quasar | 841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe
Size

3.1MB
MD5

1d5b1579c6cf546964a067edf15d75e6
SHA1

1d3e8bb39c7ad10f864efe0adfe8c4028a6fa332
SHA256

841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164
SHA512

6e9d6228928775787a4d25c1a82d36b68bb082c04cb08afb2abe93aff4d54fb25d0e216a5eb7bc11f260bfe3191259f61261556620895b5fc96e76438e354f02
SSDEEP

49152:6v+I22SsaNYfdPBldt698dBcjH7OmumzRfoGdRTHHB72eh2NT:6vz22SsaNYfdPBldt6+dBcjH7Oml

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

suport24.ddns.net:4782

Mutex

b4ad83f8-b608-477d-8395-2274bcaab6d1

Attributes

encryption_key
62EF51244AF3535A6A9C77206CD89D5BFECD7E4E
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 12 IoCs

resource	yara_rule
behavioral1/memory/2204-1-0x0000000000920000-0x0000000000C44000-memory.dmp	family_quasar
behavioral1/files/0x000800000001686c-6.dat	family_quasar
behavioral1/memory/608-9-0x0000000001300000-0x0000000001624000-memory.dmp	family_quasar
behavioral1/memory/2660-23-0x0000000000340000-0x0000000000664000-memory.dmp	family_quasar
behavioral1/memory/756-34-0x0000000000C60000-0x0000000000F84000-memory.dmp	family_quasar
behavioral1/memory/2500-45-0x0000000000D40000-0x0000000001064000-memory.dmp	family_quasar
behavioral1/memory/2832-56-0x0000000000050000-0x0000000000374000-memory.dmp	family_quasar
behavioral1/memory/1176-68-0x0000000000120000-0x0000000000444000-memory.dmp	family_quasar
behavioral1/memory/1716-79-0x00000000000C0000-0x00000000003E4000-memory.dmp	family_quasar
behavioral1/memory/1896-90-0x0000000000F70000-0x0000000001294000-memory.dmp	family_quasar
behavioral1/memory/644-132-0x00000000003C0000-0x00000000006E4000-memory.dmp	family_quasar
behavioral1/memory/2644-143-0x0000000001180000-0x00000000014A4000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
608	Client.exe
2660	Client.exe
756	Client.exe
2500	Client.exe
2832	Client.exe
1176	Client.exe
1716	Client.exe
1896	Client.exe
3068	Client.exe
2720	Client.exe
2452	Client.exe
644	Client.exe
2644	Client.exe
1288	Client.exe
3036	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1980	PING.EXE
1420	PING.EXE
2852	PING.EXE
2460	PING.EXE
1848	PING.EXE
1660	PING.EXE
2576	PING.EXE
2508	PING.EXE
2784	PING.EXE
2576	PING.EXE
820	PING.EXE
1920	PING.EXE
1728	PING.EXE
2876	PING.EXE
1792	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
1920	PING.EXE
1980	PING.EXE
2852	PING.EXE
1848	PING.EXE
1660	PING.EXE
1792	PING.EXE
2508	PING.EXE
2784	PING.EXE
2576	PING.EXE
1420	PING.EXE
1728	PING.EXE
2576	PING.EXE
2460	PING.EXE
820	PING.EXE
2876	PING.EXE

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe
Token: SeDebugPrivilege	608	Client.exe
Token: SeDebugPrivilege	2660	Client.exe
Token: SeDebugPrivilege	756	Client.exe
Token: SeDebugPrivilege	2500	Client.exe
Token: SeDebugPrivilege	2832	Client.exe
Token: SeDebugPrivilege	1176	Client.exe
Token: SeDebugPrivilege	1716	Client.exe
Token: SeDebugPrivilege	1896	Client.exe
Token: SeDebugPrivilege	3068	Client.exe
Token: SeDebugPrivilege	2720	Client.exe
Token: SeDebugPrivilege	2452	Client.exe
Token: SeDebugPrivilege	644	Client.exe
Token: SeDebugPrivilege	2644	Client.exe
Token: SeDebugPrivilege	1288	Client.exe
Token: SeDebugPrivilege	3036	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
608	Client.exe
2660	Client.exe
756	Client.exe
2500	Client.exe
2832	Client.exe
1176	Client.exe
1716	Client.exe
1896	Client.exe
3068	Client.exe
2720	Client.exe
2452	Client.exe
644	Client.exe
2644	Client.exe
1288	Client.exe
3036	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
608	Client.exe
2660	Client.exe
756	Client.exe
2500	Client.exe
2832	Client.exe
1176	Client.exe
1716	Client.exe
1896	Client.exe
3068	Client.exe
2720	Client.exe
2452	Client.exe
644	Client.exe
2644	Client.exe
1288	Client.exe
3036	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
608	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 608	2204	841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe	31
PID 2204 wrote to memory of 608	2204	841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe	31
PID 2204 wrote to memory of 608	2204	841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe	31
PID 608 wrote to memory of 2648	608	Client.exe	32
PID 608 wrote to memory of 2648	608	Client.exe	32
PID 608 wrote to memory of 2648	608	Client.exe	32
PID 2648 wrote to memory of 2780	2648	cmd.exe	34
PID 2648 wrote to memory of 2780	2648	cmd.exe	34
PID 2648 wrote to memory of 2780	2648	cmd.exe	34
PID 2648 wrote to memory of 2876	2648	cmd.exe	35
PID 2648 wrote to memory of 2876	2648	cmd.exe	35
PID 2648 wrote to memory of 2876	2648	cmd.exe	35
PID 2648 wrote to memory of 2660	2648	cmd.exe	36
PID 2648 wrote to memory of 2660	2648	cmd.exe	36
PID 2648 wrote to memory of 2660	2648	cmd.exe	36
PID 2660 wrote to memory of 1780	2660	Client.exe	37
PID 2660 wrote to memory of 1780	2660	Client.exe	37
PID 2660 wrote to memory of 1780	2660	Client.exe	37
PID 1780 wrote to memory of 2564	1780	cmd.exe	39
PID 1780 wrote to memory of 2564	1780	cmd.exe	39
PID 1780 wrote to memory of 2564	1780	cmd.exe	39
PID 1780 wrote to memory of 2576	1780	cmd.exe	40
PID 1780 wrote to memory of 2576	1780	cmd.exe	40
PID 1780 wrote to memory of 2576	1780	cmd.exe	40
PID 1780 wrote to memory of 756	1780	cmd.exe	41
PID 1780 wrote to memory of 756	1780	cmd.exe	41
PID 1780 wrote to memory of 756	1780	cmd.exe	41
PID 756 wrote to memory of 1448	756	Client.exe	42
PID 756 wrote to memory of 1448	756	Client.exe	42
PID 756 wrote to memory of 1448	756	Client.exe	42
PID 1448 wrote to memory of 2328	1448	cmd.exe	44
PID 1448 wrote to memory of 2328	1448	cmd.exe	44
PID 1448 wrote to memory of 2328	1448	cmd.exe	44
PID 1448 wrote to memory of 2508	1448	cmd.exe	45
PID 1448 wrote to memory of 2508	1448	cmd.exe	45
PID 1448 wrote to memory of 2508	1448	cmd.exe	45
PID 1448 wrote to memory of 2500	1448	cmd.exe	46
PID 1448 wrote to memory of 2500	1448	cmd.exe	46
PID 1448 wrote to memory of 2500	1448	cmd.exe	46
PID 2500 wrote to memory of 1748	2500	Client.exe	47
PID 2500 wrote to memory of 1748	2500	Client.exe	47
PID 2500 wrote to memory of 1748	2500	Client.exe	47
PID 1748 wrote to memory of 1852	1748	cmd.exe	49
PID 1748 wrote to memory of 1852	1748	cmd.exe	49
PID 1748 wrote to memory of 1852	1748	cmd.exe	49
PID 1748 wrote to memory of 1920	1748	cmd.exe	50
PID 1748 wrote to memory of 1920	1748	cmd.exe	50
PID 1748 wrote to memory of 1920	1748	cmd.exe	50
PID 1748 wrote to memory of 2832	1748	cmd.exe	51
PID 1748 wrote to memory of 2832	1748	cmd.exe	51
PID 1748 wrote to memory of 2832	1748	cmd.exe	51
PID 2832 wrote to memory of 1944	2832	Client.exe	52
PID 2832 wrote to memory of 1944	2832	Client.exe	52
PID 2832 wrote to memory of 1944	2832	Client.exe	52
PID 1944 wrote to memory of 2892	1944	cmd.exe	54
PID 1944 wrote to memory of 2892	1944	cmd.exe	54
PID 1944 wrote to memory of 2892	1944	cmd.exe	54
PID 1944 wrote to memory of 1728	1944	cmd.exe	55
PID 1944 wrote to memory of 1728	1944	cmd.exe	55
PID 1944 wrote to memory of 1728	1944	cmd.exe	55
PID 1944 wrote to memory of 1176	1944	cmd.exe	56
PID 1944 wrote to memory of 1176	1944	cmd.exe	56
PID 1944 wrote to memory of 1176	1944	cmd.exe	56
PID 1176 wrote to memory of 1440	1176	Client.exe	57

C:\Users\Admin\AppData\Local\Temp\841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe
"C:\Users\Admin\AppData\Local\Temp\841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:608
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\2XjussMGNtRq.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2780
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2876
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\dDb12YSkVbf1.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1780
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2564
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2576
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:756
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\GfiNfja67nnQ.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2508
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Qmw2oKKAmpYG.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1852
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1920
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\9dQMlR47J9y5.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1728
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1176
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QyS49b79dvFe.bat" "
        13⤵
        
        PID:1440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1592
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1980
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1716
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\M022yADmkRAH.bat" "
        15⤵
        
        PID:2116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2012
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1420
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1896
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QNOb3p7iT9Ik.bat" "
        17⤵
        
        PID:596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2196
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2852
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3068
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QQREmBd7ZokT.bat" "
        19⤵
        
        PID:2864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2860
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2784
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2720
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\r6ayfMXRT6qm.bat" "
        21⤵
        
        PID:2932
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2712
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2576
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2452
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\LCHiemHKTU5Z.bat" "
        23⤵
        
        PID:2032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1272
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2460
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:644
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\UoNWHuw6TaTm.bat" "
        25⤵
        
        PID:1620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1848
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2644
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\xRl1tNmQYNli.bat" "
        27⤵
        
        PID:1728
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1660
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1288
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Y5b6vezdKi2G.bat" "
        29⤵
        
        PID:1860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1428
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:820
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3036
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zzDtjGncXtXC.bat" "
        31⤵
        
        PID:2172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:1536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2XjussMGNtRq.bat

Filesize
207B

MD5
2a707a7a98bb1e0121b36e61d29abcbe

SHA1
ba63e8d3d1e6cc8f7f99212586d5d707596a1428

SHA256
847cde88610b94f68433e6d7b24bc5221fab34a0187ba0302fb23e6a5a1e5a82

SHA512
9ec10f6fc5b0b7199a2e261eaaa1e43e5251d398132d29636e1069b150d84f7e6761516efd4a685fbc54cb3bf73581769f64c8e7f3667c80d2bbf857668ae036

Download Submit
C:\Users\Admin\AppData\Local\Temp\9dQMlR47J9y5.bat

Filesize
207B

MD5
b9ca8504b69dae3b5b6395a2454cff4b

SHA1
4caf7f66655448f14593d57e5713dd1443d3114a

SHA256
e2efeb9d7f35a76e939d04e6fde1014a35016885414e0233dcdb353fe31f7bcd

SHA512
76d2f1ec1afa7656fc82dbdc1112c482d052e5f5d73767deb7752b843bd5e5efa780bc0b44b93dd269a3de3809a1eb79312b6b41e05d7e15026404cd483dd784

Download Submit
C:\Users\Admin\AppData\Local\Temp\GfiNfja67nnQ.bat

Filesize
207B

MD5
516c9a51d42b146d1f67fe676525ec57

SHA1
1b188f1d6b0d36d893b66fdf4db04a6bee786c23

SHA256
389673e687bdbb38df35e06aaf0fe632b29629d5ff3b35466caa7a74cefe8f92

SHA512
1358c0d456467133a0cfe414a8d44538528c0aab7413ce09825cade2eaa047d1689d1043a670e01b8c0eaa2eb6fc80687b0e0dbfa873ed8fe55b30c9ab26ac4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\LCHiemHKTU5Z.bat

Filesize
207B

MD5
31cf52eb7237c58d150417e0d6a641a3

SHA1
7d5d8778d1bb4d87a6eb0ab695d2b29929982bc5

SHA256
cf45c37c093961db3413f6f68e7c5d15f4fff911f9def4b0ff35e0f60fd915b2

SHA512
03eabb64a952799a74c2ea07ef54454f7722284a6319c6063b7ff9b71ebb1305909bc1f235cbc41cd22f0614d33b47d234b4c8c30c64cdf81e9eae13a3360264

Download Submit
C:\Users\Admin\AppData\Local\Temp\M022yADmkRAH.bat

Filesize
207B

MD5
0516b0c4ad51cfda234640b28c12fdd4

SHA1
4521456f1799e50c42e6b3d4fc27b4bea830f73b

SHA256
682b5bbee0465892dbf3ce2ccb73bfc97650c6248a60ad84eeb09245dfb86e12

SHA512
c6460d712d0b16c14d53fde8a0819130db9fc669eec5cd4d1fedfbd431e1f6b812e569c5b3f1186d511e1075843bcf45d7564774c9fd50d607f6a9f492a540f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\QNOb3p7iT9Ik.bat

Filesize
207B

MD5
f1138fa1a49bc9ffd6aa53b829917df4

SHA1
73cafbaea18dfc9e0db9e27e4c2b50cea9cac6fd

SHA256
2a0c859312ddda209b9a03230d6d7917d9bc9cddd28bac695fe7e45a6f7a827b

SHA512
81159b794bc472072111e4407ce817babea613c1acf084d76188a5942664fdda17e6d09742caf3284c0a0191fcc84153db353d05ee91936a33ffa8d55bf2ba3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\QQREmBd7ZokT.bat

Filesize
207B

MD5
a764d4c34416c814c1968f6cf60b5b53

SHA1
29476b7d283d75d14abd87e58fa437d1d141afe0

SHA256
60d060474b5190539fe7d0ce0b04a6f970a0a04aec0f91300815f961e6ef871b

SHA512
163b42733658d3de4e6d97a01465d0fd53ae8f7117ecd6ba2567cd5d634a4c84b840f473f58fef93560d46fd059adf141f55a9e96ec0510c0d5fc2661c31515a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qmw2oKKAmpYG.bat

Filesize
207B

MD5
278b53d4e211221b6b76a70276729319

SHA1
b58dec5d4e06cf33a5632718e1815b2c8217753a

SHA256
67da0412702d26c6fb4400b98bab2565248cc82902dfb97d0ce23b357c6c7095

SHA512
cc7e6a6e51e9a2e88d68bf7da7fa69b6072b587cef18138c2c48fba22e757c96920f2f3f6f8fbca3e2646abbe911b822ca6cc1d16f53afc28c3dad086a872a68

Download Submit
C:\Users\Admin\AppData\Local\Temp\QyS49b79dvFe.bat

Filesize
207B

MD5
6632bc6f356b5c2b04594352a4b6f3e4

SHA1
548e0cc74bfe9f26e50c430870d69e11d2c1525e

SHA256
38d2ab66d34c928f235e984dbde29c771d55f315bb9a5de62fb13ed5f0881b0e

SHA512
f85974c19677673db56187d9972983d43b6d2547236f67bf5c715ffc0e1e99895d22e706b9098fae9de4c9663b2ac325baca2b1d225e2b4f097a8c9d513e88b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\UoNWHuw6TaTm.bat

Filesize
207B

MD5
2247e01f2d0609637e5beb43ec3df154

SHA1
2f75bce1a82ef1830701ad66736238f9fb350d51

SHA256
19dffdc3f1cc1bd293679004f7639feb5b5966713e17f85f2993ed85cdfdfce4

SHA512
6fd64c42abe8b29826e39cc7863fb97d68f7dfa2e555ae0184434a6bf037c56392ce3288873285478b4ca93d56463abeefd1cb9660b8df5999499d5daa2752f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Y5b6vezdKi2G.bat

Filesize
207B

MD5
00007b64d979ff0cf852c2617f516053

SHA1
c3f2d3435ea8799c1bd89ae865974e8b6610d544

SHA256
6fe4e3b6a05bdda0c6e74c1eb86d8f95105f16b5c49c964daef883981d8885a1

SHA512
3d03cf7c78b0fd02b39aa5f01884f9527eb4d064ab78f2a1bbac3bf3b4c1f4a726f3fd43f1f4747c2e4f08c64016cff212cd10e39d94cfd95e1b0a806c84996d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dDb12YSkVbf1.bat

Filesize
207B

MD5
9dc30db24509c65c6a5f12a4cee65381

SHA1
0d63f1b3df9e500e764725a19e69bb4c0bec17ff

SHA256
3ab0f6a61d2f9986f3e3a52300c3a34338e783e74e18c0e9dacb29016fffdf63

SHA512
e4a42877bea0b10093b399b6be68389e6b1cc7a368636d0f31ca6f15a1acf2a0663c37be781805047081c98f3999741cc85ec18864a236b868c8a295ac7e3b47

Download Submit
C:\Users\Admin\AppData\Local\Temp\r6ayfMXRT6qm.bat

Filesize
207B

MD5
2edaa238dd3394ae39ef38f862867886

SHA1
4e6fabe7ec80897bba71af14c472598eb1503953

SHA256
3ac2013aa1abadff6d3dde1e1b1386bb7881cbbe1f446dee342f67bf2c24a3b3

SHA512
47520ec9384e145a3fb50655df905dcd5cc0a3c28ec1e5faa395d155a0b5536a342d1474d18c7f50346b40c568590e5a8d83f10b9aa1b7a3b649def2606ce2ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\xRl1tNmQYNli.bat

Filesize
207B

MD5
ea528f9b7a2dc58dec5be3c1f15cc76a

SHA1
be3b39fc59561f526e18b009a451b869f72b0433

SHA256
44cd360d9c78cf2a146a9abb0573a44eca99389cd08029a5f9cf8f459024ee47

SHA512
b59f541f2ba6d645f1ed03936dcfeba948ffad07051f462fd11bfdad0a73cd2efa9057dbfcb53f65cd763a42d139af5ef6a1af07e545a272d34ffae406a8575f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zzDtjGncXtXC.bat

Filesize
207B

MD5
169374af6c612190303f906f35940ce9

SHA1
533209fa26b03a8670c9cdc4ce657d8edd78b964

SHA256
78d68589221907df2cf8cd3d9668b036beecdac1cdb95ad6c4463781325589c5

SHA512
c4dc28f4ae9900d006a012320c7e5c8929d9949a4542d4f5b561bb4348731a3291a0b41a9fefdb2ccbc6fed6f7a2733e1c73f46f3291693307ff61b3452201e2

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
1d5b1579c6cf546964a067edf15d75e6

SHA1
1d3e8bb39c7ad10f864efe0adfe8c4028a6fa332

SHA256
841f178c15802a89ad903f05c5148bca7ef49efd9113d636cad35067be4a4164

SHA512
6e9d6228928775787a4d25c1a82d36b68bb082c04cb08afb2abe93aff4d54fb25d0e216a5eb7bc11f260bfe3191259f61261556620895b5fc96e76438e354f02

Download Submit
memory/608-8-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/608-11-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/608-9-0x0000000001300000-0x0000000001624000-memory.dmp

Filesize
3.1MB

Download
memory/608-20-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/644-132-0x00000000003C0000-0x00000000006E4000-memory.dmp

Filesize
3.1MB

Download
memory/756-34-0x0000000000C60000-0x0000000000F84000-memory.dmp

Filesize
3.1MB

Download
memory/1176-68-0x0000000000120000-0x0000000000444000-memory.dmp

Filesize
3.1MB

Download
memory/1716-79-0x00000000000C0000-0x00000000003E4000-memory.dmp

Filesize
3.1MB

Download
memory/1896-90-0x0000000000F70000-0x0000000001294000-memory.dmp

Filesize
3.1MB

Download
memory/2204-2-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/2204-1-0x0000000000920000-0x0000000000C44000-memory.dmp

Filesize
3.1MB

Download
memory/2204-10-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/2204-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmp

Filesize
4KB

Download
memory/2500-45-0x0000000000D40000-0x0000000001064000-memory.dmp

Filesize
3.1MB

Download
memory/2644-143-0x0000000001180000-0x00000000014A4000-memory.dmp

Filesize
3.1MB

Download
memory/2660-23-0x0000000000340000-0x0000000000664000-memory.dmp

Filesize
3.1MB

Download
memory/2832-56-0x0000000000050000-0x0000000000374000-memory.dmp

Filesize
3.1MB

Download