quasar | 00bdef606eb20070701dfc27ed4578c25f5e3357e969ef25ba07ab251450c636

Analysis

max time kernel
147s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 06:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

runtimebroker.exe
Size

3.1MB
MD5

a29d070abe87b2be24892421e0c763bb
SHA1

383104c7c6956a98ae5f63c743250f737700f509
SHA256

00bdef606eb20070701dfc27ed4578c25f5e3357e969ef25ba07ab251450c636
SHA512

6d2a161e8193ed3e05443bd76652b958990f01d2cc2452185f58a5bff3031d268e2fe71c009fa4938ac1cbc914ba2163133079f8218f1c67b0758f594a67f969
SSDEEP

49152:Pvht62XlaSFNWPjljiFa2RoUYIygJCKI/nwoGdYTHHB72eh2NT:PvL62XlaSFNWPjljiFXRoUYIygJCi

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

interestingsigma.hopto.org:20

Mutex

11bbf22e-826e-486b-b024-adbd86228a9e

Attributes

encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
ctfmon
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/memory/2160-1-0x0000000000DB0000-0x00000000010D4000-memory.dmp	family_quasar
behavioral1/files/0x0009000000015d7e-6.dat	family_quasar
behavioral1/memory/2332-9-0x00000000003C0000-0x00000000006E4000-memory.dmp	family_quasar
behavioral1/memory/2840-33-0x0000000000FA0000-0x00000000012C4000-memory.dmp	family_quasar
behavioral1/memory/1920-108-0x0000000000350000-0x0000000000674000-memory.dmp	family_quasar
behavioral1/memory/3024-119-0x0000000001190000-0x00000000014B4000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2332	Client.exe
1912	Client.exe
2840	Client.exe
1776	Client.exe
2836	Client.exe
2144	Client.exe
2608	Client.exe
2740	Client.exe
2632	Client.exe
1920	Client.exe
3024	Client.exe
2816	Client.exe
2568	Client.exe
1268	Client.exe
948	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2800	PING.EXE
1000	PING.EXE
2808	PING.EXE
2684	PING.EXE
784	PING.EXE
2600	PING.EXE
1208	PING.EXE
1868	PING.EXE
3012	PING.EXE
1900	PING.EXE
2448	PING.EXE
2976	PING.EXE
1844	PING.EXE
2792	PING.EXE
772	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2800	PING.EXE
1208	PING.EXE
772	PING.EXE
2684	PING.EXE
2600	PING.EXE
2976	PING.EXE
1900	PING.EXE
2792	PING.EXE
1000	PING.EXE
1868	PING.EXE
1844	PING.EXE
2448	PING.EXE
2808	PING.EXE
784	PING.EXE
3012	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1572	schtasks.exe
2652	schtasks.exe
2864	schtasks.exe
1632	schtasks.exe
2064	schtasks.exe
2148	schtasks.exe
3012	schtasks.exe
1696	schtasks.exe
1592	schtasks.exe
1464	schtasks.exe
2800	schtasks.exe
2180	schtasks.exe
1108	schtasks.exe
2500	schtasks.exe
2692	schtasks.exe
1064	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2160	runtimebroker.exe
Token: SeDebugPrivilege	2332	Client.exe
Token: SeDebugPrivilege	1912	Client.exe
Token: SeDebugPrivilege	2840	Client.exe
Token: SeDebugPrivilege	1776	Client.exe
Token: SeDebugPrivilege	2836	Client.exe
Token: SeDebugPrivilege	2144	Client.exe
Token: SeDebugPrivilege	2608	Client.exe
Token: SeDebugPrivilege	2740	Client.exe
Token: SeDebugPrivilege	2632	Client.exe
Token: SeDebugPrivilege	1920	Client.exe
Token: SeDebugPrivilege	3024	Client.exe
Token: SeDebugPrivilege	2816	Client.exe
Token: SeDebugPrivilege	2568	Client.exe
Token: SeDebugPrivilege	1268	Client.exe
Token: SeDebugPrivilege	948	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2332	Client.exe
1912	Client.exe
2840	Client.exe
1776	Client.exe
2836	Client.exe
2144	Client.exe
2608	Client.exe
2740	Client.exe
2632	Client.exe
1920	Client.exe
3024	Client.exe
2816	Client.exe
2568	Client.exe
1268	Client.exe
948	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2332	Client.exe
1912	Client.exe
2840	Client.exe
1776	Client.exe
2836	Client.exe
2144	Client.exe
2608	Client.exe
2740	Client.exe
2632	Client.exe
1920	Client.exe
3024	Client.exe
2816	Client.exe
2568	Client.exe
1268	Client.exe
948	Client.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2332	Client.exe
2144	Client.exe
2608	Client.exe
2632	Client.exe
2568	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1464	2160	runtimebroker.exe	30
PID 2160 wrote to memory of 1464	2160	runtimebroker.exe	30
PID 2160 wrote to memory of 1464	2160	runtimebroker.exe	30
PID 2160 wrote to memory of 2332	2160	runtimebroker.exe	32
PID 2160 wrote to memory of 2332	2160	runtimebroker.exe	32
PID 2160 wrote to memory of 2332	2160	runtimebroker.exe	32
PID 2332 wrote to memory of 2500	2332	Client.exe	33
PID 2332 wrote to memory of 2500	2332	Client.exe	33
PID 2332 wrote to memory of 2500	2332	Client.exe	33
PID 2332 wrote to memory of 2108	2332	Client.exe	35
PID 2332 wrote to memory of 2108	2332	Client.exe	35
PID 2332 wrote to memory of 2108	2332	Client.exe	35
PID 2108 wrote to memory of 2748	2108	cmd.exe	37
PID 2108 wrote to memory of 2748	2108	cmd.exe	37
PID 2108 wrote to memory of 2748	2108	cmd.exe	37
PID 2108 wrote to memory of 2448	2108	cmd.exe	38
PID 2108 wrote to memory of 2448	2108	cmd.exe	38
PID 2108 wrote to memory of 2448	2108	cmd.exe	38
PID 2108 wrote to memory of 1912	2108	cmd.exe	40
PID 2108 wrote to memory of 1912	2108	cmd.exe	40
PID 2108 wrote to memory of 1912	2108	cmd.exe	40
PID 1912 wrote to memory of 2652	1912	Client.exe	41
PID 1912 wrote to memory of 2652	1912	Client.exe	41
PID 1912 wrote to memory of 2652	1912	Client.exe	41
PID 1912 wrote to memory of 1836	1912	Client.exe	43
PID 1912 wrote to memory of 1836	1912	Client.exe	43
PID 1912 wrote to memory of 1836	1912	Client.exe	43
PID 1836 wrote to memory of 560	1836	cmd.exe	45
PID 1836 wrote to memory of 560	1836	cmd.exe	45
PID 1836 wrote to memory of 560	1836	cmd.exe	45
PID 1836 wrote to memory of 1208	1836	cmd.exe	46
PID 1836 wrote to memory of 1208	1836	cmd.exe	46
PID 1836 wrote to memory of 1208	1836	cmd.exe	46
PID 1836 wrote to memory of 2840	1836	cmd.exe	47
PID 1836 wrote to memory of 2840	1836	cmd.exe	47
PID 1836 wrote to memory of 2840	1836	cmd.exe	47
PID 2840 wrote to memory of 2692	2840	Client.exe	48
PID 2840 wrote to memory of 2692	2840	Client.exe	48
PID 2840 wrote to memory of 2692	2840	Client.exe	48
PID 2840 wrote to memory of 2876	2840	Client.exe	50
PID 2840 wrote to memory of 2876	2840	Client.exe	50
PID 2840 wrote to memory of 2876	2840	Client.exe	50
PID 2876 wrote to memory of 448	2876	cmd.exe	52
PID 2876 wrote to memory of 448	2876	cmd.exe	52
PID 2876 wrote to memory of 448	2876	cmd.exe	52
PID 2876 wrote to memory of 2976	2876	cmd.exe	53
PID 2876 wrote to memory of 2976	2876	cmd.exe	53
PID 2876 wrote to memory of 2976	2876	cmd.exe	53
PID 2876 wrote to memory of 1776	2876	cmd.exe	54
PID 2876 wrote to memory of 1776	2876	cmd.exe	54
PID 2876 wrote to memory of 1776	2876	cmd.exe	54
PID 1776 wrote to memory of 3012	1776	Client.exe	55
PID 1776 wrote to memory of 3012	1776	Client.exe	55
PID 1776 wrote to memory of 3012	1776	Client.exe	55
PID 1776 wrote to memory of 2428	1776	Client.exe	57
PID 1776 wrote to memory of 2428	1776	Client.exe	57
PID 1776 wrote to memory of 2428	1776	Client.exe	57
PID 2428 wrote to memory of 2248	2428	cmd.exe	59
PID 2428 wrote to memory of 2248	2428	cmd.exe	59
PID 2428 wrote to memory of 2248	2428	cmd.exe	59
PID 2428 wrote to memory of 1000	2428	cmd.exe	60
PID 2428 wrote to memory of 1000	2428	cmd.exe	60
PID 2428 wrote to memory of 1000	2428	cmd.exe	60
PID 2428 wrote to memory of 2836	2428	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\runtimebroker.exe
"C:\Users\Admin\AppData\Local\Temp\runtimebroker.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1464
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2500
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\vFCmQovl2ruB.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2748
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2448
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2652
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Af7Dvcd2WkPw.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1836
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:560
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1208
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2692
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Ryi1fYmAcQB8.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:448
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2976
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1776
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3012
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\KoXs7BddeUxp.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2248
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1000
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2836
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1064
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\WY4wBvLSSlS2.bat" "
        11⤵
        
        PID:1568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2128
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:772
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2144
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1696
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\JU4brH9X4qhq.bat" "
        13⤵
        
        PID:2564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1292
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2808
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2608
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1592
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\LWvIl0HO7knB.bat" "
        15⤵
        
        PID:2412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2812
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1868
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2740
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2180
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6bdsRNBSvalT.bat" "
        17⤵
        
        PID:2960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2664
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2684
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2632
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2800
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AJaX5NmQaM7M.bat" "
        19⤵
        
        PID:2968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:852
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:784
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1920
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2864
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QBAy75oN2xTF.bat" "
        21⤵
        
        PID:2876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3012
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3024
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1632
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\pncjyqp5xUNm.bat" "
        23⤵
        
        PID:2208
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1548
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1900
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2816
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1572
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\aV2YjnMmQf9G.bat" "
        25⤵
        
        PID:2544
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1564
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1844
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2568
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1108
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CYKcLA1eOQYN.bat" "
        27⤵
        
        PID:1372
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1624
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2600
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1268
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2064
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MghnKiKTLZD5.bat" "
        29⤵
        
        PID:2472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2180
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2792
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:948
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2148
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\bncj6HwxEq45.bat" "
        31⤵
        
        PID:2756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2644
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6bdsRNBSvalT.bat

Filesize
207B

MD5
3671abf0e4a8adfb82ccb2099372ca06

SHA1
3485617e37dfa81bc6d2eb428797084dd1a2a338

SHA256
496b9f408a74d44756f52e51a2a8ea57de927ae005f2b74c7533393a50e9a8f7

SHA512
4edb332224e27e89b6dbbc48ad4d58b67766abb3e997e29643a84799de76dfce51955655695ff6c8b56f73c7c2fd80caa52363ccc7a8c4dc23fbc0b2a151ca5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\AJaX5NmQaM7M.bat

Filesize
207B

MD5
241575a4ebf4ce72283ca50c6def38be

SHA1
d05e9981288c0e37b77d23949a62a2106ea2ed15

SHA256
2179c205484846797df0ba4449a517b63173505c4a5050532f58f3e78e8bbd5c

SHA512
07a026ae61b3158d2a00d4bac5f58e1efbb22ee3bb831ed55e14e616fd4c4f677605335e3d565c53d25936b723eff85fd07afdf8fbb2ee345e6f82dd4e913f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Af7Dvcd2WkPw.bat

Filesize
207B

MD5
90fd4fcc7a1fd616d6b469cdb9f4798a

SHA1
f529191c41a3d7b31e4f9620708658c56398731d

SHA256
f42e9d40764abec24f9d2d8f8be5b71d28d926639038872280bf561d9bbdd9e1

SHA512
7f5708a7f2bf635c5ceae17d1a4755c5a056ed2572df764a7ef11447a7c8f9cdaf50ef41591212093c523a1e6b6d3ef02da9ca0053031e894e5db7ec509ba175

Download Submit
C:\Users\Admin\AppData\Local\Temp\CYKcLA1eOQYN.bat

Filesize
207B

MD5
b6b97428ea87abf5dcab41cf5e768a0c

SHA1
6c10577816752a8c4e275a819422df3a1e25b5c3

SHA256
70895424ab4f51e63e250c5043aa9ac70f334e77dff4ad9fb03b1a5325bff11a

SHA512
4904e8b8d53af45e563bed9031daa216036c0d897b27382ecb330ebdc4eb881a0ab6c7dc748bed359d48b87e10acbb056bc9ee351d375ed4990dbe23eb7479b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\JU4brH9X4qhq.bat

Filesize
207B

MD5
114616efa961d035facf38d828700064

SHA1
d26199143e353058739514730d2494128a8c88ac

SHA256
922af10cc6766ff53ae198e3c0dcd184ac0dc67b69eb3108eba09a6d94f2bb3d

SHA512
8998218d5cfabb6d2ffd86ca16aa1edd3e578b7026ae9aa3531ddf2efe2f8d2dde1ad25f112318e18850b093f4db651d5af1a4725f1ffbc63b06d00c2a597d53

Download Submit
C:\Users\Admin\AppData\Local\Temp\KoXs7BddeUxp.bat

Filesize
207B

MD5
7a8bb8c0fad46d6efaada6b7fec029ec

SHA1
2e8f7f399c07479a04f04fa7e61269255d7787ca

SHA256
e9ae69e1c8275f8b69594a60b314d0c173fc18c9769db55b91db3e2ba3e0fe26

SHA512
045a99f0e71abe366e233e2d0a43fd00a480dbc035b72f3de4fd8cbc86de393538685615d416bddf66a8ee663ed40cdb3b13df28bfa9e7baa0a04e80f987b5a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\LWvIl0HO7knB.bat

Filesize
207B

MD5
d968e4d085e1aa52aaed56fc90fa075a

SHA1
af6967b9be9f804b3823f917080ac54cd23b567a

SHA256
2e09283b69aff243aea728cdcad2f9e235622753b511c01ba5b0768967e7fed2

SHA512
cdfe3f1597326159f0f4587764f6a599ad97f867d5e8bbdbbdc1a777f865d10d9c96efdb3d6f18960577c4db5eaf68bc4e4af2f9877a2f2a35e3ed53692c65fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MghnKiKTLZD5.bat

Filesize
207B

MD5
a81b1d6107016537be0f8a998cabd758

SHA1
6b17d968f0c238067366b5c47bd4e48d5958a62b

SHA256
a6dd03aa183087b0eed3ad8ffc5d248c15eb9cec9b9139cc9bb902dadf0ac66c

SHA512
e642cceda4498d5ce8e0662cb19208f9fe17449484b8f8eb51882ee3df8d0520c00e883a3c22e9c33ba859fe0ad51ab8bf35663e9f6725b149de61406dc07e93

Download Submit
C:\Users\Admin\AppData\Local\Temp\QBAy75oN2xTF.bat

Filesize
207B

MD5
e36b399a09cc69e30e80fd5d9222fc1a

SHA1
ad319f1695b7ea107d741209ecaf8200a3432813

SHA256
4812c40d5e75941bd17bdb67c796c40d2c3f8c4406c174413530fdf6029670cc

SHA512
65dc6f4a84f23d2fabbfe911191c13bda66ed45024235bcb20ead4f92781a4b58b51afb4dc8854ac2cc6acc770c6679a8feb71f2fa3b097efb88000497412e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ryi1fYmAcQB8.bat

Filesize
207B

MD5
3f881b4d8b02b7f81afa2f034db75f5c

SHA1
6cd5145a8c40fde1dd86389fa38075d9905e422e

SHA256
fb045b0686e9ac581ba4cd2703dc5210d82a538e38bb50248b52baa493e3dee4

SHA512
a6e955d9710d0a97456c85dd7239af533bad2211fa9274b0828d690e499dd93437ae95f8d653aae0e48a99a87764f245193fd77d83212ebb8240b6261b238ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\WY4wBvLSSlS2.bat

Filesize
207B

MD5
e32371d76df4e0fb3b6d59f5aa632249

SHA1
d3f31a2cb3326c0428ce4042652a82d8e45d82b1

SHA256
0eba4362ef1fa628a1a832148d892c581c105a8e11eddba7776062ef0a0a8dfe

SHA512
006693b7a706cdaa7cb4f3d941d673ea0fe0800e501091b25ae376f5b6a5aa427f0362d09b2391dae21f245602cba64a2d5270a523606d4333f79d3a9ef14f7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\aV2YjnMmQf9G.bat

Filesize
207B

MD5
8a2353dc7565bfb401363c6dcff07444

SHA1
3092c730ed016bb6e50457523b98d1c0b83acd79

SHA256
da4b863ca3f9b8d4ecce8bc84454281137a39752fa8a36a5773da957f43d02c3

SHA512
f19a691e77b4012f9be454afb423d3e922d68787f87a4813f38234a8e43317cfb049f20fb50068bc982ea8d74fa637caa0db31d8e156d73099b351b1cba8bc2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\bncj6HwxEq45.bat

Filesize
207B

MD5
cbf9f337982ee0c9bb70a52774c02c16

SHA1
507297d7cedc47caabf23eea089971c6fc4ceec8

SHA256
07a8d97109780945d6662ed64038312720a10b9d7f96c9e8476745f2ced9a1a0

SHA512
cda8e56dc5069d7889f163aaa8ec68a7979aecb0c837e7fc1b852a83af561dfb4d80d4ea5d28eb7468b6654b313b8c111a3967060dc5f0cf3742dff18c0f3c0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pncjyqp5xUNm.bat

Filesize
207B

MD5
5ab0ca638af7b3711d99c1c1b93ca543

SHA1
6dba0d6c918e31d449a91dea27553f77d00abdf5

SHA256
2486689a508c1682dc9c6f0531dc60ccc3185fe19293794a85e43307dfe295e9

SHA512
ef3c476d23c9511e7009b7a2019b61b8b12017d24f486224bb08fa92c85db554a275e7561dd8ff873f1212d030b22a17a3bd40bb3c8e08e528b6244b60536589

Download Submit
C:\Users\Admin\AppData\Local\Temp\vFCmQovl2ruB.bat

Filesize
207B

MD5
5b9c9c186613adaa61ada3825bf54d15

SHA1
fc25946861c27ee5c6e3fdbf09f5984005a42e53

SHA256
42393a730e3575132ac57e94a9c5162ecc7f6991d418cbc55ef6054f63a73b98

SHA512
a5905afe7a322046d5b9e7ed33f3d555405aea804ba3ba4a0ec7c9e6afe7c4568b08a0b525a819d9b5e7104662f5ca2b5b22e46202f4bdf377879a05f42bf83e

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
a29d070abe87b2be24892421e0c763bb

SHA1
383104c7c6956a98ae5f63c743250f737700f509

SHA256
00bdef606eb20070701dfc27ed4578c25f5e3357e969ef25ba07ab251450c636

SHA512
6d2a161e8193ed3e05443bd76652b958990f01d2cc2452185f58a5bff3031d268e2fe71c009fa4938ac1cbc914ba2163133079f8218f1c67b0758f594a67f969

Download Submit
memory/1920-108-0x0000000000350000-0x0000000000674000-memory.dmp

Filesize
3.1MB

Download
memory/2160-0-0x000007FEF5B23000-0x000007FEF5B24000-memory.dmp

Filesize
4KB

Download
memory/2160-8-0x000007FEF5B20000-0x000007FEF650C000-memory.dmp

Filesize
9.9MB

Download
memory/2160-2-0x000007FEF5B20000-0x000007FEF650C000-memory.dmp

Filesize
9.9MB

Download
memory/2160-1-0x0000000000DB0000-0x00000000010D4000-memory.dmp

Filesize
3.1MB

Download
memory/2332-10-0x000007FEF5B20000-0x000007FEF650C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-9-0x00000000003C0000-0x00000000006E4000-memory.dmp

Filesize
3.1MB

Download
memory/2332-20-0x000007FEF5B20000-0x000007FEF650C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-11-0x000007FEF5B20000-0x000007FEF650C000-memory.dmp

Filesize
9.9MB

Download
memory/2840-33-0x0000000000FA0000-0x00000000012C4000-memory.dmp

Filesize
3.1MB

Download
memory/3024-119-0x0000000001190000-0x00000000014B4000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads