f24bb8e35d34eee2e667cd4e84
SHA1 99d798cceec172ef2c882f93eb6b5817ae17e232
SHA256 27d046b53141780ae5584c448e446f56a4b8443c35c2a9c218b032afa74cca80
SHA512 92c31587808b26ddcbdef7885f8f9d016d727ee83e380a66f7f3d0410f4f8708d9570990bcc18e75076e60b03037e7b2508eb722562e3d6d64801d7a932a434b

C:\Users\Admin\AppData\Local\Temp\2YO3QB7yM2vN.bat

MD5 beadc88d1795d1fad37f1d5c6b6b15fc
SHA1 070dbb61e08412dc20d0ecbf92d7d464611ae475
SHA256 98e185bc748b391c26e43fca1780290aa81a2d13e16238834b85b26f48692715
SHA512 bdd4f015cc5e0fcf18b0c9aa5b5b2238e2bdaca78939f60b04c76329d244e83551b197a702f9b5a59a032a516af2228f84da0173a5c60849b414d6017858548f