quasar | 533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc

Analysis

max time kernel
147s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe
Size

502KB
MD5

a9c9735f6e34482c1cdd09e347a98787
SHA1

6214e43cdc3fd17978955abf9c01a8d8c3ea791e
SHA256

533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc
SHA512

084b40e683d88e8eda7a60047f1a640310455986629a63382b3b6ffa6a91f295b47963e2ba52115cb113f57f1f727f2adb98f910a9adca1596af242f266b4a50
SSDEEP

6144:sTEgdc0YeX1uRabMR0FdOWbYZTR9UbGzcEKVb8F9ywLlqlHcTR3t:sTEgdfYzRa9uza6FL4lHcdt

Score

10^/10

quasar target discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

Target

127.0.0.1:6070

affasdqa.ddns.net:6070

haffasdqa.duckdns.org:6070

Mutex

670d21b7-71ed-4958-9ba7-a58fa54d8203

Attributes

encryption_key
25B2622CE0635F9A273AB61B1B7D7B94220AC509
install_name
svhoste.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svhoste
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 7 IoCs

resource	yara_rule
behavioral1/memory/1576-1-0x00000000008A0000-0x0000000000924000-memory.dmp	family_quasar
behavioral1/files/0x000700000001867d-5.dat	family_quasar
behavioral1/memory/2136-9-0x00000000003F0000-0x0000000000474000-memory.dmp	family_quasar
behavioral1/memory/2696-22-0x0000000000270000-0x00000000002F4000-memory.dmp	family_quasar
behavioral1/memory/2448-34-0x0000000000EB0000-0x0000000000F34000-memory.dmp	family_quasar
behavioral1/memory/2740-76-0x0000000000EE0000-0x0000000000F64000-memory.dmp	family_quasar
behavioral1/memory/2312-87-0x0000000001320000-0x00000000013A4000-memory.dmp	family_quasar

Executes dropped EXE 11 IoCs

pid	Process
2136	svhoste.exe
2696	svhoste.exe
2448	svhoste.exe
2092	svhoste.exe
840	svhoste.exe
2148	svhoste.exe
2740	svhoste.exe
2312	svhoste.exe
2040	svhoste.exe
2960	svhoste.exe
968	svhoste.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2900	PING.EXE
2272	PING.EXE
600	PING.EXE
2732	PING.EXE
2492	PING.EXE
2540	PING.EXE
2824	PING.EXE
2280	PING.EXE
2568	PING.EXE
1308	PING.EXE

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
1308	PING.EXE
2272	PING.EXE
2732	PING.EXE
2568	PING.EXE
2540	PING.EXE
2824	PING.EXE
2900	PING.EXE
600	PING.EXE
2492	PING.EXE
2280	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2728	schtasks.exe
2436	schtasks.exe
2776	schtasks.exe
2032	schtasks.exe
2552	schtasks.exe
2776	schtasks.exe
2356	schtasks.exe
1712	schtasks.exe
1236	schtasks.exe
852	schtasks.exe
1812	schtasks.exe
1740	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe
Token: SeDebugPrivilege	2136	svhoste.exe
Token: SeDebugPrivilege	2696	svhoste.exe
Token: SeDebugPrivilege	2448	svhoste.exe
Token: SeDebugPrivilege	2092	svhoste.exe
Token: SeDebugPrivilege	840	svhoste.exe
Token: SeDebugPrivilege	2148	svhoste.exe
Token: SeDebugPrivilege	2740	svhoste.exe
Token: SeDebugPrivilege	2312	svhoste.exe
Token: SeDebugPrivilege	2040	svhoste.exe
Token: SeDebugPrivilege	2960	svhoste.exe
Token: SeDebugPrivilege	968	svhoste.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2136	svhoste.exe
2696	svhoste.exe
2448	svhoste.exe
2092	svhoste.exe
840	svhoste.exe
2148	svhoste.exe
2740	svhoste.exe
2312	svhoste.exe
2040	svhoste.exe
2960	svhoste.exe
968	svhoste.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2552	1576	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	30
PID 1576 wrote to memory of 2552	1576	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	30
PID 1576 wrote to memory of 2552	1576	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	30
PID 1576 wrote to memory of 2136	1576	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	32
PID 1576 wrote to memory of 2136	1576	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	32
PID 1576 wrote to memory of 2136	1576	533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe	32
PID 2136 wrote to memory of 2776	2136	svhoste.exe	33
PID 2136 wrote to memory of 2776	2136	svhoste.exe	33
PID 2136 wrote to memory of 2776	2136	svhoste.exe	33
PID 2136 wrote to memory of 2268	2136	svhoste.exe	35
PID 2136 wrote to memory of 2268	2136	svhoste.exe	35
PID 2136 wrote to memory of 2268	2136	svhoste.exe	35
PID 2268 wrote to memory of 2920	2268	cmd.exe	37
PID 2268 wrote to memory of 2920	2268	cmd.exe	37
PID 2268 wrote to memory of 2920	2268	cmd.exe	37
PID 2268 wrote to memory of 2272	2268	cmd.exe	38
PID 2268 wrote to memory of 2272	2268	cmd.exe	38
PID 2268 wrote to memory of 2272	2268	cmd.exe	38
PID 2268 wrote to memory of 2696	2268	cmd.exe	40
PID 2268 wrote to memory of 2696	2268	cmd.exe	40
PID 2268 wrote to memory of 2696	2268	cmd.exe	40
PID 2696 wrote to memory of 2356	2696	svhoste.exe	41
PID 2696 wrote to memory of 2356	2696	svhoste.exe	41
PID 2696 wrote to memory of 2356	2696	svhoste.exe	41
PID 2696 wrote to memory of 2888	2696	svhoste.exe	43
PID 2696 wrote to memory of 2888	2696	svhoste.exe	43
PID 2696 wrote to memory of 2888	2696	svhoste.exe	43
PID 2888 wrote to memory of 532	2888	cmd.exe	45
PID 2888 wrote to memory of 532	2888	cmd.exe	45
PID 2888 wrote to memory of 532	2888	cmd.exe	45
PID 2888 wrote to memory of 600	2888	cmd.exe	46
PID 2888 wrote to memory of 600	2888	cmd.exe	46
PID 2888 wrote to memory of 600	2888	cmd.exe	46
PID 2888 wrote to memory of 2448	2888	cmd.exe	47
PID 2888 wrote to memory of 2448	2888	cmd.exe	47
PID 2888 wrote to memory of 2448	2888	cmd.exe	47
PID 2448 wrote to memory of 1712	2448	svhoste.exe	48
PID 2448 wrote to memory of 1712	2448	svhoste.exe	48
PID 2448 wrote to memory of 1712	2448	svhoste.exe	48
PID 2448 wrote to memory of 1748	2448	svhoste.exe	50
PID 2448 wrote to memory of 1748	2448	svhoste.exe	50
PID 2448 wrote to memory of 1748	2448	svhoste.exe	50
PID 1748 wrote to memory of 2900	1748	cmd.exe	52
PID 1748 wrote to memory of 2900	1748	cmd.exe	52
PID 1748 wrote to memory of 2900	1748	cmd.exe	52
PID 1748 wrote to memory of 2732	1748	cmd.exe	53
PID 1748 wrote to memory of 2732	1748	cmd.exe	53
PID 1748 wrote to memory of 2732	1748	cmd.exe	53
PID 1748 wrote to memory of 2092	1748	cmd.exe	54
PID 1748 wrote to memory of 2092	1748	cmd.exe	54
PID 1748 wrote to memory of 2092	1748	cmd.exe	54
PID 2092 wrote to memory of 2728	2092	svhoste.exe	55
PID 2092 wrote to memory of 2728	2092	svhoste.exe	55
PID 2092 wrote to memory of 2728	2092	svhoste.exe	55
PID 2092 wrote to memory of 1656	2092	svhoste.exe	57
PID 2092 wrote to memory of 1656	2092	svhoste.exe	57
PID 2092 wrote to memory of 1656	2092	svhoste.exe	57
PID 1656 wrote to memory of 1348	1656	cmd.exe	59
PID 1656 wrote to memory of 1348	1656	cmd.exe	59
PID 1656 wrote to memory of 1348	1656	cmd.exe	59
PID 1656 wrote to memory of 2492	1656	cmd.exe	60
PID 1656 wrote to memory of 2492	1656	cmd.exe	60
PID 1656 wrote to memory of 2492	1656	cmd.exe	60
PID 1656 wrote to memory of 840	1656	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe
"C:\Users\Admin\AppData\Local\Temp\533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2552
- C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2776
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\kZg5GSZ6U0vw.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2920
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2272
  - - C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2356
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\qTAvBz64UXYI.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2888
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:532
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:600
      - C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1712
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NtWzjrWmgaUm.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2900
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2732
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2728
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MIGFke0SeaHs.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1348
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2492
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:840
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1236
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\USPNhA1n6MnK.bat" "
        11⤵
        
        PID:1688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3048
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2280
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2148
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2436
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\cDFDitfXeVbQ.bat" "
        13⤵
        
        PID:1632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2540
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2776
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\enRwvPDIxbCt.bat" "
        15⤵
        
        PID:2948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2824
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2312
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:852
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\nrrZOOY2B3Q2.bat" "
        17⤵
        
        PID:2000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1996
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2568
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1812
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CGTfDIgSx1Tv.bat" "
        19⤵
        
        PID:2392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2860
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2900
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2960
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2032
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Tud6lgac2DbU.bat" "
        21⤵
        
        PID:1232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1164
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1308
        
        C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:968
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "svhoste" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CGTfDIgSx1Tv.bat

Filesize
208B

MD5
f74745e1735820d8e9e293562998fa17

SHA1
c73ac6bd5ac6fec7d9e26b48675db67fdba377a1

SHA256
8bf24399a6d844b9b84c60207b8afd1aa500b240cbca2efa31cf24aea470e616

SHA512
86cce171d029264bd157d9f1fc3cdb8ab321b172593c98ebe882ce19671be29da8f633fa56222a143adca892a2d4642ddb4e89f481079c6cbe440ff8fe103cb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MIGFke0SeaHs.bat

Filesize
208B

MD5
95fdb9af3eb34034771b7f7dfaa471fc

SHA1
96b76cb5db2185a60574b76cbb3d34cffe3eb10d

SHA256
4ae9f1dfb4adf6bc66cd3433478c8be9ebed459a6ceca3770f6ecfef1b6e12de

SHA512
b203770d7ddbdf33de259dac66955039f5b067cfbb6e472e4a5b835a45fb6407fd08d853d69f453a14b7ad921527c7ef43612d4e27a619382561efa7607b04cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\NtWzjrWmgaUm.bat

Filesize
208B

MD5
73b72537235f95bbeacbc40dc72cbef8

SHA1
1c7d14102f8d7a385f3ee6da511c9860afabe091

SHA256
4f5d18206edbfc35399aaf5892d698787920faca6a7a26af6544b1765b09cd51

SHA512
c2f0526b393c278bb987c9365626c9b4082e6c70f4c20e3a33085b7ba5b084f30327d8d038820b3df31356fcbfe86a7dc9d5a7fc764f9977dbca878cdbf7ecb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tud6lgac2DbU.bat

Filesize
208B

MD5
1e7fbcddbb9697a13f3f976a6434d51e

SHA1
fd4c90fb4e1a567aaefc92c3ab810648b11e7346

SHA256
a59ff352d1d358c8d409d474252a03e1ed69fd4bdd3fb29e3d7c46ecabbc6034

SHA512
2248b9871fa23d0019757c41fcb97d30e93f6c55665451d59b8c3fab26618784b4be10f0793745ac4d0fa0b74b3bdbfddf7e96f1de3debcdebad75b0c229936a

Download Submit
C:\Users\Admin\AppData\Local\Temp\USPNhA1n6MnK.bat

Filesize
208B

MD5
f82364b35de709f607a1fe9090358169

SHA1
dabce200f191db687d0bb1d47e034a559e5907f0

SHA256
f03f2ed3f167e49b2e7dc88d269021b08a71d70eebb607c5dc5ee212b7ea923e

SHA512
f1997a22d79b34b48fecc0949c61d161dd0de131c1eb985d3c24e536eadc354532ec39890d14851198653b5de9dd03a3214f5d49eea351fddaa02695025743c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cDFDitfXeVbQ.bat

Filesize
208B

MD5
e7e7e2d0f1c8ee571037f961d55c5e03

SHA1
0712c2fb8d5de77245428c76d4702e9e12506a62

SHA256
e9f9ed308647c039c5d6a2344004dd7043c454fd79226e4a709ad4b6e706ea8c

SHA512
a28dc7db8486d3d4c337e815b70f3b6f757bf647840291feaba1605b8aaf5b8f62607d9adea902ea9bcb0d61b08eae03afc46baa9e15d671608ac6fa6d96952b

Download Submit
C:\Users\Admin\AppData\Local\Temp\enRwvPDIxbCt.bat

Filesize
208B

MD5
7c195c106a5cc2186fbaf9ea4fadfd5c

SHA1
87b7d308770145b84ba1e55b676095f474ca677f

SHA256
b625e2f9b0fc4a32a3f4143f2b3cc3afcb7a7f6d676cf3738666998dbd383acd

SHA512
3ed9b3fc800f73e08173e7e7fd4db6164e1b064e02b0174f9e53f2ae9cf2899deae7eb8110309a31e3f535321220e6d5622a3b14cedf94d19bee74a4828e1606

Download Submit
C:\Users\Admin\AppData\Local\Temp\kZg5GSZ6U0vw.bat

Filesize
208B

MD5
b61ed4da549ffcfc5ce0bbaf22a9e8c6

SHA1
db3f90fc3549121a39f416f8112f4cbabd0edbe5

SHA256
073e6adae611f5241ed5e79bf5328eb884eb584445a38563a1c591227ee0902a

SHA512
284aa07a61fdd45bfbf46083cadf9d83d7cc251d55acc7ab49d725d4b99dbfd25cf69fc0a0e7aeea4ff718cfe81cd227c69672ffccf8bddda99c71e77201b147

Download Submit
C:\Users\Admin\AppData\Local\Temp\nrrZOOY2B3Q2.bat

Filesize
208B

MD5
360c1fd3a7a7a18cfe1bd08eb99960f1

SHA1
5ffd627efaaef104d2c1065bf9115692e3b38220

SHA256
6b8db250581f63ae5841416b2983683efa04abb92b03fe637d5bbacda58156b8

SHA512
390dde5a4a85482db362d70d707e1b9fb36c024c4c4da161427c54424d99290733786f6fe6830208cb0754129246374d5bf647fa2472c7f6dea81343cd8941c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\qTAvBz64UXYI.bat

Filesize
208B

MD5
24a39efa0b3bccd99185c5f02e23651d

SHA1
1731b78d373b932d2fcd7e5acaa97fbedf05db9f

SHA256
1a801cab2175d53a1fa633b8c618e1b9629b86d49fc9ab21825bf443e77d647b

SHA512
f1545163b1b4539264ca185a4e411a2605e37ed6945f57104ab86ee96837125c6fa0cf98c515cd1c531767d77691a308a0cab841f06dc11c7a810b625b2b4aee

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\svhoste.exe

Filesize
502KB

MD5
a9c9735f6e34482c1cdd09e347a98787

SHA1
6214e43cdc3fd17978955abf9c01a8d8c3ea791e

SHA256
533d8476431fefd3f83fd39d66366277b2420a549cb01e9232f558b2617871fc

SHA512
084b40e683d88e8eda7a60047f1a640310455986629a63382b3b6ffa6a91f295b47963e2ba52115cb113f57f1f727f2adb98f910a9adca1596af242f266b4a50

Download Submit
memory/1576-8-0x000007FEF5190000-0x000007FEF5B7C000-memory.dmp

Filesize
9.9MB

Download
memory/1576-0-0x000007FEF5193000-0x000007FEF5194000-memory.dmp

Filesize
4KB

Download
memory/1576-2-0x000007FEF5190000-0x000007FEF5B7C000-memory.dmp

Filesize
9.9MB

Download
memory/1576-1-0x00000000008A0000-0x0000000000924000-memory.dmp

Filesize
528KB

Download
memory/2136-19-0x000007FEF5190000-0x000007FEF5B7C000-memory.dmp

Filesize
9.9MB

Download
memory/2136-10-0x000007FEF5190000-0x000007FEF5B7C000-memory.dmp

Filesize
9.9MB

Download
memory/2136-9-0x00000000003F0000-0x0000000000474000-memory.dmp

Filesize
528KB

Download
memory/2136-7-0x000007FEF5190000-0x000007FEF5B7C000-memory.dmp

Filesize
9.9MB

Download
memory/2312-87-0x0000000001320000-0x00000000013A4000-memory.dmp

Filesize
528KB

Download
memory/2448-34-0x0000000000EB0000-0x0000000000F34000-memory.dmp

Filesize
528KB

Download
memory/2696-22-0x0000000000270000-0x00000000002F4000-memory.dmp

Filesize
528KB

Download
memory/2740-76-0x0000000000EE0000-0x0000000000F64000-memory.dmp

Filesize
528KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads