quasar | 46136025a4d84640710a3c3ab05588b2ff288c7294ea3d855061b67609839cf6

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2024, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
liberium executor.exe
Size 3.1MB
Sample241201-1f9v7sxpdp
SHA256 46136025a4d84640710a3c3ab05588b2ff288c7294ea3d855061b67609839cf6
MD5 a83c74ddda692ff3e4279ef4d1e1ab6b
SHA1 f807912389ed16a9d7ac3e3e7b73282658c6ecf0
SHA512 70b79b90362b50fa52762554161f962535aff171f4cf3147afb960b5aba302cc8d969eb2168f331653b114b4199201be4ef5cd3bb97c67547708e2622e72874b
SSDEEP 49152:Svdt62XlaSFNWPjljiFa2RoUYIsSDsKdpvVoGdqTHHB72eh2NT:Svf62XlaSFNWPjljiFXRoUYIsCsE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.0.0.0.1:4782

Mutex

92adbb05-a27e-42e8-b9a2-c260d01e742b

Attributes

encryption_key
46B4B3697EBEA35C7930856CF4E60FB52D50DE37
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
executor
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2052-1-0x0000000000A80000-0x0000000000DA4000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023c95-6.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 15 IoCs

pid	Process
2924	Client.exe
4548	Client.exe
2356	Client.exe
4324	Client.exe
1672	Client.exe
2660	Client.exe
2444	Client.exe
736	Client.exe
3632	Client.exe
3396	Client.exe
4248	Client.exe
4668	Client.exe
1548	Client.exe
3940	Client.exe
1936	Client.exe

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File created	C:\Program Files\SubDir\Client.exe	liberium executor.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	liberium executor.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir	liberium executor.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe
File opened for modification	C:\Program Files\SubDir\Client.exe	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4736	PING.EXE
1792	PING.EXE
2008	PING.EXE
440	PING.EXE
840	PING.EXE
3716	PING.EXE
2784	PING.EXE
1660	PING.EXE
3528	PING.EXE
2404	PING.EXE
4080	PING.EXE
1660	PING.EXE
1132	PING.EXE
2212	PING.EXE
2704	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
4080	PING.EXE
2404	PING.EXE
1660	PING.EXE
3528	PING.EXE
4736	PING.EXE
2784	PING.EXE
440	PING.EXE
1660	PING.EXE
3716	PING.EXE
2008	PING.EXE
2212	PING.EXE
840	PING.EXE
2704	PING.EXE
1792	PING.EXE
1132	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2008	schtasks.exe
3988	schtasks.exe
2340	schtasks.exe
384	schtasks.exe
3288	schtasks.exe
2544	schtasks.exe
4620	schtasks.exe
228	schtasks.exe
4760	schtasks.exe
3064	schtasks.exe
228	schtasks.exe
980	schtasks.exe
456	schtasks.exe
2664	schtasks.exe
3972	schtasks.exe
772	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	liberium executor.exe
Token: SeDebugPrivilege	2924	Client.exe
Token: SeDebugPrivilege	4548	Client.exe
Token: SeDebugPrivilege	2356	Client.exe
Token: SeDebugPrivilege	4324	Client.exe
Token: SeDebugPrivilege	1672	Client.exe
Token: SeDebugPrivilege	2660	Client.exe
Token: SeDebugPrivilege	2444	Client.exe
Token: SeDebugPrivilege	736	Client.exe
Token: SeDebugPrivilege	3632	Client.exe
Token: SeDebugPrivilege	3396	Client.exe
Token: SeDebugPrivilege	4248	Client.exe
Token: SeDebugPrivilege	4668	Client.exe
Token: SeDebugPrivilege	1548	Client.exe
Token: SeDebugPrivilege	3940	Client.exe
Token: SeDebugPrivilege	1936	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2924	Client.exe
4548	Client.exe
2356	Client.exe
4324	Client.exe
1672	Client.exe
2660	Client.exe
2444	Client.exe
736	Client.exe
3632	Client.exe
3396	Client.exe
4248	Client.exe
4668	Client.exe
1548	Client.exe
3940	Client.exe
1936	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2924	Client.exe
4548	Client.exe
2356	Client.exe
4324	Client.exe
1672	Client.exe
2660	Client.exe
2444	Client.exe
736	Client.exe
3632	Client.exe
3396	Client.exe
4248	Client.exe
4668	Client.exe
1548	Client.exe
3940	Client.exe
1936	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 3288	2052	liberium executor.exe	83
PID 2052 wrote to memory of 3288	2052	liberium executor.exe	83
PID 2052 wrote to memory of 2924	2052	liberium executor.exe	85
PID 2052 wrote to memory of 2924	2052	liberium executor.exe	85
PID 2924 wrote to memory of 2008	2924	Client.exe	86
PID 2924 wrote to memory of 2008	2924	Client.exe	86
PID 2924 wrote to memory of 2524	2924	Client.exe	88
PID 2924 wrote to memory of 2524	2924	Client.exe	88
PID 2524 wrote to memory of 3528	2524	cmd.exe	90
PID 2524 wrote to memory of 3528	2524	cmd.exe	90
PID 2524 wrote to memory of 2404	2524	cmd.exe	91
PID 2524 wrote to memory of 2404	2524	cmd.exe	91
PID 2524 wrote to memory of 4548	2524	cmd.exe	101
PID 2524 wrote to memory of 4548	2524	cmd.exe	101
PID 4548 wrote to memory of 2664	4548	Client.exe	102
PID 4548 wrote to memory of 2664	4548	Client.exe	102
PID 4548 wrote to memory of 2556	4548	Client.exe	104
PID 4548 wrote to memory of 2556	4548	Client.exe	104
PID 2556 wrote to memory of 4908	2556	cmd.exe	107
PID 2556 wrote to memory of 4908	2556	cmd.exe	107
PID 2556 wrote to memory of 2784	2556	cmd.exe	108
PID 2556 wrote to memory of 2784	2556	cmd.exe	108
PID 2556 wrote to memory of 2356	2556	cmd.exe	114
PID 2556 wrote to memory of 2356	2556	cmd.exe	114
PID 2356 wrote to memory of 4760	2356	Client.exe	115
PID 2356 wrote to memory of 4760	2356	Client.exe	115
PID 2356 wrote to memory of 3300	2356	Client.exe	118
PID 2356 wrote to memory of 3300	2356	Client.exe	118
PID 3300 wrote to memory of 4856	3300	cmd.exe	120
PID 3300 wrote to memory of 4856	3300	cmd.exe	120
PID 3300 wrote to memory of 1660	3300	cmd.exe	121
PID 3300 wrote to memory of 1660	3300	cmd.exe	121
PID 3300 wrote to memory of 4324	3300	cmd.exe	124
PID 3300 wrote to memory of 4324	3300	cmd.exe	124
PID 4324 wrote to memory of 3064	4324	Client.exe	125
PID 4324 wrote to memory of 3064	4324	Client.exe	125
PID 4324 wrote to memory of 3252	4324	Client.exe	128
PID 4324 wrote to memory of 3252	4324	Client.exe	128
PID 3252 wrote to memory of 264	3252	cmd.exe	130
PID 3252 wrote to memory of 264	3252	cmd.exe	130
PID 3252 wrote to memory of 2008	3252	cmd.exe	131
PID 3252 wrote to memory of 2008	3252	cmd.exe	131
PID 3252 wrote to memory of 1672	3252	cmd.exe	133
PID 3252 wrote to memory of 1672	3252	cmd.exe	133
PID 1672 wrote to memory of 228	1672	Client.exe	134
PID 1672 wrote to memory of 228	1672	Client.exe	134
PID 1672 wrote to memory of 3964	1672	Client.exe	137
PID 1672 wrote to memory of 3964	1672	Client.exe	137
PID 3964 wrote to memory of 4072	3964	cmd.exe	139
PID 3964 wrote to memory of 4072	3964	cmd.exe	139
PID 3964 wrote to memory of 2212	3964	cmd.exe	140
PID 3964 wrote to memory of 2212	3964	cmd.exe	140
PID 3964 wrote to memory of 2660	3964	cmd.exe	141
PID 3964 wrote to memory of 2660	3964	cmd.exe	141
PID 2660 wrote to memory of 980	2660	Client.exe	142
PID 2660 wrote to memory of 980	2660	Client.exe	142
PID 2660 wrote to memory of 2336	2660	Client.exe	145
PID 2660 wrote to memory of 2336	2660	Client.exe	145
PID 2336 wrote to memory of 4032	2336	cmd.exe	147
PID 2336 wrote to memory of 4032	2336	cmd.exe	147
PID 2336 wrote to memory of 4080	2336	cmd.exe	148
PID 2336 wrote to memory of 4080	2336	cmd.exe	148
PID 2336 wrote to memory of 2444	2336	cmd.exe	150
PID 2336 wrote to memory of 2444	2336	cmd.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\liberium executor.exe
"C:\Users\Admin\AppData\Local\Temp\liberium executor.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3288
- C:\Program Files\SubDir\Client.exe
  "C:\Program Files\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EdD7iQOCtKff.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3528
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2404
  - - C:\Program Files\SubDir\Client.exe
      "C:\Program Files\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2664
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GfedfTWAbuLK.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2556
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4908
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2784
      - C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4760
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6ZxZpfGrHCYt.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4856
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1660
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wxTuOTe1euq4.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:264
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2008
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iWr3Zs5vkNfm.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4072
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2212
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CeD6vYJ8Qyf5.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4032
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4080
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2444
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q4mJ5G1iBLfF.bat" "
        15⤵
        
        PID:1272
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:368
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:440
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:736
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oxHDLEbKHB3T.bat" "
        17⤵
        
        PID:2000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1660
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3632
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u0nXayst6AkG.bat" "
        19⤵
        
        PID:4864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3424
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3528
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3396
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8ayli89aHEeM.bat" "
        21⤵
        
        PID:4212
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2832
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:840
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4248
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7tfPiQ4rtPof.bat" "
        23⤵
        
        PID:3808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3908
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3716
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4668
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mXUKLpEfID9d.bat" "
        25⤵
        
        PID:4376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:5000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2704
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1548
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\V92dlyKHY5mB.bat" "
        27⤵
        
        PID:2284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4736
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3940
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kUmTGCM1qHgV.bat" "
        29⤵
        
        PID:4180
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3104
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1792
        
        C:\Program Files\SubDir\Client.exe
        
        "C:\Program Files\SubDir\Client.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1936
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "executor" /sc ONLOGON /tr "C:\Program Files\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hQNeTAetQzHd.bat" "
        31⤵
        
        PID:2080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2236
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe

Path C:\Program Files\SubDir\Client.exe
Size 3.1MB
SHA256 46136025a4d84640710a3c3ab05588b2ff288c7294ea3d855061b67609839cf6
MD5 a83c74ddda692ff3e4279ef4d1e1ab6b
SHA1 f807912389ed16a9d7ac3e3e7b73282658c6ecf0
SHA512 70b79b90362b50fa52762554161f962535aff171f4cf3147afb960b5aba302cc8d969eb2168f331653b114b4199201be4ef5cd3bb97c67547708e2622e72874b
SSDEEP 49152:Svdt62XlaSFNWPjljiFa2RoUYIsSDsKdpvVoGdqTHHB72eh2NT:Svf62XlaSFNWPjljiFXRoUYIsCsE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

6ZxZpfGrHCYt.bat

Path C:\Users\Admin\AppData\Local\Temp\6ZxZpfGrHCYt.bat
Size 193B
SHA256 330bc396880979cc4282d3e9575cd83d668a5cdca5284e62dd88aa32ca55368b
MD5 be6e9272d40750af0add2daa1b848474
SHA1 81072324a4afa8f96347879bc400d285feb42575
SHA512 e804c57b590dba078bb5ee63fa382b5844fa7cc9962ce8ce225fdd79548afc0d58a755e34bbbdec8966445205e17100649061b3f3115c52ac1192ca964ae1e61
MD5 SHA1 SHA512

Submit Download

7tfPiQ4rtPof.bat

Path C:\Users\Admin\AppData\Local\Temp\7tfPiQ4rtPof.bat
Size 193B
SHA256 0032ade1699a071a0592f825e164ec6de6d2deb627c1f95426baf8d3228a7d2a
MD5 903d9c4a83908859f68c9283282705a0
SHA1 cfb6668cbf6c6bf6f5b9d7464d38d3778671ebe5
SHA512 22b7da447325f40dde949b707552782a3f0e829864e9f898ec27778d786202f7d568ea5fc10ac5feb619bebd72a4a32d88d51a1420cc40a5083dd8623bd42276
MD5 SHA1 SHA512

Submit Download

8ayli89aHEeM.bat

Path C:\Users\Admin\AppData\Local\Temp\8ayli89aHEeM.bat
Size 193B
SHA256 0a98a40cc6157da66693585d6d5fdeb985e737c40dd4f2a4bd3b210dc1d3fa4d
MD5 8b28dcbae3419c29fa615fef682a0d02
SHA1 12b8de4491a91691a78689e0947c65fc9cc6a916
SHA512 dc5309b4a6c9b19c52f09681d95223e3fa54e21236ff1a73866a8e8a635071e2095df13f4ab11c32d37839248519f6be0851d64704f9ad09661b0be420d4769f
MD5 SHA1 SHA512

Submit Download

CeD6vYJ8Qyf5.bat

Path C:\Users\Admin\AppData\Local\Temp\CeD6vYJ8Qyf5.bat
Size 193B
SHA256 fefd14b2f46221bd19da0cd02e7150133c38f58236ce7f55c7058e9501b530be
MD5 8244048c1bc8f1a841aeebca3002ddb6
SHA1 1a98ef0e8554dd7ca11a9784b05e02828a9abb4f
SHA512 019503ea3d88ee9a58a5c58ea256f393504692e7083d4f77687de3a4053e38afd0e28408479da8d0a1f6b35d61ae1dc6691b9f9827fb8bad8ec752df64687119
MD5 SHA1 SHA512

Submit Download

EdD7iQOCtKff.bat

Path C:\Users\Admin\AppData\Local\Temp\EdD7iQOCtKff.bat
Size 193B
SHA256 17135f3b9f585e7d124172234217a5489700f45034c0e68d3a81d50ed4437b0e
MD5 3990a249e72716f37ecd12f26514655c
SHA1 6e34827c8a5438ef53d3600db3fb8e2956fc4603
SHA512 aa8dd01e026351e96a4a8e5ff9adf6800f7b9cd5a3a1428f050cb0cda9ed1cf4b54a5bb95011a02c952ff94c831e720f8828ea114bb65617e8cb6cb18e2f0b22
MD5 SHA1 SHA512

Submit Download

GfedfTWAbuLK.bat

Path C:\Users\Admin\AppData\Local\Temp\GfedfTWAbuLK.bat
Size 193B
SHA256 8b93c3882ca44c9eccffb3db5e6f7d01f3b98e51f1fe8ca2736a260b01289b1d
MD5 680633ed1d7f2b9acf15f45807b40f77
SHA1 8e5eb2d5a04246aa6c9bef0fec388467c3560df3
SHA512 1517eb93be2c20dd65411ed9881daefd6415ba89962a5e7b7254db2af0bce3a841c53a6988953208fbae534973e8869b893032743fdf83acaa870055db044aad
MD5 SHA1 SHA512

Submit Download

Q4mJ5G1iBLfF.bat

Path C:\Users\Admin\AppData\Local\Temp\Q4mJ5G1iBLfF.bat
Size 193B
SHA256 579169497c70183ae7cbcd0a9e8e332a723b1ee9ac18c0062a9f01fe9dacc750
MD5 3bbecaf7326efc3a105874ea3cba9062
SHA1 6c5f239793c0caecd3203bb65349df6ee13b042a
SHA512 49662fea7de656f6f091716e3848c910781c7ec36a62eeb0e6ba35b06b219d902e51dbae7051000929206ec4d6a2b71b5699ba852c53ab4d3f39a2edf84757a6
MD5 SHA1 SHA512

Submit Download

V92dlyKHY5mB.bat

Path C:\Users\Admin\AppData\Local\Temp\V92dlyKHY5mB.bat
Size 193B
SHA256 03b15397139eb0e0def65d6929fb53bb62e419ecb3af533c895678d81acd4e6d
MD5 1462e0308e62901319f097c1dce87af9
SHA1 b055e8f1f593adac14f67b6062dd8a161950a860
SHA512 8080ff0bafe37dbb95191ef5d2235f9a1651a4cb81dbc6847ba56265d9d5845e5da32681ba54e0876fda7ed206e0c927f7ae8f5d88797cb9cb90d0e00719a3ad
MD5 SHA1 SHA512

Submit Download

hQNeTAetQzHd.bat

Path C:\Users\Admin\AppData\Local\Temp\hQNeTAetQzHd.bat
Size 193B
SHA256 161abee2dafe612db0da29351440d115727cf88ae7b7d8ca61e9bdfcbbf09605
MD5 939f4b4e538529b3af32b594560c8558
SHA1 b693ee637f5da1c3d5d68b87b94bb3da746baf32
SHA512 1c6503f7c27a678cb08e24bd9ee283a9602222e28e9c6543a2fc74258fefc6f99af75e26fc7361fe07ae1b1a44f89c391a631ed9cfa5bf596a67491c070c76ed
MD5 SHA1 SHA512

Submit Download

iWr3Zs5vkNfm.bat

Path C:\Users\Admin\AppData\Local\Temp\iWr3Zs5vkNfm.bat
Size 193B
SHA256 1abd119b1bd96503e876c46c32a643b18994e20df0052c1051b8f6622cb8b54e
MD5 8e73b4d84ac96a5835b530de9c75e2db
SHA1 8b98e060bfb0d5d43f996e95fa27d5f90aa49988
SHA512 856b286463931fecb7a0ad5ed48788b612a8d2edd1b13ac29578d4968f4fcaa6ed9a390043790d6675ebae06acf1a192db075fec6e458531dee4bb2ce2d5da70
MD5 SHA1 SHA512

Submit Download

kUmTGCM1qHgV.bat

Path C:\Users\Admin\AppData\Local\Temp\kUmTGCM1qHgV.bat
Size 193B
SHA256 09bde6c9307e626860502644232b196fa3811499596007b79d0180ea5e555706
MD5 57280038246ae439fe96a9ff15ce064d
SHA1 fe423eb141b5c6812882e6b930f42a5944083cbe
SHA512 72f63207ef4f879fa9249bc3c5f40dae6300099df8429c7d8a312a353ebbc4eee0d418e784f0bf0a884af7afcf47cec0b3dacd63937b632bd01904e5830c00d3
MD5 SHA1 SHA512

Submit Download

mXUKLpEfID9d.bat

Path C:\Users\Admin\AppData\Local\Temp\mXUKLpEfID9d.bat
Size 193B
SHA256 e1cbf522e78b93066ae195b1eaa1b70ea52dd346c9b1ece622736331fbc1d8c0
MD5 6a982cdcee8de74587ba88600a2b92f0
SHA1 7171d914cd626a9542815b898598e40fc51e3f1d
SHA512 1997133f85afe7f459544f520d2e8e9df31c0429e7156a56bf4c05ac4a1f5ff2740affc3536d803f4fe2ee7bc90a6d7d9d767258e3ad4d6265e70a8d5f43498b
MD5 SHA1 SHA512

Submit Download

oxHDLEbKHB3T.bat

Path C:\Users\Admin\AppData\Local\Temp\oxHDLEbKHB3T.bat
Size 193B
SHA256 367b550e9a541cb7cfa260b08967e37f298629416e3f722ce18da98a56415a71
MD5 ce483b4c347563046995e7764aa3e095
SHA1 317065a19addb6d11000fc313bbc0b0546d3128a
SHA512 f4778a7b2839cffdf499cbb40debb2c98f2de35c5743d5aebd3d8868525ffbd53c1a1db6b34a2b1900cb41558a81f90d6b8eb0282320345302f6e4caaa43cd76
MD5 SHA1 SHA512

Submit Download

u0nXayst6AkG.bat

Path C:\Users\Admin\AppData\Local\Temp\u0nXayst6AkG.bat
Size 193B
SHA256 2937a15ee582dab150879ffd8783f43f1f6f551a6e23e4902c6e6f2d32e3e192
MD5 f35ba883cd4236f202ae23e4c6009fce
SHA1 a836e49d0dfcadb7d9876cf403708bcecbf6896f
SHA512 88794119290f4348858cb82839a4f6d8b6136b9e42c73e415cc2bd61ecdd072ef887b16ded60c7cd980cc45a1e7f6c8bb7d114687d5505f9f837effc9893681b
MD5 SHA1 SHA512

Submit Download

wxTuOTe1euq4.bat

Path C:\Users\Admin\AppData\Local\Temp\wxTuOTe1euq4.bat
Size 193B
SHA256 86b96e7c845f5f7a870b642b47fb9e9d4f2da9f393c013e026d5c228962c0bc2
MD5 990a1a315b104a08f62ce5bcfc693340
SHA1 7cdc7d30e37b0b8c9ec768560c66dc8683f6bcc2
SHA512 68f13ced3422e7fb46856cff6eaa6fb947a77dc1e6585b1f950c16ff82419ed2a28d9edf7a3487a77750a370676380dce19169bd7af5b8be21c8adf6326636d7
MD5 SHA1 SHA512

Submit Download

memory/2052-0-0x00007FFB66543000-0x00007FFB66545000-memory.dmp

Download

memory/2052-10-0x00007FFB66540000-0x00007FFB67001000-memory.dmp

Download

memory/2052-2-0x00007FFB66540000-0x00007FFB67001000-memory.dmp

Download

memory/2052-1-0x0000000000A80000-0x0000000000DA4000-memory.dmp

Download

memory/2924-19-0x00007FFB66540000-0x00007FFB67001000-memory.dmp

Download

memory/2924-13-0x000000001CA70000-0x000000001CB22000-memory.dmp

Download

memory/2924-12-0x000000001C960000-0x000000001C9B0000-memory.dmp

Download

memory/2924-11-0x00007FFB66540000-0x00007FFB67001000-memory.dmp

Download

memory/2924-9-0x00007FFB66540000-0x00007FFB67001000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads