quasar | 93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0

Analysis

max time kernel
142s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Bootstrapper.exe
Size 3.3MB
Sample240818-e7874awbjg
SHA256 93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0
MD5 53327dca23173e9e9bae9d780786ba78
SHA1 1108be5863af8152dce9d7534cd217f44bfa12d3
SHA512 cda6cc2aad6fac5474c30cd5e38eaec8baed816521c5141538a9401cbe4594a5c980fef943ab5558e90e7dc5f7ec18d9289bcee996d089af505ffdf0504031ed
SSDEEP 49152:9vae821/aQWl8P0lSk3aKA3Z+nbnaJBxZzoGdlTHHB72eh2NTke:9vx821/aQWl8P0lSk3DA3Z+nraDpe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar napalm discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

napalm

napalmwtf-42785.portmap.host:42785
Drownzy-54034.portmap.host:54034

Mutex

90d42f9c-2535-47cc-9947-9a1a89c43fc4

Attributes

encryption_key
19D2CF4A708769AB5B4B046C13865B4AB48B4C4D
install_name
EAC.exe
log_directory
Logs
reconnect_delay
3000
startup_key
EasyAntiCheat EOS
subdirectory
EasyAntiCheat

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3884-1-0x00000000004D0000-0x0000000000830000-memory.dmp	family_quasar
behavioral2/files/0x00070000000235c8-6.dat	family_quasar

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	EAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	EAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	EAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	EAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	EAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	EAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	EAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	EAC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	EAC.exe

Executes dropped EXE 9 IoCs

pid	Process
1992	EAC.exe
4168	EAC.exe
1700	EAC.exe
1708	EAC.exe
5100	EAC.exe
184	EAC.exe
396	EAC.exe
2932	EAC.exe
4104	EAC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1888	PING.EXE
4272	PING.EXE
4284	PING.EXE
3308	PING.EXE
816	PING.EXE
3868	PING.EXE
4800	PING.EXE
2352	PING.EXE
1900	PING.EXE

Runs ping.exe 1 TTPs 9 IoCs

Remote System Discovery

T1018

pid	Process
1900	PING.EXE
3868	PING.EXE
1888	PING.EXE
4272	PING.EXE
2352	PING.EXE
816	PING.EXE
4800	PING.EXE
4284	PING.EXE
3308	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1768	schtasks.exe
2336	schtasks.exe
4196	schtasks.exe
3884	schtasks.exe
4552	schtasks.exe
4844	schtasks.exe
5000	schtasks.exe
2088	schtasks.exe
3160	schtasks.exe
736	schtasks.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	Bootstrapper.exe
Token: SeDebugPrivilege	1992	EAC.exe
Token: SeDebugPrivilege	4168	EAC.exe
Token: SeDebugPrivilege	1700	EAC.exe
Token: SeDebugPrivilege	1708	EAC.exe
Token: SeDebugPrivilege	5100	EAC.exe
Token: SeDebugPrivilege	184	EAC.exe
Token: SeDebugPrivilege	396	EAC.exe
Token: SeDebugPrivilege	2932	EAC.exe
Token: SeDebugPrivilege	4104	EAC.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1992	EAC.exe
4168	EAC.exe
1700	EAC.exe
1708	EAC.exe
5100	EAC.exe
184	EAC.exe
396	EAC.exe
2932	EAC.exe
4104	EAC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 5000	3884	Bootstrapper.exe	95
PID 3884 wrote to memory of 5000	3884	Bootstrapper.exe	95
PID 3884 wrote to memory of 1992	3884	Bootstrapper.exe	97
PID 3884 wrote to memory of 1992	3884	Bootstrapper.exe	97
PID 1992 wrote to memory of 1768	1992	EAC.exe	99
PID 1992 wrote to memory of 1768	1992	EAC.exe	99
PID 1992 wrote to memory of 1180	1992	EAC.exe	106
PID 1992 wrote to memory of 1180	1992	EAC.exe	106
PID 1180 wrote to memory of 4828	1180	cmd.exe	108
PID 1180 wrote to memory of 4828	1180	cmd.exe	108
PID 1180 wrote to memory of 2352	1180	cmd.exe	109
PID 1180 wrote to memory of 2352	1180	cmd.exe	109
PID 1180 wrote to memory of 4168	1180	cmd.exe	113
PID 1180 wrote to memory of 4168	1180	cmd.exe	113
PID 4168 wrote to memory of 2088	4168	EAC.exe	114
PID 4168 wrote to memory of 2088	4168	EAC.exe	114
PID 4168 wrote to memory of 5004	4168	EAC.exe	116
PID 4168 wrote to memory of 5004	4168	EAC.exe	116
PID 5004 wrote to memory of 4928	5004	cmd.exe	118
PID 5004 wrote to memory of 4928	5004	cmd.exe	118
PID 5004 wrote to memory of 816	5004	cmd.exe	119
PID 5004 wrote to memory of 816	5004	cmd.exe	119
PID 5004 wrote to memory of 1700	5004	cmd.exe	123
PID 5004 wrote to memory of 1700	5004	cmd.exe	123
PID 1700 wrote to memory of 3160	1700	EAC.exe	124
PID 1700 wrote to memory of 3160	1700	EAC.exe	124
PID 1700 wrote to memory of 4004	1700	EAC.exe	126
PID 1700 wrote to memory of 4004	1700	EAC.exe	126
PID 4004 wrote to memory of 2628	4004	cmd.exe	128
PID 4004 wrote to memory of 2628	4004	cmd.exe	128
PID 4004 wrote to memory of 1900	4004	cmd.exe	129
PID 4004 wrote to memory of 1900	4004	cmd.exe	129
PID 4004 wrote to memory of 1708	4004	cmd.exe	130
PID 4004 wrote to memory of 1708	4004	cmd.exe	130
PID 1708 wrote to memory of 736	1708	EAC.exe	131
PID 1708 wrote to memory of 736	1708	EAC.exe	131
PID 1708 wrote to memory of 4752	1708	EAC.exe	133
PID 1708 wrote to memory of 4752	1708	EAC.exe	133
PID 4752 wrote to memory of 4792	4752	cmd.exe	135
PID 4752 wrote to memory of 4792	4752	cmd.exe	135
PID 4752 wrote to memory of 3868	4752	cmd.exe	136
PID 4752 wrote to memory of 3868	4752	cmd.exe	136
PID 4752 wrote to memory of 5100	4752	cmd.exe	138
PID 4752 wrote to memory of 5100	4752	cmd.exe	138
PID 5100 wrote to memory of 3884	5100	EAC.exe	139
PID 5100 wrote to memory of 3884	5100	EAC.exe	139
PID 5100 wrote to memory of 1664	5100	EAC.exe	141
PID 5100 wrote to memory of 1664	5100	EAC.exe	141
PID 1664 wrote to memory of 2524	1664	cmd.exe	143
PID 1664 wrote to memory of 2524	1664	cmd.exe	143
PID 1664 wrote to memory of 1888	1664	cmd.exe	144
PID 1664 wrote to memory of 1888	1664	cmd.exe	144
PID 1664 wrote to memory of 184	1664	cmd.exe	145
PID 1664 wrote to memory of 184	1664	cmd.exe	145
PID 184 wrote to memory of 2336	184	EAC.exe	146
PID 184 wrote to memory of 2336	184	EAC.exe	146
PID 184 wrote to memory of 2960	184	EAC.exe	148
PID 184 wrote to memory of 2960	184	EAC.exe	148
PID 2960 wrote to memory of 208	2960	cmd.exe	150
PID 2960 wrote to memory of 208	2960	cmd.exe	150
PID 2960 wrote to memory of 4272	2960	cmd.exe	151
PID 2960 wrote to memory of 4272	2960	cmd.exe	151
PID 2960 wrote to memory of 396	2960	cmd.exe	154
PID 2960 wrote to memory of 396	2960	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5000
- C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
  "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ddfg0yr40AzX.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4828
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2352
  - - C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
      "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4168
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bnhS6UXYyVq8.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5004
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4928
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:816
      - C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
        
        "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VlKm7fNOZIIl.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2628
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1900
        
        C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
        
        "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TQHbqSpADXsY.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4792
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3868
        
        C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
        
        "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m8FRH14OsGCw.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2524
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
        
        "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:184
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\m0ijituyVK5l.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:208
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4272
        
        C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
        
        "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:396
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yYguihOY5GL4.bat" "
        15⤵
        
        PID:2020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4284
        
        C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
        
        "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fXlH3NxVkPYI.bat" "
        17⤵
        
        PID:1180
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1808
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3308
        
        C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
        
        "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4104
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "EasyAntiCheat EOS" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lAv0C8THv7JP.bat" "
        19⤵
        
        PID:2084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1904
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4608,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:8
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EAC.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\EAC.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

TQHbqSpADXsY.bat

Path C:\Users\Admin\AppData\Local\Temp\TQHbqSpADXsY.bat
Size 211B
SHA256 aa29b32d92fc077ab4434bb9eaade082d0c26d9d3c893b5696589f6737865423
MD5 1805edc0081c419cdb0399d9fa3df843
SHA1 73b43c453099e3a94382d7b3a7362d360e48e1e2
SHA512 822299502bc3e07af9e28ade8efb9b9822e2992732042ad079b917343674399bed015b78e47331c576adb720e1a0e5553067518c48bf02e112dc35aec656848d
MD5 SHA1 SHA512

Submit Download

VlKm7fNOZIIl.bat

Path C:\Users\Admin\AppData\Local\Temp\VlKm7fNOZIIl.bat
Size 211B
SHA256 00709d317b73d98a3eede07c33c55f3795cddf191853417c55df79991c20c34f
MD5 72c992a45f120628b748542284f7b5d1
SHA1 9b364d287609701f2b66a13fe06c7546148f6b44
SHA512 3fcbb1a8eb30bcb920f46c3a5e2e2def22fe98100d50ace7a1b6f76cf40dfc10089b4f094454a5a1277fcd450318fa74834c11fee3f94fd6f6327dd81ce81894
MD5 SHA1 SHA512

Submit Download

bnhS6UXYyVq8.bat

Path C:\Users\Admin\AppData\Local\Temp\bnhS6UXYyVq8.bat
Size 211B
SHA256 8f19a70d65894fba5661649048f4015badf8916d566de09aca5968a321694659
MD5 277593aa37bbef3b3ebf88610506b9f9
SHA1 22881e066fb24893ec70d75d515c7c8d801342d1
SHA512 629e36501232e00f1b0b8288587025dc68e080e954328167a8d5284bcea15bb664d0afabaa3c50105081affed9fc1fc389e98d5c2434b99874cec9975126304a
MD5 SHA1 SHA512

Submit Download

ddfg0yr40AzX.bat

Path C:\Users\Admin\AppData\Local\Temp\ddfg0yr40AzX.bat
Size 211B
SHA256 3f22f503713323ea99cb1fab3551fa3240391c91ea772eeef1b798684e730fa2
MD5 973785481e31a036d5989db8914fb1ce
SHA1 27bb67a45aaaf952b1c87a24c0c732a281ac1972
SHA512 c3063d9e27dd33cfb32d377911de3db5e06f3c27fef57829e6f0aab3a04c5c4585b650b355b46f369cd30de03c93aeb0041626d0adbd39a73cc200215025f61b
MD5 SHA1 SHA512

Submit Download

fXlH3NxVkPYI.bat

Path C:\Users\Admin\AppData\Local\Temp\fXlH3NxVkPYI.bat
Size 211B
SHA256 13b5b6691a8f6040aff084c51c4048a353d944fe30be75f277a6d31ff49bc269
MD5 6d55845c2fe141ef067830c868b578da
SHA1 cba3d562d1264e082ccbd583786b7483edc776dc
SHA512 5013a6a97bc8a17e06ba4aa7a814d062874ed25e3083866c774622d5feb636b02fb0411eb2a08a6f6d3237a058d399c5a9357f23b8bb30713881c2c1a50da473
MD5 SHA1 SHA512

Submit Download

lAv0C8THv7JP.bat

Path C:\Users\Admin\AppData\Local\Temp\lAv0C8THv7JP.bat
Size 211B
SHA256 c001a6f76abc565c89b3303217e6ecff98cd2a7565198e0044078742538e10ca
MD5 ad2a4073fc1448d48d21bc76344292c5
SHA1 712006628c160cd33246de0b46fede8ff6f21de6
SHA512 5a673f23c334ad540f454a3e6ebdc4754e85ee2d040e3b50e5dace33324beed6b4ea62a76f787c6cec0834827a3831cfaea2000e4e80adc33158e91df9886d96
MD5 SHA1 SHA512

Submit Download

m0ijituyVK5l.bat

Path C:\Users\Admin\AppData\Local\Temp\m0ijituyVK5l.bat
Size 211B
SHA256 3dacf641df3803080b2d71a71655faaffd1e05438ec7eff494d8bd12240e9c6d
MD5 7d8d16de2fb790936a6f641a560fa307
SHA1 0a76f090e87b3950f21519e93d851cfe3c2b380f
SHA512 a4535684a7bdc9b56b4b1c4a8cce666a063562c259e0e4a88772570fe518e4819caf7432e62b55f63ccb88f1990cf619697734a0af793e99db569a9e058b9c2d
MD5 SHA1 SHA512

Submit Download

m8FRH14OsGCw.bat

Path C:\Users\Admin\AppData\Local\Temp\m8FRH14OsGCw.bat
Size 211B
SHA256 85e1eb9312d3e8d67fa2869038d17941dba349f8ba504770713ab3bc4e2ab6d9
MD5 e96ba253c5143ef5ad5fa727d383a102
SHA1 5e5558761cc651eabfa2941c461ce8e0a174fa95
SHA512 14bda11a54f501787b193b8efe070121ee12a98581e76ea0d8bfdda87065ca2099b7b3c0f25471b566f8d4f38dc9885b0327433acea1dda2ab22c498f8929102
MD5 SHA1 SHA512

Submit Download

yYguihOY5GL4.bat

Path C:\Users\Admin\AppData\Local\Temp\yYguihOY5GL4.bat
Size 211B
SHA256 70a342ec8bf57aeab0bc42f1c0a89fd78112c3196db1bc2c054a5f7c36431292
MD5 1f6115464bee0987f8285b9c9e6a3b54
SHA1 13cbc46f9b5a9919ffb1f3d0ae2743efad728bd0
SHA512 a0fddf679f973733d82ab982922838eccbdf1092e848e64ffadc87d149bc0387bdd434cf319a7ece767257fbeac4fc260e36b89a21da63517bb825cd9126e853
MD5 SHA1 SHA512

Submit Download

EAC.exe

Path C:\Users\Admin\AppData\Roaming\EasyAntiCheat\EAC.exe
Size 3.3MB
SHA256 93fd2544b315e84b2fd26cca70b84cbdcff3e02cc01b83a7abac2f99d56b19d0
MD5 53327dca23173e9e9bae9d780786ba78
SHA1 1108be5863af8152dce9d7534cd217f44bfa12d3
SHA512 cda6cc2aad6fac5474c30cd5e38eaec8baed816521c5141538a9401cbe4594a5c980fef943ab5558e90e7dc5f7ec18d9289bcee996d089af505ffdf0504031ed
SSDEEP 49152:9vae821/aQWl8P0lSk3aKA3Z+nbnaJBxZzoGdlTHHB72eh2NTke:9vx821/aQWl8P0lSk3DA3Z+nraDpe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1992-18-0x00007FFDE9420000-0x00007FFDE9EE1000-memory.dmp

Download

memory/1992-13-0x000000001BCF0000-0x000000001BDA2000-memory.dmp

Download

memory/1992-12-0x000000001BBE0000-0x000000001BC30000-memory.dmp

Download

memory/1992-11-0x00007FFDE9420000-0x00007FFDE9EE1000-memory.dmp

Download

memory/1992-10-0x00007FFDE9420000-0x00007FFDE9EE1000-memory.dmp

Download

memory/3884-9-0x00007FFDE9420000-0x00007FFDE9EE1000-memory.dmp

Download

memory/3884-0-0x00007FFDE9423000-0x00007FFDE9425000-memory.dmp

Download

memory/3884-2-0x00007FFDE9420000-0x00007FFDE9EE1000-memory.dmp

Download

memory/3884-1-0x00000000004D0000-0x0000000000830000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads