quasar | e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575N.exe
Size 3.1MB
Sample241004-npklfswckf
SHA256 e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575
MD5 ad2e1e26843028659449081dc60ce0d0
SHA1 094af16b4addd1d7984a953ff777d25ee97c1130
SHA512 9cf82a19ba5679433b6f07cb830fec40b335a6106e626270525667f58d9ffea02badf27b64b0149b18cd855315a163d278100fed89817fd2c9c7161982a0fe40
SSDEEP 49152:GvFt62XlaSFNWPjljiFa2RoUYIX5RJ6AbR3LoGdOvTHHB72eh2NT:Gv362XlaSFNWPjljiFXRoUYIX5RJ6a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

X2ss-51946.portmap.host:51946

Mutex

326adeb5-804d-4883-8f14-7baf5a19646e

Attributes

encryption_key
2255F445503583B2E31BF6BC3F2F8F45A6414A9A
install_name
Win32.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchost.exe
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3928-1-0x0000000000D90000-0x00000000010B4000-memory.dmp	family_quasar
behavioral2/files/0x000700000002344d-6.dat	family_quasar

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	Win32.exe

Executes dropped EXE 15 IoCs

pid	Process
3596	Win32.exe
620	Win32.exe
1452	Win32.exe
4916	Win32.exe
756	Win32.exe
2216	Win32.exe
1460	Win32.exe
1648	Win32.exe
3420	Win32.exe
2248	Win32.exe
2940	Win32.exe
2972	Win32.exe
1036	Win32.exe
2052	Win32.exe
2184	Win32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1936	PING.EXE
940	PING.EXE
2364	PING.EXE
2800	PING.EXE
1048	PING.EXE
3920	PING.EXE
4792	PING.EXE
4512	PING.EXE
4372	PING.EXE
832	PING.EXE
4512	PING.EXE
1848	PING.EXE
512	PING.EXE
1264	PING.EXE

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
512	PING.EXE
1264	PING.EXE
3920	PING.EXE
4372	PING.EXE
2800	PING.EXE
832	PING.EXE
4512	PING.EXE
4512	PING.EXE
1936	PING.EXE
940	PING.EXE
4792	PING.EXE
1048	PING.EXE
1848	PING.EXE
2364	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1144	schtasks.exe
2896	schtasks.exe
4640	schtasks.exe
2092	schtasks.exe
3704	schtasks.exe
3368	schtasks.exe
3156	schtasks.exe
1720	schtasks.exe
3248	schtasks.exe
1616	schtasks.exe
968	schtasks.exe
4832	schtasks.exe
1160	schtasks.exe
3644	schtasks.exe
216	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575N.exe
Token: SeDebugPrivilege	3596	Win32.exe
Token: SeDebugPrivilege	620	Win32.exe
Token: SeDebugPrivilege	1452	Win32.exe
Token: SeDebugPrivilege	4916	Win32.exe
Token: SeDebugPrivilege	756	Win32.exe
Token: SeDebugPrivilege	2216	Win32.exe
Token: SeDebugPrivilege	1460	Win32.exe
Token: SeDebugPrivilege	1648	Win32.exe
Token: SeDebugPrivilege	3420	Win32.exe
Token: SeDebugPrivilege	2248	Win32.exe
Token: SeDebugPrivilege	2940	Win32.exe
Token: SeDebugPrivilege	2972	Win32.exe
Token: SeDebugPrivilege	1036	Win32.exe
Token: SeDebugPrivilege	2052	Win32.exe
Token: SeDebugPrivilege	2184	Win32.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
3596	Win32.exe
620	Win32.exe
1452	Win32.exe
4916	Win32.exe
756	Win32.exe
2216	Win32.exe
1460	Win32.exe
1648	Win32.exe
3420	Win32.exe
2248	Win32.exe
2940	Win32.exe
2972	Win32.exe
1036	Win32.exe
2052	Win32.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3596	Win32.exe
620	Win32.exe
1452	Win32.exe
4916	Win32.exe
756	Win32.exe
2216	Win32.exe
1460	Win32.exe
1648	Win32.exe
3420	Win32.exe
2248	Win32.exe
2940	Win32.exe
2972	Win32.exe
1036	Win32.exe
2052	Win32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 968	3928	e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575N.exe	82
PID 3928 wrote to memory of 968	3928	e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575N.exe	82
PID 3928 wrote to memory of 3596	3928	e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575N.exe	84
PID 3928 wrote to memory of 3596	3928	e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575N.exe	84
PID 3596 wrote to memory of 3644	3596	Win32.exe	85
PID 3596 wrote to memory of 3644	3596	Win32.exe	85
PID 3596 wrote to memory of 1236	3596	Win32.exe	87
PID 3596 wrote to memory of 1236	3596	Win32.exe	87
PID 1236 wrote to memory of 4480	1236	cmd.exe	89
PID 1236 wrote to memory of 4480	1236	cmd.exe	89
PID 1236 wrote to memory of 512	1236	cmd.exe	90
PID 1236 wrote to memory of 512	1236	cmd.exe	90
PID 1236 wrote to memory of 620	1236	cmd.exe	95
PID 1236 wrote to memory of 620	1236	cmd.exe	95
PID 620 wrote to memory of 3368	620	Win32.exe	96
PID 620 wrote to memory of 3368	620	Win32.exe	96
PID 620 wrote to memory of 1560	620	Win32.exe	98
PID 620 wrote to memory of 1560	620	Win32.exe	98
PID 1560 wrote to memory of 4080	1560	cmd.exe	100
PID 1560 wrote to memory of 4080	1560	cmd.exe	100
PID 1560 wrote to memory of 4512	1560	cmd.exe	101
PID 1560 wrote to memory of 4512	1560	cmd.exe	101
PID 1560 wrote to memory of 1452	1560	cmd.exe	105
PID 1560 wrote to memory of 1452	1560	cmd.exe	105
PID 1452 wrote to memory of 3156	1452	Win32.exe	106
PID 1452 wrote to memory of 3156	1452	Win32.exe	106
PID 1452 wrote to memory of 4796	1452	Win32.exe	108
PID 1452 wrote to memory of 4796	1452	Win32.exe	108
PID 4796 wrote to memory of 2240	4796	cmd.exe	110
PID 4796 wrote to memory of 2240	4796	cmd.exe	110
PID 4796 wrote to memory of 1936	4796	cmd.exe	111
PID 4796 wrote to memory of 1936	4796	cmd.exe	111
PID 4796 wrote to memory of 4916	4796	cmd.exe	113
PID 4796 wrote to memory of 4916	4796	cmd.exe	113
PID 4916 wrote to memory of 1720	4916	Win32.exe	114
PID 4916 wrote to memory of 1720	4916	Win32.exe	114
PID 4916 wrote to memory of 116	4916	Win32.exe	116
PID 4916 wrote to memory of 116	4916	Win32.exe	116
PID 116 wrote to memory of 744	116	cmd.exe	118
PID 116 wrote to memory of 744	116	cmd.exe	118
PID 116 wrote to memory of 1848	116	cmd.exe	119
PID 116 wrote to memory of 1848	116	cmd.exe	119
PID 116 wrote to memory of 756	116	cmd.exe	120
PID 116 wrote to memory of 756	116	cmd.exe	120
PID 756 wrote to memory of 4640	756	Win32.exe	122
PID 756 wrote to memory of 4640	756	Win32.exe	122
PID 756 wrote to memory of 2972	756	Win32.exe	124
PID 756 wrote to memory of 2972	756	Win32.exe	124
PID 2972 wrote to memory of 5092	2972	cmd.exe	126
PID 2972 wrote to memory of 5092	2972	cmd.exe	126
PID 2972 wrote to memory of 1264	2972	cmd.exe	127
PID 2972 wrote to memory of 1264	2972	cmd.exe	127
PID 2972 wrote to memory of 2216	2972	cmd.exe	128
PID 2972 wrote to memory of 2216	2972	cmd.exe	128
PID 2216 wrote to memory of 2092	2216	Win32.exe	129
PID 2216 wrote to memory of 2092	2216	Win32.exe	129
PID 2216 wrote to memory of 2828	2216	Win32.exe	131
PID 2216 wrote to memory of 2828	2216	Win32.exe	131
PID 2828 wrote to memory of 3644	2828	cmd.exe	133
PID 2828 wrote to memory of 3644	2828	cmd.exe	133
PID 2828 wrote to memory of 940	2828	cmd.exe	134
PID 2828 wrote to memory of 940	2828	cmd.exe	134
PID 2828 wrote to memory of 1460	2828	cmd.exe	135
PID 2828 wrote to memory of 1460	2828	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575N.exe
"C:\Users\Admin\AppData\Local\Temp\e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575N.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:968
- C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Owwd1q0c1FgA.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4480
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:512
  - - C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:620
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3368
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F7k6Lxulc6e7.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1560
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4080
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4512
      - C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1452
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qV1BBNOUW0iF.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1936
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ew5bj2a7eYXb.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:744
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1848
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CEapZtx32No6.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:5092
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1264
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gq8WNgVQs4sM.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3644
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:940
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1460
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nmPFTQtWWwA1.bat" "
        15⤵
        
        PID:4708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3368
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3920
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1648
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QeXTXvHR1svA.bat" "
        17⤵
        
        PID:3200
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4284
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4512
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3420
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bXTQ0nHERdow.bat" "
        19⤵
        
        PID:4676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3808
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4792
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2248
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oaU3lF0wsfcS.bat" "
        21⤵
        
        PID:636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:4752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2364
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2940
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GJA3PjEY5dkf.bat" "
        23⤵
        
        PID:4300
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1336
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4372
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2972
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8pG7l7jj9XUC.bat" "
        25⤵
        
        PID:1088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3628
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2800
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1036
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XJPqKv6vekAJ.bat" "
        27⤵
        
        PID:1768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4548
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1048
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2052
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0CySlSB42ZDw.bat" "
        29⤵
        
        PID:4920
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:864
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:832
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Win32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Win32.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

0CySlSB42ZDw.bat

Path C:\Users\Admin\AppData\Local\Temp\0CySlSB42ZDw.bat
Size 206B
SHA256 067869b1dc7ff778871208e11b33e160603d8a33c19ad406d0abe08d8a1d5232
MD5 0a2c5b95e9668cf2072cd0777cd679a9
SHA1 5f684f7b149aa598b5d6d383951aa76eca431a6c
SHA512 5aa7fd8479cd636e2f1290ceec2f940e5626bbdbba3202b1957d771515ae2f8edc99fe3461813b4e797b436ba2eee35614eaa0a3245440e74a2c4a5c920f0b21
MD5 SHA1 SHA512

Submit Download

8pG7l7jj9XUC.bat

Path C:\Users\Admin\AppData\Local\Temp\8pG7l7jj9XUC.bat
Size 206B
SHA256 de21fb79c31da0ae355dbff6f38bf5e678867dc38c8e307659ee40b3a454e368
MD5 9a81761851de84e0059e1262c02296ec
SHA1 95db8aaefd7406b63edf9b10dbaacf1f5f1f0c45
SHA512 ca35cbe4f2d6846f623ce47c55e7ba3134271c5aefb6ab2ec9a7d090befdf29936dd8c95dccc765928a4fdda37bb6938bcb5dd86b777bbf6b364fe0b7911dcc2
MD5 SHA1 SHA512

Submit Download

CEapZtx32No6.bat

Path C:\Users\Admin\AppData\Local\Temp\CEapZtx32No6.bat
Size 206B
SHA256 1f6695191807703979bacb53cf94f500a59b057afce8449605a96a43795a0170
MD5 90f87124617abd6375e2ff798964fe9c
SHA1 ae0e106d5e82177b4d522643bc17b32aca6aebab
SHA512 f6144fd704232e50cc535edc404e69f663fd09c6a4417335eedea6b882ce9c02ae7de330dcbdbfbc9e733db37caf09d5a48cce109f89d71737abfd8e5df4a0c3
MD5 SHA1 SHA512

Submit Download

F7k6Lxulc6e7.bat

Path C:\Users\Admin\AppData\Local\Temp\F7k6Lxulc6e7.bat
Size 206B
SHA256 114379ceda511199742df8f6093472944fcd37dcd133fef0b1bdef0fc8f37d33
MD5 3e6ea8b490cd71c11a96cb0e1554ac00
SHA1 00605bda1b1437a172bc1dcafcdc0187737e6e74
SHA512 dee60c0e90b91eebf1f353bb35f3bde346785c80108fc981863255b6cf28dc1064e03b185c3c0e3eb3645569b0bbe82607ab47689a2f755525a56e26b7d2d820
MD5 SHA1 SHA512

Submit Download

GJA3PjEY5dkf.bat

Path C:\Users\Admin\AppData\Local\Temp\GJA3PjEY5dkf.bat
Size 206B
SHA256 8e2ec071640b5f8f75595c28585df31da67c1e3be9733229249c8fc39d4aae0f
MD5 341dc9953d7cd5d1faf5ed8157b1fb63
SHA1 e56bc3a8b04ba4cb841ee606112b7c2028abfeb0
SHA512 27aeb19248536c4df42e15c325534960cf67d470a513b7476931a76a106fdd13a1c4ea625de3d5925719282f523bfa550e94ebaeb1b9fc95f6d612456f10e38e
MD5 SHA1 SHA512

Submit Download

Gq8WNgVQs4sM.bat

Path C:\Users\Admin\AppData\Local\Temp\Gq8WNgVQs4sM.bat
Size 206B
SHA256 cbb0c919b8e8070f6d1ef031d214a0dcd205a09d56abdf278c511dbe6e17e02d
MD5 7b6cd9afe6d0db2b2142b19ac1c6e5bc
SHA1 101b71db6710e6895efb745de7d918e3a242f579
SHA512 8f20f3b3cf89d2141233411fcdebdff17d4ba3d7e004647faa5d7140a0f12ad68ea3b1304d79763ad356e2a608997fb8d42fa3d23f41a7292ab5e831cd9e7aa9
MD5 SHA1 SHA512

Submit Download

Owwd1q0c1FgA.bat

Path C:\Users\Admin\AppData\Local\Temp\Owwd1q0c1FgA.bat
Size 206B
SHA256 495102fa386c190dec54fbf4bff9ccd00f7add211b22a6245fb68abc5d276795
MD5 80a6a8cb7ea3611fa62252dfa587bdf5
SHA1 4cc0c697b675bfc30dfbab2659d6b9ce9a97ddec
SHA512 13408615c86b51f2c9610b395107c599cb2d2b8a6baf2e03079b4b517bcbf0fdca2cf36e0824968be870b4d3c19e1f2aebe90a6d1e9190e0060654b0b5674be0
MD5 SHA1 SHA512

Submit Download

QeXTXvHR1svA.bat

Path C:\Users\Admin\AppData\Local\Temp\QeXTXvHR1svA.bat
Size 206B
SHA256 aceb082779845b758996d2401fdf6601e510bf08463c1affebe041bda4cb356c
MD5 68823887351314b87a02c17068124232
SHA1 e66d5c4f23b2694940cad2e65b6309952871dd47
SHA512 d4f5d6d58852db186698fb5b565c05e4c8d55b1209e7a58669a81e04b16e2e25a9504a6d9f794259f255fdad3c3dbe1e44c8832bf63ee8f2a355fd4fed39263b
MD5 SHA1 SHA512

Submit Download

XJPqKv6vekAJ.bat

Path C:\Users\Admin\AppData\Local\Temp\XJPqKv6vekAJ.bat
Size 206B
SHA256 a7de554a95e8e32f40dbd56ef82ab947eeb5abc94632d630df47346ab82f7268
MD5 b929c464daa9913140e09fa4c60ac9e5
SHA1 6d47707466af9da6eccb792b8f79e0dce10152fe
SHA512 15d2e202cb58211838179a1cd2e4f835836e11743b60c405b7b1bed7864575474d711b0122ae657e56fc20c603f230d28294da0da79569ffc6f9fb7703dd16c0
MD5 SHA1 SHA512

Submit Download

bXTQ0nHERdow.bat

Path C:\Users\Admin\AppData\Local\Temp\bXTQ0nHERdow.bat
Size 206B
SHA256 6ce334b5fba2469862750a3c240f073175eac87925673e105b33bae0209c4ed4
MD5 1b55f366d1d59dedd7eb94839d713b84
SHA1 b119d94523ba993ec6cc1366efda88f0393a014b
SHA512 4a581ff90662b97d8ae64db3f0daa18ad085565812259fecfcfc7bc912c5bf2165712eebcb3820c4c6921959bf5ad9af7dece5498efe96af69a0f9040db9b3d6
MD5 SHA1 SHA512

Submit Download

ew5bj2a7eYXb.bat

Path C:\Users\Admin\AppData\Local\Temp\ew5bj2a7eYXb.bat
Size 206B
SHA256 076acae7af7486960064dbcebed566da733780730329246251a8072ade879bc5
MD5 f6c126282c06ee58749c72cc551dcc70
SHA1 ebed1fdbbb23ee3bcb622b325302dc298d5f055d
SHA512 f16ac7d155904ba0ff7f2e12790def26e0b5a9092f68b95b3b74c69d3eb96e69fc47c47ef9d72438d059aaf1c23998656efa59014f6ca3b6564a8ff80560160d
MD5 SHA1 SHA512

Submit Download

nmPFTQtWWwA1.bat

Path C:\Users\Admin\AppData\Local\Temp\nmPFTQtWWwA1.bat
Size 206B
SHA256 c654d28fa261dafedd83a84ec6e58b8b235514174206ff97430c2bce973930bb
MD5 22def70f79bdf84c46773faa93b10bd9
SHA1 2e1e3cda9ae03fbc32fef271a2deef1174138c5f
SHA512 3eaec50af19f4a46461f4e6a86128be4f40bc9203fceccafa35c79c8186d46fecfce36e4798e05fcc7e7e3c5d87f7e705b237184fe06b85009695c2446cc635e
MD5 SHA1 SHA512

Submit Download

oaU3lF0wsfcS.bat

Path C:\Users\Admin\AppData\Local\Temp\oaU3lF0wsfcS.bat
Size 206B
SHA256 119ff46e807ee991476f7685349a633b9e9903ccbfd9e65efc9b38d7f4fa6bf7
MD5 9284230290a6ace4eb49737d0064471c
SHA1 05f3a0b73ce9a2b900f13dc995deda6f97393aec
SHA512 1de195b32e0edbb83419aebdc69dc5bc25cf31f040c7b239c985bfec5eb86788b57d9417b4662f21d58020490d2ca7a36821e20c36f1fc7e4095bcb564194424
MD5 SHA1 SHA512

Submit Download

qV1BBNOUW0iF.bat

Path C:\Users\Admin\AppData\Local\Temp\qV1BBNOUW0iF.bat
Size 206B
SHA256 a0ae024624ccfc628b87c8f8d7d33d1095f4604efbaac2846a2176ceb33ac18d
MD5 a779765288da198857830fd75f2480a9
SHA1 4334c470e6fbcb8b11b5d440ab877cad697f5c18
SHA512 c8b361d9a64b38037f1ca719495346f0b923d7b6316ababb2f8ca37d7b27509cc648454ce3ac509404e125637bc9018a5d576d880e4360db95906c7078cb0a6f
MD5 SHA1 SHA512

Submit Download

Win32.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Win32.exe
Size 3.1MB
SHA256 e929375c114907b4f904df77e22bc68551606011b01a186640f34d38259d2575
MD5 ad2e1e26843028659449081dc60ce0d0
SHA1 094af16b4addd1d7984a953ff777d25ee97c1130
SHA512 9cf82a19ba5679433b6f07cb830fec40b335a6106e626270525667f58d9ffea02badf27b64b0149b18cd855315a163d278100fed89817fd2c9c7161982a0fe40
SSDEEP 49152:GvFt62XlaSFNWPjljiFa2RoUYIX5RJ6AbR3LoGdOvTHHB72eh2NT:Gv362XlaSFNWPjljiFXRoUYIX5RJ6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3596-10-0x00007FF8924E0000-0x00007FF892FA1000-memory.dmp

Download

memory/3596-18-0x00007FF8924E0000-0x00007FF892FA1000-memory.dmp

Download

memory/3596-11-0x00007FF8924E0000-0x00007FF892FA1000-memory.dmp

Download

memory/3596-12-0x000000001C090000-0x000000001C0E0000-memory.dmp

Download

memory/3596-13-0x000000001C1A0000-0x000000001C252000-memory.dmp

Download

memory/3928-9-0x00007FF8924E0000-0x00007FF892FA1000-memory.dmp

Download

memory/3928-0-0x00007FF8924E3000-0x00007FF8924E5000-memory.dmp

Download

memory/3928-2-0x00007FF8924E0000-0x00007FF892FA1000-memory.dmp

Download

memory/3928-1-0x0000000000D90000-0x00000000010B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads