quasar | 544f0fca11640d5ee8773de000674d869833b834ae2819e5a9196351fb479c50

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06/08/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
incognito.exe
Size 3.1MB
Sample240806-pn445sshqb
SHA256 544f0fca11640d5ee8773de000674d869833b834ae2819e5a9196351fb479c50
MD5 4e885e883cb02e14af809a2e8b4807b2
SHA1 61ffdce7aa773657e4e80bec8ae5581973d86f47
SHA512 884fbc32ea58d02a735ddf48ada2e2c9915581ff50679535bbb0d0cada6463b330454c6bbd66f7fee54f07d033b114816feeee527df9197cc87622029336227d
SSDEEP 49152:uvmI22SsaNYfdPBldt698dBcjHK5DGbRcLoGdz2lTHHB72eh2NT:uvr22SsaNYfdPBldt6+dBcjHK5DJD2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

/gakimyny-40562.portmap.host:4782

Mutex

46e7ef3b-8d62-4396-a1b6-7d8a2353e907

Attributes

encryption_key
4CCD03EE2B3F5EBE1286E32B25E48A9D2C6CC0F5
install_name
incognito.exe
log_directory
Logs
reconnect_delay
3000
startup_key
CrashHandler
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/476-1-0x00000000009B0000-0x0000000000CD4000-memory.dmp	family_quasar
behavioral1/files/0x000200000002aa50-6.dat	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
4372	incognito.exe
3520	incognito.exe
780	incognito.exe
3324	incognito.exe
2916	incognito.exe
2568	incognito.exe
5116	incognito.exe
4296	incognito.exe
4884	incognito.exe
1724	incognito.exe
248	incognito.exe
2304	incognito.exe
4432	incognito.exe
4556	incognito.exe
1928	incognito.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4704	PING.EXE
3008	PING.EXE
3764	PING.EXE
768	PING.EXE
4948	PING.EXE
3688	PING.EXE
3948	PING.EXE
652	PING.EXE
2988	PING.EXE
5012	PING.EXE
3900	PING.EXE
1088	PING.EXE
340	PING.EXE
4732	PING.EXE
2856	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
3900	PING.EXE
5012	PING.EXE
4732	PING.EXE
3008	PING.EXE
3764	PING.EXE
1088	PING.EXE
2856	PING.EXE
340	PING.EXE
3688	PING.EXE
4704	PING.EXE
3948	PING.EXE
652	PING.EXE
768	PING.EXE
4948	PING.EXE
2988	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1416	schtasks.exe
2016	schtasks.exe
2660	schtasks.exe
664	schtasks.exe
3160	schtasks.exe
2104	schtasks.exe
2704	schtasks.exe
1964	schtasks.exe
1392	schtasks.exe
4860	schtasks.exe
5108	schtasks.exe
2436	schtasks.exe
2880	schtasks.exe
4344	schtasks.exe
2448	schtasks.exe
1072	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	476	incognito.exe
Token: SeDebugPrivilege	4372	incognito.exe
Token: SeDebugPrivilege	3520	incognito.exe
Token: SeDebugPrivilege	780	incognito.exe
Token: SeDebugPrivilege	3324	incognito.exe
Token: SeDebugPrivilege	2916	incognito.exe
Token: SeDebugPrivilege	2568	incognito.exe
Token: SeDebugPrivilege	5116	incognito.exe
Token: SeDebugPrivilege	4296	incognito.exe
Token: SeDebugPrivilege	4884	incognito.exe
Token: SeDebugPrivilege	1724	incognito.exe
Token: SeDebugPrivilege	248	incognito.exe
Token: SeDebugPrivilege	2304	incognito.exe
Token: SeDebugPrivilege	4432	incognito.exe
Token: SeDebugPrivilege	4556	incognito.exe
Token: SeDebugPrivilege	1928	incognito.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
4372	incognito.exe
3520	incognito.exe
780	incognito.exe
3324	incognito.exe
2916	incognito.exe
2568	incognito.exe
5116	incognito.exe
4296	incognito.exe
4884	incognito.exe
1724	incognito.exe
248	incognito.exe
2304	incognito.exe
4432	incognito.exe
4556	incognito.exe
1928	incognito.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
4372	incognito.exe
3520	incognito.exe
780	incognito.exe
3324	incognito.exe
2916	incognito.exe
2568	incognito.exe
5116	incognito.exe
4296	incognito.exe
4884	incognito.exe
1724	incognito.exe
248	incognito.exe
2304	incognito.exe
4432	incognito.exe
4556	incognito.exe
1928	incognito.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 1392	476	incognito.exe	78
PID 476 wrote to memory of 1392	476	incognito.exe	78
PID 476 wrote to memory of 4372	476	incognito.exe	80
PID 476 wrote to memory of 4372	476	incognito.exe	80
PID 4372 wrote to memory of 664	4372	incognito.exe	81
PID 4372 wrote to memory of 664	4372	incognito.exe	81
PID 4372 wrote to memory of 2344	4372	incognito.exe	83
PID 4372 wrote to memory of 2344	4372	incognito.exe	83
PID 2344 wrote to memory of 2760	2344	cmd.exe	85
PID 2344 wrote to memory of 2760	2344	cmd.exe	85
PID 2344 wrote to memory of 2988	2344	cmd.exe	86
PID 2344 wrote to memory of 2988	2344	cmd.exe	86
PID 2344 wrote to memory of 3520	2344	cmd.exe	87
PID 2344 wrote to memory of 3520	2344	cmd.exe	87
PID 3520 wrote to memory of 3160	3520	incognito.exe	88
PID 3520 wrote to memory of 3160	3520	incognito.exe	88
PID 3520 wrote to memory of 1112	3520	incognito.exe	90
PID 3520 wrote to memory of 1112	3520	incognito.exe	90
PID 1112 wrote to memory of 1512	1112	cmd.exe	92
PID 1112 wrote to memory of 1512	1112	cmd.exe	92
PID 1112 wrote to memory of 340	1112	cmd.exe	93
PID 1112 wrote to memory of 340	1112	cmd.exe	93
PID 1112 wrote to memory of 780	1112	cmd.exe	94
PID 1112 wrote to memory of 780	1112	cmd.exe	94
PID 780 wrote to memory of 1416	780	incognito.exe	95
PID 780 wrote to memory of 1416	780	incognito.exe	95
PID 780 wrote to memory of 4656	780	incognito.exe	97
PID 780 wrote to memory of 4656	780	incognito.exe	97
PID 4656 wrote to memory of 1508	4656	cmd.exe	99
PID 4656 wrote to memory of 1508	4656	cmd.exe	99
PID 4656 wrote to memory of 3688	4656	cmd.exe	100
PID 4656 wrote to memory of 3688	4656	cmd.exe	100
PID 4656 wrote to memory of 3324	4656	cmd.exe	101
PID 4656 wrote to memory of 3324	4656	cmd.exe	101
PID 3324 wrote to memory of 4860	3324	incognito.exe	102
PID 3324 wrote to memory of 4860	3324	incognito.exe	102
PID 3324 wrote to memory of 1584	3324	incognito.exe	104
PID 3324 wrote to memory of 1584	3324	incognito.exe	104
PID 1584 wrote to memory of 3892	1584	cmd.exe	106
PID 1584 wrote to memory of 3892	1584	cmd.exe	106
PID 1584 wrote to memory of 4704	1584	cmd.exe	107
PID 1584 wrote to memory of 4704	1584	cmd.exe	107
PID 1584 wrote to memory of 2916	1584	cmd.exe	108
PID 1584 wrote to memory of 2916	1584	cmd.exe	108
PID 2916 wrote to memory of 2448	2916	incognito.exe	109
PID 2916 wrote to memory of 2448	2916	incognito.exe	109
PID 2916 wrote to memory of 876	2916	incognito.exe	111
PID 2916 wrote to memory of 876	2916	incognito.exe	111
PID 876 wrote to memory of 3080	876	cmd.exe	113
PID 876 wrote to memory of 3080	876	cmd.exe	113
PID 876 wrote to memory of 2856	876	cmd.exe	114
PID 876 wrote to memory of 2856	876	cmd.exe	114
PID 876 wrote to memory of 2568	876	cmd.exe	115
PID 876 wrote to memory of 2568	876	cmd.exe	115
PID 2568 wrote to memory of 1072	2568	incognito.exe	116
PID 2568 wrote to memory of 1072	2568	incognito.exe	116
PID 2568 wrote to memory of 852	2568	incognito.exe	118
PID 2568 wrote to memory of 852	2568	incognito.exe	118
PID 852 wrote to memory of 3576	852	cmd.exe	120
PID 852 wrote to memory of 3576	852	cmd.exe	120
PID 852 wrote to memory of 4732	852	cmd.exe	121
PID 852 wrote to memory of 4732	852	cmd.exe	121
PID 852 wrote to memory of 5116	852	cmd.exe	122
PID 852 wrote to memory of 5116	852	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\incognito.exe
"C:\Users\Admin\AppData\Local\Temp\incognito.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:476
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1392
- C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wlMci5LGHlbg.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2760
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2988
  - - C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GqtGMNZFmdbm.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1112
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1512
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:340
      - C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:780
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2sJ8zyT4Y7RF.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1508
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3688
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rx7GglyCW7ve.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1584
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4704
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3b7mp9BWXDdk.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3080
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2856
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2568
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N0DXmqb51pom.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:852
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3576
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4732
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5116
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NapM8b11GcsF.bat" "
        15⤵
        
        PID:4120
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1836
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3008
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4296
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bgbCI5KLj9b5.bat" "
        17⤵
        
        PID:2252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4824
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5012
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4884
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fZSqhbSaK0pZ.bat" "
        19⤵
        
        PID:2760
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3948
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1724
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vFy9e5kHoIUm.bat" "
        21⤵
        
        PID:3872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:332
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:652
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:248
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\inYjW9ZUZiyj.bat" "
        23⤵
        
        PID:2044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3296
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3900
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2304
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3L7Y3sPPVZ5l.bat" "
        25⤵
        
        PID:4444
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4936
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3764
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4432
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QoZ5bSiLRRkJ.bat" "
        27⤵
        
        PID:1116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2724
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:768
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4556
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pewnc7jkgXtj.bat" "
        29⤵
        
        PID:1100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3744
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4948
        
        C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1928
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CrashHandler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eLr03xojiYqt.bat" "
        31⤵
        
        PID:4288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:1568
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

incognito.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\incognito.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
MD5 SHA1 SHA512

Submit Download

2sJ8zyT4Y7RF.bat

Path C:\Users\Admin\AppData\Local\Temp\2sJ8zyT4Y7RF.bat
Size 210B
SHA256 060c55ec2fd9d7881b53c58d92c3c79f4e3bf200f7241518a8cfa92ef5e85027
MD5 36fcb615e30886746ed719b3ee8fb602
SHA1 6c5310a6f90a847269eaf6286811beaf471a342a
SHA512 e55617f865d49e45365a0d299daa225242e32332b69f43409f0079472ed7a650c839e738f93b6e05315bb56dd87d73cb38d13cf6d1476fa5130cb874e60090a1
MD5 SHA1 SHA512

Submit Download

3L7Y3sPPVZ5l.bat

Path C:\Users\Admin\AppData\Local\Temp\3L7Y3sPPVZ5l.bat
Size 210B
SHA256 8a019952f325ada7f9b3b22af51f1b3494759eb44d3882b228459af8a1b8ff25
MD5 8ba908de0eb84f1106db1ee55ad62c93
SHA1 5016341141c6732d0aa3ffb9895880e3e7c3eeaf
SHA512 69ac81739ea9c72a624cac933b5e0d2e3d3356833998075470f2fe1028ce46be5cb955e4def8a654bec816c683b98e1df73757151161ec9a6edc44eab1831b35
MD5 SHA1 SHA512

Submit Download

3b7mp9BWXDdk.bat

Path C:\Users\Admin\AppData\Local\Temp\3b7mp9BWXDdk.bat
Size 210B
SHA256 58e1f2bbc76aba9d722c64aec00c61e7857673761e9edb35015a2fd15b6ab29f
MD5 4abc69458f463468e48bdb06b5cb6f4f
SHA1 5995e82db4588aee6bbac6b24ea46f7dc76bd750
SHA512 6f0edbc3d6c44c01d046ab59ec42c9d259f356b294e1f818b20179e7ab7fe2db6bc6b5abac9167cf5c10dce2ac8fcb3cde127464e5cd6d98b4297b3171b186c9
MD5 SHA1 SHA512

Submit Download

GqtGMNZFmdbm.bat

Path C:\Users\Admin\AppData\Local\Temp\GqtGMNZFmdbm.bat
Size 210B
SHA256 e78f708d63061cbb3a263aa0cbc233e4d2b03e17eb59e952de689c420dd3834f
MD5 53d3986b878b6fba959aaec7e5b696ce
SHA1 bfb60eeb87ffc6cb39750df010aac36db893bf2b
SHA512 6083129df3723f6362ff72a1a0490983cfebb11bddd0b2794b862112a3c988314a75243aeace0d1ab9921d04ccc205e075e4e541fb72b4a9d302ae881540a80c
MD5 SHA1 SHA512

Submit Download

N0DXmqb51pom.bat

Path C:\Users\Admin\AppData\Local\Temp\N0DXmqb51pom.bat
Size 210B
SHA256 9147505b0b5056d8aa06367acc601a2fc32efeb95c9d71b26f6be90b0916c9d1
MD5 238070f649154c23520ec519066cca10
SHA1 dc3dca88bb5054bff64f1b2b88f8d3be2402504f
SHA512 448b3a0746fac9e14a0df62c3e8df9d7785083c343a183cc0f27ac2788ab54d5d115ad57325d5d2e055e7b4834d90fe40def899dec70c584231b67e7767834de
MD5 SHA1 SHA512

Submit Download

NapM8b11GcsF.bat

Path C:\Users\Admin\AppData\Local\Temp\NapM8b11GcsF.bat
Size 210B
SHA256 641980ced615d953a8e145622a617deefa352ece6dd373af6aacd39eb31364bc
MD5 28fe79aa86a349a93a283144b2e3a234
SHA1 e5299fcc36df617093ace60ed7077a19d31e0d50
SHA512 69c8839981216f7c8fc27e0e80090549af51a2b9d543376bc810301ee3e33477163e05e34bb8ab722e1ee06e9562df063d2e59e544a88d0b843ba6572755bed0
MD5 SHA1 SHA512

Submit Download

QoZ5bSiLRRkJ.bat

Path C:\Users\Admin\AppData\Local\Temp\QoZ5bSiLRRkJ.bat
Size 210B
SHA256 13caed732379c8235adf9aabd9fb19b6d16622e8715537b1942cb40b580a9aa3
MD5 d6cb40cb3127cd84436eefd77f2918b0
SHA1 a8c36a139a66b5319d12c030849bb1f81865c1c2
SHA512 e625d07e8120ac67c75e86ad17f37578f32aa26e432c7c3abcaa3823ec9b30a86afa68955225c6dc30df4ab617df3084b65b4e6649f7707462f527d02b05c4ac
MD5 SHA1 SHA512

Submit Download

bgbCI5KLj9b5.bat

Path C:\Users\Admin\AppData\Local\Temp\bgbCI5KLj9b5.bat
Size 210B
SHA256 d740f340e1387499f2df637374c53ce3a5f009c453a8d80ad7f52f4eecdcd11b
MD5 266d64dd7b6656f1925077e7a39074c6
SHA1 ca046f5e085167a10824e7220533b5399b538464
SHA512 647d9a86855f33da205bcb3e249dab9daca32a006112835077f72edaac236dc267a778b26d5f80cfe339c6a7cac8252604972b30d2a34b8cbe94266229cb7cb9
MD5 SHA1 SHA512

Submit Download

eLr03xojiYqt.bat

Path C:\Users\Admin\AppData\Local\Temp\eLr03xojiYqt.bat
Size 210B
SHA256 59784bcf00bb13b2fcfac134d3914d42176de685eccdf9b3af15742c77ce03be
MD5 d45f448bcb6440163e614b21f3f21088
SHA1 7cd9f789547f674a414c6423c14e121748a2e5af
SHA512 da923e840ad2d1c347dd6dc53191e33bed87b5a50f095035ee37c7d2be38fdfa3814d90a630900e58251f2fd0251a9658390966a2cc20ab70a0075d8d86283e9
MD5 SHA1 SHA512

Submit Download

fZSqhbSaK0pZ.bat

Path C:\Users\Admin\AppData\Local\Temp\fZSqhbSaK0pZ.bat
Size 210B
SHA256 2a686e6d02bac2135cf1ab7abef852a5b3e9da37fab768453b111499aff67cfa
MD5 c7498dfe4508edaa932482325cbd2293
SHA1 def758c7c2824f0e6dec8b429acd054193a20b40
SHA512 92a3f53dbc3aef7ecfccf78c542d2f6fb1c32ebab5e345652b5bb8a53d0c47c8198a05ea83ccb3649d9fb127289149261911f5e04b4738845f60f1488e5468a5
MD5 SHA1 SHA512

Submit Download

inYjW9ZUZiyj.bat

Path C:\Users\Admin\AppData\Local\Temp\inYjW9ZUZiyj.bat
Size 210B
SHA256 3bc4bd2c061b3a259fb66ab72fc480e712cff6854826ce7a95b7ddc3faf1c585
MD5 d18aac20b9af93a143060a7b91fdfb93
SHA1 0a3bb973785eea3191818ffddecca8b5e0b6cd5d
SHA512 fd4d5c67887d086e1514f851950ab152aadb70b8b0eb687c7f9fba5856e2dce2b4226e23e9d64d46fa2d9a628ac0b221c48fbc4fc0f5c42adc8391ee3ca77501
MD5 SHA1 SHA512

Submit Download

pewnc7jkgXtj.bat

Path C:\Users\Admin\AppData\Local\Temp\pewnc7jkgXtj.bat
Size 210B
SHA256 bc1cc9b61f2abd01f45dbff81eb994ed17a4bc83a7f8d8c491e632bc89f8c808
MD5 47f2473056709c701042522b8dfe6247
SHA1 be41b4dab93cafcddc0e68b99e14d5ba286d4cc5
SHA512 a76919b75812747e5f82591c818392afea0f677a252d33341e48188bed373e4c5a4ffb7e60f5f9eb6bbe146c90d90194bc5a285d913880284f8508a2270239ff
MD5 SHA1 SHA512

Submit Download

rx7GglyCW7ve.bat

Path C:\Users\Admin\AppData\Local\Temp\rx7GglyCW7ve.bat
Size 210B
SHA256 62165c1944ecc4f6c8f7df128b8d8e800cb068426759f20947fba5a7733faa66
MD5 3fb13eab225061f50db44f3ba2053236
SHA1 b979f4fe95a429c65d8f0dd2235a3fca8628a3bb
SHA512 cf6fac670016a6be79efe033b81be86080a6b53eb414e5e3ec0332b9895b33d43bdc1622a9dd824455b7c8de204338cce53871669cfcb6c7f440bc4eec44d2fe
MD5 SHA1 SHA512

Submit Download

vFy9e5kHoIUm.bat

Path C:\Users\Admin\AppData\Local\Temp\vFy9e5kHoIUm.bat
Size 210B
SHA256 86ea2e8cfe0a7ec83c11ec222bafa10d8f0c6a1f24094cd054f601ee37e4f129
MD5 c13feb0f391e2b32edf9d0b4a16441b2
SHA1 7a2a95cd0e7a8421898b65eaab7c816b3c1e381a
SHA512 92c2f9eab06f2753d644a802326ded411bc9a38b84756a3dd78b98bd8709b808f63d5f19c8e656d101b1fee4a81186f9230bdb86ff2986fd51378b743d9c26f8
MD5 SHA1 SHA512

Submit Download

wlMci5LGHlbg.bat

Path C:\Users\Admin\AppData\Local\Temp\wlMci5LGHlbg.bat
Size 210B
SHA256 2e453da9a49788cd363e2038f9108bf1e7c729bc10f51aae069de2851b38c59b
MD5 8429516eec5753f7551a25c1dc2aeee1
SHA1 9fe711c79d275200220b1e082529a1c8891cf189
SHA512 cf4526a4584f1b570b06cfa1f6b667bfdac397709a0393f45d6ca9a1742fb6ff57689a33e4a979d8a388be78d7030c19289abc193496a2e6db8aea4e26b9fc8c
MD5 SHA1 SHA512

Submit Download

incognito.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\incognito.exe
Size 3.1MB
SHA256 544f0fca11640d5ee8773de000674d869833b834ae2819e5a9196351fb479c50
MD5 4e885e883cb02e14af809a2e8b4807b2
SHA1 61ffdce7aa773657e4e80bec8ae5581973d86f47
SHA512 884fbc32ea58d02a735ddf48ada2e2c9915581ff50679535bbb0d0cada6463b330454c6bbd66f7fee54f07d033b114816feeee527df9197cc87622029336227d
SSDEEP 49152:uvmI22SsaNYfdPBldt698dBcjHK5DGbRcLoGdz2lTHHB72eh2NT:uvr22SsaNYfdPBldt6+dBcjHK5DJD2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/476-0-0x00007FFEE8323000-0x00007FFEE8325000-memory.dmp

Download

memory/476-9-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

Download

memory/476-2-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

Download

memory/476-1-0x00000000009B0000-0x0000000000CD4000-memory.dmp

Download

memory/4372-13-0x000000001C130000-0x000000001C1E2000-memory.dmp

Download

memory/4372-10-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

Download

memory/4372-11-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

Download

memory/4372-12-0x000000001C020000-0x000000001C070000-memory.dmp

Download

memory/4372-19-0x00007FFEE8320000-0x00007FFEE8DE2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads