quasar | 4ad66f08167a301d51c613fa49c846297787a2fbc57d526c4885b419f61bb78f

Analysis

max time kernel
141s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

3.1MB
MD5

455889b66765b1638dd978a0280f1c7e
SHA1

774c78b88528e366cb46ba6723f7bbc7dbb192c1
SHA256

4ad66f08167a301d51c613fa49c846297787a2fbc57d526c4885b419f61bb78f
SHA512

df5c6d8615e1f41f4d908b62f052805ee8b9dd50d129a9ae2da66888cb60b985a841b00f74090c436e05d6b26672d6fc9957a551cbbf30d91a2af4d5d81e3d3e
SSDEEP

49152:avBt62XlaSFNWPjljiFa2RoUYIWXhymzg8oGd5ZTHHB72eh2NT:avr62XlaSFNWPjljiFXRoUYIWXhnp

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

JJ:4782

192.168.10.1:4782

Mutex

9a10c5be-59aa-4915-9bd2-d92256f2c938

Attributes

encryption_key
83ADBC9532F819159CF9138DCD18B9BF646C2117
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Discord
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2108-1-0x0000000000500000-0x0000000000824000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023ca9-6.dat	family_quasar

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 12 IoCs

pid	Process
516	Client.exe
3736	Client.exe
3728	Client.exe
2464	Client.exe
3160	Client.exe
808	Client.exe
64	Client.exe
1520	Client.exe
4992	Client.exe
2884	Client.exe
3744	Client.exe
2380	Client.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client-built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3556	PING.EXE
844	PING.EXE
3200	PING.EXE
3220	PING.EXE
3632	PING.EXE
2344	PING.EXE
3292	PING.EXE
4848	PING.EXE
3116	PING.EXE
1836	PING.EXE
3580	PING.EXE
1240	PING.EXE

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
3580	PING.EXE
844	PING.EXE
3220	PING.EXE
3116	PING.EXE
2344	PING.EXE
3292	PING.EXE
3556	PING.EXE
1240	PING.EXE
3632	PING.EXE
1836	PING.EXE
4848	PING.EXE
3200	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4668	schtasks.exe
2952	schtasks.exe
4648	schtasks.exe
1468	schtasks.exe
4208	schtasks.exe
5012	schtasks.exe
2908	schtasks.exe
3960	schtasks.exe
4940	schtasks.exe
2328	schtasks.exe
2256	schtasks.exe
2284	schtasks.exe
1512	schtasks.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	Client-built.exe
Token: SeDebugPrivilege	516	Client.exe
Token: SeDebugPrivilege	3736	Client.exe
Token: SeDebugPrivilege	3728	Client.exe
Token: SeDebugPrivilege	2464	Client.exe
Token: SeDebugPrivilege	3160	Client.exe
Token: SeDebugPrivilege	808	Client.exe
Token: SeDebugPrivilege	64	Client.exe
Token: SeDebugPrivilege	1520	Client.exe
Token: SeDebugPrivilege	4992	Client.exe
Token: SeDebugPrivilege	2884	Client.exe
Token: SeDebugPrivilege	3744	Client.exe
Token: SeDebugPrivilege	2380	Client.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
516	Client.exe
3736	Client.exe
3728	Client.exe
2464	Client.exe
3160	Client.exe
808	Client.exe
64	Client.exe
1520	Client.exe
4992	Client.exe
2884	Client.exe
3744	Client.exe
2380	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2952	2108	Client-built.exe	82
PID 2108 wrote to memory of 2952	2108	Client-built.exe	82
PID 2108 wrote to memory of 516	2108	Client-built.exe	84
PID 2108 wrote to memory of 516	2108	Client-built.exe	84
PID 516 wrote to memory of 4648	516	Client.exe	85
PID 516 wrote to memory of 4648	516	Client.exe	85
PID 516 wrote to memory of 4100	516	Client.exe	87
PID 516 wrote to memory of 4100	516	Client.exe	87
PID 4100 wrote to memory of 1848	4100	cmd.exe	89
PID 4100 wrote to memory of 1848	4100	cmd.exe	89
PID 4100 wrote to memory of 3292	4100	cmd.exe	90
PID 4100 wrote to memory of 3292	4100	cmd.exe	90
PID 4100 wrote to memory of 3736	4100	cmd.exe	91
PID 4100 wrote to memory of 3736	4100	cmd.exe	91
PID 3736 wrote to memory of 4940	3736	Client.exe	92
PID 3736 wrote to memory of 4940	3736	Client.exe	92
PID 3736 wrote to memory of 1520	3736	Client.exe	94
PID 3736 wrote to memory of 1520	3736	Client.exe	94
PID 1520 wrote to memory of 4556	1520	cmd.exe	96
PID 1520 wrote to memory of 4556	1520	cmd.exe	96
PID 1520 wrote to memory of 4848	1520	cmd.exe	97
PID 1520 wrote to memory of 4848	1520	cmd.exe	97
PID 1520 wrote to memory of 3728	1520	cmd.exe	102
PID 1520 wrote to memory of 3728	1520	cmd.exe	102
PID 3728 wrote to memory of 1468	3728	Client.exe	104
PID 3728 wrote to memory of 1468	3728	Client.exe	104
PID 3728 wrote to memory of 3688	3728	Client.exe	106
PID 3728 wrote to memory of 3688	3728	Client.exe	106
PID 3688 wrote to memory of 2436	3688	cmd.exe	108
PID 3688 wrote to memory of 2436	3688	cmd.exe	108
PID 3688 wrote to memory of 3556	3688	cmd.exe	109
PID 3688 wrote to memory of 3556	3688	cmd.exe	109
PID 3688 wrote to memory of 2464	3688	cmd.exe	113
PID 3688 wrote to memory of 2464	3688	cmd.exe	113
PID 2464 wrote to memory of 4208	2464	Client.exe	114
PID 2464 wrote to memory of 4208	2464	Client.exe	114
PID 2464 wrote to memory of 3256	2464	Client.exe	116
PID 2464 wrote to memory of 3256	2464	Client.exe	116
PID 3256 wrote to memory of 2884	3256	cmd.exe	118
PID 3256 wrote to memory of 2884	3256	cmd.exe	118
PID 3256 wrote to memory of 3580	3256	cmd.exe	119
PID 3256 wrote to memory of 3580	3256	cmd.exe	119
PID 3256 wrote to memory of 3160	3256	cmd.exe	120
PID 3256 wrote to memory of 3160	3256	cmd.exe	120
PID 3160 wrote to memory of 2328	3160	Client.exe	121
PID 3160 wrote to memory of 2328	3160	Client.exe	121
PID 3160 wrote to memory of 2468	3160	Client.exe	123
PID 3160 wrote to memory of 2468	3160	Client.exe	123
PID 2468 wrote to memory of 2952	2468	cmd.exe	125
PID 2468 wrote to memory of 2952	2468	cmd.exe	125
PID 2468 wrote to memory of 844	2468	cmd.exe	126
PID 2468 wrote to memory of 844	2468	cmd.exe	126
PID 2468 wrote to memory of 808	2468	cmd.exe	128
PID 2468 wrote to memory of 808	2468	cmd.exe	128
PID 808 wrote to memory of 2256	808	Client.exe	129
PID 808 wrote to memory of 2256	808	Client.exe	129
PID 808 wrote to memory of 3316	808	Client.exe	131
PID 808 wrote to memory of 3316	808	Client.exe	131
PID 3316 wrote to memory of 4680	3316	cmd.exe	133
PID 3316 wrote to memory of 4680	3316	cmd.exe	133
PID 3316 wrote to memory of 3200	3316	cmd.exe	134
PID 3316 wrote to memory of 3200	3316	cmd.exe	134
PID 3316 wrote to memory of 64	3316	cmd.exe	135
PID 3316 wrote to memory of 64	3316	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2952
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vTJhAMRdu0xA.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1848
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3292
  - - C:\Windows\system32\SubDir\Client.exe
      "C:\Windows\system32\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3736
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IWRBreJMAY1g.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1520
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4556
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4848
      - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3728
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Os24SjFkgZMu.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3556
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4208
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Gmt15C0tlnyQ.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2884
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3580
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2328
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5sl2sByjy5yn.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2952
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:844
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NJCbEb38jYg0.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4680
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3200
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:64
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GNlhsWQ56tDh.bat" "
        15⤵
        
        PID:1996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4832
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3220
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1520
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KfbUQUNH8rYm.bat" "
        17⤵
        
        PID:784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4608
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1240
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4992
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1512
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bR8qDo1zJs5s.bat" "
        19⤵
        
        PID:1124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3064
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3632
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ASd2dF4IkSt.bat" "
        21⤵
        
        PID:4948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:4532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3116
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3744
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nL4qZEbfKBlu.bat" "
        23⤵
        
        PID:2468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1692
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1836
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PXi1ac8TDLKk.bat" "
        25⤵
        
        PID:2192
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\5sl2sByjy5yn.bat

Filesize
196B

MD5
da5cb3f1ad57556ea4f4182856c264cb

SHA1
d5c1dfcadfc85844f89b34835080e7d73ab2370a

SHA256
305f2e6a40eb48e888430e9efad08968c8abf858a9d03a692a13f8a9b9185d1a

SHA512
ac42bd77415a467c17c13d3bff46278b8a220f6754e3fb270c3b026c49cddabe774e6d23759ff46b6c04f81b845e4dc5ef63454b84388b824570d87b0f1ef353

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ASd2dF4IkSt.bat

Filesize
196B

MD5
3a1984875f09053198df29db6737df8a

SHA1
063b08be4cec9a3a9ada97761746383a27d923f0

SHA256
f7b0be8fa8cd7cae2327abf820304866f14a2a06008f76f96b2f7c809734d15b

SHA512
0f21fabd02b4dd3e9520b53b3d9e1c384dfb94fd6dd3381e90bf7a88219ea1a674cb08ffbf46d93ebabb386a7127223cd69c816770e9b1c74cba5c2bf8eff753

Download Submit
C:\Users\Admin\AppData\Local\Temp\GNlhsWQ56tDh.bat

Filesize
196B

MD5
e726c492c7af425f5b2285d2d4f1663a

SHA1
a5b7bdb2adfc8dc9c5d916870ac2fb3c08bd2443

SHA256
d98859c76f739a83b742307a304defb61d43e197a26dfecb738e2ed3a7e797f4

SHA512
c35a51effaab6cde290b57a833a4c7df57118cc723f8c08e42942ce73bdd448cad889073000a0d33a13806ae62a076e79fb6d065e4cff7128c221268b244766a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gmt15C0tlnyQ.bat

Filesize
196B

MD5
711bb74c669b9a3215b293802b2220a6

SHA1
67afd7742419e5081dbbac6667130b7f7e60e414

SHA256
7f09c1a80ce3aae0409d16f6756fe5955d9167383462cb7d5e67b134e4d26f89

SHA512
1350e5bef4575b5f4274b5c4cc10bc241dc28f43ccf45e1d11715e90361775bb5552b59a967623a0f2867aef881b5b0edb074c5d730ffcc9602075cec2bcfcd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IWRBreJMAY1g.bat

Filesize
196B

MD5
8caac39d30a6f8879004e9cdfae242ed

SHA1
c5db76a54fe6fa54f85c8aed51b5f97285c9584a

SHA256
e8d8fb9a6d2a4de5811ab230108a47cca716e3265736a5518f2a10bcbf2e16a2

SHA512
2eef830c40663f9e15718f209e3b25d1509301d3be7c7fe5660e1e2ecb14ebd59ee6c3b664a16ccef8536b18336dab217987a0b052f33293129a2197d2691aaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\KfbUQUNH8rYm.bat

Filesize
196B

MD5
9bebfd88f8ac111d476b1e76dd902d85

SHA1
c91a0ff54b089225136443acac7a459329c012ba

SHA256
f704f4e6b3e0149c6fde7d594b75515fc9a5355876e74d9b29ced5c5e2abdca0

SHA512
7cf64014db0800fa7642469a77e33ed94bf255b882d0d3a4969d00fa2006eecd67cb641ef8e1bcb9e9b1e525859a8488e2985207c40d23e3d30972daa51482aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\NJCbEb38jYg0.bat

Filesize
196B

MD5
e68e34016bc1a0af3be2b4544a16b0b4

SHA1
9ed6402739bb86fbec8667b269f21e5c7c4fef6d

SHA256
a3b06fbb5805e4738bae4eb61f514c3ac9f728f51662d3bed494f3f7d820373e

SHA512
4f141d7182e1acb56a73a5020cb42d0be37a5a4505629a7043a817b0450e29cafcacae470119084f66a677f5cacf2f7abc7d148b5d660ec2d8dd00d767825038

Download Submit
C:\Users\Admin\AppData\Local\Temp\Os24SjFkgZMu.bat

Filesize
196B

MD5
aaa4ef73a3ee6940d9cae394471b7263

SHA1
37c3a126e5355a67498ef9fe604ef4683401c9b9

SHA256
0a0921e6dc540de54a24f8451db6361e1f0670c34013ea72287daf8038019273

SHA512
d1729b88634b3fb1d66806e5e4958dad2d10c33e47784ece77bcae2b28408e45ace447ef5783c7f19be194dff7c66167e8c6e00c7af58c49265f385f8d95e2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\PXi1ac8TDLKk.bat

Filesize
196B

MD5
6e6e837820f4cae043e360e40af69f2a

SHA1
8c131552f7bfd268a6cb507f0e8893d30b919083

SHA256
a2af6b94336ab3cf71b5357f4e0cf97b37aa9abbfc61df669be12d64b14ea2fb

SHA512
9b84901aaec7dfa80226e59bcd4f2518a76a7482ef7e6e3496a6cd6edc1732c6925c71aa30662682f246d0ff7c5fc4021d9f7587b4da216733daef2d079c3d12

Download Submit
C:\Users\Admin\AppData\Local\Temp\bR8qDo1zJs5s.bat

Filesize
196B

MD5
073f64d0bd601ca658ce9d1093b738e3

SHA1
9587e377d423bce4477121691e9f45f3c24b74b6

SHA256
7ea87ce4baf270859cd318c8ee1e3b328b31a422708ad02c865457b10d94eda6

SHA512
5e24c061be7db2a214341edbd97745343ffde7e049c2c80e875586c2890a1ad181eb069a652cefcf0953464160436cd725e4c57140b711839629961544d3e757

Download Submit
C:\Users\Admin\AppData\Local\Temp\nL4qZEbfKBlu.bat

Filesize
196B

MD5
ff4c7da7e9c95f1b4df7f9164d138ccd

SHA1
288b167326aa79df9c8cad13ee1883941f3d6684

SHA256
d49fd77067fbf3a13dbde934166bb58f18dfb40a5fd089d4e27ce1c4fc0693fb

SHA512
f08fe04b7feac95bdc4fc67a250474c1107b7a1c7a70cc80ba64fede7e6dac822cfca910d31075788d8bb49c643fa4fe0f3c7656e88565b097c8c4013cc7ed8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vTJhAMRdu0xA.bat

Filesize
196B

MD5
33c5e4eb6583b4b20fbc4c10f2c1b9a4

SHA1
1cca612e1d64ffcba82c2f45269e19de3c5d0e84

SHA256
7b554868267f5e9b9a4c58b7a5551e1fd2260f8e63594116966b6f9b98ef9602

SHA512
644375d2ed5da5971a30c75a4f7259d8746eb56c9d155509909451b8dffa55d7b0be7ab2dff0427bdaebd94e013b758040a84a826e6df830647c704d78806c75

Download Submit
C:\Windows\System32\SubDir\Client.exe

Filesize
3.1MB

MD5
455889b66765b1638dd978a0280f1c7e

SHA1
774c78b88528e366cb46ba6723f7bbc7dbb192c1

SHA256
4ad66f08167a301d51c613fa49c846297787a2fbc57d526c4885b419f61bb78f

SHA512
df5c6d8615e1f41f4d908b62f052805ee8b9dd50d129a9ae2da66888cb60b985a841b00f74090c436e05d6b26672d6fc9957a551cbbf30d91a2af4d5d81e3d3e

Download Submit
memory/516-18-0x00007FFF17D30000-0x00007FFF187F1000-memory.dmp

Filesize
10.8MB

Download
memory/516-13-0x000000001D670000-0x000000001D722000-memory.dmp

Filesize
712KB

Download
memory/516-12-0x000000001B6A0000-0x000000001B6F0000-memory.dmp

Filesize
320KB

Download
memory/516-11-0x00007FFF17D30000-0x00007FFF187F1000-memory.dmp

Filesize
10.8MB

Download
memory/516-9-0x00007FFF17D30000-0x00007FFF187F1000-memory.dmp

Filesize
10.8MB

Download
memory/2108-0-0x00007FFF17D33000-0x00007FFF17D35000-memory.dmp

Filesize
8KB

Download
memory/2108-10-0x00007FFF17D30000-0x00007FFF187F1000-memory.dmp

Filesize
10.8MB

Download
memory/2108-2-0x00007FFF17D30000-0x00007FFF187F1000-memory.dmp

Filesize
10.8MB

Download
memory/2108-1-0x0000000000500000-0x0000000000824000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads