quasar | b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e

Analysis

max time kernel
143s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe
Size

3.1MB
MD5

f9fd797dbef56a3900d2fe9d0a6e2e86
SHA1

c5d002cc63bd21fa35fdad428ca4c909f34c4309
SHA256

b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e
SHA512

c4d170855397e2e62d754883b2caab00d14f58787463924141d2077997ee03b25cd752565354c1c4cbace637cf1c053c45a162d0b61b31caa73f1ec70b998ce1
SSDEEP

49152:ivkt62XlaSFNWPjljiFa2RoUYIobRJ6MbR3LoGdNwhTHHB72eh2NT:iv462XlaSFNWPjljiFXRoUYIobRJ6WK

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

biseo-48321.portmap.host:48321

Mutex

cb74f432-50f1-4947-8163-7687a0292fb0

Attributes

encryption_key
D1BBEF3C04D88FE8F97EE2745041632CE9C760EE
install_name
Svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Svchost
subdirectory
Svchost

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 8 IoCs

resource	yara_rule
behavioral1/memory/1904-1-0x00000000008A0000-0x0000000000BC4000-memory.dmp	family_quasar
behavioral1/files/0x0008000000016d06-6.dat	family_quasar
behavioral1/memory/1100-8-0x00000000010E0000-0x0000000001404000-memory.dmp	family_quasar
behavioral1/memory/2424-44-0x0000000001110000-0x0000000001434000-memory.dmp	family_quasar
behavioral1/memory/2764-86-0x00000000011E0000-0x0000000001504000-memory.dmp	family_quasar
behavioral1/memory/780-137-0x00000000002C0000-0x00000000005E4000-memory.dmp	family_quasar
behavioral1/memory/1680-149-0x0000000000310000-0x0000000000634000-memory.dmp	family_quasar
behavioral1/memory/1984-160-0x0000000000D10000-0x0000000001034000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
1100	Svchost.exe
2852	Svchost.exe
2736	Svchost.exe
2424	Svchost.exe
2268	Svchost.exe
2732	Svchost.exe
1660	Svchost.exe
2764	Svchost.exe
2688	Svchost.exe
2696	Svchost.exe
1188	Svchost.exe
2232	Svchost.exe
780	Svchost.exe
1680	Svchost.exe
1984	Svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1948	PING.EXE
2040	PING.EXE
1420	PING.EXE
3004	PING.EXE
2040	PING.EXE
1368	PING.EXE
2644	PING.EXE
2644	PING.EXE
1684	PING.EXE
1600	PING.EXE
2720	PING.EXE
1848	PING.EXE
2656	PING.EXE
1860	PING.EXE
1588	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2040	PING.EXE
2644	PING.EXE
3004	PING.EXE
2040	PING.EXE
2720	PING.EXE
2644	PING.EXE
1860	PING.EXE
1848	PING.EXE
1368	PING.EXE
1684	PING.EXE
1600	PING.EXE
1420	PING.EXE
2656	PING.EXE
1588	PING.EXE
1948	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1644	schtasks.exe
2760	schtasks.exe
2380	schtasks.exe
2508	schtasks.exe
2484	schtasks.exe
2884	schtasks.exe
2480	schtasks.exe
1788	schtasks.exe
2812	schtasks.exe
2908	schtasks.exe
1952	schtasks.exe
2372	schtasks.exe
2652	schtasks.exe
1476	schtasks.exe
1624	schtasks.exe
808	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1904	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe
Token: SeDebugPrivilege	1100	Svchost.exe
Token: SeDebugPrivilege	2852	Svchost.exe
Token: SeDebugPrivilege	2736	Svchost.exe
Token: SeDebugPrivilege	2424	Svchost.exe
Token: SeDebugPrivilege	2268	Svchost.exe
Token: SeDebugPrivilege	2732	Svchost.exe
Token: SeDebugPrivilege	1660	Svchost.exe
Token: SeDebugPrivilege	2764	Svchost.exe
Token: SeDebugPrivilege	2688	Svchost.exe
Token: SeDebugPrivilege	2696	Svchost.exe
Token: SeDebugPrivilege	1188	Svchost.exe
Token: SeDebugPrivilege	2232	Svchost.exe
Token: SeDebugPrivilege	780	Svchost.exe
Token: SeDebugPrivilege	1680	Svchost.exe
Token: SeDebugPrivilege	1984	Svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1100	Svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1624	1904	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	30
PID 1904 wrote to memory of 1624	1904	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	30
PID 1904 wrote to memory of 1624	1904	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	30
PID 1904 wrote to memory of 1100	1904	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	32
PID 1904 wrote to memory of 1100	1904	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	32
PID 1904 wrote to memory of 1100	1904	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	32
PID 1100 wrote to memory of 2484	1100	Svchost.exe	33
PID 1100 wrote to memory of 2484	1100	Svchost.exe	33
PID 1100 wrote to memory of 2484	1100	Svchost.exe	33
PID 1100 wrote to memory of 2856	1100	Svchost.exe	35
PID 1100 wrote to memory of 2856	1100	Svchost.exe	35
PID 1100 wrote to memory of 2856	1100	Svchost.exe	35
PID 2856 wrote to memory of 2760	2856	cmd.exe	37
PID 2856 wrote to memory of 2760	2856	cmd.exe	37
PID 2856 wrote to memory of 2760	2856	cmd.exe	37
PID 2856 wrote to memory of 2644	2856	cmd.exe	38
PID 2856 wrote to memory of 2644	2856	cmd.exe	38
PID 2856 wrote to memory of 2644	2856	cmd.exe	38
PID 2856 wrote to memory of 2852	2856	cmd.exe	39
PID 2856 wrote to memory of 2852	2856	cmd.exe	39
PID 2856 wrote to memory of 2852	2856	cmd.exe	39
PID 2852 wrote to memory of 2908	2852	Svchost.exe	40
PID 2852 wrote to memory of 2908	2852	Svchost.exe	40
PID 2852 wrote to memory of 2908	2852	Svchost.exe	40
PID 2852 wrote to memory of 2912	2852	Svchost.exe	42
PID 2852 wrote to memory of 2912	2852	Svchost.exe	42
PID 2852 wrote to memory of 2912	2852	Svchost.exe	42
PID 2912 wrote to memory of 2960	2912	cmd.exe	44
PID 2912 wrote to memory of 2960	2912	cmd.exe	44
PID 2912 wrote to memory of 2960	2912	cmd.exe	44
PID 2912 wrote to memory of 3004	2912	cmd.exe	45
PID 2912 wrote to memory of 3004	2912	cmd.exe	45
PID 2912 wrote to memory of 3004	2912	cmd.exe	45
PID 2912 wrote to memory of 2736	2912	cmd.exe	47
PID 2912 wrote to memory of 2736	2912	cmd.exe	47
PID 2912 wrote to memory of 2736	2912	cmd.exe	47
PID 2736 wrote to memory of 2884	2736	Svchost.exe	48
PID 2736 wrote to memory of 2884	2736	Svchost.exe	48
PID 2736 wrote to memory of 2884	2736	Svchost.exe	48
PID 2736 wrote to memory of 2624	2736	Svchost.exe	50
PID 2736 wrote to memory of 2624	2736	Svchost.exe	50
PID 2736 wrote to memory of 2624	2736	Svchost.exe	50
PID 2624 wrote to memory of 2024	2624	cmd.exe	52
PID 2624 wrote to memory of 2024	2624	cmd.exe	52
PID 2624 wrote to memory of 2024	2624	cmd.exe	52
PID 2624 wrote to memory of 1860	2624	cmd.exe	53
PID 2624 wrote to memory of 1860	2624	cmd.exe	53
PID 2624 wrote to memory of 1860	2624	cmd.exe	53
PID 2624 wrote to memory of 2424	2624	cmd.exe	54
PID 2624 wrote to memory of 2424	2624	cmd.exe	54
PID 2624 wrote to memory of 2424	2624	cmd.exe	54
PID 2424 wrote to memory of 808	2424	Svchost.exe	55
PID 2424 wrote to memory of 808	2424	Svchost.exe	55
PID 2424 wrote to memory of 808	2424	Svchost.exe	55
PID 2424 wrote to memory of 1088	2424	Svchost.exe	57
PID 2424 wrote to memory of 1088	2424	Svchost.exe	57
PID 2424 wrote to memory of 1088	2424	Svchost.exe	57
PID 1088 wrote to memory of 1244	1088	cmd.exe	59
PID 1088 wrote to memory of 1244	1088	cmd.exe	59
PID 1088 wrote to memory of 1244	1088	cmd.exe	59
PID 1088 wrote to memory of 2040	1088	cmd.exe	60
PID 1088 wrote to memory of 2040	1088	cmd.exe	60
PID 1088 wrote to memory of 2040	1088	cmd.exe	60
PID 1088 wrote to memory of 2268	1088	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe
"C:\Users\Admin\AppData\Local\Temp\b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1624
- C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
  "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2484
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\mZTNaLvNSMB8.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2760
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2644
  - - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
      "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2908
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NaHA4BlYWYp9.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2912
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2960
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3004
      - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2884
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\VkNz8VyZOAKt.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2024
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1860
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:808
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\nqeVjijFWCzd.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1244
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2268
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1788
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\V1SDhcDm06EF.bat" "
        11⤵
        
        PID:1248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1492
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1588
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1644
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\kess2TXXIZJY.bat" "
        13⤵
        
        PID:764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2216
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1948
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2372
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\J3sVQmbTwOvg.bat" "
        15⤵
        
        PID:1004
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2716
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2720
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2760
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ev3dp75tgNB.bat" "
        17⤵
        
        PID:2664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2340
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2644
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2688
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2652
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4meAK7wbE59w.bat" "
        19⤵
        
        PID:2896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:668
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1848
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2812
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\qnAimarXQ8qB.bat" "
        21⤵
        
        PID:2940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2452
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1368
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2380
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\68iW5HMghluv.bat" "
        23⤵
        
        PID:448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:848
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1476
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ANAiCuYdxkYV.bat" "
        25⤵
        
        PID:1724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2604
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1684
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:780
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2480
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ZVJy7fgemy0Z.bat" "
        27⤵
        
        PID:1112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2184
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1600
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1952
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\wS0tw57PFepY.bat" "
        29⤵
        
        PID:2576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2484
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1420
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2508
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\JwICS36fAoRv.bat" "
        31⤵
        
        PID:2512
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2632
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4meAK7wbE59w.bat

Filesize
209B

MD5
c901ae9deeafb289e4f53807b9d78f5a

SHA1
d662b92f62df6bc0a830d70fb673ff46db75d196

SHA256
cf25e7ab859445fc41abb86d1b53aac32df45d2720ae0b674fe475b71c779b86

SHA512
524df64725527480d2baf223d34da0f50b0116296ec283485c030f3c02397bd1517263cb8c784b4cd25e5f87ea889c8ba28a70114b49ef92c44537213d4d65ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\68iW5HMghluv.bat

Filesize
209B

MD5
75aa849aa8d50cc0e23a084ed7372786

SHA1
23d9ebcc76f902c035564c53eea1edd564e66d29

SHA256
1935e2b0d485a41a88aa9126de9614a865278088d18f99ede253d5b75b7d3ac9

SHA512
6ce03424d04ee5ccb754fc3e8e19c0ec7d30212925bd117481046c30e88bfacacc66580378631d541a286d420ca014b371b7ffc507ee2108e6b91c5af72fae65

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ev3dp75tgNB.bat

Filesize
209B

MD5
da7a867295aef3a269b06753d404e735

SHA1
48a7a1d42a7ac1e669de1aac52f185096db6204c

SHA256
3a5ef2021aaf8aa9753dcafde36d042ea4255c3023504cd41104fa77b91768f7

SHA512
2eb2800308813073cef2fd327028f616c4e1441bff500960de25317520fe873e290a66949626f226c54708189171756c02fb2cb73b9977e7a850d63b32afce26

Download Submit
C:\Users\Admin\AppData\Local\Temp\ANAiCuYdxkYV.bat

Filesize
209B

MD5
71b853e5077135eb0742b3116ed40b5d

SHA1
fb4788ec1e371cb29f7b6ce374f6ed0495bf2860

SHA256
90ff23bc7ab3e2ea661d06638333c31d3efb7a9862def64e1428ca1808e3e698

SHA512
8a55cec2be0ae008c9366a351707143cf6a9047e388fd8fd4cfbbdee6d33d2056c8baad5d878262f3466a1e613d7459937161fdae2ba2ac6284f9b8de22134b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\J3sVQmbTwOvg.bat

Filesize
209B

MD5
7a7d6e1c7b191919f2e9da6dfd75340d

SHA1
39b077b2b1857f767a7eefb8b514a4737c67179c

SHA256
8a3925c0e6b8baa54dc3dfa09f1f2b09bc204ea7f1e6fc0dde9f7a65a8bb5932

SHA512
0af5e3b247d36069e71b6fa84176155f0bbfacb79d752e88177d693e96098eab2836e0f881a08eaf9c0cc663d0ef9757e6316b574893f890d933969991a0307f

Download Submit
C:\Users\Admin\AppData\Local\Temp\JwICS36fAoRv.bat

Filesize
209B

MD5
e9e71989ab2b8a7ff7cc0c9c0cca4800

SHA1
52a4ff45c0b2c68fe8f21e321d1998a7d132c5ee

SHA256
d9fadecb6f879b2295feb54d5e28990b5c24066431045b2a92feccc7bcb0e84d

SHA512
8ff0a3887b77643f1fb71d85b2604fd1a8447c639f38506205dca703021731744f4ad0d30cae43228ca554a81e6afdaf2190ff9237876bf71fc4083e2e18daa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\NaHA4BlYWYp9.bat

Filesize
209B

MD5
501533c0e553ffcc2258d26e535689dc

SHA1
1f8696cfe3f66506e63c0cdd87cab650fd10fe02

SHA256
c530b2267e6a20c1efdc7cfc2ab591d0e42a060f67478292331f44109e013af8

SHA512
7700ea19b5918d0a9ef74cf6ed86e7cf10c31bd518cdc95b30c25420d782f4960d0cc02a3deaa0f2139941a61c9fb29d467a46ba7c6d530a4b92241b4ede33dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\V1SDhcDm06EF.bat

Filesize
209B

MD5
3e564051b7d61d4f0a7ad526f4dcbf25

SHA1
8e4ed827556f3714055111154c89a49b53341c35

SHA256
788940d33d41211da7732da01623f63ff4bdecd1bcace5b4f2c913be03edd109

SHA512
c9043de0dca6ea7caff7f8aa8fac6d5d2b317b05837b11ed07a46b26186d64231bc3a8faf0cf41a0ece9e29abb9f7f888519ca712d009098dbbabda4295eb42e

Download Submit
C:\Users\Admin\AppData\Local\Temp\VkNz8VyZOAKt.bat

Filesize
209B

MD5
4c99452bb73f793630ddad80cfdd0b5e

SHA1
f60ef40c4d9756c959b77a97cd1b4540c0b5625b

SHA256
eec71be4f7552e5152a1f61432e9316b472ab9c4a898244d5eaeb42e09ae03a0

SHA512
f3ff8347f662b7a9bb32c11334b661706831d1ae8fafd49b8f48a20b0ab0f91ab41231458dff918ee8476d1346de76f28726fa1a470685d3f9cdf84fd6e1472e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZVJy7fgemy0Z.bat

Filesize
209B

MD5
504cc349926ae9a3c216cd4ed34c1e09

SHA1
5185194bf1b76e4738b832c006124ba536491243

SHA256
3cb7c085b9fedef90c75839979bf3aa4f93abdce2a65bb9917115e0aaac2a843

SHA512
2a7abb35f0e154e6cd6aefb4f1dbaf90c4e86eb23c4acf7e0c1217f0e7a94323f6758bd6bdc73826f5614736e41ebaa80e86310b1d115a73986831f4e2fccc30

Download Submit
C:\Users\Admin\AppData\Local\Temp\kess2TXXIZJY.bat

Filesize
209B

MD5
02168fd23fbd7795a3191aa1b119a211

SHA1
dd2d45e61db880df401d5ba8e5cd841a3f7e400d

SHA256
5f648c92084e71ccc68fbc2eb3fbc2a4471a16dc644c3762ceb18caaac8ca55d

SHA512
c5bfa52dc9cfbe3950008de9ee08a409aaedc9f2ae3529f59a8c69324fedd5a6fcdf18899b44336d820a772a5affc7ea65708278e18bff02796eee2b8f2bd3fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\mZTNaLvNSMB8.bat

Filesize
209B

MD5
523ab7a359db3aa0f65e8829a765f8b7

SHA1
7917bd6c72866605daafc3b9be57cf923c71d68a

SHA256
acf6106dc989bd0f99ed3d05bc7fcfdf17dcd41921dabc971ea9cdedfff4082c

SHA512
e783f019963c971591607227f72f93cddcc4cc854cad540f88c4595b8e114af2eb1f573c1a36e9c19bf141a2a14d0870a31fe7b2857f9e8a52203be71a32b734

Download Submit
C:\Users\Admin\AppData\Local\Temp\nqeVjijFWCzd.bat

Filesize
209B

MD5
640a269af1ed48486003d3501d209b49

SHA1
27e3a4ddc28e018a7d01a56164327e49bc50020c

SHA256
b9985d33fa7971863ba23f467b57692e92f69a8415ea74a3fac2b78b0ee36908

SHA512
1febc91930ae8292726fb66bec7debffe279570a069de07e4718ba030eeb365cb0caee107dc6330056835a13e1bc5ec101e205e0bb35f245ad69184df6c288bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\qnAimarXQ8qB.bat

Filesize
209B

MD5
eebf382d27597fe891f7093df344e108

SHA1
3b0fcdf260bd56120f7fdebb729d17cb28adea2c

SHA256
d67dd49583bab908c61894b9440e1d19ed4965cc0ce17626668f7805641433d8

SHA512
36d325f019765b644d7a6705a5dcdcd2f11aa091ca3217be01492e35c8292fa2e37f7028dcdec1bcf21f32bd7259a4d52747c7c4e0620043adbc296eff240fc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\wS0tw57PFepY.bat

Filesize
209B

MD5
dd7a8aa9762bfb9b5e9419e03578c9df

SHA1
2665b778d0b2ccefad8de971e78987ce33911a29

SHA256
2b3c4ca1c202322d61631924dc87e7b039d3b6ff298c6bb376b79f9f2ef398b8

SHA512
2b4b6a6109c160f61a2d7cfceeb90d14275dbcaa5ea5a1e2e2b35cb0ee3dcfbe32a5f287f3ecb254eec78e578ae9255c6d9fc1d467875c84e6fdbc86bb9f7cc7

Download Submit
C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe

Filesize
3.1MB

MD5
f9fd797dbef56a3900d2fe9d0a6e2e86

SHA1
c5d002cc63bd21fa35fdad428ca4c909f34c4309

SHA256
b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e

SHA512
c4d170855397e2e62d754883b2caab00d14f58787463924141d2077997ee03b25cd752565354c1c4cbace637cf1c053c45a162d0b61b31caa73f1ec70b998ce1

Download Submit
memory/780-137-0x00000000002C0000-0x00000000005E4000-memory.dmp

Filesize
3.1MB

Download
memory/1100-21-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1100-8-0x00000000010E0000-0x0000000001404000-memory.dmp

Filesize
3.1MB

Download
memory/1100-11-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1100-10-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1680-149-0x0000000000310000-0x0000000000634000-memory.dmp

Filesize
3.1MB

Download
memory/1904-9-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1904-2-0x000007FEF5D10000-0x000007FEF66FC000-memory.dmp

Filesize
9.9MB

Download
memory/1904-0-0x000007FEF5D13000-0x000007FEF5D14000-memory.dmp

Filesize
4KB

Download
memory/1904-1-0x00000000008A0000-0x0000000000BC4000-memory.dmp

Filesize
3.1MB

Download
memory/1984-160-0x0000000000D10000-0x0000000001034000-memory.dmp

Filesize
3.1MB

Download
memory/2424-44-0x0000000001110000-0x0000000001434000-memory.dmp

Filesize
3.1MB

Download
memory/2764-86-0x00000000011E0000-0x0000000001504000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads