quasar | 8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 03:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490.exe
Size

3.2MB
MD5

23c072bdc1c5fe6c2290df7cd3e9abf8
SHA1

e10c6f7843e89f787866aac99c0cb7a3b2c7a902
SHA256

8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490
SHA512

5e18db624ec40d90776a80d90fa80a8a39f7fcd56a523e2d831942934b00e501e7009cc37b17fa4b29a2c2e5c1895c65fdc3259421fb3ce6ea9da50048c50e0e
SSDEEP

98304:xv642pda6D+/PjlLOlZyQipV2mRJ6Nae:1eOpPU9

Score

10^/10

quasar main discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Main

tpinauskas-54803.portmap.host:54803

Mutex

8422dcc2-b8bd-4080-a017-5b62524b6546

Attributes

encryption_key
2EFF7393DC1BD9FBDDD61A780B994B8166BAB8EC
install_name
Win64.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Win64
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4444-1-0x0000000000250000-0x0000000000590000-memory.dmp	family_quasar
behavioral2/files/0x000e000000023bd3-7.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Win64.exe

Executes dropped EXE 15 IoCs

pid	Process
1408	Win64.exe
3660	Win64.exe
3408	Win64.exe
4524	Win64.exe
232	Win64.exe
540	Win64.exe
4084	Win64.exe
3640	Win64.exe
1096	Win64.exe
1292	Win64.exe
920	Win64.exe
2920	Win64.exe
4464	Win64.exe
2968	Win64.exe
2860	Win64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4828	PING.EXE
2708	PING.EXE
1844	PING.EXE
628	PING.EXE
2508	PING.EXE
3908	PING.EXE
448	PING.EXE
3748	PING.EXE
2516	PING.EXE
2996	PING.EXE
4728	PING.EXE
1860	PING.EXE
3260	PING.EXE
32	PING.EXE
3540	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
448	PING.EXE
4728	PING.EXE
3748	PING.EXE
2516	PING.EXE
2508	PING.EXE
3540	PING.EXE
2708	PING.EXE
2996	PING.EXE
3908	PING.EXE
1860	PING.EXE
3260	PING.EXE
1844	PING.EXE
32	PING.EXE
4828	PING.EXE
628	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4368	schtasks.exe
3028	schtasks.exe
4776	schtasks.exe
1868	schtasks.exe
2892	schtasks.exe
2068	schtasks.exe
3448	schtasks.exe
3472	schtasks.exe
5056	schtasks.exe
2060	schtasks.exe
3948	schtasks.exe
3480	schtasks.exe
2968	schtasks.exe
1256	schtasks.exe
548	schtasks.exe
4948	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490.exe
Token: SeDebugPrivilege	1408	Win64.exe
Token: SeDebugPrivilege	3660	Win64.exe
Token: SeDebugPrivilege	3408	Win64.exe
Token: SeDebugPrivilege	4524	Win64.exe
Token: SeDebugPrivilege	232	Win64.exe
Token: SeDebugPrivilege	540	Win64.exe
Token: SeDebugPrivilege	4084	Win64.exe
Token: SeDebugPrivilege	3640	Win64.exe
Token: SeDebugPrivilege	1096	Win64.exe
Token: SeDebugPrivilege	1292	Win64.exe
Token: SeDebugPrivilege	920	Win64.exe
Token: SeDebugPrivilege	2920	Win64.exe
Token: SeDebugPrivilege	4464	Win64.exe
Token: SeDebugPrivilege	2968	Win64.exe
Token: SeDebugPrivilege	2860	Win64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3948	4444	8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490.exe	83
PID 4444 wrote to memory of 3948	4444	8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490.exe	83
PID 4444 wrote to memory of 1408	4444	8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490.exe	85
PID 4444 wrote to memory of 1408	4444	8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490.exe	85
PID 1408 wrote to memory of 3028	1408	Win64.exe	86
PID 1408 wrote to memory of 3028	1408	Win64.exe	86
PID 1408 wrote to memory of 2628	1408	Win64.exe	88
PID 1408 wrote to memory of 2628	1408	Win64.exe	88
PID 2628 wrote to memory of 868	2628	cmd.exe	90
PID 2628 wrote to memory of 868	2628	cmd.exe	90
PID 2628 wrote to memory of 1844	2628	cmd.exe	91
PID 2628 wrote to memory of 1844	2628	cmd.exe	91
PID 2628 wrote to memory of 3660	2628	cmd.exe	102
PID 2628 wrote to memory of 3660	2628	cmd.exe	102
PID 3660 wrote to memory of 4776	3660	Win64.exe	103
PID 3660 wrote to memory of 4776	3660	Win64.exe	103
PID 3660 wrote to memory of 1580	3660	Win64.exe	106
PID 3660 wrote to memory of 1580	3660	Win64.exe	106
PID 1580 wrote to memory of 3376	1580	cmd.exe	108
PID 1580 wrote to memory of 3376	1580	cmd.exe	108
PID 1580 wrote to memory of 2516	1580	cmd.exe	109
PID 1580 wrote to memory of 2516	1580	cmd.exe	109
PID 1580 wrote to memory of 3408	1580	cmd.exe	114
PID 1580 wrote to memory of 3408	1580	cmd.exe	114
PID 3408 wrote to memory of 3480	3408	Win64.exe	115
PID 3408 wrote to memory of 3480	3408	Win64.exe	115
PID 3408 wrote to memory of 1536	3408	Win64.exe	118
PID 3408 wrote to memory of 1536	3408	Win64.exe	118
PID 1536 wrote to memory of 4460	1536	cmd.exe	120
PID 1536 wrote to memory of 4460	1536	cmd.exe	120
PID 1536 wrote to memory of 2996	1536	cmd.exe	121
PID 1536 wrote to memory of 2996	1536	cmd.exe	121
PID 1536 wrote to memory of 4524	1536	cmd.exe	125
PID 1536 wrote to memory of 4524	1536	cmd.exe	125
PID 4524 wrote to memory of 2968	4524	Win64.exe	127
PID 4524 wrote to memory of 2968	4524	Win64.exe	127
PID 4524 wrote to memory of 4160	4524	Win64.exe	130
PID 4524 wrote to memory of 4160	4524	Win64.exe	130
PID 4160 wrote to memory of 5084	4160	cmd.exe	132
PID 4160 wrote to memory of 5084	4160	cmd.exe	132
PID 4160 wrote to memory of 32	4160	cmd.exe	133
PID 4160 wrote to memory of 32	4160	cmd.exe	133
PID 4160 wrote to memory of 232	4160	cmd.exe	135
PID 4160 wrote to memory of 232	4160	cmd.exe	135
PID 232 wrote to memory of 1868	232	Win64.exe	136
PID 232 wrote to memory of 1868	232	Win64.exe	136
PID 232 wrote to memory of 4480	232	Win64.exe	139
PID 232 wrote to memory of 4480	232	Win64.exe	139
PID 4480 wrote to memory of 1352	4480	cmd.exe	141
PID 4480 wrote to memory of 1352	4480	cmd.exe	141
PID 4480 wrote to memory of 2508	4480	cmd.exe	142
PID 4480 wrote to memory of 2508	4480	cmd.exe	142
PID 4480 wrote to memory of 540	4480	cmd.exe	144
PID 4480 wrote to memory of 540	4480	cmd.exe	144
PID 540 wrote to memory of 548	540	Win64.exe	145
PID 540 wrote to memory of 548	540	Win64.exe	145
PID 540 wrote to memory of 5020	540	Win64.exe	148
PID 540 wrote to memory of 5020	540	Win64.exe	148
PID 5020 wrote to memory of 4432	5020	cmd.exe	150
PID 5020 wrote to memory of 4432	5020	cmd.exe	150
PID 5020 wrote to memory of 3540	5020	cmd.exe	151
PID 5020 wrote to memory of 3540	5020	cmd.exe	151
PID 5020 wrote to memory of 4084	5020	cmd.exe	154
PID 5020 wrote to memory of 4084	5020	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490.exe
"C:\Users\Admin\AppData\Local\Temp\8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3948
- C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AUgqNT7SPqRZ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:868
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1844
  - - C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4776
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gi8MBGnopGFM.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1580
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3376
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2516
      - C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YwCTKnV8ulWP.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4460
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2996
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u4mpz3NK7qz5.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:5084
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:32
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kdbSRB7M8MqD.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1352
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2508
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SFpSMsAgGkwZ.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4432
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3540
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TP980s1zBGXB.bat" "
        15⤵
        
        PID:3804
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4828
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3640
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p98DYlae7Md9.bat" "
        17⤵
        
        PID:4108
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:628
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wAsJooINsYtJ.bat" "
        19⤵
        
        PID:3264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3908
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1292
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IifiEfZnuhxE.bat" "
        21⤵
        
        PID:2732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:448
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nzX9a3pZufUF.bat" "
        23⤵
        
        PID:5008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:5088
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2708
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XL36L1lmKccG.bat" "
        25⤵
        
        PID:4084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3880
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4728
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4464
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GG4vIBjwZ6G2.bat" "
        27⤵
        
        PID:3528
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4572
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3748
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4368
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uJraZCONRWOD.bat" "
        29⤵
        
        PID:1096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1860
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uKzEeLGPlm0S.bat" "
        31⤵
        
        PID:2188
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2832
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Win64.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AUgqNT7SPqRZ.bat

Filesize
206B

MD5
8eed09d28b2e0abdecd5eb14ff83945d

SHA1
ac3cb3493ac9699a27e6da7226aa36b90d741a5c

SHA256
5b11e378b826df9bf0878136b8bfde353b2ba6219ab6aa5fae9259efddbe2648

SHA512
8441b1de6c6f9b904060f3ac55c90d83bdec9e109d51875bdd149398e2e4b4dd511da91f34ffefeca2cba5a9663335a843c950513378af03176b3fde34e5fabd

Download Submit
C:\Users\Admin\AppData\Local\Temp\GG4vIBjwZ6G2.bat

Filesize
206B

MD5
99c8b1a6561bb8c6520502852c349130

SHA1
b70175cb0207f327f9fc64da17a447bdc8ed9150

SHA256
11ea9a51b1b6b3efbe3a40e086105a3c8b86d3fd72a27fefaff3bdd0068add28

SHA512
8c3f95771af4bd3e155e244b1836c703db1ec075565fa4df255740eb83e6273dbefb072b960fa075faa9bcd3ae8c9a378a73b75e2873785b12c659cc0adee322

Download Submit
C:\Users\Admin\AppData\Local\Temp\IifiEfZnuhxE.bat

Filesize
206B

MD5
7953f0fe903b2fa3a025b2fdccd7ffb4

SHA1
509c61f85dbfbfb7f149a049022aff16b2408eaa

SHA256
5972a502d4a7772bae64feaa5c4823bbf12a8a330c89e9932e21f984ea1573e4

SHA512
9d41a419aea983fa4f5e9d7b2ba794954cc6f9fb627cf34944fc456b983e63ea7fe77497dc9e334663c31a5bca984a79fa70498c3cee38dd13e75f59722e1155

Download Submit
C:\Users\Admin\AppData\Local\Temp\SFpSMsAgGkwZ.bat

Filesize
206B

MD5
a27b65001318acdd2b94ebf9bc55a689

SHA1
a6a99c598a448ba3e63d1786b39adc506f807d00

SHA256
1ac7a143efb9e1b4967ae1bc4d166c8e2dbc93fff1bb5b112974348a6195f500

SHA512
c6404032221dd722ad147bba45e610b5c05a6de613c0ea2d6dd71e94c2080c82b40d70d0c78deebe96907199b839b40f89075da39dd5fc54fe9a53e8884c896c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TP980s1zBGXB.bat

Filesize
206B

MD5
1c0bd618aeafa127aa1dfe1c7958dca4

SHA1
88d06fdb5dc38d150b5dcb0d5d617166bfdff7b0

SHA256
f6eb2e8997eca8960cf2f63488c8133fecd0b93db84bb3e08f2d1de088d13e62

SHA512
71e402871ad10ae2e803dbb3f5f76250f34f36e57c7d3ad192d506bfb1aa98bc9a684d9b47b69a579f7f21a97828bfbe6b81bededf0c86f7c2b1732dc89da2a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\XL36L1lmKccG.bat

Filesize
206B

MD5
e17d85a24c7259210124eec54b7b84c7

SHA1
81e37312fbf978424b7b6477f2d38ae50eabd336

SHA256
b912f4dc0b9b0df02159c15add606f8e4a63856b2d160312aac4af377f9a6893

SHA512
dee0a21a8e09535e4d4a5ca50a728a68a9e1408adab58da12d5b7e8f5bb26355fee2f8831b1db10ad989dc2d5fe56021162ad65c1012cfada719c5475042aa24

Download Submit
C:\Users\Admin\AppData\Local\Temp\YwCTKnV8ulWP.bat

Filesize
206B

MD5
4c1ca8c779a0fcd8a7bfa374429dbd27

SHA1
6d4a6e0ea81c0bf8da564906a7e21bb9b52db6c9

SHA256
41cb3930da620e502b57559146633c8d0072f1849e31d6a4ce353f531200a869

SHA512
e2c6b22b43d96fbadcca8786e7c8a2aac3bd262fb4f41d05e4b3dd95b4bb57d686b06808a8e3f0f7773fd4bb7090baa5ecdf7f7eaf266afcf42ca8b696438255

Download Submit
C:\Users\Admin\AppData\Local\Temp\gi8MBGnopGFM.bat

Filesize
206B

MD5
484a65dd234d80acd27577958dc39b39

SHA1
97d902d8196d9ba20e5d90e35a48a648b3ca6f5d

SHA256
36ae1fc88ddc95fa62be8990960ec7adc8aab342da421c42255f01ec6eac6f59

SHA512
1f0b5e882da694deb62d8e5841c30d3cdb2ef8f8a059e92d78f9d9c75917e0aa1ca25e9ef232a13a8f9d7f93e7dd963e59459c978f873cc52695caeb4334b2bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\kdbSRB7M8MqD.bat

Filesize
206B

MD5
0d5bc4698387c84319117a829eb2920c

SHA1
e4305742d5c1a575662f3648163f2030ffda0e9f

SHA256
7fafe583cb6d207833bcaeb1d27c2331cbdf4357ecbce387cbdce831ef4867c7

SHA512
d773c451fb5a46895368cccd6d591227416bed82bb22c0b0f151107642ecbefabf4a9a2b830890da39e88862a5cca67de581829da8a83d4242cc4b95ef97484d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nzX9a3pZufUF.bat

Filesize
206B

MD5
14a035aca62bcb94d3f3cb89a322fde0

SHA1
f82715cde4ac2b4618c06394eb0f64890d173d2b

SHA256
3f6abe481884b8e6a0cace3fee3c654301d80a988d5832f6f1ce8199f60b2539

SHA512
074b57aa7c42ec9f595082b35e6e4b74e76b62a4b5911cdc67e714c01328c035079d03fc5a2e5ef0acc0f4769bc2804f2f76780042cae20a003cffa2bb5d3624

Download Submit
C:\Users\Admin\AppData\Local\Temp\p98DYlae7Md9.bat

Filesize
206B

MD5
ddc187c6ad3cb1ed011bd952a1bdd347

SHA1
2ee690c778ee93e89f7ae8f762dba5ad43a79889

SHA256
7adbc2a81c24d5eec20467545281a7a7e66c41752555cafe565c94804206cf62

SHA512
36593038e47c7985348114d1af8b6fcfe00c62b428ecbda7b42a71e14489ecfc7c4a8159acb1fee13d08ea8d55daed3f5b2c0cae70602b65bbbab3eb28c7978c

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4mpz3NK7qz5.bat

Filesize
206B

MD5
3793663c04c9703c6ad01e8ce9955d21

SHA1
583f89748bbf4b6b2e4b29eb2f4ce815ede3ae85

SHA256
2da4ab645fea9325f5cf0015061e1b48a602026799f2cae224aace64df1dd5d3

SHA512
8f2e9459cdf21c60e0fea4119aee046e9506d2d44ede52a237a00705f10da11f41c4cabcf00df7084ebfff7409a8d061dae14b5ba58909275fa6e87dc8c7741e

Download Submit
C:\Users\Admin\AppData\Local\Temp\uJraZCONRWOD.bat

Filesize
206B

MD5
ee2cb1eeda36e950ca7caffa9629b907

SHA1
9eacf857c2697d0d5c4d8a8b8c979ee5aec68a1a

SHA256
4cced30c8cb12ab20a7ffc01cb023ba41d78753e93d37cb4ec7fd55e1992c4af

SHA512
53ae6794d8ca081e0300e35e2360302b443f48fddbdc9355f25897ab025056a8d3885e32e2b89c47f0a865c1a5ce4672f9c810d54f9197d9a912cb6885cfddcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\uKzEeLGPlm0S.bat

Filesize
206B

MD5
136aa1c2e1134f0944040405d9190aa9

SHA1
97a2fa0e3dc23a57eace38cdd9ffb727f4ed3fc0

SHA256
9fb6a31850024ace33e8556a50d0e56e45fdb46f1b0b4d2c8787e59a5bad4982

SHA512
b2cfe0b896ea86a621a1f8706839bc627531762c7cab9d57491d3062ef3e164da80f8012d32121fe7dc7714f91fdd8ca1f7d77d16df2a1221276000d7735b56e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wAsJooINsYtJ.bat

Filesize
206B

MD5
ecda1277fd899265b0f1b3bb462f30f5

SHA1
812bd2a59ff887425a80e95979b08b9958561c2c

SHA256
4b1e96ba41f8729a9163d9f1a32833445667d8ff8bf71483383711db8b15cc52

SHA512
8b80961144415f2b3eba694758dde1e192fea9402ee021e0c5cfbec4d845f30bfc273c600aeea24b220b6fd856ca69a2f7109ff4e2f0a0f99aec481835464a7f

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe

Filesize
3.2MB

MD5
23c072bdc1c5fe6c2290df7cd3e9abf8

SHA1
e10c6f7843e89f787866aac99c0cb7a3b2c7a902

SHA256
8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490

SHA512
5e18db624ec40d90776a80d90fa80a8a39f7fcd56a523e2d831942934b00e501e7009cc37b17fa4b29a2c2e5c1895c65fdc3259421fb3ce6ea9da50048c50e0e

Download Submit
memory/1408-12-0x0000000002F10000-0x0000000002F60000-memory.dmp

Filesize
320KB

Download
memory/1408-9-0x00007FF909130000-0x00007FF909BF1000-memory.dmp

Filesize
10.8MB

Download
memory/1408-11-0x00007FF909130000-0x00007FF909BF1000-memory.dmp

Filesize
10.8MB

Download
memory/1408-18-0x00007FF909130000-0x00007FF909BF1000-memory.dmp

Filesize
10.8MB

Download
memory/1408-13-0x000000001C300000-0x000000001C3B2000-memory.dmp

Filesize
712KB

Download
memory/4444-0-0x00007FF909133000-0x00007FF909135000-memory.dmp

Filesize
8KB

Download
memory/4444-10-0x00007FF909130000-0x00007FF909BF1000-memory.dmp

Filesize
10.8MB

Download
memory/4444-2-0x00007FF909130000-0x00007FF909BF1000-memory.dmp

Filesize
10.8MB

Download
memory/4444-1-0x0000000000250000-0x0000000000590000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads