quasar | b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/12/2024, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe
Size

3.1MB
MD5

f9fd797dbef56a3900d2fe9d0a6e2e86
SHA1

c5d002cc63bd21fa35fdad428ca4c909f34c4309
SHA256

b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e
SHA512

c4d170855397e2e62d754883b2caab00d14f58787463924141d2077997ee03b25cd752565354c1c4cbace637cf1c053c45a162d0b61b31caa73f1ec70b998ce1
SSDEEP

49152:ivkt62XlaSFNWPjljiFa2RoUYIobRJ6MbR3LoGdNwhTHHB72eh2NT:iv462XlaSFNWPjljiFXRoUYIobRJ6WK

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

biseo-48321.portmap.host:48321

Mutex

cb74f432-50f1-4947-8163-7687a0292fb0

Attributes

encryption_key
D1BBEF3C04D88FE8F97EE2745041632CE9C760EE
install_name
Svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Svchost
subdirectory
Svchost

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4272-1-0x0000000000070000-0x0000000000394000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023c65-6.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Svchost.exe

Executes dropped EXE 15 IoCs

pid	Process
3504	Svchost.exe
2136	Svchost.exe
1968	Svchost.exe
4408	Svchost.exe
4600	Svchost.exe
1432	Svchost.exe
400	Svchost.exe
3908	Svchost.exe
1924	Svchost.exe
1192	Svchost.exe
2316	Svchost.exe
748	Svchost.exe
4968	Svchost.exe
2332	Svchost.exe
4084	Svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3892	PING.EXE
2584	PING.EXE
2000	PING.EXE
4592	PING.EXE
4348	PING.EXE
2328	PING.EXE
3236	PING.EXE
2188	PING.EXE
836	PING.EXE
1144	PING.EXE
1048	PING.EXE
608	PING.EXE
2800	PING.EXE
1576	PING.EXE
2148	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2584	PING.EXE
836	PING.EXE
608	PING.EXE
2000	PING.EXE
2188	PING.EXE
4592	PING.EXE
1048	PING.EXE
2328	PING.EXE
3236	PING.EXE
4348	PING.EXE
2800	PING.EXE
3892	PING.EXE
1144	PING.EXE
1576	PING.EXE
2148	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4692	schtasks.exe
1604	schtasks.exe
4044	schtasks.exe
3432	schtasks.exe
1708	schtasks.exe
3376	schtasks.exe
2732	schtasks.exe
4388	schtasks.exe
2436	schtasks.exe
2112	schtasks.exe
4044	schtasks.exe
812	schtasks.exe
1708	schtasks.exe
4728	schtasks.exe
1364	schtasks.exe
2064	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe
Token: SeDebugPrivilege	3504	Svchost.exe
Token: SeDebugPrivilege	2136	Svchost.exe
Token: SeDebugPrivilege	1968	Svchost.exe
Token: SeDebugPrivilege	4408	Svchost.exe
Token: SeDebugPrivilege	4600	Svchost.exe
Token: SeDebugPrivilege	1432	Svchost.exe
Token: SeDebugPrivilege	400	Svchost.exe
Token: SeDebugPrivilege	3908	Svchost.exe
Token: SeDebugPrivilege	1924	Svchost.exe
Token: SeDebugPrivilege	1192	Svchost.exe
Token: SeDebugPrivilege	2316	Svchost.exe
Token: SeDebugPrivilege	748	Svchost.exe
Token: SeDebugPrivilege	4968	Svchost.exe
Token: SeDebugPrivilege	2332	Svchost.exe
Token: SeDebugPrivilege	4084	Svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 1708	4272	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	83
PID 4272 wrote to memory of 1708	4272	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	83
PID 4272 wrote to memory of 3504	4272	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	85
PID 4272 wrote to memory of 3504	4272	b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe	85
PID 3504 wrote to memory of 2112	3504	Svchost.exe	86
PID 3504 wrote to memory of 2112	3504	Svchost.exe	86
PID 3504 wrote to memory of 3948	3504	Svchost.exe	88
PID 3504 wrote to memory of 3948	3504	Svchost.exe	88
PID 3948 wrote to memory of 1288	3948	cmd.exe	90
PID 3948 wrote to memory of 1288	3948	cmd.exe	90
PID 3948 wrote to memory of 2188	3948	cmd.exe	91
PID 3948 wrote to memory of 2188	3948	cmd.exe	91
PID 3948 wrote to memory of 2136	3948	cmd.exe	101
PID 3948 wrote to memory of 2136	3948	cmd.exe	101
PID 2136 wrote to memory of 4044	2136	Svchost.exe	105
PID 2136 wrote to memory of 4044	2136	Svchost.exe	105
PID 2136 wrote to memory of 1528	2136	Svchost.exe	107
PID 2136 wrote to memory of 1528	2136	Svchost.exe	107
PID 1528 wrote to memory of 4540	1528	cmd.exe	109
PID 1528 wrote to memory of 4540	1528	cmd.exe	109
PID 1528 wrote to memory of 4592	1528	cmd.exe	110
PID 1528 wrote to memory of 4592	1528	cmd.exe	110
PID 1528 wrote to memory of 1968	1528	cmd.exe	111
PID 1528 wrote to memory of 1968	1528	cmd.exe	111
PID 1968 wrote to memory of 3376	1968	Svchost.exe	112
PID 1968 wrote to memory of 3376	1968	Svchost.exe	112
PID 1968 wrote to memory of 3420	1968	Svchost.exe	115
PID 1968 wrote to memory of 3420	1968	Svchost.exe	115
PID 3420 wrote to memory of 1584	3420	cmd.exe	117
PID 3420 wrote to memory of 1584	3420	cmd.exe	117
PID 3420 wrote to memory of 1048	3420	cmd.exe	118
PID 3420 wrote to memory of 1048	3420	cmd.exe	118
PID 3420 wrote to memory of 4408	3420	cmd.exe	122
PID 3420 wrote to memory of 4408	3420	cmd.exe	122
PID 4408 wrote to memory of 2064	4408	Svchost.exe	124
PID 4408 wrote to memory of 2064	4408	Svchost.exe	124
PID 4408 wrote to memory of 3048	4408	Svchost.exe	126
PID 4408 wrote to memory of 3048	4408	Svchost.exe	126
PID 3048 wrote to memory of 2984	3048	cmd.exe	129
PID 3048 wrote to memory of 2984	3048	cmd.exe	129
PID 3048 wrote to memory of 4348	3048	cmd.exe	130
PID 3048 wrote to memory of 4348	3048	cmd.exe	130
PID 3048 wrote to memory of 4600	3048	cmd.exe	132
PID 3048 wrote to memory of 4600	3048	cmd.exe	132
PID 4600 wrote to memory of 4692	4600	Svchost.exe	133
PID 4600 wrote to memory of 4692	4600	Svchost.exe	133
PID 4600 wrote to memory of 316	4600	Svchost.exe	136
PID 4600 wrote to memory of 316	4600	Svchost.exe	136
PID 316 wrote to memory of 2756	316	cmd.exe	138
PID 316 wrote to memory of 2756	316	cmd.exe	138
PID 316 wrote to memory of 2328	316	cmd.exe	139
PID 316 wrote to memory of 2328	316	cmd.exe	139
PID 316 wrote to memory of 1432	316	cmd.exe	141
PID 316 wrote to memory of 1432	316	cmd.exe	141
PID 1432 wrote to memory of 4044	1432	Svchost.exe	142
PID 1432 wrote to memory of 4044	1432	Svchost.exe	142
PID 1432 wrote to memory of 4540	1432	Svchost.exe	145
PID 1432 wrote to memory of 4540	1432	Svchost.exe	145
PID 4540 wrote to memory of 1544	4540	cmd.exe	147
PID 4540 wrote to memory of 1544	4540	cmd.exe	147
PID 4540 wrote to memory of 3236	4540	cmd.exe	148
PID 4540 wrote to memory of 3236	4540	cmd.exe	148
PID 4540 wrote to memory of 400	4540	cmd.exe	150
PID 4540 wrote to memory of 400	4540	cmd.exe	150

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe
"C:\Users\Admin\AppData\Local\Temp\b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1708
- C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
  "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QMc4qQI7mnnc.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1288
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2188
  - - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
      "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4044
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QnzdJhCaez0x.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1528
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4540
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4592
      - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EM2VPc7COoV5.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1584
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1048
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W9sdA90Fn3Gn.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2984
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4348
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KQRSpZQWblwt.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2756
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2328
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eERH0JyQohTg.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3236
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:400
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DvFL5HVLA6gL.bat" "
        15⤵
        
        PID:2104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2432
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3892
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3908
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKUQfWHkTfmZ.bat" "
        17⤵
        
        PID:2308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3096
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2800
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1924
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9RKePmqJOozG.bat" "
        19⤵
        
        PID:4060
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3872
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2584
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1192
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CLD7NyAFOT3o.bat" "
        21⤵
        
        PID:3804
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:396
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2000
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AAIKWICZRdet.bat" "
        23⤵
        
        PID:4396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2820
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:836
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:748
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A4IvINLGzrIp.bat" "
        25⤵
        
        PID:2040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1144
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RBEoSQKDmVAc.bat" "
        27⤵
        
        PID:4976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:888
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1576
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2332
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qIEaKM72T64w.bat" "
        29⤵
        
        PID:1288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2148
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TW0n3E8rDhnW.bat" "
        31⤵
        
        PID:2756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:1560
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Svchost.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\9RKePmqJOozG.bat

Filesize
209B

MD5
b005bdc83a82bd07a76b3834c04f7670

SHA1
9e5ed56bd918855bd52a794d6e54624c180b3252

SHA256
240cf5a70287dbdd3eee043e4921ee99d5e5e6098c20363e7a281da2f4246490

SHA512
fa66c7c8ee7836a6cba3914db14a4bd50c4e43d92045df5b5750fabee8dfcf5c1d7ee06426f29b61958a6451e537633e3b32dbb260f200cb1676dcf3b0e77085

Download Submit
C:\Users\Admin\AppData\Local\Temp\A4IvINLGzrIp.bat

Filesize
209B

MD5
2060db547ad2afa757158facb0c241f6

SHA1
c947a9bd13675f37becd0c61c85c537f910f5b41

SHA256
aff560592c4efb9d015afb3c2cabab84cf0416d8f668fbe844e6726a7fe14e43

SHA512
7a22e5f7e6e202fa725ee73b6bee2141a3123eb99c2888f18a255f9ab0756976053d9eb2db8051e0b6b862275f82f13c6ce7df53a29b627a5f7b6c148b55f3ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\AAIKWICZRdet.bat

Filesize
209B

MD5
419510b6058ca1ec5d463c397495ca86

SHA1
6218bb300fa2ea1891b981399f3de613e4e03389

SHA256
e559d95954297f5a74e14f32fd17ac71edabd8212a872d8f806ad791da618f4d

SHA512
2ee2613900185ee3dddfb2ac78adf08a0337e423714c1d93666b00a1f377242778f9a4bfb66b24feddbf2c52ef5d5deee8954598d59562eb3ec6d70e78134db2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CLD7NyAFOT3o.bat

Filesize
209B

MD5
42aaaeee56afe800793d13adb5c9db45

SHA1
dc6d954fceecbce30fbdbf8a4a033e3350a4ca4c

SHA256
e8c7974a02c1095953fc7e255b6b7ce1a411d28a44d246c231e1756dcc663010

SHA512
64082c49e028a72fd95b0c4d5d1addf065913f6c5f25a0107f886caac5d9458fd13e640c2bef98af618782c3612c5ba1e58fded41567574b00f80658f6d49468

Download Submit
C:\Users\Admin\AppData\Local\Temp\DvFL5HVLA6gL.bat

Filesize
209B

MD5
4523c8f053305c96301e4c703449fee9

SHA1
dbe88cfe2f29ede5c271a573057be10c8f346234

SHA256
cb2d0543c710b9c18aae5da7156c71ba34f66898254051122d884e1ba69ec9c3

SHA512
c69bd8d734cb1a8232514a5097cf6efd2a1d97b8c11ecd7cadf7a0d8be7c7de46a12912351cf2a6c4d0c05e9f14445faaf255fdab54bb8d6043606d3b8a83b60

Download Submit
C:\Users\Admin\AppData\Local\Temp\EM2VPc7COoV5.bat

Filesize
209B

MD5
430384843cee2980f87c60119f9230c7

SHA1
b4cb38b1de32890cea29780e236c9bd00a9a7ecd

SHA256
2646ea46a4a1f4a1d79dedee85fac2c95e3ecf860b53208539a81d9d201083c1

SHA512
77e9ead5db7e81897039467944ba0dd66a3a9611120bb3c3965fda5e778f05d94bf5c95d6845e710794fdc65d94462a8b44ce1280e4f08f774037959066af9b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\KQRSpZQWblwt.bat

Filesize
209B

MD5
182301bd6907b24d7a4be870453557df

SHA1
85794bbc8a719dbe6d969e1c901ae464f67e0ab7

SHA256
639450dee7fcb6c8f008a78041dcba71751b01bb2e7f73db910c8f9641378fb1

SHA512
fd4ed3775433a616e498dcb8e84d7aab2ccdaa49367e25c3a845778712bec94492baa67e405e529b7bcec4c3a85a39b37f02253d6e9ec4306b44cffbbbc73157

Download Submit
C:\Users\Admin\AppData\Local\Temp\PKUQfWHkTfmZ.bat

Filesize
209B

MD5
9b66d30d215986271446e5c7388a813a

SHA1
0f7f0fe668009b9622f9d82732ae56a2201c5e39

SHA256
dd8581d838137beefff566782fa30d9c5de77033dd9cdc964a8e66b825b13db1

SHA512
a103cf2d81991bc01eb3e184476fa93ad880c756f2dbb36a2cd8cc7a9c7a19fad38426ca6533733c84d8286bfef9c9cdc0bdb6f1b8d422cd155cca3ce026ee7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\QMc4qQI7mnnc.bat

Filesize
209B

MD5
c2a659adfaa53875be9fb5d4ada7c93b

SHA1
f71b65653c52693f68b900bb48171868433dd2ec

SHA256
3c0ee17db84316335037af2a05ac925a09ba74c03a09985cf9199bc7ed273381

SHA512
418d72c84a0a501b97f74a3143f3d24dfc8e1c4df6e0abde383471cb965179347c40057606b98c55fb62e39ac7310a4fad504f62de0bc8f61ddae9706713e35f

Download Submit
C:\Users\Admin\AppData\Local\Temp\QnzdJhCaez0x.bat

Filesize
209B

MD5
9052968142ab1ba34701c6289f5cde39

SHA1
2123f1f99699f346961071123d82f0b20fb17f42

SHA256
61aed40fabe3f5ba7c3c14eed4d3cbf2e4f69313ff8b9ded8c07da0f805d0e35

SHA512
cb49b7430866940bd9cb195ccb85e3a88154eaa055effb2a4b8223658ae1f508f74ab3ecfd7fcb26956c4c31ad1b5dcb76a5ce00b40b7b1838c64a211992d6e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RBEoSQKDmVAc.bat

Filesize
209B

MD5
13d7d16186d30293a4fefefab7b5694f

SHA1
43fd8a17ecfd85abf598992fd70fad9e039fe1e7

SHA256
3d1fbcf7b103d3f6fb1bc8879269330209ebf9e40102a4e96bfce0ebd5b8d210

SHA512
54d33fb2650411e03a979703711e142e1e7690c701e25500c07828cfddca03c5c3862d5c8bdab3b9e4b01ac5a945fedeeb40fa19b7b661a0368dcf7805b7d083

Download Submit
C:\Users\Admin\AppData\Local\Temp\TW0n3E8rDhnW.bat

Filesize
209B

MD5
976c30eca386842fb95492d5c9bdd10e

SHA1
a8a6ff6e2a697087746e748e3fbbaaa96655aaaf

SHA256
0cd4be00d65e068f9ccaa1c6276d8be333ec0e7fd0e0041218fccdad73f25ac1

SHA512
905cc638fb5c613727246ee0ec119989a3a5a4bf2c0325ffe9858ab25aaf6c5302cf259a6f19a48aea9a44545f30f2a787da74af252fd341b803895668f22204

Download Submit
C:\Users\Admin\AppData\Local\Temp\W9sdA90Fn3Gn.bat

Filesize
209B

MD5
327177c27eaaa925e86994583fddaf40

SHA1
fd6c8049e7080208f4ec3002df98ed4122755e5f

SHA256
2645feb74e18abd9fa66b5246b995535256b2f46101021f5b1a00384eb6a0254

SHA512
7492a9b4286f18a3121f3af29b0225672a2133575909173e52ffa6ff805115c5d7d5800c1ef8c5553411b14b3561fba237011f63fecd995fbf8811ce000735d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\eERH0JyQohTg.bat

Filesize
209B

MD5
6280e0b021a60d849b153cd38aaf2f2b

SHA1
6dc66a56c326c193280a099372765b894a12a0d7

SHA256
0b74823dd7ca7c0fb37b566f8426a3736c3592f4be9b53d16bde5da861bc999b

SHA512
fd911729179a4bdceec15d5545fd18b930a30d53838afc5a6a1f7ee30061711cee1cf3470b2b5ff9404668c0d79e4f8565b5f54a9d9904d750e611ff13662de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\qIEaKM72T64w.bat

Filesize
209B

MD5
97bdd4c1a127493c46db5a33561a07e9

SHA1
c8de0067aa8c6283a209a11c2602f3e0af84b656

SHA256
aeb6823da4baa2ea5ab66bb9e6553541080977b5eacf7efc44a7805070c84ea0

SHA512
17a014c8b8b9718191ae0aceff7185302ff8ac29f9cc5f91a5748e3de5af47918dad0a68e8ecbc261d2b99b9c0ec9b4ce9f81826c9ecc6800637ac5214727cdb

Download Submit
C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe

Filesize
3.1MB

MD5
f9fd797dbef56a3900d2fe9d0a6e2e86

SHA1
c5d002cc63bd21fa35fdad428ca4c909f34c4309

SHA256
b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e

SHA512
c4d170855397e2e62d754883b2caab00d14f58787463924141d2077997ee03b25cd752565354c1c4cbace637cf1c053c45a162d0b61b31caa73f1ec70b998ce1

Download Submit
memory/3504-12-0x000000001D0C0000-0x000000001D172000-memory.dmp

Filesize
712KB

Download
memory/3504-10-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/3504-11-0x000000001BF00000-0x000000001BF50000-memory.dmp

Filesize
320KB

Download
memory/3504-17-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/4272-0-0x00007FFBC48C3000-0x00007FFBC48C5000-memory.dmp

Filesize
8KB

Download
memory/4272-9-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/4272-2-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/4272-1-0x0000000000070000-0x0000000000394000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads