Overview
overview
10Static
static
10Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1Mono.Cecil.dll
windows7-x64
1Mono.Cecil.dll
windows10-2004-x64
1Mono.Nat.dll
windows7-x64
1Mono.Nat.dll
windows10-2004-x64
1Octokit.dll
windows7-x64
1Octokit.dll
windows10-2004-x64
10Seroxen la....2.exe
windows7-x64
1Seroxen la....2.exe
windows10-2004-x64
1Siticone.D...UI.dll
windows7-x64
1Siticone.D...UI.dll
windows10-2004-x64
1Unity.Burs...fe.dll
windows7-x64
1Unity.Burs...fe.dll
windows10-2004-x64
1Unity.Burst.dll
windows7-x64
1Unity.Burst.dll
windows10-2004-x64
1Unity.Mathematics.dll
windows7-x64
1Unity.Mathematics.dll
windows10-2004-x64
1Unity.ProB...ee.dll
windows7-x64
1Unity.ProB...ee.dll
windows10-2004-x64
1Unity.ProB...ri.dll
windows7-x64
1Unity.ProB...ri.dll
windows10-2004-x64
1Unity.ProBuilder.dll
windows7-x64
1Unity.ProBuilder.dll
windows10-2004-x64
1UnityEngin...le.dll
windows7-x64
1UnityEngin...le.dll
windows10-2004-x64
1UnityEngin...le.dll
windows7-x64
1UnityEngin...le.dll
windows10-2004-x64
1UnityEngin...le.dll
windows7-x64
1UnityEngin...le.dll
windows10-2004-x64
1UnityEngin...le.dll
windows7-x64
1UnityEngin...le.dll
windows10-2004-x64
1Resubmissions
31/01/2026, 23:38
260131-3mzd6abx7a1012/01/2026, 00:27
260112-arw6dahs5e18/10/2024, 04:48
241018-fe484syalg1018/10/2024, 04:44
241018-fc46bsxhkd1018/10/2024, 03:16
241018-dse52atfpg1012/06/2024, 04:46
240612-feblss1ejn1005/05/2024, 21:44
240505-1lv91aeg6z1005/05/2024, 21:21
240505-z7h15aec4t10Analysis
- max time kernel
600s - max time network
428s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
18/10/2024, 04:48
Behavioral task
behavioral1
Sample
Guna.UI2.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
Guna.UI2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral3
Sample
Mono.Cecil.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
Mono.Cecil.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
Mono.Nat.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral6
Sample
Mono.Nat.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral7
Sample
Octokit.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
Octokit.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
600 seconds
Behavioral task
behavioral9
Sample
Seroxen launcher v3.1.2.exe
Resource
win7-20240729-en
windows7-x64
1 signatures
600 seconds
Behavioral task
behavioral10
Sample
Seroxen launcher v3.1.2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral11
Sample
Siticone.Desktop.UI.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral12
Sample
Siticone.Desktop.UI.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral13
Sample
Unity.Burst.Unsafe.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
Unity.Burst.Unsafe.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral15
Sample
Unity.Burst.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
Unity.Burst.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
Unity.Mathematics.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
Unity.Mathematics.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral19
Sample
Unity.ProBuilder.KdTree.dll
Resource
win7-20240708-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral20
Sample
Unity.ProBuilder.KdTree.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral21
Sample
Unity.ProBuilder.Poly2Tri.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral22
Sample
Unity.ProBuilder.Poly2Tri.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral23
Sample
Unity.ProBuilder.dll
Resource
win7-20241010-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral24
Sample
Unity.ProBuilder.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral25
Sample
UnityEngine.AIModule.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral26
Sample
UnityEngine.AIModule.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral27
Sample
UnityEngine.ARModule.dll
Resource
win7-20240729-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral28
Sample
UnityEngine.ARModule.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral29
Sample
UnityEngine.AccessibilityModule.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral30
Sample
UnityEngine.AccessibilityModule.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral31
Sample
UnityEngine.AndroidJNIModule.dll
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
UnityEngine.AndroidJNIModule.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
600 seconds
General
- Target Octokit.dll
- Size 1.3MB
- Sample241018-fe484syalg
- SHA256 41508af363730c9df614bfe3e498cf5dc4565ec54907f7fb26bd86194e5ff3de
- MD5 80feaeb7b8c493df5534c2b5c2c43bae
- SHA1 c73542b0a4247442c2aa979b7d4e7210ed87e03a
- SHA512 7e627e64e2273d6f0c054decd3e9cd6845d191f56e1ce29591a011e59b815805a26eba36c7746893567058fe21bde887a37c1aa89bcbae749ff00eec66d6a69b
- SSDEEP 24576:7PhshAfmAoEpwQQWhZ62KLp+CkAdjG3sMs2Cd5o775AxUzNZsPbKAayFHV+Sg:NrHCkAdjG3sMs2Cd5o775AxUzN8JayFr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
quasar
Version
-
3.1.5
Botnet
-
SeroXen
C2
-
127.0.0.1:4782
Mutex
-
$Sxr-GV6wZsGZZMeZ3qfenc
Attributes
-
encryption_key
EUSviIV2seOGLpaj2p7j
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Quasar payload 2 IoCs
resource yara_rule behavioral8/files/0x000e000000023d1a-36.dat family_quasar behavioral8/memory/2872-38-0x0000000000D30000-0x0000000000D9C000-memory.dmp family_quasar - Executes dropped EXE 2 IoCs
pid Process 2872 Uni.bat 536 Client.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 71 ip-api.com - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uni.bat Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHTASKS.exe - Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Seroxen launcher v3.1.2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Seroxen launcher v3.1.2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Seroxen launcher v3.1.2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Seroxen launcher v3.1.2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Seroxen launcher v3.1.2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Seroxen launcher v3.1.2.exe - Modifies registry class 55 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 010000000200000000000000ffffffff Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e80922b16d365937a46956b92703aca08af0000 Seroxen launcher v3.1.2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Seroxen launcher v3.1.2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\NodeSlot = "6" Seroxen launcher v3.1.2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Downloads" Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5 Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 14002e8005398e082303024b98265d99428e115f0000 Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "5" Seroxen launcher v3.1.2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6 Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = ffffffff Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202 Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Seroxen launcher v3.1.2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Documents" Seroxen launcher v3.1.2.exe Set value (data) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" Seroxen launcher v3.1.2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" Seroxen launcher v3.1.2.exe Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell Seroxen launcher v3.1.2.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" Seroxen launcher v3.1.2.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3120 SCHTASKS.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 636 Seroxen launcher v3.1.2.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2872 Uni.bat Token: SeDebugPrivilege 536 Client.exe Token: SeDebugPrivilege 636 Seroxen launcher v3.1.2.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1424 Seroxen launcher v3.1.2.exe 1424 Seroxen launcher v3.1.2.exe 636 Seroxen launcher v3.1.2.exe 636 Seroxen launcher v3.1.2.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1424 Seroxen launcher v3.1.2.exe 1424 Seroxen launcher v3.1.2.exe 636 Seroxen launcher v3.1.2.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 636 Seroxen launcher v3.1.2.exe 536 Client.exe 636 Seroxen launcher v3.1.2.exe 636 Seroxen launcher v3.1.2.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2872 wrote to memory of 536 2872 Uni.bat 113 PID 2872 wrote to memory of 536 2872 Uni.bat 113 PID 2872 wrote to memory of 536 2872 Uni.bat 113 PID 2872 wrote to memory of 3120 2872 Uni.bat 114 PID 2872 wrote to memory of 3120 2872 Uni.bat 114 PID 2872 wrote to memory of 3120 2872 Uni.bat 114
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Octokit.dll,#11⤵PID:2696
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\Seroxen launcher v3.1.2.exe"C:\Users\Admin\AppData\Local\Temp\Seroxen launcher v3.1.2.exe"1⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1424
-
C:\Users\Admin\AppData\Local\Temp\Seroxen launcher v3.1.2.exe"C:\Users\Admin\AppData\Local\Temp\Seroxen launcher v3.1.2.exe"1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:636
-
C:\Users\Admin\Downloads\Uni.bat"C:\Users\Admin\Downloads\Uni.bat"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:536
-
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Uni.bat" /tr "'C:\Users\Admin\Downloads\Uni.bat'" /sc onlogon /rl HIGHEST2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3120
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Seroxen launcher v3.1.2.exe.log
- Size 1KB
- SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
- MD5 baf55b95da4a601229647f25dad12878
- SHA1 abc16954ebfd213733c4493fc1910164d825cac8
- SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\settings.xml
- Size 402B
- SHA256 3ca285b097d81d2e5e6f375cea2840ab70e76fd55a9ad89b8e35cf70bc7eba8c
- MD5 3e7e03412bcd80ed563e36650836ffb8
- SHA1 9b76f430a0c6135424422cd717a960ede9a15e22
- SHA512 96b4b986c1748d494650511af056298a29a64683288f9f191efeb3b88ecc31a83bbff2433b8d947b22c9ff0f2f5c73ff0324efbac0d04f2f55b5ed228a0f1525
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\Uni.bat
- Size 409KB
- SHA256 2af0f2efa90bd3e2480152f7811771176c636a5d71f0782e9c7f5fc53871b680
- MD5 44cdf30654709f3cc2e87a4632595923
- SHA1 1613ac2248f83346ce82707e761449f07f8b3823
- SHA512 2a1e6f98675c57bc37492916938fe26776576cb39252ce70ef2921bde61e8a71edd7463911c1a42b057d01f1943620884e76acc6f7b6d28ac0464c056eda9cd5
- SSDEEP 12288:Ipg6M1iNfhgrzpGszbBy3KFsAKa60D2u:Qxqi8z06aA3d
- MD5 SHA1 SHA512 SSDEEP