quasar | 2d2821bb82061d52d82285f4533c8f497710ce9e7daec05af686e057b6f4746c

Analysis

max time kernel
146s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample241015-xecbrsvdrq
SHA256 2d2821bb82061d52d82285f4533c8f497710ce9e7daec05af686e057b6f4746c
MD5 036d3fc30d31b5e587e34cc28d917825
SHA1 388789286bc2bdb407558ac42fd4e96f546ca57f
SHA512 c502a756e67dea36ed8ca1ef1de9f60100f9458c8423423748f01c4de844bdbc7ed86417623efb6debbb26993308dea4bc06a8748ad935d7e37cfd1fbe9f33e6
SSDEEP 49152:rv+e821/aQWl8P0lSk3aKA3Z+nU2RBmCdjoVdATHHB72eh2NT:rv9821/aQWl8P0lSk3DA3Z+nU2Rj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

sekacex395-63736.portmap.host:63736 :4782
sekacex395-63736.portmap.host:63736

Mutex

dda89576-e16d-48d4-8242-ef487e106c4c

Attributes

encryption_key
480A149BDA5F1D4EEBD5CF8EA0711405B7FC59B1
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Avast Free Antivirus
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4852-1-0x00000000000A0000-0x00000000003C4000-memory.dmp	family_quasar
behavioral2/files/0x000b000000023b6e-6.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 15 IoCs

pid	Process
3736	Client.exe
4272	Client.exe
3412	Client.exe
2372	Client.exe
720	Client.exe
528	Client.exe
3268	Client.exe
1608	Client.exe
3904	Client.exe
3528	Client.exe
4788	Client.exe
4904	Client.exe
5092	Client.exe
4988	Client.exe
1328	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4212	PING.EXE
3080	PING.EXE
4992	PING.EXE
3996	PING.EXE
4720	PING.EXE
1964	PING.EXE
1480	PING.EXE
3528	PING.EXE
5088	PING.EXE
5076	PING.EXE
2528	PING.EXE
2952	PING.EXE
4972	PING.EXE
3240	PING.EXE
4744	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
3528	PING.EXE
3996	PING.EXE
4992	PING.EXE
2528	PING.EXE
2952	PING.EXE
3240	PING.EXE
4720	PING.EXE
5076	PING.EXE
1480	PING.EXE
1964	PING.EXE
4212	PING.EXE
5088	PING.EXE
3080	PING.EXE
4744	PING.EXE
4972	PING.EXE

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	Client-built.exe
Token: SeDebugPrivilege	3736	Client.exe
Token: SeDebugPrivilege	4272	Client.exe
Token: SeDebugPrivilege	3412	Client.exe
Token: SeDebugPrivilege	2372	Client.exe
Token: SeDebugPrivilege	720	Client.exe
Token: SeDebugPrivilege	528	Client.exe
Token: SeDebugPrivilege	3268	Client.exe
Token: SeDebugPrivilege	1608	Client.exe
Token: SeDebugPrivilege	3904	Client.exe
Token: SeDebugPrivilege	3528	Client.exe
Token: SeDebugPrivilege	4788	Client.exe
Token: SeDebugPrivilege	4904	Client.exe
Token: SeDebugPrivilege	5092	Client.exe
Token: SeDebugPrivilege	4988	Client.exe
Token: SeDebugPrivilege	1328	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
3736	Client.exe
4272	Client.exe
3412	Client.exe
2372	Client.exe
720	Client.exe
528	Client.exe
3268	Client.exe
1608	Client.exe
3904	Client.exe
3528	Client.exe
4788	Client.exe
4904	Client.exe
5092	Client.exe
4988	Client.exe
1328	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
3736	Client.exe
4272	Client.exe
3412	Client.exe
2372	Client.exe
720	Client.exe
528	Client.exe
3268	Client.exe
1608	Client.exe
3904	Client.exe
3528	Client.exe
4788	Client.exe
4904	Client.exe
5092	Client.exe
4988	Client.exe
1328	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 3736	4852	Client-built.exe	87
PID 4852 wrote to memory of 3736	4852	Client-built.exe	87
PID 3736 wrote to memory of 3996	3736	Client.exe	88
PID 3736 wrote to memory of 3996	3736	Client.exe	88
PID 3996 wrote to memory of 3528	3996	cmd.exe	90
PID 3996 wrote to memory of 3528	3996	cmd.exe	90
PID 3996 wrote to memory of 4212	3996	cmd.exe	91
PID 3996 wrote to memory of 4212	3996	cmd.exe	91
PID 3996 wrote to memory of 4272	3996	cmd.exe	98
PID 3996 wrote to memory of 4272	3996	cmd.exe	98
PID 4272 wrote to memory of 2136	4272	Client.exe	99
PID 4272 wrote to memory of 2136	4272	Client.exe	99
PID 2136 wrote to memory of 3252	2136	cmd.exe	101
PID 2136 wrote to memory of 3252	2136	cmd.exe	101
PID 2136 wrote to memory of 4972	2136	cmd.exe	102
PID 2136 wrote to memory of 4972	2136	cmd.exe	102
PID 2136 wrote to memory of 3412	2136	cmd.exe	104
PID 2136 wrote to memory of 3412	2136	cmd.exe	104
PID 3412 wrote to memory of 792	3412	Client.exe	105
PID 3412 wrote to memory of 792	3412	Client.exe	105
PID 792 wrote to memory of 604	792	cmd.exe	107
PID 792 wrote to memory of 604	792	cmd.exe	107
PID 792 wrote to memory of 3240	792	cmd.exe	108
PID 792 wrote to memory of 3240	792	cmd.exe	108
PID 792 wrote to memory of 2372	792	cmd.exe	111
PID 792 wrote to memory of 2372	792	cmd.exe	111
PID 2372 wrote to memory of 4056	2372	Client.exe	113
PID 2372 wrote to memory of 4056	2372	Client.exe	113
PID 4056 wrote to memory of 1664	4056	cmd.exe	115
PID 4056 wrote to memory of 1664	4056	cmd.exe	115
PID 4056 wrote to memory of 3528	4056	cmd.exe	116
PID 4056 wrote to memory of 3528	4056	cmd.exe	116
PID 4056 wrote to memory of 720	4056	cmd.exe	117
PID 4056 wrote to memory of 720	4056	cmd.exe	117
PID 720 wrote to memory of 864	720	Client.exe	118
PID 720 wrote to memory of 864	720	Client.exe	118
PID 864 wrote to memory of 3092	864	cmd.exe	120
PID 864 wrote to memory of 3092	864	cmd.exe	120
PID 864 wrote to memory of 5088	864	cmd.exe	121
PID 864 wrote to memory of 5088	864	cmd.exe	121
PID 864 wrote to memory of 528	864	cmd.exe	122
PID 864 wrote to memory of 528	864	cmd.exe	122
PID 528 wrote to memory of 2864	528	Client.exe	123
PID 528 wrote to memory of 2864	528	Client.exe	123
PID 2864 wrote to memory of 4872	2864	cmd.exe	125
PID 2864 wrote to memory of 4872	2864	cmd.exe	125
PID 2864 wrote to memory of 3996	2864	cmd.exe	126
PID 2864 wrote to memory of 3996	2864	cmd.exe	126
PID 2864 wrote to memory of 3268	2864	cmd.exe	127
PID 2864 wrote to memory of 3268	2864	cmd.exe	127
PID 3268 wrote to memory of 3020	3268	Client.exe	128
PID 3268 wrote to memory of 3020	3268	Client.exe	128
PID 3020 wrote to memory of 4876	3020	cmd.exe	130
PID 3020 wrote to memory of 4876	3020	cmd.exe	130
PID 3020 wrote to memory of 3080	3020	cmd.exe	131
PID 3020 wrote to memory of 3080	3020	cmd.exe	131
PID 3020 wrote to memory of 1608	3020	cmd.exe	134
PID 3020 wrote to memory of 1608	3020	cmd.exe	134
PID 1608 wrote to memory of 388	1608	Client.exe	135
PID 1608 wrote to memory of 388	1608	Client.exe	135
PID 388 wrote to memory of 4316	388	cmd.exe	137
PID 388 wrote to memory of 4316	388	cmd.exe	137
PID 388 wrote to memory of 4720	388	cmd.exe	138
PID 388 wrote to memory of 4720	388	cmd.exe	138

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PhvQPABTzyc6.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3528
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4212
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1QdiVzHjBSXY.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2136
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3252
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4972
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DocyhdA5F89r.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:604
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3240
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bJfI6T4LSNIb.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1664
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3528
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DZ8tJmWppnll.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3092
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5088
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sniC1MpEowVj.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4872
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3996
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hZczwScUneCB.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4876
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3080
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TqZvgNl3Psy3.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4316
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4720
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7S9mWChsOrkY.bat" "
        19⤵
        
        PID:1108
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1664
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5076
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nKs5zboKY4Yf.bat" "
        21⤵
        
        PID:1064
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2664
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1480
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JUOV1uydAXyK.bat" "
        23⤵
        
        PID:3052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4364
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1964
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TUYfyu7cgHlt.bat" "
        25⤵
        
        PID:1336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3644
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4744
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QYtBySuQsukn.bat" "
        27⤵
        
        PID:4732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:3760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4992
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gG2QlAZiTU0z.bat" "
        29⤵
        
        PID:3116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3296
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2528
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XEBkIssrgyhU.bat" "
        31⤵
        
        PID:2128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:4132
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

1QdiVzHjBSXY.bat

Path C:\Users\Admin\AppData\Local\Temp\1QdiVzHjBSXY.bat
Size 207B
SHA256 dc33f994933bf14f8b111fad1349b560e13dffb6e34ee75edcf1d7e457f0792a
MD5 c839e4893d544f5d24629732fbc93bfa
SHA1 0a9d76cd7e5411c0fb31493e5d6ef785013f23b9
SHA512 22b75650127a52fd05200c71de2ee60eeb30f119935495de105f32d16e6489210841fdf841bc3b9d6f07fa12f07386f038cc075ef3a7d438a8395683d54adef0
MD5 SHA1 SHA512

Submit Download

7S9mWChsOrkY.bat

Path C:\Users\Admin\AppData\Local\Temp\7S9mWChsOrkY.bat
Size 207B
SHA256 da80ec7179d553ee814cd72b194bf0bff351768f942b1dfbf4d8fb1ce5ad478f
MD5 21c7d6cf95b118ac1b5a357535549aee
SHA1 c83b8e530520ca03c879e22e2d341cb06041cd99
SHA512 e46d44501c4f60785ebef52e24ab3293833dca14b2cdee52eac7a4171a7ead7caff6a1b8f37231f19f64f5452540f2f18bfa98b1627d43a31a17cd7e1760e706
MD5 SHA1 SHA512

Submit Download

DZ8tJmWppnll.bat

Path C:\Users\Admin\AppData\Local\Temp\DZ8tJmWppnll.bat
Size 207B
SHA256 217adeb41fdb4fe7bdf5b5dd28c270a37b921d43491f991d5f8ae1a3715b8ad0
MD5 b3615fe6c69cb116f3cab91f6dd677c7
SHA1 df69055f89c719b3701b607112940ecde7ccbcbf
SHA512 e617b292441bfd0d1cba012e1379d0e577bbb489ce37dddd2f4d2767b3543d5bd09204c9a0617e0d81976068bc17a665ff66c737284f72d0e1703ca788b22b2e
MD5 SHA1 SHA512

Submit Download

DocyhdA5F89r.bat

Path C:\Users\Admin\AppData\Local\Temp\DocyhdA5F89r.bat
Size 207B
SHA256 ed7a6d055d5c14c26a6d05de218f5e16f8279a5b4d6ab1ec90f052a4213fdfac
MD5 e189811ff96b5e3e6c223a3cd32c758d
SHA1 c593bf5583145b0c804992c7cb87d78efcd8dc5a
SHA512 2bf2f1b9de746693ceaf3d53c00a82c6a10de728df0eb1555ad19770609ce6c86483355cce1c49ca7dc6df472f78fe12a7dfbf0ba552748d43c01fa9ad1554ef
MD5 SHA1 SHA512

Submit Download

JUOV1uydAXyK.bat

Path C:\Users\Admin\AppData\Local\Temp\JUOV1uydAXyK.bat
Size 207B
SHA256 d29412317d7f56b79b2df43704bdf3dfc202b25c252b17ef49c27c873c55c256
MD5 a718af32e8fa4dbb56937407696531a6
SHA1 1b50e2d2b5ad915680960cfbc8dc3734182da6c6
SHA512 f914647d51df68b071c507332893c4a950e7b4bf17e33c3f06176740751945f40a9b204f0ec9ffb21f9728957b2dec1a0e7e189c226a8387a4857050dd61159b
MD5 SHA1 SHA512

Submit Download

PhvQPABTzyc6.bat

Path C:\Users\Admin\AppData\Local\Temp\PhvQPABTzyc6.bat
Size 207B
SHA256 d9e1df6ec70605d6be65c9e464f83145c40fba6b897b3c147b463dd6da618096
MD5 d1b051b9985b5abd3d013c1e80737c41
SHA1 31c2ffc3a163eeb8d9023afb6301d5e33373ff14
SHA512 8762dc0623cc46f566d5d092ce2394b26904b6b9551e30c74ae9464010a982f748e3d531b49153c3f8284ad1926f5eb7e11810b330055c1c46ed87196316a25b
MD5 SHA1 SHA512

Submit Download

QYtBySuQsukn.bat

Path C:\Users\Admin\AppData\Local\Temp\QYtBySuQsukn.bat
Size 207B
SHA256 61ea1e50d602416b336ffb50e30f12486ceeb4787b8de792c91173102f9d6840
MD5 03418fafb9919a66e275964dd93628db
SHA1 acb08c0f33b7bfc24bc0be34fca65a5964544228
SHA512 b2809af81811b5e6b8cb29f8543bc3186f57d43fc5415fb9465124de2ecb276b8ddeaa6773ae48d6d23c2d3dc502a667682bcd37f6a24a9d81a2e65d7740fd45
MD5 SHA1 SHA512

Submit Download

TUYfyu7cgHlt.bat

Path C:\Users\Admin\AppData\Local\Temp\TUYfyu7cgHlt.bat
Size 207B
SHA256 0d8688b624e92093663561488913c7202acf025118d4a188ef96b9cfbed81e23
MD5 88fc4176957058b15b1ce2028509cf00
SHA1 efc8f72b5c3b4fe5b4d8c0b5de91bda6085fa819
SHA512 c236dd8f3ea221f242a2ea2d3d619cab7d6a3cebd69f597ace8c15ffc4e28eff1c0904c7f9190cca055332e7b03c0e2173b7cb689a83a5208a38e59d5f991962
MD5 SHA1 SHA512

Submit Download

TqZvgNl3Psy3.bat

Path C:\Users\Admin\AppData\Local\Temp\TqZvgNl3Psy3.bat
Size 207B
SHA256 2a0e9fa327ee548162099b38dc86dd4f397d24d884902e5add9f7337be2cbd94
MD5 530f01eeb70fa775b986dee47664a42e
SHA1 23c5536cc78d6e33710392518dc9704c8b61cd1d
SHA512 818915ecb1b3a162c4ce12f3664eab550eeb2d9f263fef0c8ffce013db540cd4d4d1a715d54535a3cdd5b40c3e95c8c5982fd06766f60dc26cb00762311fe8f7
MD5 SHA1 SHA512

Submit Download

XEBkIssrgyhU.bat

Path C:\Users\Admin\AppData\Local\Temp\XEBkIssrgyhU.bat
Size 207B
SHA256 cf3ac81b5e26a00e5c4d31d3608baf28454eb08b5ec7e02b977d33d083c4bbad
MD5 4c4fe4e1f7c5898182f745e039fe6ce8
SHA1 3d07840630566b1a656d375af5ac7a7dfd4516fb
SHA512 a3f40a1936ec4bd8142aca2dde7f125838ebb0b8b619815d39610e93fb0e4c9dda90302166bfc32b37acad0ebef33f275a794b747d64c3c1b9e47f84ce4a2230
MD5 SHA1 SHA512

Submit Download

bJfI6T4LSNIb.bat

Path C:\Users\Admin\AppData\Local\Temp\bJfI6T4LSNIb.bat
Size 207B
SHA256 36a089dea92e94e8fd66259fcdc9531b56f41708debaaa26f2d1ae0d5d11d7db
MD5 916071b8d03c87bb79d93c3490671a77
SHA1 5a8c81093e3a04be92a032c1abacc0c533df9c5c
SHA512 772ed9cede96a5f49ce10568b6739dd09d222c230e2b8cbefe2a7ca83250714ad6595a0de240f7fd0d04062454766d62a244420febc2874ea605dc3966684ed6
MD5 SHA1 SHA512

Submit Download

gG2QlAZiTU0z.bat

Path C:\Users\Admin\AppData\Local\Temp\gG2QlAZiTU0z.bat
Size 207B
SHA256 dc304b39767df6f90cdda5ff605bcab6e5386da165297ae242dcc79d5d8d7620
MD5 6b8540fed3a56a5627ae13b77b6736a9
SHA1 74c0bac5ead4da3992b05577463435e86f3a2e4e
SHA512 3a94cf3e0b77219d65ea13e3dd538f59cc8f58639bc569442222c987819b988adcf2250710cfa14f8d0fd7e632ed33aa1411a4f9e0022bfbafa3230b76f7d4fe
MD5 SHA1 SHA512

Submit Download

hZczwScUneCB.bat

Path C:\Users\Admin\AppData\Local\Temp\hZczwScUneCB.bat
Size 207B
SHA256 f60926728fdbadbdde5728300f5536b84c907032209ead5b5da2eac9d64a3940
MD5 dc78ea883e7b59df15f1e3db30dd0662
SHA1 55983f9872efe3cf63d5ac3c11410542f3717ed1
SHA512 6d65a22121cf68201aef3b49737b5e9ced349e110ddca3d024070bb745d976980fcb41ad5cd1d88d93406b87bb0f073b73c6e2d6dc943bf631f10c8671cc26af
MD5 SHA1 SHA512

Submit Download

nKs5zboKY4Yf.bat

Path C:\Users\Admin\AppData\Local\Temp\nKs5zboKY4Yf.bat
Size 207B
SHA256 254ffa09eb7952229fd530fdb7ab566acb92237a4cbfb2b5ddf5816834dbf940
MD5 3e9f39e7a8353e4e351f64835846f408
SHA1 702cc7b56fe261d3e01f7a1ac854d71cd8abec1c
SHA512 1299a0afdab262f61a11c1d0411e66777b53f002c1655a0f7d09371116931c38e1bebaffddad078f72d9ae4df1e4eb0aed31e47a1f841c22a1754250c5dc25a7
MD5 SHA1 SHA512

Submit Download

sniC1MpEowVj.bat

Path C:\Users\Admin\AppData\Local\Temp\sniC1MpEowVj.bat
Size 207B
SHA256 a38d8b6573e322ae8d8995805434508c6cce5f5a3e495a0db47feb866f1caa6b
MD5 80f09beb66c915bdcbc5f62a719bfe9d
SHA1 77c7769c7b3a353d35e2b27f57eddfe2802f73d4
SHA512 6d8ca2959577ce2051d8cda27e8761a02e70f6974c2aabe0a334990b095c155ca8fbf61adc8c3ea6ce6e25f3d7b246c062f6add465e853e8133d5c5379dffc94
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 2d2821bb82061d52d82285f4533c8f497710ce9e7daec05af686e057b6f4746c
MD5 036d3fc30d31b5e587e34cc28d917825
SHA1 388789286bc2bdb407558ac42fd4e96f546ca57f
SHA512 c502a756e67dea36ed8ca1ef1de9f60100f9458c8423423748f01c4de844bdbc7ed86417623efb6debbb26993308dea4bc06a8748ad935d7e37cfd1fbe9f33e6
SSDEEP 49152:rv+e821/aQWl8P0lSk3aKA3Z+nU2RBmCdjoVdATHHB72eh2NT:rv9821/aQWl8P0lSk3DA3Z+nU2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3736-12-0x000000001BB70000-0x000000001BC22000-memory.dmp

Download

memory/3736-11-0x000000001BA60000-0x000000001BAB0000-memory.dmp

Download

memory/3736-10-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Download

memory/3736-17-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Download

memory/3736-9-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Download

memory/4852-0-0x00007FFC7EB33000-0x00007FFC7EB35000-memory.dmp

Download

memory/4852-1-0x00000000000A0000-0x00000000003C4000-memory.dmp

Download

memory/4852-2-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Download

memory/4852-8-0x00007FFC7EB30000-0x00007FFC7F5F1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads