quasar | 84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 19:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe
Size 502KB
Sample240727-xsmpnatdmk
SHA256 84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7
MD5 fd8e1a617bc7a4bc6d62e32911c17042
SHA1 a222614719614f3d8f78e449e3e3d98051b6f315
SHA512 44f1e24b6d6b747aea30e20409b719a583f0e385a12dcea5dbe37bed2b19842af08f149489f62c38d6a2a280bd85044ccd3384dbf22fba2b83a3f1b42989d2ee
SSDEEP 6144:tTEgdc0YKX7IxUpGREWEvOXiLzZTPrbb2cEwgb8F9Gj5r+QcTR38:tTEgdfYTxUnbx2gDwj5r+Qcd8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

me:4782
68.201.205.56:4782

Mutex

4e19accb-bc80-45aa-917d-d5dca33ad8f0

Attributes

encryption_key
3B611D04AAFAB02940B8BD5BC8618AF575293F55
install_name
Client.exe
log_directory
Logs
reconnect_delay
2996
startup_key
system
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/820-1-0x0000000000650000-0x00000000006D4000-memory.dmp	family_quasar
behavioral2/files/0x000700000002343c-5.dat	family_quasar

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1403246978-718555486-3105247137-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 11 IoCs

pid	Process
1600	Client.exe
768	Client.exe
2612	Client.exe
3020	Client.exe
4604	Client.exe
4860	Client.exe
3760	Client.exe
3060	Client.exe
4392	Client.exe
4704	Client.exe
816	Client.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Client.exe	84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3604	PING.EXE
820	PING.EXE
1388	PING.EXE
3764	PING.EXE
1960	PING.EXE
4312	PING.EXE
4792	PING.EXE
816	PING.EXE
3064	PING.EXE
732	PING.EXE
4392	PING.EXE

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
4792	PING.EXE
816	PING.EXE
732	PING.EXE
3764	PING.EXE
4312	PING.EXE
3604	PING.EXE
820	PING.EXE
3064	PING.EXE
1388	PING.EXE
4392	PING.EXE
1960	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2004	schtasks.exe
3132	schtasks.exe
1384	schtasks.exe
3332	schtasks.exe
3648	schtasks.exe
4528	schtasks.exe
372	schtasks.exe
3316	schtasks.exe
3428	schtasks.exe
5096	schtasks.exe
1612	schtasks.exe
1440	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	820	84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe
Token: SeDebugPrivilege	1600	Client.exe
Token: SeDebugPrivilege	768	Client.exe
Token: SeDebugPrivilege	2612	Client.exe
Token: SeDebugPrivilege	3020	Client.exe
Token: SeDebugPrivilege	4604	Client.exe
Token: SeDebugPrivilege	4860	Client.exe
Token: SeDebugPrivilege	3760	Client.exe
Token: SeDebugPrivilege	3060	Client.exe
Token: SeDebugPrivilege	4392	Client.exe
Token: SeDebugPrivilege	4704	Client.exe
Token: SeDebugPrivilege	816	Client.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
1600	Client.exe
768	Client.exe
2612	Client.exe
3020	Client.exe
4604	Client.exe
4860	Client.exe
3760	Client.exe
3060	Client.exe
4392	Client.exe
4704	Client.exe
816	Client.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
1600	Client.exe
768	Client.exe
2612	Client.exe
3020	Client.exe
4604	Client.exe
4860	Client.exe
3760	Client.exe
3060	Client.exe
4392	Client.exe
4704	Client.exe
816	Client.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1600	Client.exe
768	Client.exe
2612	Client.exe
3020	Client.exe
4604	Client.exe
4860	Client.exe
3760	Client.exe
3060	Client.exe
4392	Client.exe
4704	Client.exe
816	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 4528	820	84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe	84
PID 820 wrote to memory of 4528	820	84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe	84
PID 820 wrote to memory of 1600	820	84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe	87
PID 820 wrote to memory of 1600	820	84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe	87
PID 1600 wrote to memory of 372	1600	Client.exe	88
PID 1600 wrote to memory of 372	1600	Client.exe	88
PID 1600 wrote to memory of 812	1600	Client.exe	94
PID 1600 wrote to memory of 812	1600	Client.exe	94
PID 812 wrote to memory of 4692	812	cmd.exe	96
PID 812 wrote to memory of 4692	812	cmd.exe	96
PID 812 wrote to memory of 4392	812	cmd.exe	97
PID 812 wrote to memory of 4392	812	cmd.exe	97
PID 812 wrote to memory of 768	812	cmd.exe	101
PID 812 wrote to memory of 768	812	cmd.exe	101
PID 768 wrote to memory of 2004	768	Client.exe	102
PID 768 wrote to memory of 2004	768	Client.exe	102
PID 768 wrote to memory of 1424	768	Client.exe	104
PID 768 wrote to memory of 1424	768	Client.exe	104
PID 1424 wrote to memory of 3596	1424	cmd.exe	106
PID 1424 wrote to memory of 3596	1424	cmd.exe	106
PID 1424 wrote to memory of 1960	1424	cmd.exe	107
PID 1424 wrote to memory of 1960	1424	cmd.exe	107
PID 1424 wrote to memory of 2612	1424	cmd.exe	110
PID 1424 wrote to memory of 2612	1424	cmd.exe	110
PID 2612 wrote to memory of 3132	2612	Client.exe	111
PID 2612 wrote to memory of 3132	2612	Client.exe	111
PID 2612 wrote to memory of 1328	2612	Client.exe	113
PID 2612 wrote to memory of 1328	2612	Client.exe	113
PID 1328 wrote to memory of 556	1328	cmd.exe	115
PID 1328 wrote to memory of 556	1328	cmd.exe	115
PID 1328 wrote to memory of 3764	1328	cmd.exe	116
PID 1328 wrote to memory of 3764	1328	cmd.exe	116
PID 1328 wrote to memory of 3020	1328	cmd.exe	118
PID 1328 wrote to memory of 3020	1328	cmd.exe	118
PID 3020 wrote to memory of 1384	3020	Client.exe	119
PID 3020 wrote to memory of 1384	3020	Client.exe	119
PID 3020 wrote to memory of 3864	3020	Client.exe	121
PID 3020 wrote to memory of 3864	3020	Client.exe	121
PID 3864 wrote to memory of 2200	3864	cmd.exe	123
PID 3864 wrote to memory of 2200	3864	cmd.exe	123
PID 3864 wrote to memory of 4312	3864	cmd.exe	124
PID 3864 wrote to memory of 4312	3864	cmd.exe	124
PID 3864 wrote to memory of 4604	3864	cmd.exe	125
PID 3864 wrote to memory of 4604	3864	cmd.exe	125
PID 4604 wrote to memory of 3316	4604	Client.exe	126
PID 4604 wrote to memory of 3316	4604	Client.exe	126
PID 4604 wrote to memory of 3424	4604	Client.exe	128
PID 4604 wrote to memory of 3424	4604	Client.exe	128
PID 3424 wrote to memory of 4800	3424	cmd.exe	130
PID 3424 wrote to memory of 4800	3424	cmd.exe	130
PID 3424 wrote to memory of 3604	3424	cmd.exe	131
PID 3424 wrote to memory of 3604	3424	cmd.exe	131
PID 3424 wrote to memory of 4860	3424	cmd.exe	132
PID 3424 wrote to memory of 4860	3424	cmd.exe	132
PID 4860 wrote to memory of 3428	4860	Client.exe	133
PID 4860 wrote to memory of 3428	4860	Client.exe	133
PID 4860 wrote to memory of 2020	4860	Client.exe	136
PID 4860 wrote to memory of 2020	4860	Client.exe	136
PID 2020 wrote to memory of 1424	2020	cmd.exe	138
PID 2020 wrote to memory of 1424	2020	cmd.exe	138
PID 2020 wrote to memory of 4792	2020	cmd.exe	139
PID 2020 wrote to memory of 4792	2020	cmd.exe	139
PID 2020 wrote to memory of 3760	2020	cmd.exe	140
PID 2020 wrote to memory of 3760	2020	cmd.exe	140

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe
"C:\Users\Admin\AppData\Local\Temp\84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4528
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\67l05jYVpqrJ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4692
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4392
  - - C:\Windows\system32\SubDir\Client.exe
      "C:\Windows\system32\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:768
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ljASEiJZGQCC.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1424
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3596
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1960
      - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cBehnxJBnpNT.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:556
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3764
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8quIcYhNq76Z.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2200
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4312
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\16rWPrJkI3uc.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4800
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3604
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tjfXSf7VY5Vz.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1424
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4792
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3760
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uurYW2y985qw.bat" "
        15⤵
        
        PID:1440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1524
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:816
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5096
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yXNdzRsaDe9u.bat" "
        17⤵
        
        PID:4072
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3520
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:820
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4392
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iYgybgttknTD.bat" "
        19⤵
        
        PID:4472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4700
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3064
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1GKdfi9QaHCW.bat" "
        21⤵
        
        PID:2688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:4620
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:732
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:816
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "system" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cs1llyTnFBTI.bat" "
        23⤵
        
        PID:112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4488
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

16rWPrJkI3uc.bat

Path C:\Users\Admin\AppData\Local\Temp\16rWPrJkI3uc.bat
Size 196B
SHA256 b44990984ddb0aee31fd515118235e5bc9afb105ac6c78cbcd3df14e213d83f5
MD5 4fce37528456d4106ddf4bac0f7f2524
SHA1 ea612df1bdacd7c8f48e6e2544c3429f0bf7ef6d
SHA512 096c1c34c923810a0ef72bbe2f7290507804aea05ede45d620b815b3669ecb0ac4c2197fe8ebad91e7bb686c585a98ba43b53fd64b89960fa884ba65b150b7df
MD5 SHA1 SHA512

Submit Download

1GKdfi9QaHCW.bat

Path C:\Users\Admin\AppData\Local\Temp\1GKdfi9QaHCW.bat
Size 196B
SHA256 996454b0fd9ce7cbf726877034981aafd73d254518c91d50dd69ba4214febbbf
MD5 69cd89f5e96e127ba3748331d4068407
SHA1 87ac13ff5698e18748330d8a1bbc59ddf542f624
SHA512 11c547857e36dd7859aa97ec16e124b5d84065f0fc2a2c679fc1483efd03fde66e7f7907ab3115f1660c933bdbd3eeb51ecc9a4f2b3f012c09973d59f66cc771
MD5 SHA1 SHA512

Submit Download

67l05jYVpqrJ.bat

Path C:\Users\Admin\AppData\Local\Temp\67l05jYVpqrJ.bat
Size 196B
SHA256 0437fc572cc664fdbe3f7275446de9b423e07c68caf4a975b5dacbcd623aa8af
MD5 9280368c4a65b78bc5cd85e474feeb42
SHA1 b4b447edfc31511d13b783ce24d2e393f3fea62e
SHA512 ff3e43c3b20fc4c9ca94f02db7774a379caeb8f0a4521c7a25433082c094cdeb993ea451eb18600cf9c2dec2b8358b3aed3d431478b5eb4e1d0805b5bcd7a4ae
MD5 SHA1 SHA512

Submit Download

8quIcYhNq76Z.bat

Path C:\Users\Admin\AppData\Local\Temp\8quIcYhNq76Z.bat
Size 196B
SHA256 b5e337e5d91562b3e9beecfb634dbb601a8f518dfd464194b434777aabca3d5f
MD5 26540a6b95071b43306a1a6c49387814
SHA1 6b9b09e3171cbcf7836180936fda228449680d08
SHA512 6329698443a33666e62a9ed3547b5d76f90a1e56576010cbfc0c80e00d21ec0e8300e5cf41637732fc11a849349fe98e1ba68d5c31d06f81d76f0d632bf1cb8a
MD5 SHA1 SHA512

Submit Download

cBehnxJBnpNT.bat

Path C:\Users\Admin\AppData\Local\Temp\cBehnxJBnpNT.bat
Size 196B
SHA256 feac9a15e1cee89a5dff6be6c2615163fef3d8028e8251b9ddbbd3293165dd03
MD5 c3c2a513f62c87fc656e20daafc8b1aa
SHA1 2fd827a1f00b34beab855cd171018d9fbfe0fc1f
SHA512 82f0feccc3891822d76b67be4292f8b308c88d102bce95dfac2bab48963617f74a404cd2a595d8c88a9cec79d2a65e1f002c55b86558ec4099e5d01999d6c2d6
MD5 SHA1 SHA512

Submit Download

cs1llyTnFBTI.bat

Path C:\Users\Admin\AppData\Local\Temp\cs1llyTnFBTI.bat
Size 196B
SHA256 9e151b74bd678b1f0db5de0278620eabee140537a153a21f8c36736a2abddff9
MD5 6a1a6f8f014cf6a30860bf7a2a085992
SHA1 2561a380b430e4781696209c41ad300f106a6c3f
SHA512 18c7a10bcc8e2c5b3460fd300251cdb071c1fed7ff5fd4ad567595f28302dfe4ffa9873be199f2cf1461460c7508d1acb3079b760905ca0a751cc988e248c24d
MD5 SHA1 SHA512

Submit Download

iYgybgttknTD.bat

Path C:\Users\Admin\AppData\Local\Temp\iYgybgttknTD.bat
Size 196B
SHA256 f294ca92065509cd1113152ec2842cae2d50f9016870c4fbfd0dd6299b30249d
MD5 98da9971575fce73417ff075906f27e7
SHA1 90af577def5627b540aa2112b49e8b3b5814d948
SHA512 f51706c364f0d002beea2d157db8ee6305124de250b82096e911d024e1c9d1e2fe56582a6d60560d4ea76158570198fc1f902fc75a2179c2ad567ff2f27115a8
MD5 SHA1 SHA512

Submit Download

ljASEiJZGQCC.bat

Path C:\Users\Admin\AppData\Local\Temp\ljASEiJZGQCC.bat
Size 196B
SHA256 e8ccec0da76a0e8b55386f23db61605b3f6b61da34a90389a3bc290b01a40aaf
MD5 614340ec0472f5533849c2884990894f
SHA1 9238aff0be540f7fa33ee35813b896f386fd30df
SHA512 a72de109c28d6913d454e2a73fe1e55e480d1b997baca4108b9ce1f51da2c23a9edcad4e05fa4a7dbc8869ce6e72677f57d712bb015289b28caecf031db2a267
MD5 SHA1 SHA512

Submit Download

tjfXSf7VY5Vz.bat

Path C:\Users\Admin\AppData\Local\Temp\tjfXSf7VY5Vz.bat
Size 196B
SHA256 8d6fdcaebda5f07d75bcbc61c809283f38f09405b3dbe0b607a6e0ca25c8e298
MD5 fcd5eb2db5b642ca2b5f703552991d6c
SHA1 965893803b6aeb6c7b2fbd079172067945b7c9c1
SHA512 861930b338af52c85ce68e1b48e59f3613fbafa7dc2f6dd48e70cfd89b963d4fe5b9039b7db62f4dac064dd67498d5d97696d9982e710cbc515dcaf8cf4a1e57
MD5 SHA1 SHA512

Submit Download

uurYW2y985qw.bat

Path C:\Users\Admin\AppData\Local\Temp\uurYW2y985qw.bat
Size 196B
SHA256 394e890f783d0dfaae696b4ef0a212922f1421fe7f506a1ce36f009658b6bd3a
MD5 dd6ecaf3a12f8b47ba537a71baab718c
SHA1 fed423175e9af3edec2aee2ad4d2e9bed96cfbcc
SHA512 b1c0506ec65aec21341b853c8f510c49e37002bdf0d5ac24fa5c0b5a68149bb08a3685a83017d6f6bd269b445ff8302fb9ca1649b12530d683dadd6b40395417
MD5 SHA1 SHA512

Submit Download

yXNdzRsaDe9u.bat

Path C:\Users\Admin\AppData\Local\Temp\yXNdzRsaDe9u.bat
Size 196B
SHA256 fb78c737aa78084480bc34f340cfd0b55acd66ff8d0ecbd94f3e857e1395096f
MD5 f1e8a585a9463c67f60312ec9c2797ec
SHA1 aa98dba8514f88a54b45b7a8379984989afc9954
SHA512 986669f57590d19c9c1dd7e804c9b589391aa10df49aa4e9ad269a44a33543f898162387fec78ac24b6a1ecac71450faa8d71f6c8fcccb8138deffd9f5e6c549
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 502KB
SHA256 84e33e3232dc792f6333dd8ebfbcab0f4c75bf3593d58a57e424fc30e84759a7
MD5 fd8e1a617bc7a4bc6d62e32911c17042
SHA1 a222614719614f3d8f78e449e3e3d98051b6f315
SHA512 44f1e24b6d6b747aea30e20409b719a583f0e385a12dcea5dbe37bed2b19842af08f149489f62c38d6a2a280bd85044ccd3384dbf22fba2b83a3f1b42989d2ee
SSDEEP 6144:tTEgdc0YKX7IxUpGREWEvOXiLzZTPrbb2cEwgb8F9Gj5r+QcTR38:tTEgdfYTxUnbx2gDwj5r+Qcd8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/820-0-0x00007FF91EDA3000-0x00007FF91EDA5000-memory.dmp

Download

memory/820-2-0x00007FF91EDA0000-0x00007FF91F861000-memory.dmp

Download

memory/820-10-0x00007FF91EDA0000-0x00007FF91F861000-memory.dmp

Download

memory/820-1-0x0000000000650000-0x00000000006D4000-memory.dmp

Download

memory/1600-17-0x00007FF91EDA0000-0x00007FF91F861000-memory.dmp

Download

memory/1600-12-0x000000001C470000-0x000000001C522000-memory.dmp

Download

memory/1600-11-0x000000001C360000-0x000000001C3B0000-memory.dmp

Download

memory/1600-7-0x00007FF91EDA0000-0x00007FF91F861000-memory.dmp

Download

memory/1600-8-0x00007FF91EDA0000-0x00007FF91F861000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads