quasar | 884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7.exe
Size

3.1MB
MD5

a7d75b048989da5d22a1f7cca58edb51
SHA1

413d22b60ae540b3b11863e2107980b0403faf50
SHA256

884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7
SHA512

4a453dc7f2a0e82d66fe5d73727ab2a23b5f00ea1b4a53032e4a538b72edf9caaf0894774d0fafb4af401f74a0b65bbf2d83a0cc643dc1a66ae23fb2136dd351
SSDEEP

49152:TvCI22SsaNYfdPBldt698dBcjHe0RJ6qbR3LoGdHTHHB72eh2NT:TvP22SsaNYfdPBldt6+dBcjHe0RJ6E

Score

10^/10

quasar nigga discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Nigga

yzs-42879.portmap.host:42879

Mutex

57d72303-b5e9-46aa-8cc4-9690809c1a9e

Attributes

encryption_key
F1EBDB1862062F9265C0B5AC4D02C76D026534D0
install_name
svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
Steam

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 16 IoCs

resource	yara_rule
behavioral1/memory/2336-1-0x0000000001080000-0x00000000013A4000-memory.dmp	family_quasar
behavioral1/files/0x000700000001878c-6.dat	family_quasar
behavioral1/memory/2972-7-0x0000000000260000-0x0000000000584000-memory.dmp	family_quasar
behavioral1/memory/2640-22-0x0000000000230000-0x0000000000554000-memory.dmp	family_quasar
behavioral1/memory/2936-33-0x0000000001200000-0x0000000001524000-memory.dmp	family_quasar
behavioral1/memory/2824-54-0x00000000001D0000-0x00000000004F4000-memory.dmp	family_quasar
behavioral1/memory/2044-65-0x00000000009A0000-0x0000000000CC4000-memory.dmp	family_quasar
behavioral1/memory/876-76-0x0000000000C30000-0x0000000000F54000-memory.dmp	family_quasar
behavioral1/memory/2224-87-0x00000000003F0000-0x0000000000714000-memory.dmp	family_quasar
behavioral1/memory/576-98-0x0000000000270000-0x0000000000594000-memory.dmp	family_quasar
behavioral1/memory/1968-109-0x0000000000F20000-0x0000000001244000-memory.dmp	family_quasar
behavioral1/memory/2772-120-0x00000000003C0000-0x00000000006E4000-memory.dmp	family_quasar
behavioral1/memory/1020-131-0x0000000000300000-0x0000000000624000-memory.dmp	family_quasar
behavioral1/memory/2724-142-0x00000000008C0000-0x0000000000BE4000-memory.dmp	family_quasar
behavioral1/memory/1304-153-0x00000000013B0000-0x00000000016D4000-memory.dmp	family_quasar
behavioral1/memory/1988-174-0x00000000013C0000-0x00000000016E4000-memory.dmp	family_quasar

Executes dropped EXE 16 IoCs

pid	Process
2972	svchost.exe
2640	svchost.exe
2936	svchost.exe
2456	svchost.exe
2824	svchost.exe
2044	svchost.exe
876	svchost.exe
2224	svchost.exe
576	svchost.exe
1968	svchost.exe
2772	svchost.exe
1020	svchost.exe
2724	svchost.exe
1304	svchost.exe
1456	svchost.exe
1988	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2696	PING.EXE
2512	PING.EXE
1524	PING.EXE
2372	PING.EXE
2916	PING.EXE
316	PING.EXE
1436	PING.EXE
1440	PING.EXE
2756	PING.EXE
920	PING.EXE
1920	PING.EXE
2960	PING.EXE
1972	PING.EXE
2388	PING.EXE
2700	PING.EXE
1344	PING.EXE

Runs ping.exe 1 TTPs 16 IoCs

Remote System Discovery

T1018

pid	Process
2700	PING.EXE
2960	PING.EXE
1344	PING.EXE
2916	PING.EXE
2512	PING.EXE
1920	PING.EXE
2756	PING.EXE
1436	PING.EXE
1440	PING.EXE
2388	PING.EXE
2372	PING.EXE
920	PING.EXE
1524	PING.EXE
2696	PING.EXE
316	PING.EXE
1972	PING.EXE

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7.exe
Token: SeDebugPrivilege	2972	svchost.exe
Token: SeDebugPrivilege	2640	svchost.exe
Token: SeDebugPrivilege	2936	svchost.exe
Token: SeDebugPrivilege	2456	svchost.exe
Token: SeDebugPrivilege	2824	svchost.exe
Token: SeDebugPrivilege	2044	svchost.exe
Token: SeDebugPrivilege	876	svchost.exe
Token: SeDebugPrivilege	2224	svchost.exe
Token: SeDebugPrivilege	576	svchost.exe
Token: SeDebugPrivilege	1968	svchost.exe
Token: SeDebugPrivilege	2772	svchost.exe
Token: SeDebugPrivilege	1020	svchost.exe
Token: SeDebugPrivilege	2724	svchost.exe
Token: SeDebugPrivilege	1304	svchost.exe
Token: SeDebugPrivilege	1456	svchost.exe
Token: SeDebugPrivilege	1988	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2972	2336	884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7.exe	30
PID 2336 wrote to memory of 2972	2336	884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7.exe	30
PID 2336 wrote to memory of 2972	2336	884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7.exe	30
PID 2972 wrote to memory of 2468	2972	svchost.exe	31
PID 2972 wrote to memory of 2468	2972	svchost.exe	31
PID 2972 wrote to memory of 2468	2972	svchost.exe	31
PID 2468 wrote to memory of 2652	2468	cmd.exe	33
PID 2468 wrote to memory of 2652	2468	cmd.exe	33
PID 2468 wrote to memory of 2652	2468	cmd.exe	33
PID 2468 wrote to memory of 2696	2468	cmd.exe	34
PID 2468 wrote to memory of 2696	2468	cmd.exe	34
PID 2468 wrote to memory of 2696	2468	cmd.exe	34
PID 2468 wrote to memory of 2640	2468	cmd.exe	36
PID 2468 wrote to memory of 2640	2468	cmd.exe	36
PID 2468 wrote to memory of 2640	2468	cmd.exe	36
PID 2640 wrote to memory of 2680	2640	svchost.exe	37
PID 2640 wrote to memory of 2680	2640	svchost.exe	37
PID 2640 wrote to memory of 2680	2640	svchost.exe	37
PID 2680 wrote to memory of 2564	2680	cmd.exe	39
PID 2680 wrote to memory of 2564	2680	cmd.exe	39
PID 2680 wrote to memory of 2564	2680	cmd.exe	39
PID 2680 wrote to memory of 2512	2680	cmd.exe	40
PID 2680 wrote to memory of 2512	2680	cmd.exe	40
PID 2680 wrote to memory of 2512	2680	cmd.exe	40
PID 2680 wrote to memory of 2936	2680	cmd.exe	41
PID 2680 wrote to memory of 2936	2680	cmd.exe	41
PID 2680 wrote to memory of 2936	2680	cmd.exe	41
PID 2936 wrote to memory of 2324	2936	svchost.exe	42
PID 2936 wrote to memory of 2324	2936	svchost.exe	42
PID 2936 wrote to memory of 2324	2936	svchost.exe	42
PID 2324 wrote to memory of 1464	2324	cmd.exe	44
PID 2324 wrote to memory of 1464	2324	cmd.exe	44
PID 2324 wrote to memory of 1464	2324	cmd.exe	44
PID 2324 wrote to memory of 316	2324	cmd.exe	45
PID 2324 wrote to memory of 316	2324	cmd.exe	45
PID 2324 wrote to memory of 316	2324	cmd.exe	45
PID 2324 wrote to memory of 2456	2324	cmd.exe	46
PID 2324 wrote to memory of 2456	2324	cmd.exe	46
PID 2324 wrote to memory of 2456	2324	cmd.exe	46
PID 2456 wrote to memory of 1708	2456	svchost.exe	47
PID 2456 wrote to memory of 1708	2456	svchost.exe	47
PID 2456 wrote to memory of 1708	2456	svchost.exe	47
PID 1708 wrote to memory of 1896	1708	cmd.exe	49
PID 1708 wrote to memory of 1896	1708	cmd.exe	49
PID 1708 wrote to memory of 1896	1708	cmd.exe	49
PID 1708 wrote to memory of 1920	1708	cmd.exe	50
PID 1708 wrote to memory of 1920	1708	cmd.exe	50
PID 1708 wrote to memory of 1920	1708	cmd.exe	50
PID 1708 wrote to memory of 2824	1708	cmd.exe	51
PID 1708 wrote to memory of 2824	1708	cmd.exe	51
PID 1708 wrote to memory of 2824	1708	cmd.exe	51
PID 2824 wrote to memory of 380	2824	svchost.exe	52
PID 2824 wrote to memory of 380	2824	svchost.exe	52
PID 2824 wrote to memory of 380	2824	svchost.exe	52
PID 380 wrote to memory of 1388	380	cmd.exe	54
PID 380 wrote to memory of 1388	380	cmd.exe	54
PID 380 wrote to memory of 1388	380	cmd.exe	54
PID 380 wrote to memory of 1436	380	cmd.exe	55
PID 380 wrote to memory of 1436	380	cmd.exe	55
PID 380 wrote to memory of 1436	380	cmd.exe	55
PID 380 wrote to memory of 2044	380	cmd.exe	56
PID 380 wrote to memory of 2044	380	cmd.exe	56
PID 380 wrote to memory of 2044	380	cmd.exe	56
PID 2044 wrote to memory of 1176	2044	svchost.exe	57

C:\Users\Admin\AppData\Local\Temp\884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7.exe
"C:\Users\Admin\AppData\Local\Temp\884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\EKy4XnudWA9n.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2652
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2696
  - - C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\0C5iUXxPAk4U.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2680
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2564
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2512
      - C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6m3nsRQWQN0l.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1464
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:316
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QTfzgsXMIYtQ.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1896
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1920
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2824
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\2VyRazSYqjky.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:380
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1388
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1436
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MknHzLIOAKz0.bat" "
        13⤵
        
        PID:1176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1204
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1972
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4EoUMv1kd65r.bat" "
        15⤵
        
        PID:608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1440
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\hYQlmDwz1HkJ.bat" "
        17⤵
        
        PID:1864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2988
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2388
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:576
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\BVVw3XXHxrNf.bat" "
        19⤵
        
        PID:1780
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2720
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2756
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1968
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\RIBGcAhgNtwt.bat" "
        21⤵
        
        PID:2560
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2632
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2700
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\UbJ56vYpgU9G.bat" "
        23⤵
        
        PID:1140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2356
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2960
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1020
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\3JrYUdHMskwe.bat" "
        25⤵
        
        PID:1572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2256
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1344
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2724
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\RrPE2dT1On7q.bat" "
        27⤵
        
        PID:2488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2716
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:920
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1304
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FU95Dnlwn4cP.bat" "
        29⤵
        
        PID:328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1916
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1524
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1456
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\lTPDcNKuWAf1.bat" "
        31⤵
        
        PID:796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2372
        
        C:\Users\Admin\AppData\Roaming\Steam\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Steam\svchost.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1988
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zKZnLAohwEes.bat" "
        33⤵
        
        PID:992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        34⤵
        
        PID:2844
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        34⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0C5iUXxPAk4U.bat

Filesize
207B

MD5
c4badb800fe3627246359101e737c8dc

SHA1
5445ee9546e7470e639ed1df88d6a456ff299e03

SHA256
ac5ff0020989d69a7637fbdb3a3553c027efa24235bd1aefc81c16e35cf61869

SHA512
1d66d3898fa1a02a4de1bc980fa1184ca6c4eb3ef58ca8c15192c7b1d65d48f24bd7910084f0b76f65a6da20269dfa4cf0a3ac3beb0ee0d3bb2348e644af4650

Download Submit
C:\Users\Admin\AppData\Local\Temp\2VyRazSYqjky.bat

Filesize
207B

MD5
5c8982f2e992d221e4ccf89c69d54ce1

SHA1
32b2d35c124e909851792e61fd65d3172c2ccd64

SHA256
9d35143b3f4156399923bf0e0e7b8ce692b5ca7f10d8c20016a1569ed1f01a69

SHA512
2e327b0f320c682a5ec90faff9723058f9493b837f878dbf1a7af2d33cad7f7e14803c53d27e3caab3eb493c4e1d056dea4396781e769dfdb6e619b8cfb19d03

Download Submit
C:\Users\Admin\AppData\Local\Temp\3JrYUdHMskwe.bat

Filesize
207B

MD5
1f646a3e5d09d7519041a8f8f0317724

SHA1
9c08323f77ced29e5b235a3dd61d1f840e0e5348

SHA256
34fbc4154034a8527bf12dba580b8a4862abfb7f7caea9ccd42e1624a8ede635

SHA512
10e04bac9330f47c13bc2b2ea9d9daae1d7370db822c32c6f4b9ca092552ab16431664a11374331e00616568038b50c59ffd1ffc5a79d4b36b08dca5c713b26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4EoUMv1kd65r.bat

Filesize
207B

MD5
52a5de203af3c124b04c76cd5a7b8193

SHA1
6fff983f25084ceac8ceabdc9a252ad96642f64e

SHA256
02d2551cce7b65ed82cc2b96f2fa462d40f72f2b43127cdc2536a41e66dde9a9

SHA512
6de10ecdf18a7dcdf150fb34eadab2733bbdae51d4c91bffe962b95ba78c8cbbb8ef16fceaf9f3ec4549eecbba9d3b83f71d70e1176b43004ed3f9744999873d

Download Submit
C:\Users\Admin\AppData\Local\Temp\6m3nsRQWQN0l.bat

Filesize
207B

MD5
02a44886fe47b479e9e20668677c1658

SHA1
971e051c609e7b67f16e51673f234fb56729e7d9

SHA256
8ef0e9487170a04372bd6a99df8258c1ae55b2a25945aa62405a232d1930779d

SHA512
f715b39ce8047e0d030f45c4e9e06200136da95cb98b14b3a9f9c7c99eaf9c989376bae889e5b3a382744fa5abbf97cd4682cb3b57b4a17386e450bd6f2ab62d

Download Submit
C:\Users\Admin\AppData\Local\Temp\BVVw3XXHxrNf.bat

Filesize
207B

MD5
4faf78f3b1e0e5abaae71309e05e00df

SHA1
6e6badcfaa7b61f7cdff40b59d72349b09017fa1

SHA256
87929000ab3ab5fbdb64b1c465b205202a9565a63b4e31c066d1e2ef66ca7351

SHA512
51c759f811f88e4a934799fb09e695678c2205e8d6fb8d1cf2eef3807918acc9f227844691939654c22f1a41adee99e850ef4b4e796ebc77c16703c0daa6f6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\EKy4XnudWA9n.bat

Filesize
207B

MD5
4dbad2d62351e784d89bcf82fc6bca8d

SHA1
138c7a8aed15910e6aea4a0cae8c94077e8b6568

SHA256
15bf791acd0dbae4909e2fc20c76d10d79b67adb6b13a4e4ce0a97cb697d3fc2

SHA512
c18410109d36be4789e2fa7c7f62d1e460b8fd3998c686043d799fbf8d795726f82a81e7e36e790102545f991d0864f5b197c9a16c64a214b5ec6889f511a5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\FU95Dnlwn4cP.bat

Filesize
207B

MD5
32982bfdbf28937c424de210219f5ee3

SHA1
353a085a9166c80150195658dfb4b605ccbe9d07

SHA256
c3a7ab679242b25624fb8525eeccaed90cf1f06f8487d3fbf075faa98bb02f63

SHA512
abc94babfc45dc5d623f1e1c356eeedd175e6d8e80de9070174e4df9bd566bd4665e5a521a8de2bb4d87fb8220f14d17f6e8fe8b744314829157a19d4ffaa26e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MknHzLIOAKz0.bat

Filesize
207B

MD5
88c307e02d79075572acc00f7ea918a4

SHA1
04a2baacf78cc7f065f816b01d15ff5cf0594d77

SHA256
731ed29e56dce5715f6a38f197f8eadfc8ca9df37f7f1416e5395e78903b12ae

SHA512
b0962472cd21f26122a14e9547381a01c1b18e4288552fd948a822cf33274ab29da4d2b4132c0d517c8a73b749baa4ac384033a434c614649030e8831b89b51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\QTfzgsXMIYtQ.bat

Filesize
207B

MD5
cfe309af40c1cc88400d9771e334d478

SHA1
72756bb2d2e42d9b7d501340f381d10514b66c2e

SHA256
e4cf3a655430f7ccc54e61b8951edab874afcdcc723dd2e759b5b17613135436

SHA512
366562c7dde49f5aac228240f1c686b9b0ce47cb0eca8977455ee6f38038cc96dfeef3c4083aed40d9a64f34a93b14e62862f5ac4d381f7665a4f6b0c5c069d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RIBGcAhgNtwt.bat

Filesize
207B

MD5
e8b89cc117f8cdb55822ad93e714b69f

SHA1
822a084472f01ecfb3d7f71a2cc54af49fb2388e

SHA256
c48d780d9b1522db8b150c268a24b7aa7355ca893c83210d07f5e412dc0060c6

SHA512
0f5dc09ef3e6990e2f717d0ca4ec2501997b1a97be38b7b9d930dd0c52b8c2370a04757b9cf2b88431147a1e4af52283b43254199bbd4ac6909667c90f8ab9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\RrPE2dT1On7q.bat

Filesize
207B

MD5
4d9e7479e13acd0b86e4eacd5e2fb4fd

SHA1
654a8e65704767119b89d7571bdda0064497e738

SHA256
212d3add4fc739dca73d94e25461e77efc237886dd1b0de39451b4efeefb766a

SHA512
e0618aecc3a736cfbebfb2bfa1940996c92bdc069306d6816dd9e929c37ea0c3c1c612c339eff117e4639df48648029834f7e559912ab11161ac227f732e521d

Download Submit
C:\Users\Admin\AppData\Local\Temp\UbJ56vYpgU9G.bat

Filesize
207B

MD5
0e6bfeb1acfec05b6202b465772baf98

SHA1
9810ed5e877db08c7bcb054077865d55f9a24032

SHA256
3993fd6a3471528ec35b80ef9bc06d4952595a9a94864c1eba32e896119097e9

SHA512
0282eaad1fa565cd69e19b06bdc3647f55dde60690ab7b0d99789d5b21b5860d4421b39cef2b56edb4d5620539e23d6ce7ddb54dfc17eec60b6360c9f9a335ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\hYQlmDwz1HkJ.bat

Filesize
207B

MD5
734cab71d0a1d11c74d717ec1ca27aee

SHA1
2bacafab60aa2ad0961bd2108c06c4cdd19b32ae

SHA256
93ade8fa0d4995f4809f269c33404311fa66de53e23f80d307475ba5901cc573

SHA512
e6f013ff14a54bdacc6218485d151a267f21538b0d0e12fe14d4ab27a73580e98535b7e1060a7ff45e200430f418d73e50a139ee045ad62be9a22798b0fc4fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lTPDcNKuWAf1.bat

Filesize
207B

MD5
ba49fcadf35fc5ae5356569dab8e58fd

SHA1
5d01f4a6767a1184d6bbf08fb5a2a55a755b3af5

SHA256
b49bfb8cf15573291ea5ba320178e589bc787fc32073be8b9c15c33395b5ca38

SHA512
0900d7b2206340772e1b44d10540277e4c06e781e8860b0fe49820f1b0e63242e0f106369a5de8e741e41a7c4a45896ef69fb6e0b8dca03f7aebddb29b0f839c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zKZnLAohwEes.bat

Filesize
207B

MD5
962862e803f035462a5b787cf1474fea

SHA1
9f1040417398aa06748237550b68ed3bcc31d43b

SHA256
286c36353e1dcd4af38f15e712eaae6cd6637440f07c2ed0c00b25c446eb4449

SHA512
82d14e595fb8d6ebc132fd031e399592c67247563a2b4feb348400cfc2a0c6fd02a045a0ac5d8cb7542a9c060ee8cb67a4e5bd6cc8780cc7e24b7c876a392cc3

Download Submit
C:\Users\Admin\AppData\Roaming\Steam\svchost.exe

Filesize
3.1MB

MD5
a7d75b048989da5d22a1f7cca58edb51

SHA1
413d22b60ae540b3b11863e2107980b0403faf50

SHA256
884d0c2cefa850e384edd30c22b96dd9ca03443c7c57bdae7d6234c2ebf0d0c7

SHA512
4a453dc7f2a0e82d66fe5d73727ab2a23b5f00ea1b4a53032e4a538b72edf9caaf0894774d0fafb4af401f74a0b65bbf2d83a0cc643dc1a66ae23fb2136dd351

Download Submit
memory/576-98-0x0000000000270000-0x0000000000594000-memory.dmp

Filesize
3.1MB

Download
memory/876-76-0x0000000000C30000-0x0000000000F54000-memory.dmp

Filesize
3.1MB

Download
memory/1020-131-0x0000000000300000-0x0000000000624000-memory.dmp

Filesize
3.1MB

Download
memory/1304-153-0x00000000013B0000-0x00000000016D4000-memory.dmp

Filesize
3.1MB

Download
memory/1968-109-0x0000000000F20000-0x0000000001244000-memory.dmp

Filesize
3.1MB

Download
memory/1988-174-0x00000000013C0000-0x00000000016E4000-memory.dmp

Filesize
3.1MB

Download
memory/2044-65-0x00000000009A0000-0x0000000000CC4000-memory.dmp

Filesize
3.1MB

Download
memory/2224-87-0x00000000003F0000-0x0000000000714000-memory.dmp

Filesize
3.1MB

Download
memory/2336-9-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2336-0-0x000007FEF59F3000-0x000007FEF59F4000-memory.dmp

Filesize
4KB

Download
memory/2336-2-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2336-1-0x0000000001080000-0x00000000013A4000-memory.dmp

Filesize
3.1MB

Download
memory/2640-22-0x0000000000230000-0x0000000000554000-memory.dmp

Filesize
3.1MB

Download
memory/2724-142-0x00000000008C0000-0x0000000000BE4000-memory.dmp

Filesize
3.1MB

Download
memory/2772-120-0x00000000003C0000-0x00000000006E4000-memory.dmp

Filesize
3.1MB

Download
memory/2824-54-0x00000000001D0000-0x00000000004F4000-memory.dmp

Filesize
3.1MB

Download
memory/2936-33-0x0000000001200000-0x0000000001524000-memory.dmp

Filesize
3.1MB

Download
memory/2972-20-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-10-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-8-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2972-7-0x0000000000260000-0x0000000000584000-memory.dmp

Filesize
3.1MB

Download