quasar | 533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe
Size

502KB
MD5

a9c9735f6e34482c1cdd09e347a98787
SHA1

6214e43cdc3fd17978955abf9c01a8d8c3ea791e
SHA256

533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc
SHA512

084b40e683d88e8eda7a60047f1a640310455986629a63382b3b6ffa6a91f295b47963e2ba52115cb113f57f1f727f2adb98f910a9adca1596af242f266b4a50
SSDEEP

6144:sTEgdc0YeX1uRabMR0FdOWbYZTR9UbGzcEKVb8F9ywLlqlHcTR3t:sTEgdfYzRa9uza6FL4lHcdt

Score

10^/10

quasar target discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Target

127.0.0.1:6070

affasdqa.ddns.net:6070

haffasdqa.duckdns.org:6070

Mutex

670d21b7-71ed-4958-9ba7-a58fa54d8203

Attributes

encryption_key
25B2622CE0635F9A273AB61B1B7D7B94220AC509
install_name
svhoste.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svhoste
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 10 IoCs

resource	yara_rule
behavioral1/memory/3040-1-0x0000000001160000-0x00000000011E4000-memory.dmp	family_quasar
behavioral1/files/0x0009000000016141-5.dat	family_quasar
behavioral1/memory/1972-9-0x0000000000220000-0x00000000002A4000-memory.dmp	family_quasar
behavioral1/memory/2680-22-0x00000000000A0000-0x0000000000124000-memory.dmp	family_quasar
behavioral1/memory/1716-33-0x0000000000C80000-0x0000000000D04000-memory.dmp	family_quasar
behavioral1/memory/3028-64-0x0000000001250000-0x00000000012D4000-memory.dmp	family_quasar
behavioral1/memory/2904-85-0x00000000012E0000-0x0000000001364000-memory.dmp	family_quasar
behavioral1/memory/2804-96-0x0000000000270000-0x00000000002F4000-memory.dmp	family_quasar
behavioral1/memory/2940-107-0x0000000001350000-0x00000000013D4000-memory.dmp	family_quasar
behavioral1/memory/2028-118-0x0000000000170000-0x00000000001F4000-memory.dmp	family_quasar

Executes dropped EXE 11 IoCs

pid	Process
1972	svhoste.exe
2680	svhoste.exe
1716	svhoste.exe
2056	svhoste.exe
2184	svhoste.exe
3028	svhoste.exe
3060	svhoste.exe
2904	svhoste.exe
2804	svhoste.exe
2940	svhoste.exe
2028	svhoste.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2408	PING.EXE
2616	PING.EXE
2424	PING.EXE
1520	PING.EXE
2640	PING.EXE
264	PING.EXE
2956	PING.EXE
2028	PING.EXE
3000	PING.EXE
1824	PING.EXE

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
3000	PING.EXE
2424	PING.EXE
1520	PING.EXE
1824	PING.EXE
2640	PING.EXE
264	PING.EXE
2956	PING.EXE
2028	PING.EXE
2408	PING.EXE
2616	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2476	schtasks.exe
1908	schtasks.exe
772	schtasks.exe
2260	schtasks.exe
2576	schtasks.exe
2116	schtasks.exe
1764	schtasks.exe
660	schtasks.exe
2664	schtasks.exe
1816	schtasks.exe
2220	schtasks.exe
2172	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe
Token: SeDebugPrivilege	1972	svhoste.exe
Token: SeDebugPrivilege	2680	svhoste.exe
Token: SeDebugPrivilege	1716	svhoste.exe
Token: SeDebugPrivilege	2056	svhoste.exe
Token: SeDebugPrivilege	2184	svhoste.exe
Token: SeDebugPrivilege	3028	svhoste.exe
Token: SeDebugPrivilege	3060	svhoste.exe
Token: SeDebugPrivilege	2904	svhoste.exe
Token: SeDebugPrivilege	2804	svhoste.exe
Token: SeDebugPrivilege	2940	svhoste.exe
Token: SeDebugPrivilege	2028	svhoste.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1972	svhoste.exe
2680	svhoste.exe
1716	svhoste.exe
2056	svhoste.exe
2184	svhoste.exe
3028	svhoste.exe
3060	svhoste.exe
2904	svhoste.exe
2804	svhoste.exe
2940	svhoste.exe
2028	svhoste.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 772	3040	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	30
PID 3040 wrote to memory of 772	3040	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	30
PID 3040 wrote to memory of 772	3040	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	30
PID 3040 wrote to memory of 1972	3040	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	32
PID 3040 wrote to memory of 1972	3040	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	32
PID 3040 wrote to memory of 1972	3040	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	32
PID 1972 wrote to memory of 2260	1972	svhoste.exe	33
PID 1972 wrote to memory of 2260	1972	svhoste.exe	33
PID 1972 wrote to memory of 2260	1972	svhoste.exe	33
PID 1972 wrote to memory of 2840	1972	svhoste.exe	35
PID 1972 wrote to memory of 2840	1972	svhoste.exe	35
PID 1972 wrote to memory of 2840	1972	svhoste.exe	35
PID 2840 wrote to memory of 2888	2840	cmd.exe	37
PID 2840 wrote to memory of 2888	2840	cmd.exe	37
PID 2840 wrote to memory of 2888	2840	cmd.exe	37
PID 2840 wrote to memory of 2640	2840	cmd.exe	38
PID 2840 wrote to memory of 2640	2840	cmd.exe	38
PID 2840 wrote to memory of 2640	2840	cmd.exe	38
PID 2840 wrote to memory of 2680	2840	cmd.exe	40
PID 2840 wrote to memory of 2680	2840	cmd.exe	40
PID 2840 wrote to memory of 2680	2840	cmd.exe	40
PID 2680 wrote to memory of 2664	2680	svhoste.exe	41
PID 2680 wrote to memory of 2664	2680	svhoste.exe	41
PID 2680 wrote to memory of 2664	2680	svhoste.exe	41
PID 2680 wrote to memory of 1908	2680	svhoste.exe	43
PID 2680 wrote to memory of 1908	2680	svhoste.exe	43
PID 2680 wrote to memory of 1908	2680	svhoste.exe	43
PID 1908 wrote to memory of 600	1908	cmd.exe	45
PID 1908 wrote to memory of 600	1908	cmd.exe	45
PID 1908 wrote to memory of 600	1908	cmd.exe	45
PID 1908 wrote to memory of 264	1908	cmd.exe	46
PID 1908 wrote to memory of 264	1908	cmd.exe	46
PID 1908 wrote to memory of 264	1908	cmd.exe	46
PID 1908 wrote to memory of 1716	1908	cmd.exe	47
PID 1908 wrote to memory of 1716	1908	cmd.exe	47
PID 1908 wrote to memory of 1716	1908	cmd.exe	47
PID 1716 wrote to memory of 1816	1716	svhoste.exe	48
PID 1716 wrote to memory of 1816	1716	svhoste.exe	48
PID 1716 wrote to memory of 1816	1716	svhoste.exe	48
PID 1716 wrote to memory of 1856	1716	svhoste.exe	50
PID 1716 wrote to memory of 1856	1716	svhoste.exe	50
PID 1716 wrote to memory of 1856	1716	svhoste.exe	50
PID 1856 wrote to memory of 2708	1856	cmd.exe	52
PID 1856 wrote to memory of 2708	1856	cmd.exe	52
PID 1856 wrote to memory of 2708	1856	cmd.exe	52
PID 1856 wrote to memory of 2956	1856	cmd.exe	53
PID 1856 wrote to memory of 2956	1856	cmd.exe	53
PID 1856 wrote to memory of 2956	1856	cmd.exe	53
PID 1856 wrote to memory of 2056	1856	cmd.exe	54
PID 1856 wrote to memory of 2056	1856	cmd.exe	54
PID 1856 wrote to memory of 2056	1856	cmd.exe	54
PID 2056 wrote to memory of 2220	2056	svhoste.exe	55
PID 2056 wrote to memory of 2220	2056	svhoste.exe	55
PID 2056 wrote to memory of 2220	2056	svhoste.exe	55
PID 2056 wrote to memory of 2292	2056	svhoste.exe	57
PID 2056 wrote to memory of 2292	2056	svhoste.exe	57
PID 2056 wrote to memory of 2292	2056	svhoste.exe	57
PID 2292 wrote to memory of 3012	2292	cmd.exe	59
PID 2292 wrote to memory of 3012	2292	cmd.exe	59
PID 2292 wrote to memory of 3012	2292	cmd.exe	59
PID 2292 wrote to memory of 2028	2292	cmd.exe	60
PID 2292 wrote to memory of 2028	2292	cmd.exe	60
PID 2292 wrote to memory of 2028	2292	cmd.exe	60
PID 2292 wrote to memory of 2184	2292	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe
"C:\Users\Admin\AppData\Local\Temp\533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:772
- C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2260
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\uG63dyZtNMhQ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2888
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2640
  - - C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2664
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\rhZoQS7RrycE.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1908
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:600
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:264
      - C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1816
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\vTjEPH4hQ8Ao.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2708
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2956
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2056
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2220
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Oc2ZKNdyrXqs.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3012
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2028
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2184
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2576
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\gqOK9bbULZm6.bat" "
        11⤵
        
        PID:916
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:708
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3000
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3028
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2116
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6kxkXT033VNw.bat" "
        13⤵
        
        PID:1612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1736
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2408
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3060
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2172
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1EwYQsVvPBnF.bat" "
        15⤵
        
        PID:2868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2232
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2616
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2476
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\5hsoiTW351Ab.bat" "
        17⤵
        
        PID:2728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1800
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1824
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2804
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1908
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NftGt3DSo0M7.bat" "
        19⤵
        
        PID:2356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2808
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2424
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2940
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1764
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\rsMYxBh8jIrb.bat" "
        21⤵
        
        PID:872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1016
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1520
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2028
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1EwYQsVvPBnF.bat

Filesize
208B

MD5
caead16558964d5e8d666463e58be271

SHA1
7772441a6ee916bc10de4aa78a9b795f34bff806

SHA256
b90b8c3355a3001f487c5b0c6ef05b4d42952c0bd55768b423bbb3cc1b814f51

SHA512
81c1ca98dae18d34ef68c931ceccb01d0f6c6ce65400d31ab3495e8ec7918401225dbf8119f4632daaa498fcd71617e27f2a8b1272621d83ca6306d01f6f8a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\5hsoiTW351Ab.bat

Filesize
208B

MD5
ad5a83486629efefe282861cb8712517

SHA1
7f7e8d1eefc687dfde71a4b178b0ce6a6bd02503

SHA256
8d29fe6a3c978da313b5a781ba0a94bde9904f342473b3eddc4d2464050e72db

SHA512
e4f6ed68bb895266fe375821b235ee75bef1c3c3b024755de3c8bebe0775cb38e70976042941121da3fa4240308c2ea1ef64180bb8c34da18f54bac01926b47a

Download Submit
C:\Users\Admin\AppData\Local\Temp\6kxkXT033VNw.bat

Filesize
208B

MD5
5c586bcc3b3b91961808ef08e67a731b

SHA1
d6660fb2da32952b06d5d6b68c7bdda6a1a5591b

SHA256
e9ace4adff7646f92b9e2c23fee5ff94cb5f203f98739cc41c4dbd181e7e36a7

SHA512
2ce80acb49c244598e76805148e75d5872527e1ae03f8cd659563b06c0f29144f86e389992e7f871f6a7f764d460368efa67a352898390223e95d5090293e1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\NftGt3DSo0M7.bat

Filesize
208B

MD5
1e5e7c15df6aa8ddfbd9d1c4a705a250

SHA1
1edace9c3bf119ec04825f012534f4618c5ce5d3

SHA256
690ae2ea064accf5f6d9178d66fef0b13f276ea1a1655ffa622aa3882c84295e

SHA512
e0dc78eaf9e253b1d78772a04c5244d5da60014213c3b341e55de1505e82eabd38c8d10096c65124a7ae9a6299533f9a670ce908d292ec2f8107636467e77482

Download Submit
C:\Users\Admin\AppData\Local\Temp\Oc2ZKNdyrXqs.bat

Filesize
208B

MD5
858c06fcdf737cbb37cb934797fddcce

SHA1
570ae1a55c73e5a7ed0173b95b830f6dc16a7ae5

SHA256
83af5c01a832bd66b00fcaa41a7c0b9e1ae32a497e2f44732433120293821815

SHA512
296983b5a8075b3333549929a7fda1a1386343b0b0424a10b033b737e6b652cbe980572e3e9266eb62b08219eeb7dd022b24f2de2ac13689a07e0bed3176edf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\gqOK9bbULZm6.bat

Filesize
208B

MD5
d2b570535a247e1e09668a0d22482882

SHA1
7e7b8e634dd23a058d25870bba62669f6e9386cf

SHA256
59cf6e373a06e0cd45cc1efc52087d745b27545fc3bf2cfbe41ecd2170a64365

SHA512
586969d0f90843624e454a84b333cdfdcc40ce0a4f83f71ac3af3788cff8d0445d950e3ce0254cea51d887ea365f014d43f51eb3466a557cc2dd943c2c0409c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\rhZoQS7RrycE.bat

Filesize
208B

MD5
91cf274d7adc666e82694b03fd8370a4

SHA1
689539d215502f846d57f457485f9a6fedb207bb

SHA256
3012f097a84748e432dabd12c2405df1e2318cdf23204512b65eba062047a26d

SHA512
d56324a6b550fab44f8bfc1f02f34fa377c7115814d6c4fb96712469fbf58794333e3e97d76c060cc8802bdf03d3b5f5b62b94b700c9dc2a6133a2b9288cd4e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\rsMYxBh8jIrb.bat

Filesize
208B

MD5
794a95070e1f7afc4fea87cfacd0e846

SHA1
8bf801b10f2520a41609eb777b9acf32a743e61a

SHA256
896ed282f6b67eacee33e287be4f74a4ed522875da0a1efd5ced4f7d19b1dc13

SHA512
5cd80701d29e80a0ff67f10e1718ea4d1717cb24aa536d833ed00fe500291c06d1254e3ec3457436c9384fb3bca27a6be290dead398a4ea4e407c9494c37810f

Download Submit
C:\Users\Admin\AppData\Local\Temp\uG63dyZtNMhQ.bat

Filesize
208B

MD5
d43a3d10b95f475ce33f7edaa3212de0

SHA1
6987e51dc22ea52980e6a304f2c7d2ca495e8e2c

SHA256
9132826da857276b8d4e85b4822324dbbc14fb835f56970401a02bae0b390e55

SHA512
325e06a7062cc07cd31dc5d8c756de7a4b1dd70732107093d5f97100a9b456d99a6dec769dcafd4590fadcc115ad11986e5a7e8d852ce42f42f36c5880a85e8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vTjEPH4hQ8Ao.bat

Filesize
208B

MD5
14122e9851c318017a2f4d49b53f00cb

SHA1
cd8e660aa0aa38d0ea6c99b5b25cf6193a4bd70c

SHA256
d2d24cd58a993354b8d6fe1cd775e37d644a5622f3c4cac041b5ec3120bf1d93

SHA512
42767603ef9734f35367d1c8e1f36338dd6c3a18e7677780699c0491bc899b3bdc53151ed7bd1e2c8f88a02d35a49b7b051356d6ce6b42c6942d42affc115eb6

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe

Filesize
502KB

MD5
a9c9735f6e34482c1cdd09e347a98787

SHA1
6214e43cdc3fd17978955abf9c01a8d8c3ea791e

SHA256
533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc

SHA512
084b40e683d88e8eda7a60047f1a640310455986629a63382b3b6ffa6a91f295b47963e2ba52115cb113f57f1f727f2adb98f910a9adca1596af242f266b4a50

Download Submit
memory/1716-33-0x0000000000C80000-0x0000000000D04000-memory.dmp

Filesize
528KB

Download
memory/1972-9-0x0000000000220000-0x00000000002A4000-memory.dmp

Filesize
528KB

Download
memory/1972-20-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-7-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download
memory/1972-10-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download
memory/2028-118-0x0000000000170000-0x00000000001F4000-memory.dmp

Filesize
528KB

Download
memory/2680-22-0x00000000000A0000-0x0000000000124000-memory.dmp

Filesize
528KB

Download
memory/2804-96-0x0000000000270000-0x00000000002F4000-memory.dmp

Filesize
528KB

Download
memory/2904-85-0x00000000012E0000-0x0000000001364000-memory.dmp

Filesize
528KB

Download
memory/2940-107-0x0000000001350000-0x00000000013D4000-memory.dmp

Filesize
528KB

Download
memory/3028-64-0x0000000001250000-0x00000000012D4000-memory.dmp

Filesize
528KB

Download
memory/3040-0-0x000007FEF58B3000-0x000007FEF58B4000-memory.dmp

Filesize
4KB

Download
memory/3040-2-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download
memory/3040-1-0x0000000001160000-0x00000000011E4000-memory.dmp

Filesize
528KB

Download
memory/3040-8-0x000007FEF58B0000-0x000007FEF629C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads