quasar | 841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164

Analysis

max time kernel
143s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe
Size

3.1MB
MD5

1d5b1579c6cf546964a067edf15d75e6
SHA1

1d3e8bb39c7ad10f864efe0adfe8c4028a6fa332
SHA256

841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164
SHA512

6e9d6228928775787a4d25c1a82d36b68bb082c04cb08afb2abe93aff4d54fb25d0e216a5eb7bc11f260bfe3191259f61261556620895b5fc96e76438e354f02
SSDEEP

49152:6v+I22SsaNYfdPBldt698dBcjH7OmumzRfoGdRTHHB72eh2NT:6vz22SsaNYfdPBldt6+dBcjH7Oml

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

suport24.ddns.net:4782

Mutex

b4ad83f8-b608-477d-8395-2274bcaab6d1

Attributes

encryption_key
62EF51244AF3535A6A9C77206CD89D5BFECD7E4E
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 10 IoCs

resource	yara_rule
behavioral1/memory/2104-1-0x00000000011A0000-0x00000000014C4000-memory.dmp	family_quasar
behavioral1/files/0x0016000000018657-6.dat	family_quasar
behavioral1/memory/2580-9-0x0000000001060000-0x0000000001384000-memory.dmp	family_quasar
behavioral1/memory/1400-33-0x0000000000050000-0x0000000000374000-memory.dmp	family_quasar
behavioral1/memory/1992-44-0x0000000000CA0000-0x0000000000FC4000-memory.dmp	family_quasar
behavioral1/memory/1384-66-0x0000000000CE0000-0x0000000001004000-memory.dmp	family_quasar
behavioral1/memory/888-77-0x0000000000D60000-0x0000000001084000-memory.dmp	family_quasar
behavioral1/memory/1580-88-0x00000000012A0000-0x00000000015C4000-memory.dmp	family_quasar
behavioral1/memory/1772-153-0x00000000002B0000-0x00000000005D4000-memory.dmp	family_quasar
behavioral1/memory/1268-164-0x0000000000B60000-0x0000000000E84000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2580	Client.exe
2948	Client.exe
1400	Client.exe
1992	Client.exe
2128	Client.exe
1384	Client.exe
888	Client.exe
1580	Client.exe
1492	Client.exe
1788	Client.exe
1956	Client.exe
2000	Client.exe
1980	Client.exe
1772	Client.exe
1268	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2752	PING.EXE
2452	PING.EXE
1940	PING.EXE
2884	PING.EXE
2552	PING.EXE
2040	PING.EXE
2828	PING.EXE
2932	PING.EXE
348	PING.EXE
2696	PING.EXE
1256	PING.EXE
2328	PING.EXE
2964	PING.EXE
1056	PING.EXE
3016	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2828	PING.EXE
2964	PING.EXE
1940	PING.EXE
1056	PING.EXE
3016	PING.EXE
2752	PING.EXE
2696	PING.EXE
2328	PING.EXE
2552	PING.EXE
2040	PING.EXE
1256	PING.EXE
348	PING.EXE
2452	PING.EXE
2932	PING.EXE
2884	PING.EXE

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe
Token: SeDebugPrivilege	2580	Client.exe
Token: SeDebugPrivilege	2948	Client.exe
Token: SeDebugPrivilege	1400	Client.exe
Token: SeDebugPrivilege	1992	Client.exe
Token: SeDebugPrivilege	2128	Client.exe
Token: SeDebugPrivilege	1384	Client.exe
Token: SeDebugPrivilege	888	Client.exe
Token: SeDebugPrivilege	1580	Client.exe
Token: SeDebugPrivilege	1492	Client.exe
Token: SeDebugPrivilege	1788	Client.exe
Token: SeDebugPrivilege	1956	Client.exe
Token: SeDebugPrivilege	2000	Client.exe
Token: SeDebugPrivilege	1980	Client.exe
Token: SeDebugPrivilege	1772	Client.exe
Token: SeDebugPrivilege	1268	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2580	Client.exe
2948	Client.exe
1400	Client.exe
1992	Client.exe
2128	Client.exe
1384	Client.exe
888	Client.exe
1580	Client.exe
1492	Client.exe
1788	Client.exe
1956	Client.exe
2000	Client.exe
1980	Client.exe
1772	Client.exe
1268	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2580	Client.exe
2948	Client.exe
1400	Client.exe
1992	Client.exe
2128	Client.exe
1384	Client.exe
888	Client.exe
1580	Client.exe
1492	Client.exe
1788	Client.exe
1956	Client.exe
2000	Client.exe
1980	Client.exe
1772	Client.exe
1268	Client.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2580	Client.exe
1492	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2580	2104	841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe	30
PID 2104 wrote to memory of 2580	2104	841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe	30
PID 2104 wrote to memory of 2580	2104	841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe	30
PID 2580 wrote to memory of 2888	2580	Client.exe	32
PID 2580 wrote to memory of 2888	2580	Client.exe	32
PID 2580 wrote to memory of 2888	2580	Client.exe	32
PID 2888 wrote to memory of 3008	2888	cmd.exe	34
PID 2888 wrote to memory of 3008	2888	cmd.exe	34
PID 2888 wrote to memory of 3008	2888	cmd.exe	34
PID 2888 wrote to memory of 2752	2888	cmd.exe	35
PID 2888 wrote to memory of 2752	2888	cmd.exe	35
PID 2888 wrote to memory of 2752	2888	cmd.exe	35
PID 2888 wrote to memory of 2948	2888	cmd.exe	36
PID 2888 wrote to memory of 2948	2888	cmd.exe	36
PID 2888 wrote to memory of 2948	2888	cmd.exe	36
PID 2948 wrote to memory of 2612	2948	Client.exe	37
PID 2948 wrote to memory of 2612	2948	Client.exe	37
PID 2948 wrote to memory of 2612	2948	Client.exe	37
PID 2612 wrote to memory of 2684	2612	cmd.exe	39
PID 2612 wrote to memory of 2684	2612	cmd.exe	39
PID 2612 wrote to memory of 2684	2612	cmd.exe	39
PID 2612 wrote to memory of 2696	2612	cmd.exe	40
PID 2612 wrote to memory of 2696	2612	cmd.exe	40
PID 2612 wrote to memory of 2696	2612	cmd.exe	40
PID 2612 wrote to memory of 1400	2612	cmd.exe	41
PID 2612 wrote to memory of 1400	2612	cmd.exe	41
PID 2612 wrote to memory of 1400	2612	cmd.exe	41
PID 1400 wrote to memory of 1736	1400	Client.exe	42
PID 1400 wrote to memory of 1736	1400	Client.exe	42
PID 1400 wrote to memory of 1736	1400	Client.exe	42
PID 1736 wrote to memory of 1752	1736	cmd.exe	44
PID 1736 wrote to memory of 1752	1736	cmd.exe	44
PID 1736 wrote to memory of 1752	1736	cmd.exe	44
PID 1736 wrote to memory of 2040	1736	cmd.exe	45
PID 1736 wrote to memory of 2040	1736	cmd.exe	45
PID 1736 wrote to memory of 2040	1736	cmd.exe	45
PID 1736 wrote to memory of 1992	1736	cmd.exe	46
PID 1736 wrote to memory of 1992	1736	cmd.exe	46
PID 1736 wrote to memory of 1992	1736	cmd.exe	46
PID 1992 wrote to memory of 2688	1992	Client.exe	47
PID 1992 wrote to memory of 2688	1992	Client.exe	47
PID 1992 wrote to memory of 2688	1992	Client.exe	47
PID 2688 wrote to memory of 2860	2688	cmd.exe	49
PID 2688 wrote to memory of 2860	2688	cmd.exe	49
PID 2688 wrote to memory of 2860	2688	cmd.exe	49
PID 2688 wrote to memory of 2452	2688	cmd.exe	50
PID 2688 wrote to memory of 2452	2688	cmd.exe	50
PID 2688 wrote to memory of 2452	2688	cmd.exe	50
PID 2688 wrote to memory of 2128	2688	cmd.exe	51
PID 2688 wrote to memory of 2128	2688	cmd.exe	51
PID 2688 wrote to memory of 2128	2688	cmd.exe	51
PID 2128 wrote to memory of 440	2128	Client.exe	52
PID 2128 wrote to memory of 440	2128	Client.exe	52
PID 2128 wrote to memory of 440	2128	Client.exe	52
PID 440 wrote to memory of 2428	440	cmd.exe	54
PID 440 wrote to memory of 2428	440	cmd.exe	54
PID 440 wrote to memory of 2428	440	cmd.exe	54
PID 440 wrote to memory of 2828	440	cmd.exe	55
PID 440 wrote to memory of 2828	440	cmd.exe	55
PID 440 wrote to memory of 2828	440	cmd.exe	55
PID 440 wrote to memory of 1384	440	cmd.exe	56
PID 440 wrote to memory of 1384	440	cmd.exe	56
PID 440 wrote to memory of 1384	440	cmd.exe	56
PID 1384 wrote to memory of 1824	1384	Client.exe	57

C:\Users\Admin\AppData\Local\Temp\841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe
"C:\Users\Admin\AppData\Local\Temp\841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\EJCcU6uMmmoE.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3008
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2752
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\I2mUihBYvvRB.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2684
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2696
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\hwgdUzaA0P0a.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1752
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ezczP42hRk0p.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2860
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2452
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1z8iclfe63Ph.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2428
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2828
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1yqgGTl2qKmF.bat" "
        13⤵
        
        PID:1824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2136
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1256
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:888
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FyvpQZBKjSKI.bat" "
        15⤵
        
        PID:2260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:288
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2328
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1580
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\9UJl9SX5EtAX.bat" "
        17⤵
        
        PID:2348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2244
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2884
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1492
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\UEuPvmPgfHr0.bat" "
        19⤵
        
        PID:2364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2872
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2964
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1788
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\uYELN89CoeqN.bat" "
        21⤵
        
        PID:2696
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2200
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1940
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\w7iOJg1d6Jgv.bat" "
        23⤵
        
        PID:2040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1124
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2932
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2000
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NRcERU80v0is.bat" "
        25⤵
        
        PID:1484
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1056
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NDZbpug1rEqN.bat" "
        27⤵
        
        PID:1700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1252
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:348
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1772
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4wyvqVdPOW2w.bat" "
        29⤵
        
        PID:2076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2304
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3016
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1268
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\my5Oqk0dXNEU.bat" "
        31⤵
        
        PID:2148
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:1280
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1yqgGTl2qKmF.bat

Filesize
207B

MD5
71a6318c667f2bb9a8120e518aaa8134

SHA1
417c8ddde9063c9b32d4bbbf2872f0dfeeb6a3b0

SHA256
9d26f55f0a12594b2d65f913418e54b67c393110a6ee300c07f2923738ede827

SHA512
0a855db6d70210aea288868603d3bbaf45d0cf3e394cc4c0d553eb262975173e1277ac1342ce5b2780bc93c7f70509e2e8a389df0b9b59d8bf7ad1a85ba8497c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1z8iclfe63Ph.bat

Filesize
207B

MD5
1c6f0e05f0f9449d8afbdf25ae11b10d

SHA1
c82af23ce85220ec871d56708a3bb32d05421839

SHA256
1480f31785230bd466473d4f26a1459b285dc47bb4a200708af61c7d7bc5c592

SHA512
8daa699332a94e8fec16d57b5bdf006c6e5b463aac17a05353ccbee310d6b009796fa58bb4fe2b0df689911f1e563b80630654d96db1f13c42cf3cc749d0e7b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4wyvqVdPOW2w.bat

Filesize
207B

MD5
5dc0787bf370a22e924b106f75d69af6

SHA1
4004e35d9fc136edb3ce799447b5ead50a1ee233

SHA256
e9ad9bf96903dd015be5eef29cb5ab29673368e32765f3bfe80567985378406d

SHA512
0c85240de990b7be543f4191ef579ca90f4d1e46ada8093bc3537d8619c36a1cbaab9a408166e8dfbde4513ff2e1439ceb078fdb96c179405808852d00e990bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\9UJl9SX5EtAX.bat

Filesize
207B

MD5
55a6fe8f84615c1874473d54c8a31130

SHA1
afafd71a096fbdb99df1ca939ac770702ad15099

SHA256
da8694341a0a6c8eddc05f8527701049fc228ccb7f8fa172f7760ddb09ccd087

SHA512
b48e6c3d063fcb3e3f840f9b422df06e59eeafd3be895d3893dc7eed68a97fb633a001986dfef1997cb3363c7301976291e6597232da72ed5f911227d19531b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\EJCcU6uMmmoE.bat

Filesize
207B

MD5
948e42845ff7b27e3e72ab989e0f739b

SHA1
5cfa38237ad6d62e9311e2dbc09811752b9314a9

SHA256
73406573220dd261b384776aa14768cb07d8791003d66ec43dcf2c034f3a5f76

SHA512
9ccfd9a21370dc4ec426fc183023079b6d4d0daabcd1686ac4c1c87ee8b1cd3ef154f7237b036a41b9339ff1eb838799b4891ab34d64221b6a2f8e0243e7ead2

Download Submit
C:\Users\Admin\AppData\Local\Temp\FyvpQZBKjSKI.bat

Filesize
207B

MD5
ac7997d3adf4cc06537425b9ddf99261

SHA1
96423b93fc9c092b2fa05404563067531f33f153

SHA256
5a74f4a9559f4ac6673ee06acd5cdc21263aabcdfb038973c73544bb88d7aa46

SHA512
da507d06eecae8ca4da2d3327e101fa0ca868a65323fb7bc7d99e037d292471b53d91a98e433b6a6d7a718593ea2cf4f22fbc4420cff24149eaeb4102c629d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\I2mUihBYvvRB.bat

Filesize
207B

MD5
1d89bafd008026839074a56c99a7a610

SHA1
c9364d130f4d28efd00f1c6541c4cf5053d5fff4

SHA256
0fe3fdeefac782219d302ef72f41f13f0c8596a8e66b40d94e8c113f26d612e6

SHA512
718961de0c11e59df9a6c2573f2aa281f44fbc0b83b155cf9ce7807736095dc8e5768bd6eed08b6dd667e52d42673dc9e856bd3cb550a2e00297373b7c607ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\NDZbpug1rEqN.bat

Filesize
207B

MD5
551f945f89772e8d50b88bccfdd045a5

SHA1
a3d3f67ee9d96646b3fca91fe3b6b0af1fd7c2b5

SHA256
5306c972e009a3ea651f8a19bdfdf5eaad621889826b5d28ec265a4e7613c0e4

SHA512
f19b10ffd63d0660e39ec53bc43f3c5c789c69a14ed9acb3e7d50d24ecfa9d76e7d47476d3275157a3a2c5799a465a13999abfb735705dcbdca420482e8233ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\NRcERU80v0is.bat

Filesize
207B

MD5
17081ac18055afd47122c6070ba4793b

SHA1
afcdac285f8804d6687492d09f787c1033ab0497

SHA256
4224dd2184e55c3ac682da0cb0bd49d4ee255ae84220d401b2825ea03eb8910a

SHA512
62838318f6772f36a8c493c7e1387c3113df03eaceffa24de2b17302b59a490110784a207afacb6d250f81ab7f2bec26034937e9a827388f6914312761229886

Download Submit
C:\Users\Admin\AppData\Local\Temp\UEuPvmPgfHr0.bat

Filesize
207B

MD5
478aa1477296a964a988c5fecb479acf

SHA1
66c090ad53878e36bda356080d05c1952b461c7e

SHA256
6d419361786bd9a683a05b030bf66dd5820069fa931926ddd435ada7492cc761

SHA512
2e9bb439c0a7aca71ea7db6c7b7968f2cb5bf5fcaf99b745cc053cc1854a34adf545b31fff973be021a9aeec4da48e565bcaa03e0374f239b6b3e54951a00b45

Download Submit
C:\Users\Admin\AppData\Local\Temp\ezczP42hRk0p.bat

Filesize
207B

MD5
dc960db0e676556a687b0ef78aa055fc

SHA1
bd10d67a20f5065c5d23cbff6eab7ad0af9a3477

SHA256
e58b986637f013167b8afcc483fa1584efde93fed2a6ee716a101946e2580ff5

SHA512
4533cd89522af4cb635bfa3858eb7cdd0dde6a3c480edb1fceec47ec6af746d345f293943539ff68b4f6458af514b6331656bc6a4c26fa5c2f56fafcc113f6df

Download Submit
C:\Users\Admin\AppData\Local\Temp\hwgdUzaA0P0a.bat

Filesize
207B

MD5
260bc6d036843f300325735e616a0c76

SHA1
d6de77f308aa6f9e93114dce839b4b04dbb289f6

SHA256
e7f8b1295757b1a91860d57f3ceb126a1fe1e8abf9e54df8902cb51d49a14fe6

SHA512
db3fd69fbe66bc32baef5a39b05ee1a4a8ddf3ed815be268154fdb9978896d21343d55cee0aae144b2f3e02445ec3197c271fca9dd08fd5fd11b5f890cc88fb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\my5Oqk0dXNEU.bat

Filesize
207B

MD5
c89668df267f2e9f19b79197101b1279

SHA1
7e56feb2fd6d0fd6760aee76da14a6d87bf4dcbe

SHA256
3106ebe8c22bbe1f01c3a0f54f371be738b0bd401cb0dca98c165f9c7e9505dc

SHA512
521655cc51b83f5c6dce93b8e71d17f3a2a5d81ee4c62ac629c26a6ea31d8c7f4f2907ef2d60c59a5b5f92404d040c2bdd8bba8365b263a6e81cd91a5275d6dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\uYELN89CoeqN.bat

Filesize
207B

MD5
712163bfe74feb6dbff071ca7b8839af

SHA1
bcfee845d85b3f67e8d4dfc82a7face6f26acc38

SHA256
2a598d664c746e812c7e707e6cf5c9300be14b71d29099e6ada5020d33603ded

SHA512
8e298cac1b642dbb026501170dc5c1085d300b30b29ddb85bc4634410cb8627ff11eaa4a7eb5ef393c433faba01b9dc52fe4cd9ed766356c127de35ec4bd3d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\w7iOJg1d6Jgv.bat

Filesize
207B

MD5
24fc8c3d9b8f76fb08c022e0d3183f90

SHA1
995199251c9b14d2bda57062160c6ada51a94369

SHA256
9ee89d365272faf1fe08d543dee4e7051b564097b16596abaa67270df146777f

SHA512
3eb1fd39a416c6fcc21916f5e341368952d3d87647816b5d3358888b755d23c71904012538fc450622d18ac0c320122d1ac304c165c1b2f07a2f7380abc41266

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
1d5b1579c6cf546964a067edf15d75e6

SHA1
1d3e8bb39c7ad10f864efe0adfe8c4028a6fa332

SHA256
841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164

SHA512
6e9d6228928775787a4d25c1a82d36b68bb082c04cb08afb2abe93aff4d54fb25d0e216a5eb7bc11f260bfe3191259f61261556620895b5fc96e76438e354f02

Download Submit
memory/888-77-0x0000000000D60000-0x0000000001084000-memory.dmp

Filesize
3.1MB

Download
memory/1268-164-0x0000000000B60000-0x0000000000E84000-memory.dmp

Filesize
3.1MB

Download
memory/1384-66-0x0000000000CE0000-0x0000000001004000-memory.dmp

Filesize
3.1MB

Download
memory/1400-33-0x0000000000050000-0x0000000000374000-memory.dmp

Filesize
3.1MB

Download
memory/1580-88-0x00000000012A0000-0x00000000015C4000-memory.dmp

Filesize
3.1MB

Download
memory/1772-153-0x00000000002B0000-0x00000000005D4000-memory.dmp

Filesize
3.1MB

Download
memory/1992-44-0x0000000000CA0000-0x0000000000FC4000-memory.dmp

Filesize
3.1MB

Download
memory/2104-2-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2104-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/2104-1-0x00000000011A0000-0x00000000014C4000-memory.dmp

Filesize
3.1MB

Download
memory/2104-8-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2580-9-0x0000000001060000-0x0000000001384000-memory.dmp

Filesize
3.1MB

Download
memory/2580-10-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2580-20-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2580-11-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download