quasar | 655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995

Analysis

max time kernel
145s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe
Size

3.1MB
MD5

ee86735f1427e86dcbba39339cecfe15
SHA1

cd492443264bdae1f0a5e5f16e57af3d1819a3ec
SHA256

655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995
SHA512

59309d24c6df7d66033afe1aac2a7cc734438c3a6dfd02ad8a20299216fee4417dd10931a283366cbf42dea2b83b3e451527817c084bb20aac4c9800c68b82b1
SSDEEP

49152:2v9t62XlaSFNWPjljiFa2RoUYI8IRJ6ibR3LoGdeoYtTHHB72eh2NT:2v/62XlaSFNWPjljiFXRoUYI8IRJ6c

Score

10^/10

quasar qussa discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Qussa

ggergejhijseih.myvnc.com:47820

Mutex

5910e19f-3073-4c42-a174-513d316126e7

Attributes

encryption_key
7A23123B6E1E0CCDB27477C6C7654C7BE2FEDE54
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
xml
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 14 IoCs

resource	yara_rule
behavioral1/memory/2688-1-0x0000000000980000-0x0000000000CA4000-memory.dmp	family_quasar
behavioral1/files/0x003200000001566d-6.dat	family_quasar
behavioral1/memory/2792-9-0x00000000012C0000-0x00000000015E4000-memory.dmp	family_quasar
behavioral1/memory/2536-43-0x0000000000370000-0x0000000000694000-memory.dmp	family_quasar
behavioral1/memory/444-55-0x0000000001190000-0x00000000014B4000-memory.dmp	family_quasar
behavioral1/memory/2828-76-0x0000000000050000-0x0000000000374000-memory.dmp	family_quasar
behavioral1/memory/2576-87-0x0000000000FF0000-0x0000000001314000-memory.dmp	family_quasar
behavioral1/memory/2004-98-0x00000000000D0000-0x00000000003F4000-memory.dmp	family_quasar
behavioral1/memory/1992-109-0x00000000001A0000-0x00000000004C4000-memory.dmp	family_quasar
behavioral1/memory/2108-120-0x0000000000EB0000-0x00000000011D4000-memory.dmp	family_quasar
behavioral1/memory/1056-131-0x0000000000140000-0x0000000000464000-memory.dmp	family_quasar
behavioral1/memory/2356-142-0x0000000000F00000-0x0000000001224000-memory.dmp	family_quasar
behavioral1/memory/552-154-0x0000000000250000-0x0000000000574000-memory.dmp	family_quasar
behavioral1/memory/2712-165-0x0000000001060000-0x0000000001384000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2792	Client.exe
1020	Client.exe
1412	Client.exe
2536	Client.exe
444	Client.exe
1680	Client.exe
2828	Client.exe
2576	Client.exe
2004	Client.exe
1992	Client.exe
2108	Client.exe
1056	Client.exe
2356	Client.exe
552	Client.exe
2712	Client.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2876	PING.EXE
2836	PING.EXE
1704	PING.EXE
2172	PING.EXE
1372	PING.EXE
2532	PING.EXE
2244	PING.EXE
2764	PING.EXE
404	PING.EXE
2376	PING.EXE
2900	PING.EXE
1672	PING.EXE
2476	PING.EXE
2244	PING.EXE
2204	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2764	PING.EXE
1704	PING.EXE
2532	PING.EXE
1672	PING.EXE
404	PING.EXE
2476	PING.EXE
2876	PING.EXE
2836	PING.EXE
2244	PING.EXE
2204	PING.EXE
2900	PING.EXE
2244	PING.EXE
2376	PING.EXE
2172	PING.EXE
1372	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2944	schtasks.exe
2732	schtasks.exe
956	schtasks.exe
2312	schtasks.exe
2212	schtasks.exe
1860	schtasks.exe
1928	schtasks.exe
1792	schtasks.exe
2040	schtasks.exe
2844	schtasks.exe
2656	schtasks.exe
924	schtasks.exe
2060	schtasks.exe
2688	schtasks.exe
2096	schtasks.exe
1812	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe
Token: SeDebugPrivilege	2792	Client.exe
Token: SeDebugPrivilege	1020	Client.exe
Token: SeDebugPrivilege	1412	Client.exe
Token: SeDebugPrivilege	2536	Client.exe
Token: SeDebugPrivilege	444	Client.exe
Token: SeDebugPrivilege	1680	Client.exe
Token: SeDebugPrivilege	2828	Client.exe
Token: SeDebugPrivilege	2576	Client.exe
Token: SeDebugPrivilege	2004	Client.exe
Token: SeDebugPrivilege	1992	Client.exe
Token: SeDebugPrivilege	2108	Client.exe
Token: SeDebugPrivilege	1056	Client.exe
Token: SeDebugPrivilege	2356	Client.exe
Token: SeDebugPrivilege	552	Client.exe
Token: SeDebugPrivilege	2712	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2944	2688	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe	30
PID 2688 wrote to memory of 2944	2688	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe	30
PID 2688 wrote to memory of 2944	2688	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe	30
PID 2688 wrote to memory of 2792	2688	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe	32
PID 2688 wrote to memory of 2792	2688	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe	32
PID 2688 wrote to memory of 2792	2688	655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe	32
PID 2792 wrote to memory of 2732	2792	Client.exe	33
PID 2792 wrote to memory of 2732	2792	Client.exe	33
PID 2792 wrote to memory of 2732	2792	Client.exe	33
PID 2792 wrote to memory of 2632	2792	Client.exe	35
PID 2792 wrote to memory of 2632	2792	Client.exe	35
PID 2792 wrote to memory of 2632	2792	Client.exe	35
PID 2632 wrote to memory of 3012	2632	cmd.exe	37
PID 2632 wrote to memory of 3012	2632	cmd.exe	37
PID 2632 wrote to memory of 3012	2632	cmd.exe	37
PID 2632 wrote to memory of 2244	2632	cmd.exe	38
PID 2632 wrote to memory of 2244	2632	cmd.exe	38
PID 2632 wrote to memory of 2244	2632	cmd.exe	38
PID 2632 wrote to memory of 1020	2632	cmd.exe	39
PID 2632 wrote to memory of 1020	2632	cmd.exe	39
PID 2632 wrote to memory of 1020	2632	cmd.exe	39
PID 1020 wrote to memory of 2096	1020	Client.exe	40
PID 1020 wrote to memory of 2096	1020	Client.exe	40
PID 1020 wrote to memory of 2096	1020	Client.exe	40
PID 1020 wrote to memory of 2196	1020	Client.exe	42
PID 1020 wrote to memory of 2196	1020	Client.exe	42
PID 1020 wrote to memory of 2196	1020	Client.exe	42
PID 2196 wrote to memory of 2016	2196	cmd.exe	44
PID 2196 wrote to memory of 2016	2196	cmd.exe	44
PID 2196 wrote to memory of 2016	2196	cmd.exe	44
PID 2196 wrote to memory of 2876	2196	cmd.exe	45
PID 2196 wrote to memory of 2876	2196	cmd.exe	45
PID 2196 wrote to memory of 2876	2196	cmd.exe	45
PID 2196 wrote to memory of 1412	2196	cmd.exe	46
PID 2196 wrote to memory of 1412	2196	cmd.exe	46
PID 2196 wrote to memory of 1412	2196	cmd.exe	46
PID 1412 wrote to memory of 1792	1412	Client.exe	47
PID 1412 wrote to memory of 1792	1412	Client.exe	47
PID 1412 wrote to memory of 1792	1412	Client.exe	47
PID 1412 wrote to memory of 2864	1412	Client.exe	49
PID 1412 wrote to memory of 2864	1412	Client.exe	49
PID 1412 wrote to memory of 2864	1412	Client.exe	49
PID 2864 wrote to memory of 2988	2864	cmd.exe	51
PID 2864 wrote to memory of 2988	2864	cmd.exe	51
PID 2864 wrote to memory of 2988	2864	cmd.exe	51
PID 2864 wrote to memory of 2836	2864	cmd.exe	52
PID 2864 wrote to memory of 2836	2864	cmd.exe	52
PID 2864 wrote to memory of 2836	2864	cmd.exe	52
PID 2864 wrote to memory of 2536	2864	cmd.exe	54
PID 2864 wrote to memory of 2536	2864	cmd.exe	54
PID 2864 wrote to memory of 2536	2864	cmd.exe	54
PID 2536 wrote to memory of 2040	2536	Client.exe	55
PID 2536 wrote to memory of 2040	2536	Client.exe	55
PID 2536 wrote to memory of 2040	2536	Client.exe	55
PID 2536 wrote to memory of 2112	2536	Client.exe	57
PID 2536 wrote to memory of 2112	2536	Client.exe	57
PID 2536 wrote to memory of 2112	2536	Client.exe	57
PID 2112 wrote to memory of 2268	2112	cmd.exe	59
PID 2112 wrote to memory of 2268	2112	cmd.exe	59
PID 2112 wrote to memory of 2268	2112	cmd.exe	59
PID 2112 wrote to memory of 1672	2112	cmd.exe	60
PID 2112 wrote to memory of 1672	2112	cmd.exe	60
PID 2112 wrote to memory of 1672	2112	cmd.exe	60
PID 2112 wrote to memory of 444	2112	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe
"C:\Users\Admin\AppData\Local\Temp\655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2944
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2732
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\sjdxdHjohEtJ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3012
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2244
  - - C:\Windows\system32\SubDir\Client.exe
      "C:\Windows\system32\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1020
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2096
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\HRFbQu4hIlEK.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2196
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2016
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2876
      - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1792
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\C1xK00Iu7ms9.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2988
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2836
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2040
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CDQWrEkyyUvv.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2268
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1672
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:444
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1860
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\bJ60rEhrhYIG.bat" "
        11⤵
        
        PID:676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1864
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1372
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\VA7Qdn8Fm3Jt.bat" "
        13⤵
        
        PID:2376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2304
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2476
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1812
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\56Nvgfi3mOwh.bat" "
        15⤵
        
        PID:2712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2764
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2576
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2312
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\h6AZtSMz8Ln2.bat" "
        17⤵
        
        PID:264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2244
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2004
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2212
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\wJPy62WLO9wn.bat" "
        19⤵
        
        PID:1552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2204
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2844
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MvzFKXj3tIfh.bat" "
        21⤵
        
        PID:1232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2900
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2656
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\qwSWGIBPcWw7.bat" "
        23⤵
        
        PID:1912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:404
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1056
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1928
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\5zuDz02ZxSZP.bat" "
        25⤵
        
        PID:1780
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3024
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1704
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:924
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\B14Z1fnNYq9k.bat" "
        27⤵
        
        PID:1736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1096
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2376
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:552
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2060
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\vdk68gsMMvJc.bat" "
        29⤵
        
        PID:2152
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2780
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2532
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "xml" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2688
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7M5bMxp2EdV7.bat" "
        31⤵
        
        PID:532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:1248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\56Nvgfi3mOwh.bat

Filesize
196B

MD5
7c37b0623ab6a8a4d728978f9ae35bd1

SHA1
3d7af614a19cf550de5d3ef944b22497413744ac

SHA256
6000ddea7de99db4bce956f74a414d5dc6a2bd718a90ac09213bacc2b4fa0264

SHA512
8af491372b518ee1e75e9953c3f0453c8806631e5375953815e3047c7bf199c6154372717e26c3184d69384f6d7a852abed1b1d9413e73811a47c947217217a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\5zuDz02ZxSZP.bat

Filesize
196B

MD5
301646e0aba3401aa8f71f6ce51c1e75

SHA1
1db10898a32badfd6497934816d84defed9fc1ce

SHA256
493982d5d249a1f2cfc2bf8f1e41d054df23692ea33450ceb1a3cdd696f6d534

SHA512
372a6bd616378ab0d377640e5747e21f1e0ecd72263d7141ddf8446c013eefd5b31e1bdda50031741d1278a1d731fd73ab8c454d927d8b0b712ea56344795d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\7M5bMxp2EdV7.bat

Filesize
196B

MD5
fe58eb9195fa508e14d91da72582b7e2

SHA1
c1003980b50966fcf8e0d52c041d3aaa266c1935

SHA256
6a26ea117279644218e3a7340b33f8695857c1eb36e620c4506dbd8c2798213d

SHA512
0da77559ea803b63670d0084b90a90aae2985aa24049aed51b6c4301851c3b40d3fa7fb3aeea560754f83156a33db658e9dba7b7ba2c3760205fb4f829d58ea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\B14Z1fnNYq9k.bat

Filesize
196B

MD5
8bd2a86f8b5d14f85f8f7389cba3101a

SHA1
6f456bf06492ba1a1bf5758d0760b6033e017899

SHA256
6020a28bf5272cdac13fbccbb784e167e480a1085df3eacabc7c9fd12d507307

SHA512
2f8e435ff65fc13f76236c6d96075b989a0a1d6143397d034ad19843eaeccb16e0e68be22ce649e4b5e79f907337c999f56550e6003f9652feb420a561a982b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\C1xK00Iu7ms9.bat

Filesize
196B

MD5
88c82e80c8c88d821e91cc919a92f906

SHA1
d7e4e77704619eda44b4ec881d81c73841efb623

SHA256
56949c6024acbd9a1346657a75c4b7704cc37196eb4b0510bb61e325081c3cc2

SHA512
4592663401b465c76ff94e573a95e16b8ae2b79220e76207e3c018b94dba7875fc469d70db189fa95a3803ecd6ab1b34cb6c8965c8426574129f1669b7081f71

Download Submit
C:\Users\Admin\AppData\Local\Temp\CDQWrEkyyUvv.bat

Filesize
196B

MD5
63dd8589292d84230ed61e3032e249a8

SHA1
8bff7cbb1fdb77cdc497eda4200a75b625cef89d

SHA256
de6e8e56f895653afc47391984557ec9a20bfe40f4df21a16d70a4669f4f6d7a

SHA512
5111fd25a61feb71deb5620f8c238cc58487f57fa7158cd32f2098bef44a974d886e718a45f5aecb065753cb8857de35da7db2c084afdc45da21881458ad3c1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\HRFbQu4hIlEK.bat

Filesize
196B

MD5
fefd260c58d5832e97c48e651e0c021c

SHA1
3db0c1cae5253f9a62a7fcada126cd67f2d77d0b

SHA256
95be599af7ce8f645a128ce4d1aefdf81fa35ea41d4748b36c6ec38b903d227c

SHA512
cd67408c379c5a11f6345e32d42e63625a8b19b9acae5fc23d0f8f722fe986f3a261389b831e3cfe4eaf81202fb98c7c3c504188762498b9cc750e3e83c7ba75

Download Submit
C:\Users\Admin\AppData\Local\Temp\MvzFKXj3tIfh.bat

Filesize
196B

MD5
bf925cccf356e662c05d5806de232dc2

SHA1
60ed29862bfe315f7a0a4135f4e4bd385f51a249

SHA256
9ef2180673373366909eb725b8244917f6e973281ac6c3cdc1f2c27189016899

SHA512
157a722e5c670bb90b86ce289800f2ee49b8706c5699db381e943ec271ff1bb452366e72962c7711974f6a050776fbd6b53cfdce60d1e9fdb9e45610139365c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\VA7Qdn8Fm3Jt.bat

Filesize
196B

MD5
d6f6ebb842163e9dd99f95d9eb128903

SHA1
617e68efb1eae1d61003b59661f0379065a6b875

SHA256
f0153a9c61a2a52da6783834ba5fb67a1d775741edcddf9e5e1d9ed794bc9968

SHA512
cea7d0179bf001d64ba7cc4d5b56f4189abd38f0492c9dba0c1033b12315a5056b9a97059e82dd153c9ec6cfa808ef3a5ba661af2c4df9fa03149ef4fd1389d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\bJ60rEhrhYIG.bat

Filesize
196B

MD5
ea0bcfda6d58151f2a8937dcb4404fd6

SHA1
5c0b6b5248406af8f62e78488fc8827fff54d4d7

SHA256
314c581688a6760732952ab20b59ecd7e7274747cc95851ee01a72262a8f7362

SHA512
f6c9d5edf0b953d49dfd35d069f6169ceedd92cacdf0e8066279120dd719dadffbcca35cf0640b6a33966c17ee63af2ad0338634c06ce6ce7ed6809031eaa9a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\h6AZtSMz8Ln2.bat

Filesize
196B

MD5
83aceb3656c4d33a320a19d222dc7fcb

SHA1
694c88b941a99e2f932919e42dc04352c9256982

SHA256
8281ce60f0f68ac931cbb33686641a78d5709151b1b10164be0082e03c5b18b8

SHA512
2f659ec27a95c59e69542b6e92f0842a596f6d4ddaf174c2efdf5b1ef759cf106f737983d9cc0c946b1e7cbe74952f03e912c82493e05d2089b0f372da13efd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\qwSWGIBPcWw7.bat

Filesize
196B

MD5
442aca2406686ccd060e0fa560f29cde

SHA1
56f27e38e6a0fd6a13da75081b0bbe420c8150c0

SHA256
564cdd5fab39ff0f1ec22ed9f141631fb55127332d82ace2d0b6b661b1867935

SHA512
7fcc7ee61c26df56e84ef68ee3b02c9ac74e3ddb2e39243955cccb620a8b847ceb96e6f22fdead4926c933d1cd85ca5016b666afa73f7fcc2de356876cf3759c

Download Submit
C:\Users\Admin\AppData\Local\Temp\sjdxdHjohEtJ.bat

Filesize
196B

MD5
eab194e2c56a1e28ad8a9dea323ff05f

SHA1
eaf97666b3119e98d1b6bcde95a93667e8b72896

SHA256
ac85e1b0f5529aa9be1082982f15249a2532893f2de76f3f1010682b2763393c

SHA512
bf79495a14abe21f28c64376b847b0ffa2d701679c5c54f96b11dd37c4713b79eea00ab35ef5edd888c50603d5073fe19ee48115dfc4b1fcd6290e7ad31bc4a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdk68gsMMvJc.bat

Filesize
196B

MD5
cac6e499af6791a383273d4ccd605deb

SHA1
c7ef59802b6f8a36751718b2e03dfccb409f6079

SHA256
1999ea8f1815bdcf8ce6b89d17326a98d7bac8d3515abf651d00f21aa9fd08cc

SHA512
98aac551cfa62fc87c0f4d42f43017b7c4daca30aa4c178a974673f5631ea0be6ae9d36d868b64c660b176f7bdaaa8ce409210c134fd7013a335607f23d40b31

Download Submit
C:\Users\Admin\AppData\Local\Temp\wJPy62WLO9wn.bat

Filesize
196B

MD5
8cfdf4f387472101c9df4bce96e438a2

SHA1
91bf9e305454312f28bc77174c0bd89d262104bc

SHA256
a2e52c53716058e824da335adb0397b168b1fbd7151339c9f9e70367e7be552b

SHA512
039cdce8fd487cd70a716ec79b3de4c003ddda4f94b9c31587970a2ec7768174cabaea45b2dc8eca0f5b3ea7f0d9f6dabf792bb7dbc75d19f5dbd8612e0be20e

Download Submit
C:\Windows\System32\SubDir\Client.exe

Filesize
3.1MB

MD5
ee86735f1427e86dcbba39339cecfe15

SHA1
cd492443264bdae1f0a5e5f16e57af3d1819a3ec

SHA256
655d2103255a0ec7e0aa4b488d75499ce880428fdcc2831bfdc52987b4660995

SHA512
59309d24c6df7d66033afe1aac2a7cc734438c3a6dfd02ad8a20299216fee4417dd10931a283366cbf42dea2b83b3e451527817c084bb20aac4c9800c68b82b1

Download Submit
memory/444-55-0x0000000001190000-0x00000000014B4000-memory.dmp

Filesize
3.1MB

Download
memory/552-154-0x0000000000250000-0x0000000000574000-memory.dmp

Filesize
3.1MB

Download
memory/1056-131-0x0000000000140000-0x0000000000464000-memory.dmp

Filesize
3.1MB

Download
memory/1992-109-0x00000000001A0000-0x00000000004C4000-memory.dmp

Filesize
3.1MB

Download
memory/2004-98-0x00000000000D0000-0x00000000003F4000-memory.dmp

Filesize
3.1MB

Download
memory/2108-120-0x0000000000EB0000-0x00000000011D4000-memory.dmp

Filesize
3.1MB

Download
memory/2356-142-0x0000000000F00000-0x0000000001224000-memory.dmp

Filesize
3.1MB

Download
memory/2536-43-0x0000000000370000-0x0000000000694000-memory.dmp

Filesize
3.1MB

Download
memory/2576-87-0x0000000000FF0000-0x0000000001314000-memory.dmp

Filesize
3.1MB

Download
memory/2688-8-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2688-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2688-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2688-1-0x0000000000980000-0x0000000000CA4000-memory.dmp

Filesize
3.1MB

Download
memory/2712-165-0x0000000001060000-0x0000000001384000-memory.dmp

Filesize
3.1MB

Download
memory/2792-20-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2792-10-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2792-11-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2792-9-0x00000000012C0000-0x00000000015E4000-memory.dmp

Filesize
3.1MB

Download
memory/2828-76-0x0000000000050000-0x0000000000374000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads