quasar | adc4c01dc28064c32c6b451a9c7d82001b21c9f58022a78dfbcbd8a36291aee1

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 06:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

218b79ebe7679fa1beab775ca7e49c4b
SHA1

2d08ac223c07b13e93e6f8e2d73d3b7b08f4b54f
SHA256

adc4c01dc28064c32c6b451a9c7d82001b21c9f58022a78dfbcbd8a36291aee1
SHA512

8e92fef65245e770a66d849c14bc344ff7231c68cb5e31e2ad6c5f1a7bfa85d4db89e426a2fdb22d9fead1563c9352693cbbeaecfe3252ad777ca9e035f15002
SSDEEP

49152:3vbI22SsaNYfdPBldt698dBcjHcxDE/glk/JxjoGdeTHHB72eh2NT:3vk22SsaNYfdPBldt6+dBcjHcxKF

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

127.0.0.0.1:4782

Mutex

89f58ee5-7af9-42de-843f-2a331a641e3f

Attributes

encryption_key
CD4F349DEB46AEE10C2FE886E5B2BD7A766723CE
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2808-1-0x0000000000D90000-0x00000000010B4000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Client-built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3280	PING.EXE
4212	PING.EXE
2660	PING.EXE
4824	PING.EXE
392	PING.EXE
4172	PING.EXE
904	PING.EXE
4684	PING.EXE
2908	PING.EXE
3544	PING.EXE
4680	PING.EXE
3560	PING.EXE
1168	PING.EXE
1472	PING.EXE
3052	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
1168	PING.EXE
904	PING.EXE
4212	PING.EXE
4824	PING.EXE
3052	PING.EXE
392	PING.EXE
3280	PING.EXE
1472	PING.EXE
4172	PING.EXE
2660	PING.EXE
3560	PING.EXE
4680	PING.EXE
4684	PING.EXE
2908	PING.EXE
3544	PING.EXE

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	Client-built.exe
Token: SeDebugPrivilege	1844	Client-built.exe
Token: SeDebugPrivilege	1688	Client-built.exe
Token: SeDebugPrivilege	4364	Client-built.exe
Token: SeDebugPrivilege	4580	Client-built.exe
Token: SeDebugPrivilege	1652	Client-built.exe
Token: SeDebugPrivilege	4548	Client-built.exe
Token: SeDebugPrivilege	4008	Client-built.exe
Token: SeDebugPrivilege	4544	Client-built.exe
Token: SeDebugPrivilege	2916	Client-built.exe
Token: SeDebugPrivilege	2220	Client-built.exe
Token: SeDebugPrivilege	3576	Client-built.exe
Token: SeDebugPrivilege	3856	Client-built.exe
Token: SeDebugPrivilege	5108	Client-built.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
2808	Client-built.exe
1844	Client-built.exe
1688	Client-built.exe
4364	Client-built.exe
4580	Client-built.exe
1652	Client-built.exe
4548	Client-built.exe
4008	Client-built.exe
4544	Client-built.exe
2916	Client-built.exe
2220	Client-built.exe
3576	Client-built.exe
3856	Client-built.exe
5108	Client-built.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2808	Client-built.exe
1844	Client-built.exe
1688	Client-built.exe
4364	Client-built.exe
4580	Client-built.exe
1652	Client-built.exe
4548	Client-built.exe
4008	Client-built.exe
4544	Client-built.exe
2916	Client-built.exe
2220	Client-built.exe
3576	Client-built.exe
3856	Client-built.exe
5108	Client-built.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 8	2808	Client-built.exe	83
PID 2808 wrote to memory of 8	2808	Client-built.exe	83
PID 8 wrote to memory of 4284	8	cmd.exe	85
PID 8 wrote to memory of 4284	8	cmd.exe	85
PID 8 wrote to memory of 1168	8	cmd.exe	86
PID 8 wrote to memory of 1168	8	cmd.exe	86
PID 8 wrote to memory of 1844	8	cmd.exe	88
PID 8 wrote to memory of 1844	8	cmd.exe	88
PID 1844 wrote to memory of 4860	1844	Client-built.exe	92
PID 1844 wrote to memory of 4860	1844	Client-built.exe	92
PID 4860 wrote to memory of 2112	4860	cmd.exe	94
PID 4860 wrote to memory of 2112	4860	cmd.exe	94
PID 4860 wrote to memory of 4172	4860	cmd.exe	95
PID 4860 wrote to memory of 4172	4860	cmd.exe	95
PID 4860 wrote to memory of 1688	4860	cmd.exe	107
PID 4860 wrote to memory of 1688	4860	cmd.exe	107
PID 1688 wrote to memory of 4888	1688	Client-built.exe	109
PID 1688 wrote to memory of 4888	1688	Client-built.exe	109
PID 4888 wrote to memory of 2464	4888	cmd.exe	111
PID 4888 wrote to memory of 2464	4888	cmd.exe	111
PID 4888 wrote to memory of 904	4888	cmd.exe	112
PID 4888 wrote to memory of 904	4888	cmd.exe	112
PID 4888 wrote to memory of 4364	4888	cmd.exe	115
PID 4888 wrote to memory of 4364	4888	cmd.exe	115
PID 4364 wrote to memory of 1252	4364	Client-built.exe	118
PID 4364 wrote to memory of 1252	4364	Client-built.exe	118
PID 1252 wrote to memory of 3184	1252	cmd.exe	120
PID 1252 wrote to memory of 3184	1252	cmd.exe	120
PID 1252 wrote to memory of 4684	1252	cmd.exe	121
PID 1252 wrote to memory of 4684	1252	cmd.exe	121
PID 1252 wrote to memory of 4580	1252	cmd.exe	123
PID 1252 wrote to memory of 4580	1252	cmd.exe	123
PID 4580 wrote to memory of 4764	4580	Client-built.exe	125
PID 4580 wrote to memory of 4764	4580	Client-built.exe	125
PID 4764 wrote to memory of 4252	4764	cmd.exe	127
PID 4764 wrote to memory of 4252	4764	cmd.exe	127
PID 4764 wrote to memory of 3280	4764	cmd.exe	128
PID 4764 wrote to memory of 3280	4764	cmd.exe	128
PID 4764 wrote to memory of 1652	4764	cmd.exe	130
PID 4764 wrote to memory of 1652	4764	cmd.exe	130
PID 1652 wrote to memory of 3404	1652	Client-built.exe	132
PID 1652 wrote to memory of 3404	1652	Client-built.exe	132
PID 3404 wrote to memory of 5004	3404	cmd.exe	134
PID 3404 wrote to memory of 5004	3404	cmd.exe	134
PID 3404 wrote to memory of 1472	3404	cmd.exe	135
PID 3404 wrote to memory of 1472	3404	cmd.exe	135
PID 3404 wrote to memory of 4548	3404	cmd.exe	136
PID 3404 wrote to memory of 4548	3404	cmd.exe	136
PID 4548 wrote to memory of 1152	4548	Client-built.exe	138
PID 4548 wrote to memory of 1152	4548	Client-built.exe	138
PID 1152 wrote to memory of 740	1152	cmd.exe	140
PID 1152 wrote to memory of 740	1152	cmd.exe	140
PID 1152 wrote to memory of 4212	1152	cmd.exe	141
PID 1152 wrote to memory of 4212	1152	cmd.exe	141
PID 1152 wrote to memory of 4008	1152	cmd.exe	143
PID 1152 wrote to memory of 4008	1152	cmd.exe	143
PID 4008 wrote to memory of 5024	4008	Client-built.exe	145
PID 4008 wrote to memory of 5024	4008	Client-built.exe	145
PID 5024 wrote to memory of 4036	5024	cmd.exe	147
PID 5024 wrote to memory of 4036	5024	cmd.exe	147
PID 5024 wrote to memory of 4824	5024	cmd.exe	148
PID 5024 wrote to memory of 4824	5024	cmd.exe	148
PID 5024 wrote to memory of 2160	5024	cmd.exe	150
PID 5024 wrote to memory of 2160	5024	cmd.exe	150

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aMuYUs4TQf38.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4284
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PNN4Rn2powYh.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2112
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4172
    - - C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1688
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4tRjkLIDspEM.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2464
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cA86kaJJjMxe.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3184
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sGsQlr4Lx483.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4252
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Sfb9o33zvR0K.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:5004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gWPfuus6ExjN.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:740
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\11CRVjpW5dn0.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:4036
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        17⤵
        Checks computer location settings
        
        PID:2160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TCJKRRWkNSUK.bat" "
        18⤵
        
        PID:5088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4564
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TLkrYIQOeBLh.bat" "
        20⤵
        
        PID:2096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:3940
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CY3QaYH1GNd4.bat" "
        22⤵
        
        PID:1892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:3204
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2220
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\15PEI4aA46V8.bat" "
        24⤵
        
        PID:2952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:540
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jx8bEnOSpyl4.bat" "
        26⤵
        
        PID:960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4688
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\v8MfoZZvmp7D.bat" "
        28⤵
        
        PID:1028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:4768
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M2yp6C6Eure0.bat" "
        30⤵
        
        PID:2356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:4760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        31⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\11CRVjpW5dn0.bat

Filesize
209B

MD5
663fa2596faad34c5f788f87453658a5

SHA1
702a9b2e7c4ebb9ae27de6a3442c02e3f6a42627

SHA256
ca1b1a229d720e6343e19e8299fbb7c74a752e35876cb1b2f442c0796a186456

SHA512
c460eda5c5753bed8dc2084a9e4c4e688bd0e69eace1a2d75937afad932e9ddff76c8ee2cac31b2b8edd6d62f4360f967a3e661ecc8fdc9b3e3ae3479de13fbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\15PEI4aA46V8.bat

Filesize
209B

MD5
9b690a9c2742a0a07d5c548538f9a55c

SHA1
76d524f35ab82095d6bf1eb722ea7cd0e3ec9e69

SHA256
64b189e39d5904fa2204abeeadac0b5e23e1ec2cea1529982a2f96c6b9961cb4

SHA512
3c7a90ee9b83bbb358c0bd4bef22d58594876311a286245e73633ce56603f24fb1bcaad5dbcf1f2e21376daa9ff9ea3cee4186614cc9eabd9992872d6f0bb867

Download Submit
C:\Users\Admin\AppData\Local\Temp\4tRjkLIDspEM.bat

Filesize
209B

MD5
97e2764a8c94858dfb881ef5563475cc

SHA1
bd7caefd54c3e4b84a6eadc51a0635df4d1e4b3d

SHA256
ee8560826bd1ed451841111404cbac03ebb0e625b3333f979924521d66947b9f

SHA512
349782fd9a0b1f41839587ef0423862a8c4a4caa39ebbe98890efef939d38ac44677ea32c266c1a3a2b1cb216592dd0e09686c605871464e3190093fc8b08a58

Download Submit
C:\Users\Admin\AppData\Local\Temp\CY3QaYH1GNd4.bat

Filesize
209B

MD5
68ddb8150651986e02219f772c5990a1

SHA1
25a4a79aefc3d3af4f7a7c6730cf4bfc9f66d223

SHA256
25c12d9edffc649f7dc04719fa79d39794fdeb473328a3c922a89dd8f6578e47

SHA512
0cc13f719c8438f6825a3a1401917570dcacdcb5f433b78050dbc37e181fd629c5164ee7839cfcd31f5d0892be50ac37b6505fccc2960c635e82b31c0c5aae90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jx8bEnOSpyl4.bat

Filesize
209B

MD5
bf779d6d948317c660cbd1824591501c

SHA1
81516bdb86c12a437b7cb15acfe3e0e8bb11be0f

SHA256
8e4cfd172eb316439bcd975023a7e5fbb924d96f5b9289b0a7b47841e7305b95

SHA512
222f7c58581d5cdf638e11297cccff3fa5fd4e10d17f930efaf96935be06615abf11eb5e9a7c0db670b5e261a5673e40792a192b6dfac1366bd055210f3cb17a

Download Submit
C:\Users\Admin\AppData\Local\Temp\M2yp6C6Eure0.bat

Filesize
209B

MD5
a50fa4a87a5f03c6d002045e9f40e48f

SHA1
7246a0d51b75ded502150aa229f5b4d3e48dadae

SHA256
17d14de3b7df8473330481467df32d9c682d2af2b6e3fd0685ab5b523af1872d

SHA512
fd5478e07cc6301e9cfb18e9757112d686a138b4e47c787b25586f1b16d42d17b578b3517f451b4d87b2eaccb6bac7c5c8f01106bd3587c2a63636973eb3d332

Download Submit
C:\Users\Admin\AppData\Local\Temp\PNN4Rn2powYh.bat

Filesize
209B

MD5
16ee4e1d8c4bba71fa96f2e13dbb1042

SHA1
a54ef8210fc6fc33c4d4370411024a0d5ff41a71

SHA256
985833b501c442b60aa6bea9c226a037a98b0a747a5d4c9727377c5cb55f8752

SHA512
3793f8bb79bb5aa60b07b6c35dd0c0f6f647db5d43ca6f5b25acce99dd401bf028f22b45f6d87b936e5150abe00739a9155cf1f49f515c64a1ee55bd76b6bb06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sfb9o33zvR0K.bat

Filesize
209B

MD5
c41356ab009738a86cdcef4b9223fcf7

SHA1
3301d7c9a1f51050ac7a4756cecaee376ea667f7

SHA256
c3f974f832bf5ce2c62bd4f358fed143dc59cb2e0c0a06c4ba46d5f95a3e4ecc

SHA512
d9ae35c74caafef06fbc45a60af42de0aec0e83fcb08acf39a237e6caab110dea862f3ba987738786ccb7dd71019ef77f457e6a6590ff664a920dea7ace4dd64

Download Submit
C:\Users\Admin\AppData\Local\Temp\TLkrYIQOeBLh.bat

Filesize
209B

MD5
6e0737795ac696f7276f8b0d99a911f5

SHA1
94e1ad5ac7cb6f44c351812a5a6d26a8e2f47d97

SHA256
2e62df7356895b64bcc4f089fbb0283818bd3b61e0c09e5f2457a6bda8ca5a0e

SHA512
3acdd21b4289a06b4d7165c4048000c74bdcd0cf5113e1d45229bdacc75649457260320c106770a8b712de38f2b5eda4a65858e901700a95d2078e045edcdebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\aMuYUs4TQf38.bat

Filesize
209B

MD5
349844fcf8ba9f4a0e3a1e360b482db6

SHA1
46d412d251a69f1c81936893c242cb36597899e2

SHA256
26a6fb63535c05e3f3678afb91ad439435249b3ec5a116f9a14de0700955fc35

SHA512
1deb5d04ce11b51f939f2845e643da52576328ca75bd24c10816d272ed9a1ffe87a0d955d93f71cad42226497857b4e742f60dba60b97b4ab38d267a49c414f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cA86kaJJjMxe.bat

Filesize
209B

MD5
dfa05e6c2620ee2c368636c15cc523f1

SHA1
bb72f8dbcbad657690fe53b6dac0a47efdc2ae35

SHA256
e5c99127111b97fe4145481e17ab11075db4cb6528eee198ef0f109e7ad082a5

SHA512
abfbe33171f750fcfea46480924aa401568132ff320916ec2e70149fbaae50aadd345d9a9bbae7983ecebbf1bdcd9de27c2b08d371bd92e750f4e91433e39337

Download Submit
C:\Users\Admin\AppData\Local\Temp\gWPfuus6ExjN.bat

Filesize
209B

MD5
fb7e0a4abf86b459cf8a3f233c154a2a

SHA1
1c64d761aa7c115f78f71b746969c0230fd8be41

SHA256
68528fd98b6000b7e4487f342342d5dd0e95d999ce25831c788a39af67d1408a

SHA512
256f89fc47d112497a08d4dce2dfbb25dee39729e7dac5e2f28e1f8c17b2466e2752c1d4b3869ec55a98f548cdc1188d616cdfe1e86b25c8af6f15da8f5147d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\sGsQlr4Lx483.bat

Filesize
209B

MD5
9fefffe89fc5b37233d13029375045e7

SHA1
89ddc1c1b8b1076837e550f74753cdfa94f11f68

SHA256
0b6a364f0c1c44dccb1e63da193971da33bc74366ae1ebcf3a2aa6a94b386f91

SHA512
cfeb393fb02463edbb615f05c2fe6f49b8820a11409da4bd9b517b3a42ee495fbec9beed740856932b8fc4ebfb5ee2764729f4ed5b01804df42604222ccf4f62

Download Submit
C:\Users\Admin\AppData\Local\Temp\v8MfoZZvmp7D.bat

Filesize
209B

MD5
69b5a211854846f47589872925ae2d92

SHA1
6d402e76cad24cdbef17b8bc550c94bb9bd4b46a

SHA256
3c57b432167da8047608e28e7b2a77c1a3fbd696c64ddaca46f9881a4b781593

SHA512
71ed7d3223673ad02c28134128345a8c74ac4c31bfc56e6ba4bc242303e02008c4caf7a6d3475455e429f1a01cfcc0f354cd9d61ac068bcb77b8b55ff91b54fc

Download Submit
memory/1844-11-0x00007FFB42CD3000-0x00007FFB42CD5000-memory.dmp

Filesize
8KB

Download
memory/1844-13-0x00007FFB42CD0000-0x00007FFB43791000-memory.dmp

Filesize
10.8MB

Download
memory/1844-17-0x00007FFB42CD0000-0x00007FFB43791000-memory.dmp

Filesize
10.8MB

Download
memory/2808-9-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

Filesize
10.8MB

Download
memory/2808-0-0x00007FFB42953000-0x00007FFB42955000-memory.dmp

Filesize
8KB

Download
memory/2808-4-0x000000001C8C0000-0x000000001C972000-memory.dmp

Filesize
712KB

Download
memory/2808-3-0x000000001C7B0000-0x000000001C800000-memory.dmp

Filesize
320KB

Download
memory/2808-2-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

Filesize
10.8MB

Download
memory/2808-1-0x0000000000D90000-0x00000000010B4000-memory.dmp

Filesize
3.1MB

Download