quasar | b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-12-2024 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe
Size

3.1MB
MD5

f9fd797dbef56a3900d2fe9d0a6e2e86
SHA1

c5d002cc63bd21fa35fdad428ca4c909f34c4309
SHA256

b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e
SHA512

c4d170855397e2e62d754883b2caab00d14f58787463924141d2077997ee03b25cd752565354c1c4cbace637cf1c053c45a162d0b61b31caa73f1ec70b998ce1
SSDEEP

49152:ivkt62XlaSFNWPjljiFa2RoUYIobRJ6MbR3LoGdNwhTHHB72eh2NT:iv462XlaSFNWPjljiFXRoUYIobRJ6WK

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

biseo-48321.portmap.host:48321

Mutex

cb74f432-50f1-4947-8163-7687a0292fb0

Attributes

encryption_key
D1BBEF3C04D88FE8F97EE2745041632CE9C760EE
install_name
Svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Svchost
subdirectory
Svchost

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 7 IoCs

resource	yara_rule
behavioral1/memory/1824-1-0x00000000000B0000-0x00000000003D4000-memory.dmp	family_quasar
behavioral1/files/0x0033000000018650-6.dat	family_quasar
behavioral1/memory/2828-8-0x0000000000FD0000-0x00000000012F4000-memory.dmp	family_quasar
behavioral1/memory/1116-54-0x0000000000080000-0x00000000003A4000-memory.dmp	family_quasar
behavioral1/memory/924-65-0x00000000011C0000-0x00000000014E4000-memory.dmp	family_quasar
behavioral1/memory/1812-106-0x0000000001270000-0x0000000001594000-memory.dmp	family_quasar
behavioral1/memory/3048-158-0x0000000000210000-0x0000000000534000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2828	Svchost.exe
2908	Svchost.exe
1940	Svchost.exe
996	Svchost.exe
1116	Svchost.exe
924	Svchost.exe
2300	Svchost.exe
2704	Svchost.exe
2260	Svchost.exe
1812	Svchost.exe
2432	Svchost.exe
1352	Svchost.exe
1592	Svchost.exe
1564	Svchost.exe
3048	Svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2644	PING.EXE
2684	PING.EXE
2352	PING.EXE
1612	PING.EXE
1660	PING.EXE
2700	PING.EXE
844	PING.EXE
684	PING.EXE
2728	PING.EXE
776	PING.EXE
2448	PING.EXE
1628	PING.EXE
1464	PING.EXE
1008	PING.EXE
1240	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2644	PING.EXE
1660	PING.EXE
1008	PING.EXE
2684	PING.EXE
1464	PING.EXE
2700	PING.EXE
2352	PING.EXE
2728	PING.EXE
1612	PING.EXE
2448	PING.EXE
1240	PING.EXE
776	PING.EXE
1628	PING.EXE
684	PING.EXE
844	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
648	schtasks.exe
2004	schtasks.exe
2516	schtasks.exe
2964	schtasks.exe
2548	schtasks.exe
2304	schtasks.exe
2536	schtasks.exe
828	schtasks.exe
1948	schtasks.exe
2936	schtasks.exe
2880	schtasks.exe
2916	schtasks.exe
2764	schtasks.exe
2472	schtasks.exe
1516	schtasks.exe
2832	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe
Token: SeDebugPrivilege	2828	Svchost.exe
Token: SeDebugPrivilege	2908	Svchost.exe
Token: SeDebugPrivilege	1940	Svchost.exe
Token: SeDebugPrivilege	996	Svchost.exe
Token: SeDebugPrivilege	1116	Svchost.exe
Token: SeDebugPrivilege	924	Svchost.exe
Token: SeDebugPrivilege	2300	Svchost.exe
Token: SeDebugPrivilege	2704	Svchost.exe
Token: SeDebugPrivilege	2260	Svchost.exe
Token: SeDebugPrivilege	1812	Svchost.exe
Token: SeDebugPrivilege	2432	Svchost.exe
Token: SeDebugPrivilege	1352	Svchost.exe
Token: SeDebugPrivilege	1592	Svchost.exe
Token: SeDebugPrivilege	1564	Svchost.exe
Token: SeDebugPrivilege	3048	Svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2828	Svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2880	1824	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	30
PID 1824 wrote to memory of 2880	1824	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	30
PID 1824 wrote to memory of 2880	1824	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	30
PID 1824 wrote to memory of 2828	1824	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	32
PID 1824 wrote to memory of 2828	1824	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	32
PID 1824 wrote to memory of 2828	1824	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	32
PID 2828 wrote to memory of 2916	2828	Svchost.exe	33
PID 2828 wrote to memory of 2916	2828	Svchost.exe	33
PID 2828 wrote to memory of 2916	2828	Svchost.exe	33
PID 2828 wrote to memory of 1696	2828	Svchost.exe	35
PID 2828 wrote to memory of 1696	2828	Svchost.exe	35
PID 2828 wrote to memory of 1696	2828	Svchost.exe	35
PID 1696 wrote to memory of 2740	1696	cmd.exe	37
PID 1696 wrote to memory of 2740	1696	cmd.exe	37
PID 1696 wrote to memory of 2740	1696	cmd.exe	37
PID 1696 wrote to memory of 2728	1696	cmd.exe	38
PID 1696 wrote to memory of 2728	1696	cmd.exe	38
PID 1696 wrote to memory of 2728	1696	cmd.exe	38
PID 1696 wrote to memory of 2908	1696	cmd.exe	39
PID 1696 wrote to memory of 2908	1696	cmd.exe	39
PID 1696 wrote to memory of 2908	1696	cmd.exe	39
PID 2908 wrote to memory of 648	2908	Svchost.exe	40
PID 2908 wrote to memory of 648	2908	Svchost.exe	40
PID 2908 wrote to memory of 648	2908	Svchost.exe	40
PID 2908 wrote to memory of 1796	2908	Svchost.exe	42
PID 2908 wrote to memory of 1796	2908	Svchost.exe	42
PID 2908 wrote to memory of 1796	2908	Svchost.exe	42
PID 1796 wrote to memory of 2980	1796	cmd.exe	44
PID 1796 wrote to memory of 2980	1796	cmd.exe	44
PID 1796 wrote to memory of 2980	1796	cmd.exe	44
PID 1796 wrote to memory of 2644	1796	cmd.exe	45
PID 1796 wrote to memory of 2644	1796	cmd.exe	45
PID 1796 wrote to memory of 2644	1796	cmd.exe	45
PID 1796 wrote to memory of 1940	1796	cmd.exe	46
PID 1796 wrote to memory of 1940	1796	cmd.exe	46
PID 1796 wrote to memory of 1940	1796	cmd.exe	46
PID 1940 wrote to memory of 2764	1940	Svchost.exe	47
PID 1940 wrote to memory of 2764	1940	Svchost.exe	47
PID 1940 wrote to memory of 2764	1940	Svchost.exe	47
PID 1940 wrote to memory of 2572	1940	Svchost.exe	49
PID 1940 wrote to memory of 2572	1940	Svchost.exe	49
PID 1940 wrote to memory of 2572	1940	Svchost.exe	49
PID 2572 wrote to memory of 1440	2572	cmd.exe	51
PID 2572 wrote to memory of 1440	2572	cmd.exe	51
PID 2572 wrote to memory of 1440	2572	cmd.exe	51
PID 2572 wrote to memory of 1464	2572	cmd.exe	52
PID 2572 wrote to memory of 1464	2572	cmd.exe	52
PID 2572 wrote to memory of 1464	2572	cmd.exe	52
PID 2572 wrote to memory of 996	2572	cmd.exe	54
PID 2572 wrote to memory of 996	2572	cmd.exe	54
PID 2572 wrote to memory of 996	2572	cmd.exe	54
PID 996 wrote to memory of 2472	996	Svchost.exe	55
PID 996 wrote to memory of 2472	996	Svchost.exe	55
PID 996 wrote to memory of 2472	996	Svchost.exe	55
PID 996 wrote to memory of 2124	996	Svchost.exe	57
PID 996 wrote to memory of 2124	996	Svchost.exe	57
PID 996 wrote to memory of 2124	996	Svchost.exe	57
PID 2124 wrote to memory of 1284	2124	cmd.exe	59
PID 2124 wrote to memory of 1284	2124	cmd.exe	59
PID 2124 wrote to memory of 1284	2124	cmd.exe	59
PID 2124 wrote to memory of 1612	2124	cmd.exe	60
PID 2124 wrote to memory of 1612	2124	cmd.exe	60
PID 2124 wrote to memory of 1612	2124	cmd.exe	60
PID 2124 wrote to memory of 1116	2124	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe
"C:\Users\Admin\AppData\Local\Temp\b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2880
- C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
  "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2916
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\m5crGYBoaVOu.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2740
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2728
  - - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
      "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2908
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:648
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\hCD3L9cqnZo5.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1796
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2980
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2644
      - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2764
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6kd2ono6IDS2.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1464
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2472
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AmgQ4hVFWXL9.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1284
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1612
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2536
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\jnqLMLXNkr03.bat" "
        11⤵
        
        PID:1508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:660
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1660
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1516
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\6SNrqNXtYzeq.bat" "
        13⤵
        
        PID:2340
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:568
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1008
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2300
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2004
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\pJYGPcdvrP0d.bat" "
        15⤵
        
        PID:2924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2972
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2700
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2832
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zEu5apTecEHo.bat" "
        17⤵
        
        PID:2844
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2684
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:828
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\dgccVfKp036f.bat" "
        19⤵
        
        PID:1544
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2336
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1240
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2964
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\pAMazoJpwpX8.bat" "
        21⤵
        
        PID:2576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2652
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:776
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2432
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2516
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AR2AhVMRa5Jz.bat" "
        23⤵
        
        PID:2084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2560
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2448
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2548
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\VznpB7B00IlK.bat" "
        25⤵
        
        PID:608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1628
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1592
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2304
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\59gt11iUcp2R.bat" "
        27⤵
        
        PID:2992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1264
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2352
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1948
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\OIVvcVNUm6f9.bat" "
        29⤵
        
        PID:2344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:684
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2936
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\9esV0YRS8mq2.bat" "
        31⤵
        
        PID:2740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\59gt11iUcp2R.bat

Filesize
209B

MD5
af6bb62980465192ff50627a08292c49

SHA1
5f71d223ef7fce7c9255c518bfd3d0a54a322b35

SHA256
b43734a88d2fc70d5cc74209acc4a3f6d35772995580d8d28b407d93007c8837

SHA512
c72bd81e318f9da1682b1056e9548e9b44b4518f981172773c31b78c6fa82947cb6bfa1fb10f51dbb6e9c22b4cd921f753fd3de83a3302cd1ed6f6c8bf084015

Download Submit
C:\Users\Admin\AppData\Local\Temp\6SNrqNXtYzeq.bat

Filesize
209B

MD5
f463861c66f4c5f37512da485ac82aa4

SHA1
77837c8c514b57ff690852feee527a59310d6ff9

SHA256
1c330ca99558be11b8a6628399f40c40fedf6af76daeff7873e304aeb5a011d6

SHA512
b8b98eb94ed14e305e351431240c1c48a3328219814cfcaca49d5d743a44bc6122366010f6004fc7812d78108d740a80266e51f504ba6e5b58e20efbe87ca1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\6kd2ono6IDS2.bat

Filesize
209B

MD5
fc671487521330eeb42e22278de74b74

SHA1
707ed1f0a4155bcb224dfeb6c9e2a85e23fce094

SHA256
111a9641e8b66df0ffef06a84359e05891e3b071201545a9a59228da460320b7

SHA512
8b37a4d6941db875af240e2aab2a70a8a757840191b3e2ecd96e0e108c08af7d4d276e48f8f615165292428a9ae2f51a065b59a0a62803f18b2e118c70120442

Download Submit
C:\Users\Admin\AppData\Local\Temp\9esV0YRS8mq2.bat

Filesize
209B

MD5
316eceed682b6a2998b7baf7efbb8718

SHA1
577ce79920e1413497521e847e55d17cbceba645

SHA256
5569d107a70227af259f4456260c9ce95ef513cff4d7cd14de1b22d7c31659dc

SHA512
9951b3b047b1a5d1328db10548d91cd35ee90186a0331f1545d15b54e2209b3a2b586b148ab4fa095e0e8a58a1b29a9ab915d161d39835966dd59c2f6bfe9975

Download Submit
C:\Users\Admin\AppData\Local\Temp\AR2AhVMRa5Jz.bat

Filesize
209B

MD5
a16f2ec10642c7a19af3dfe465c40def

SHA1
d34bef6fe8885142f94b09ff324b6724959db4aa

SHA256
c8ec6c351c5094bddffc7115b0506d5c7ef57247ff6b5aad4920f5fa731a83ed

SHA512
f43da40dde657bc4093dd3120296588da1867711e1c22c148a88472cc6e62f72bf53e68dafedd580313605578e0e18dd64a77093eeeb0967bb4ac8f5b1a5c1c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AmgQ4hVFWXL9.bat

Filesize
209B

MD5
af07d018ce03eafc58c241ed83f2eec5

SHA1
7a36bcecfdd6dd20c593628084d37cdc15b32d7e

SHA256
5c111accf5764c7f107a9259c431625f8e403041f792cd8960a487e2f0e9ea93

SHA512
f3d4c4694ba1ac2e2aab7ecf6e540992dbef96ca0c16c1f678f82b1cdf939661fd64817ebab2c510ef7e290915609c129c98a9ffce088224a2ca28b1d1634709

Download Submit
C:\Users\Admin\AppData\Local\Temp\OIVvcVNUm6f9.bat

Filesize
209B

MD5
c51b4eec965e242a3af65615ee94395a

SHA1
9975b21526b27da5f35e63ab53a1cdefdc67ea93

SHA256
37816ccd6f79e206c3fd12118e2ee18fbde3f548b9f9dffd4106d38cc2e8f538

SHA512
3b31f3e27c421998737c6aad74aa633bdf4498be0ade9e10cbe8e3ae04eba867bad75469f5554cdf6b3c251ed015d52075eeb2a44bcfde2ac61b09ce0f16e33a

Download Submit
C:\Users\Admin\AppData\Local\Temp\VznpB7B00IlK.bat

Filesize
209B

MD5
1d5e0f05dee2dc5b4281eb71c39809ad

SHA1
6d1c8b4e9923f24986144e515883b222bb06ceb1

SHA256
384ad1f230cdff71c9b5d9ea893a80036ec49145d3df8bcc24306ad1299f9405

SHA512
519f742541b3268e75b30faed9501349d816633d8bb1d2a79273428c0c160ec88feceb14c8ca0a28c2d77a11a3ffba1af92f2dc9cf8a4d0fa0b0c406116ac9dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\dgccVfKp036f.bat

Filesize
209B

MD5
3b04f38037835d2b8710df99d0a64cb6

SHA1
7ecaa7c5c9b67814140c3db0835142d4a28641d1

SHA256
9340f6d24c1e7a8c46b1eb102e19383e4b7cbc0d1ebe2097fdbc87d50d1be43f

SHA512
68d2fab6caf8f39e43856f1834cf5cd374720709f29989fa8dda0c3d67d911e389def537bf4d8744bd009b8536712a0e2608e138b57bbce93c96d32c69965edb

Download Submit
C:\Users\Admin\AppData\Local\Temp\hCD3L9cqnZo5.bat

Filesize
209B

MD5
04e2556d3bea0c1a5085d055a8b1e08d

SHA1
17047971fe35f2cfd22fc8eca4a3564dd08db340

SHA256
ede5bf8dd161784766da9d5a0ef0532e03e58059bc3c81ef2a030b3448ee1700

SHA512
3d573d49889cfbdbcd4a04b64cd3070e7963020c831b4fda558800e39916010f87f2a2113a66dc7c0de2096859eb37fb465fcb6e3c925385953da766eb9fa864

Download Submit
C:\Users\Admin\AppData\Local\Temp\jnqLMLXNkr03.bat

Filesize
209B

MD5
d77c9300e5fa0a8ab7d8e1616917f794

SHA1
df8e883bdd696cc9a48a7abe1ae8348fb555230a

SHA256
3cf3dd86f0001c5ccf1e09e8387a2feb0f4ab2ac8780205675b77cfae3e05973

SHA512
89126af128af29ac05e6e3acb1f8b5b6e452a985dbecf69aa0337f5bd9a20d4537498b0d6a215d0ab732f623dc9b578718b65fdb31358d685509841d07e9adf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\m5crGYBoaVOu.bat

Filesize
209B

MD5
161f19013c95132da1e226d220d7b22a

SHA1
bcd8dc05569e2f4083012a13fdb4587b2e8ad941

SHA256
c966ab0019b5ba94a053f75e893f18c3733df9401b4359e19028b0303d7f664a

SHA512
bbaff129d8ed6baf15e4b85b07f543d66c868438de7ff3acc85f218984272206051019aa3c0b42a59e76625133c8e0e92370068b1fb96c522466685ed6896a11

Download Submit
C:\Users\Admin\AppData\Local\Temp\pAMazoJpwpX8.bat

Filesize
209B

MD5
ebe62f6349cebf27da6d8924a37b3d5e

SHA1
d3cfd4bc233c6ebbd887037ac5d4a5f3f07ed276

SHA256
3380c291a6cdf8858ef3cfc1675f081c83b6301b206b7c9ddf343de8f40b88a4

SHA512
9f02375d14d0e3de1a7288668d7566a73c7cda4c6e8b28d2eb9a5fe493a472e7e075972cca99ed3b7aa5c9bc378f5c963fbb1a6b4abf154d68f4006d481be856

Download Submit
C:\Users\Admin\AppData\Local\Temp\pJYGPcdvrP0d.bat

Filesize
209B

MD5
f6607108ce0bc3e8b9b7c6a2a6c5eb63

SHA1
7b3151185a0c659f637081da7f604b640d8e17ac

SHA256
5a9e80886492bbb2bc0bb9fb0445d9a3cf868bce67cf184ee48f05c9a1231056

SHA512
d1cb5fd88e2d004d7ee88bd0b4a71ac6b6ad6979d5aeeb263d6b53c231c3f7981bdb69ad372bcacd06db20f6f540167901b2b6d9bead56f89620dc6d57d396c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\zEu5apTecEHo.bat

Filesize
209B

MD5
b1a0314aca683c370fdef5aa38205b59

SHA1
a2d1abd887d242f6bbd17d8484102b52f187c020

SHA256
47bcb6debd9a7e3651c62b1cc726d0fb7646bb726f5fd49e662015c769967262

SHA512
153eea557b6a7813602e5d192e0ea225cf5952846525104bf4bc024078d2b2ed5f3210b5fff5c182467eb3c35e1a40d2cd57d68417330ff689b62435d06e7b46

Download Submit
C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe

Filesize
3.1MB

MD5
f9fd797dbef56a3900d2fe9d0a6e2e86

SHA1
c5d002cc63bd21fa35fdad428ca4c909f34c4309

SHA256
b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e

SHA512
c4d170855397e2e62d754883b2caab00d14f58787463924141d2077997ee03b25cd752565354c1c4cbace637cf1c053c45a162d0b61b31caa73f1ec70b998ce1

Download Submit
memory/924-65-0x00000000011C0000-0x00000000014E4000-memory.dmp

Filesize
3.1MB

Download
memory/1116-54-0x0000000000080000-0x00000000003A4000-memory.dmp

Filesize
3.1MB

Download
memory/1812-106-0x0000000001270000-0x0000000001594000-memory.dmp

Filesize
3.1MB

Download
memory/1824-0-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

Filesize
4KB

Download
memory/1824-21-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/1824-2-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/1824-1-0x00000000000B0000-0x00000000003D4000-memory.dmp

Filesize
3.1MB

Download
memory/2828-20-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-9-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-10-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/2828-8-0x0000000000FD0000-0x00000000012F4000-memory.dmp

Filesize
3.1MB

Download
memory/3048-158-0x0000000000210000-0x0000000000534000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads