quasar | 4ad66f08167a301d51c613fa49c846297787a2fbc57d526c4885b419f61bb78f

Resubmissions

22-12-2024 02:36

241222-c3x8xsznby 10

22-12-2024 02:36

241222-c3ndqazna1 10

22-12-2024 02:34

241222-c2nyvszpek 10

Analysis

max time kernel
144s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

455889b66765b1638dd978a0280f1c7e
SHA1

774c78b88528e366cb46ba6723f7bbc7dbb192c1
SHA256

4ad66f08167a301d51c613fa49c846297787a2fbc57d526c4885b419f61bb78f
SHA512

df5c6d8615e1f41f4d908b62f052805ee8b9dd50d129a9ae2da66888cb60b985a841b00f74090c436e05d6b26672d6fc9957a551cbbf30d91a2af4d5d81e3d3e
SSDEEP

49152:avBt62XlaSFNWPjljiFa2RoUYIWXhymzg8oGd5ZTHHB72eh2NT:avr62XlaSFNWPjljiFXRoUYIWXhnp

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

JJ:4782

192.168.10.1:4782

Mutex

9a10c5be-59aa-4915-9bd2-d92256f2c938

Attributes

encryption_key
83ADBC9532F819159CF9138DCD18B9BF646C2117
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Discord
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 7 IoCs

resource	yara_rule
behavioral1/memory/2960-1-0x00000000011C0000-0x00000000014E4000-memory.dmp	family_quasar
behavioral1/files/0x0008000000016edb-6.dat	family_quasar
behavioral1/memory/2804-10-0x0000000001240000-0x0000000001564000-memory.dmp	family_quasar
behavioral1/memory/2020-44-0x00000000001F0000-0x0000000000514000-memory.dmp	family_quasar
behavioral1/memory/336-55-0x00000000012E0000-0x0000000001604000-memory.dmp	family_quasar
behavioral1/memory/1372-66-0x0000000001320000-0x0000000001644000-memory.dmp	family_quasar
behavioral1/memory/2880-127-0x0000000001370000-0x0000000001694000-memory.dmp	family_quasar

Executes dropped EXE 12 IoCs

pid	Process
2804	Client.exe
2820	Client.exe
1668	Client.exe
2020	Client.exe
336	Client.exe
1372	Client.exe
2520	Client.exe
2388	Client.exe
2384	Client.exe
2612	Client.exe
2604	Client.exe
2880	Client.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2644	PING.EXE
1868	PING.EXE
2268	PING.EXE
1816	PING.EXE
2472	PING.EXE
2748	PING.EXE
2372	PING.EXE
1732	PING.EXE
2732	PING.EXE
2228	PING.EXE
2016	PING.EXE
2244	PING.EXE

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
2472	PING.EXE
1732	PING.EXE
2748	PING.EXE
2732	PING.EXE
2244	PING.EXE
2644	PING.EXE
1868	PING.EXE
1816	PING.EXE
2228	PING.EXE
2016	PING.EXE
2372	PING.EXE
2268	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2636	schtasks.exe
996	schtasks.exe
1920	schtasks.exe
2156	schtasks.exe
2616	schtasks.exe
1744	schtasks.exe
2964	schtasks.exe
2424	schtasks.exe
2324	schtasks.exe
2428	schtasks.exe
2864	schtasks.exe
2140	schtasks.exe
1204	schtasks.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2960	Client-built.exe
Token: SeDebugPrivilege	2804	Client.exe
Token: SeDebugPrivilege	2820	Client.exe
Token: SeDebugPrivilege	1668	Client.exe
Token: SeDebugPrivilege	2020	Client.exe
Token: SeDebugPrivilege	336	Client.exe
Token: SeDebugPrivilege	1372	Client.exe
Token: SeDebugPrivilege	2520	Client.exe
Token: SeDebugPrivilege	2388	Client.exe
Token: SeDebugPrivilege	2384	Client.exe
Token: SeDebugPrivilege	2612	Client.exe
Token: SeDebugPrivilege	2604	Client.exe
Token: SeDebugPrivilege	2880	Client.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2804	Client.exe
2820	Client.exe
1668	Client.exe
2020	Client.exe
336	Client.exe
1372	Client.exe
2520	Client.exe
2388	Client.exe
2384	Client.exe
2612	Client.exe
2604	Client.exe
2880	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2428	2960	Client-built.exe	30
PID 2960 wrote to memory of 2428	2960	Client-built.exe	30
PID 2960 wrote to memory of 2428	2960	Client-built.exe	30
PID 2960 wrote to memory of 2804	2960	Client-built.exe	32
PID 2960 wrote to memory of 2804	2960	Client-built.exe	32
PID 2960 wrote to memory of 2804	2960	Client-built.exe	32
PID 2804 wrote to memory of 2156	2804	Client.exe	33
PID 2804 wrote to memory of 2156	2804	Client.exe	33
PID 2804 wrote to memory of 2156	2804	Client.exe	33
PID 2804 wrote to memory of 2488	2804	Client.exe	36
PID 2804 wrote to memory of 2488	2804	Client.exe	36
PID 2804 wrote to memory of 2488	2804	Client.exe	36
PID 2488 wrote to memory of 2212	2488	cmd.exe	38
PID 2488 wrote to memory of 2212	2488	cmd.exe	38
PID 2488 wrote to memory of 2212	2488	cmd.exe	38
PID 2488 wrote to memory of 2644	2488	cmd.exe	39
PID 2488 wrote to memory of 2644	2488	cmd.exe	39
PID 2488 wrote to memory of 2644	2488	cmd.exe	39
PID 2488 wrote to memory of 2820	2488	cmd.exe	40
PID 2488 wrote to memory of 2820	2488	cmd.exe	40
PID 2488 wrote to memory of 2820	2488	cmd.exe	40
PID 2820 wrote to memory of 2616	2820	Client.exe	41
PID 2820 wrote to memory of 2616	2820	Client.exe	41
PID 2820 wrote to memory of 2616	2820	Client.exe	41
PID 2820 wrote to memory of 660	2820	Client.exe	43
PID 2820 wrote to memory of 660	2820	Client.exe	43
PID 2820 wrote to memory of 660	2820	Client.exe	43
PID 660 wrote to memory of 1284	660	cmd.exe	45
PID 660 wrote to memory of 1284	660	cmd.exe	45
PID 660 wrote to memory of 1284	660	cmd.exe	45
PID 660 wrote to memory of 1868	660	cmd.exe	46
PID 660 wrote to memory of 1868	660	cmd.exe	46
PID 660 wrote to memory of 1868	660	cmd.exe	46
PID 660 wrote to memory of 1668	660	cmd.exe	47
PID 660 wrote to memory of 1668	660	cmd.exe	47
PID 660 wrote to memory of 1668	660	cmd.exe	47
PID 1668 wrote to memory of 2864	1668	Client.exe	48
PID 1668 wrote to memory of 2864	1668	Client.exe	48
PID 1668 wrote to memory of 2864	1668	Client.exe	48
PID 1668 wrote to memory of 1736	1668	Client.exe	50
PID 1668 wrote to memory of 1736	1668	Client.exe	50
PID 1668 wrote to memory of 1736	1668	Client.exe	50
PID 1736 wrote to memory of 1544	1736	cmd.exe	52
PID 1736 wrote to memory of 1544	1736	cmd.exe	52
PID 1736 wrote to memory of 1544	1736	cmd.exe	52
PID 1736 wrote to memory of 2372	1736	cmd.exe	53
PID 1736 wrote to memory of 2372	1736	cmd.exe	53
PID 1736 wrote to memory of 2372	1736	cmd.exe	53
PID 1736 wrote to memory of 2020	1736	cmd.exe	54
PID 1736 wrote to memory of 2020	1736	cmd.exe	54
PID 1736 wrote to memory of 2020	1736	cmd.exe	54
PID 2020 wrote to memory of 1744	2020	Client.exe	55
PID 2020 wrote to memory of 1744	2020	Client.exe	55
PID 2020 wrote to memory of 1744	2020	Client.exe	55
PID 2020 wrote to memory of 2796	2020	Client.exe	57
PID 2020 wrote to memory of 2796	2020	Client.exe	57
PID 2020 wrote to memory of 2796	2020	Client.exe	57
PID 2796 wrote to memory of 2288	2796	cmd.exe	59
PID 2796 wrote to memory of 2288	2796	cmd.exe	59
PID 2796 wrote to memory of 2288	2796	cmd.exe	59
PID 2796 wrote to memory of 2268	2796	cmd.exe	60
PID 2796 wrote to memory of 2268	2796	cmd.exe	60
PID 2796 wrote to memory of 2268	2796	cmd.exe	60
PID 2796 wrote to memory of 336	2796	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2428
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\lNU2u1rAjEOL.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2212
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2644
  - - C:\Windows\system32\SubDir\Client.exe
      "C:\Windows\system32\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2616
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\dwxQK5ZJQCdg.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:660
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1284
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1868
      - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2864
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\z4GPW8DK6GcW.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2372
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1744
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\gpbKS3QKZIsk.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2288
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2268
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:336
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2140
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tut807KOwESw.bat" "
        11⤵
        
        PID:2996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:820
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1816
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1372
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1204
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\cb6gPYSjf7SZ.bat" "
        13⤵
        
        PID:1392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2320
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2472
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2520
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2424
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\8qvUfYrVx9BB.bat" "
        15⤵
        
        PID:1764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1792
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1732
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2388
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2964
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\OYE2MENfWPGi.bat" "
        17⤵
        
        PID:2708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2772
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2748
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2384
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2324
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\ZbOAvqOayBn6.bat" "
        19⤵
        
        PID:2784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2356
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2732
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2612
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2636
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\0oZH7OzxWuOV.bat" "
        21⤵
        
        PID:1288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1612
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2228
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2604
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:996
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\yBjJIESVQBWi.bat" "
        23⤵
        
        PID:1944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1624
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2016
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2880
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1920
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1XKrgOL98F8C.bat" "
        25⤵
        
        PID:2020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0oZH7OzxWuOV.bat

Filesize
196B

MD5
0018870753bb581cc2918c6b841f836d

SHA1
c5ec33dbf8ff64591c442ef8a6f7cb7ab12e3e64

SHA256
65f3f32bcfb1517fa266866686e3a1d9fb22192967368467e5c58e1982016430

SHA512
7259286e46468646f3330843c44555cca832e18c1298c6bb1f4db0e1c0599f4febe13d1d19234be4d66d7a4d02d051e7663371b68d88302028664f594ebd8aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1XKrgOL98F8C.bat

Filesize
196B

MD5
1fa990ae02190c2a05b0575d80afaccb

SHA1
9409fcd7a834db931888b43a0c167663a8ffbb06

SHA256
ae235694c8ac24c7e2baa8b11b84a355760a0a5adebe889f2b6874b96a1ccd5c

SHA512
4bab436d96359f0d0157b6a208c3ab8c2bb9f4eba90213afa9774dad5a3919dae581e3a22794b7fa137799000c819baca29a9ba5e95e179cabb2ebab447f71c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\8qvUfYrVx9BB.bat

Filesize
196B

MD5
29f61ad03c9f02c7a3cb935258d70e30

SHA1
001e8e25d28add7f85eb1a419d8775d7f92a9b78

SHA256
7cefd825ad38e7a4a1817840fcb7407be0b28d07aab701c702b9139943568bb5

SHA512
b54a5ebf1bd84be1b64f2af76f8a3bedff258ce015f85752f764a7549eb5810241b6ca382d2eb1644785517ecd966a144e180db2d476e09fd759711ac1da8150

Download Submit
C:\Users\Admin\AppData\Local\Temp\OYE2MENfWPGi.bat

Filesize
196B

MD5
006b682cdac889978d1590aa162f928b

SHA1
57238af12bc3c6abe22e65194466c332e18c8f87

SHA256
8c8fd2373815ad0fc6a33e0fca4c04be393a219d0229d9129b785099265051b7

SHA512
74e44cdfa27d0a915e58c9a6b32df4a7a764bcfc3323a94c5ec160336d0b8b1e084f20cc9dc3329a71f6bf9407bc745786863a5108ca79d3e553153ad84a69d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZbOAvqOayBn6.bat

Filesize
196B

MD5
79cbf775a019cf267f4bfb7a09fdd27b

SHA1
69961d2bd40d747a1ad4717b022d1324bfa15e71

SHA256
7ae941fbfbe8f06db151f0b55807ec282b79ca5f423e90377d648f395cf4b599

SHA512
3f2ff81aa148db76b1eb608f7994fd3bac88367428489909ba0a0ac280805187304bd509a8310263073ec0216508574b850423da3ab166a0971c5086ba6430ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb6gPYSjf7SZ.bat

Filesize
196B

MD5
d799cf5b436fdf882ca8686dbda57aca

SHA1
8c928157193f5b75cfc9af1fb9689d84e2994bb1

SHA256
145955cc6977bd0432cb1c281b672ecf4119ccecdea6995866f6fe5d59ccc5a6

SHA512
5526b20b0af67d6bb0cb257c2ee2c897dc26bb60cf146745dc8d9d6fda1f15855afa557d652e000e39b17a0deeb45986ef3ee9c3e53451a3fc598239a73e9821

Download Submit
C:\Users\Admin\AppData\Local\Temp\dwxQK5ZJQCdg.bat

Filesize
196B

MD5
e780016eac87bb1091925c3bfad6ff19

SHA1
06d3c8d19fc4c59089dad3bed5d9e475b9a009b0

SHA256
7e16b0927053f2459fbf87f2321d73d88f65bfa742087085d0775a40ddf9e5ef

SHA512
2b8c5ac3c319fa99139e0ebe66630e11fd9ee640da7dbb5476173ef37236b7686348cacb810cb877111155c942b0098006c899242b376e306b93de7a41bee9ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\gpbKS3QKZIsk.bat

Filesize
196B

MD5
af454a0da440f997c6050d6b5f330034

SHA1
096f0e462a17403b39a145d0b38a5cfe97dba040

SHA256
5d30111f41a8f4c3a913b03b43a4abf5a8fa5e942c02853c9c0329b6bd42590e

SHA512
7366f5d258393a4190d414741563cb7a19d18b2794e381231e33ced9dac36db640fa324f65d25a191f876c67ea48ac81f40252f947b996c358089e4575c9e197

Download Submit
C:\Users\Admin\AppData\Local\Temp\lNU2u1rAjEOL.bat

Filesize
196B

MD5
98fb50f0b73f546f1873fddcb499189a

SHA1
8dd1714f20426f1f9f1e271309e2c2b92f1185a7

SHA256
81c51032c755c137e70859f2af33ebc79081eae5cb73d70d206d60342eb0249c

SHA512
c85529e9009eaa329aab7005cb36026c20faa6dfc0d0648fc83bc78ece5e03d4e46c5039bbfc782be977f23c430881c0a80c554cabce23db71927c55db330e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tut807KOwESw.bat

Filesize
196B

MD5
819bad0b084e3d6fe9b872a8f31737f4

SHA1
874b19ed95df98767ca607ce0be9dbdeb5f457c1

SHA256
d512ae5cf2f735f2670e718c5b5c668b3e5036b11392327f2f9ddf7e215457c8

SHA512
c00e9804b520a4847d5362e5c9b599e98e1b05d1d5c2d0bf25a4fa9559ba99ffa3a3bd82b7f3600d9dabbbcd055e3a99a197c94b60ad5b05710968e5b99fd303

Download Submit
C:\Users\Admin\AppData\Local\Temp\yBjJIESVQBWi.bat

Filesize
196B

MD5
c57c9dc15ce81c2d0ae19d01e630a8af

SHA1
2cf6de82ad8dc721bcb6b7ba34970e5fd9797850

SHA256
66292932ac43f9253013de47ce0a479537da5aaf6e78f8a5a8116f103e3c7832

SHA512
9dd4b40c7c9877d28826a8b80351b0d5daa293d6aef8f029c3d0efe5d6c96bee05cacea5378c2a37c52778e4c71fe643303e1365e1bebb491b9af1f9614e19bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\z4GPW8DK6GcW.bat

Filesize
196B

MD5
ad5bbd6f1dc75b9536f81fc2c3ac8426

SHA1
7600e65ed25af9cedd30cc88a61c88849b7d7196

SHA256
bedf1e76a05846da7853700f75049e8a3c64ba1b57a090866eb48767cbd4fcba

SHA512
11783a23280fded1085e35373e0abdbc29f613c5cbe905859d6ed5b02486f6f567163d8ea5cb4d03c362e952237a28fe9afea3de214e486a9f6bb11310719bc6

Download Submit
C:\Windows\System32\SubDir\Client.exe

Filesize
3.1MB

MD5
455889b66765b1638dd978a0280f1c7e

SHA1
774c78b88528e366cb46ba6723f7bbc7dbb192c1

SHA256
4ad66f08167a301d51c613fa49c846297787a2fbc57d526c4885b419f61bb78f

SHA512
df5c6d8615e1f41f4d908b62f052805ee8b9dd50d129a9ae2da66888cb60b985a841b00f74090c436e05d6b26672d6fc9957a551cbbf30d91a2af4d5d81e3d3e

Download Submit
memory/336-55-0x00000000012E0000-0x0000000001604000-memory.dmp

Filesize
3.1MB

Download
memory/1372-66-0x0000000001320000-0x0000000001644000-memory.dmp

Filesize
3.1MB

Download
memory/2020-44-0x00000000001F0000-0x0000000000514000-memory.dmp

Filesize
3.1MB

Download
memory/2804-11-0x000007FEF5210000-0x000007FEF5BFC000-memory.dmp

Filesize
9.9MB

Download
memory/2804-10-0x0000000001240000-0x0000000001564000-memory.dmp

Filesize
3.1MB

Download
memory/2804-9-0x000007FEF5210000-0x000007FEF5BFC000-memory.dmp

Filesize
9.9MB

Download
memory/2804-20-0x000007FEF5210000-0x000007FEF5BFC000-memory.dmp

Filesize
9.9MB

Download
memory/2880-127-0x0000000001370000-0x0000000001694000-memory.dmp

Filesize
3.1MB

Download
memory/2960-0-0x000007FEF5213000-0x000007FEF5214000-memory.dmp

Filesize
4KB

Download
memory/2960-8-0x000007FEF5210000-0x000007FEF5BFC000-memory.dmp

Filesize
9.9MB

Download
memory/2960-2-0x000007FEF5210000-0x000007FEF5BFC000-memory.dmp

Filesize
9.9MB

Download
memory/2960-1-0x00000000011C0000-0x00000000014E4000-memory.dmp

Filesize
3.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads