quasar | 3f5ad363ca773fa11543df4a54c4f1b44b19cd1c7eb58a13e1153acd52d523c2

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2024, 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EUPHORIA SPOOFER.exe
Size

3.1MB
MD5

747da4cd939f55760c8f05ac18379274
SHA1

8c97e718177a7ebc5be519416092434b1eb703e0
SHA256

3f5ad363ca773fa11543df4a54c4f1b44b19cd1c7eb58a13e1153acd52d523c2
SHA512

9ce808076587fc6be47d851556cba2336572ca8b971ea65546e0ca6cb6908ca32d73f67a9cd42702bc1dece1e0d4a7f4f1516160f31667016d5a51f7acc8d35f
SSDEEP

49152:SvCY52fyaSZOrPWluWBuGG5g5h5BssdpSLoGdSTHHB72eh2NT:Sv352fyaSZOrPWluWBDG5g5hrsD

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

JJ:4782

Mutex

9a10c5be-59aa-4915-9bd2-d92256f2c938

Attributes

encryption_key
83ADBC9532F819159CF9138DCD18B9BF646C2117
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Discord
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1948-1-0x00000000008C0000-0x0000000000BE4000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023c94-8.dat	family_quasar

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 12 IoCs

pid	Process
2032	Client.exe
3392	Client.exe
3176	Client.exe
408	Client.exe
4124	Client.exe
2704	Client.exe
2044	Client.exe
3556	Client.exe
1824	Client.exe
2380	Client.exe
4336	Client.exe
4412	Client.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	EUPHORIA SPOOFER.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	EUPHORIA SPOOFER.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	EUPHORIA SPOOFER.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2944	PING.EXE
5092	PING.EXE
3076	PING.EXE
892	PING.EXE
208	PING.EXE
2948	PING.EXE
5076	PING.EXE
5104	PING.EXE
3200	PING.EXE
2100	PING.EXE
2532	PING.EXE
4468	PING.EXE

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
5076	PING.EXE
2944	PING.EXE
5104	PING.EXE
3200	PING.EXE
2100	PING.EXE
5092	PING.EXE
208	PING.EXE
892	PING.EXE
2532	PING.EXE
4468	PING.EXE
2948	PING.EXE
3076	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1340	schtasks.exe
1620	schtasks.exe
5040	schtasks.exe
4648	schtasks.exe
2104	schtasks.exe
3056	schtasks.exe
4752	schtasks.exe
4204	schtasks.exe
872	schtasks.exe
1692	schtasks.exe
1976	schtasks.exe
892	schtasks.exe
2416	schtasks.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	EUPHORIA SPOOFER.exe
Token: SeDebugPrivilege	2032	Client.exe
Token: SeDebugPrivilege	3392	Client.exe
Token: SeDebugPrivilege	3176	Client.exe
Token: SeDebugPrivilege	408	Client.exe
Token: SeDebugPrivilege	4124	Client.exe
Token: SeDebugPrivilege	2704	Client.exe
Token: SeDebugPrivilege	2044	Client.exe
Token: SeDebugPrivilege	3556	Client.exe
Token: SeDebugPrivilege	1824	Client.exe
Token: SeDebugPrivilege	2380	Client.exe
Token: SeDebugPrivilege	4336	Client.exe
Token: SeDebugPrivilege	4412	Client.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2032	Client.exe
3392	Client.exe
3176	Client.exe
408	Client.exe
4124	Client.exe
2704	Client.exe
2044	Client.exe
3556	Client.exe
1824	Client.exe
2380	Client.exe
4336	Client.exe
4412	Client.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2032	Client.exe
3392	Client.exe
3176	Client.exe
408	Client.exe
4124	Client.exe
2704	Client.exe
2044	Client.exe
3556	Client.exe
1824	Client.exe
2380	Client.exe
4336	Client.exe
4412	Client.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2032	Client.exe
3392	Client.exe
3176	Client.exe
408	Client.exe
4124	Client.exe
2704	Client.exe
2044	Client.exe
3556	Client.exe
1824	Client.exe
2380	Client.exe
4336	Client.exe
4412	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4648	1948	EUPHORIA SPOOFER.exe	83
PID 1948 wrote to memory of 4648	1948	EUPHORIA SPOOFER.exe	83
PID 1948 wrote to memory of 2032	1948	EUPHORIA SPOOFER.exe	85
PID 1948 wrote to memory of 2032	1948	EUPHORIA SPOOFER.exe	85
PID 2032 wrote to memory of 2104	2032	Client.exe	86
PID 2032 wrote to memory of 2104	2032	Client.exe	86
PID 2032 wrote to memory of 380	2032	Client.exe	89
PID 2032 wrote to memory of 380	2032	Client.exe	89
PID 380 wrote to memory of 4264	380	cmd.exe	91
PID 380 wrote to memory of 4264	380	cmd.exe	91
PID 380 wrote to memory of 2944	380	cmd.exe	92
PID 380 wrote to memory of 2944	380	cmd.exe	92
PID 380 wrote to memory of 3392	380	cmd.exe	94
PID 380 wrote to memory of 3392	380	cmd.exe	94
PID 3392 wrote to memory of 3056	3392	Client.exe	95
PID 3392 wrote to memory of 3056	3392	Client.exe	95
PID 3392 wrote to memory of 844	3392	Client.exe	99
PID 3392 wrote to memory of 844	3392	Client.exe	99
PID 844 wrote to memory of 2172	844	cmd.exe	101
PID 844 wrote to memory of 2172	844	cmd.exe	101
PID 844 wrote to memory of 5104	844	cmd.exe	102
PID 844 wrote to memory of 5104	844	cmd.exe	102
PID 844 wrote to memory of 3176	844	cmd.exe	104
PID 844 wrote to memory of 3176	844	cmd.exe	104
PID 3176 wrote to memory of 1692	3176	Client.exe	105
PID 3176 wrote to memory of 1692	3176	Client.exe	105
PID 3176 wrote to memory of 1356	3176	Client.exe	108
PID 3176 wrote to memory of 1356	3176	Client.exe	108
PID 1356 wrote to memory of 1776	1356	cmd.exe	110
PID 1356 wrote to memory of 1776	1356	cmd.exe	110
PID 1356 wrote to memory of 3200	1356	cmd.exe	111
PID 1356 wrote to memory of 3200	1356	cmd.exe	111
PID 1356 wrote to memory of 408	1356	cmd.exe	116
PID 1356 wrote to memory of 408	1356	cmd.exe	116
PID 408 wrote to memory of 4752	408	Client.exe	117
PID 408 wrote to memory of 4752	408	Client.exe	117
PID 408 wrote to memory of 2372	408	Client.exe	120
PID 408 wrote to memory of 2372	408	Client.exe	120
PID 2372 wrote to memory of 2624	2372	cmd.exe	122
PID 2372 wrote to memory of 2624	2372	cmd.exe	122
PID 2372 wrote to memory of 2100	2372	cmd.exe	123
PID 2372 wrote to memory of 2100	2372	cmd.exe	123
PID 2372 wrote to memory of 4124	2372	cmd.exe	127
PID 2372 wrote to memory of 4124	2372	cmd.exe	127
PID 4124 wrote to memory of 1976	4124	Client.exe	131
PID 4124 wrote to memory of 1976	4124	Client.exe	131
PID 4124 wrote to memory of 2892	4124	Client.exe	133
PID 4124 wrote to memory of 2892	4124	Client.exe	133
PID 2892 wrote to memory of 2360	2892	cmd.exe	136
PID 2892 wrote to memory of 2360	2892	cmd.exe	136
PID 2892 wrote to memory of 2532	2892	cmd.exe	138
PID 2892 wrote to memory of 2532	2892	cmd.exe	138
PID 2892 wrote to memory of 2704	2892	cmd.exe	144
PID 2892 wrote to memory of 2704	2892	cmd.exe	144
PID 2704 wrote to memory of 1340	2704	Client.exe	145
PID 2704 wrote to memory of 1340	2704	Client.exe	145
PID 2704 wrote to memory of 2716	2704	Client.exe	148
PID 2704 wrote to memory of 2716	2704	Client.exe	148
PID 2716 wrote to memory of 4640	2716	cmd.exe	150
PID 2716 wrote to memory of 4640	2716	cmd.exe	150
PID 2716 wrote to memory of 4468	2716	cmd.exe	151
PID 2716 wrote to memory of 4468	2716	cmd.exe	151
PID 2716 wrote to memory of 2044	2716	cmd.exe	153
PID 2716 wrote to memory of 2044	2716	cmd.exe	153

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\EUPHORIA SPOOFER.exe
"C:\Users\Admin\AppData\Local\Temp\EUPHORIA SPOOFER.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4648
- C:\Windows\system32\SubDir\Client.exe
  "C:\Windows\system32\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uWPxAtIx2YZH.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:380
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4264
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2944
  - - C:\Windows\system32\SubDir\Client.exe
      "C:\Windows\system32\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3392
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iL8qSIGuJrFK.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:844
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2172
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5104
      - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1HReSi7Vt78i.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3200
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sCRyNsB2hTri.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2624
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2100
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4124
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uSop6KcyXZp2.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2360
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2532
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yfv99r23Q3Gq.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4640
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4468
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2044
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0z8luQEBovjL.bat" "
        15⤵
        
        PID:4924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2720
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5092
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3556
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RrKP8zebWC1f.bat" "
        17⤵
        
        PID:2708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2232
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:208
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1824
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9K77PQyqwpau.bat" "
        19⤵
        
        PID:2852
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1748
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2948
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2380
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vGX1iRNZXhnT.bat" "
        21⤵
        
        PID:4944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3024
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3076
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4336
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VHazoBeyOgzH.bat" "
        23⤵
        
        PID:4724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:892
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4412
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2V0FbitDDokn.bat" "
        25⤵
        
        PID:2448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2312
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\0z8luQEBovjL.bat

Filesize
196B

MD5
023678a533f9fc815bcb85493537b836

SHA1
1ee43db05ea00b76a8d30b1fac8acab17ef87433

SHA256
7ac714e09cf9394c7d1de210a6e3e4f045d38b06462bd48500ef3e448643a1c7

SHA512
75b6d267bf5950bb6fdf6983e7cf2642bc990206728a664b634822857b84cea1c1e80496b13f2fd219ebca08e96cca5887a16eb7dc8034930c897fe62c335b30

Download Submit
C:\Users\Admin\AppData\Local\Temp\1HReSi7Vt78i.bat

Filesize
196B

MD5
ac5791823aa3cae24f48db26a5f06483

SHA1
f7cf2b2b81e9d8a1ac7d15d8ae6ad0c343ca8ac1

SHA256
0a45aba2b675acb08de40436b0b40e11297c030e9e07b6adb9bd0472801765f7

SHA512
49fad00a9626fb25f63e3e72ecf10fe56b97e31f4962b15607d51eb8bed011ae2dd925c4f15fca7121a6a504ab3aaeb6aab7d2945e1d1267f1f92cec62453837

Download Submit
C:\Users\Admin\AppData\Local\Temp\2V0FbitDDokn.bat

Filesize
196B

MD5
22b59dd6113e2503fcd3b67d6cfd359c

SHA1
ca8d50eff76aea3534282ca0d161e515ce652eaa

SHA256
fa595036f4c1475201c47ea8da60901832f1aa83f07067c7ed056333f2f6400f

SHA512
b9e0fd59bc7a26fd80f1cc7b014ef5fb3b69766acdc24aedcd96a3f20635945138589a2c5c30a5939e6e447f5aeb63f203d07ae4f59c9b09bbf7fcd7919cd951

Download Submit
C:\Users\Admin\AppData\Local\Temp\9K77PQyqwpau.bat

Filesize
196B

MD5
d56631d2685adeaa9dff7384284757a2

SHA1
23a4bc2c4e5a2b2793040690d1564fa91e9bedfd

SHA256
70a462349605e19c4692e7dfc0e3ef4c700984b2810a6440d12aeda8ebb5b3a8

SHA512
115ad4dcba6cff1d9bf095c4c8fe5931a1d70b85cd187ded023704b4da65b2fc62d8554f865ef9ce5c9a347a57c5385162ff5f1ede9e5ce6c38bf48af514b7ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\RrKP8zebWC1f.bat

Filesize
196B

MD5
d2161760eb37ee5812564a6262bb4930

SHA1
fdb343ceceb6f55979eeaefe1f916e00180bef41

SHA256
c12795781cef4bed226ffc570f0e2bd85c5ce662711813027451f8819b588594

SHA512
df50760899a7a832ea1763909728ea895c3583211b32214d7e6053fafb301450086f8a4c9093bba02cc20b35ef22fea34850b7ee1da6ea5c00f769f1fa4b9984

Download Submit
C:\Users\Admin\AppData\Local\Temp\VHazoBeyOgzH.bat

Filesize
196B

MD5
10819401a8c412563afd25a67346198e

SHA1
d6c90d9090f30392c36d1243e0c9fb06d3caf08a

SHA256
ab17fe5f1e56dfc34240a28863208532faac5f3642e1934d06a2d351b9a62547

SHA512
3cf28d5cc4de92169a7cf6c46354d0745b29dade18e436a92cd02b058d1e4494945079667b8ccafcfe06ab078a7620f3c8873746f166b31ccf8fc65a7eba50ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\iL8qSIGuJrFK.bat

Filesize
196B

MD5
382fb366b995e164f975035fdd7c48e9

SHA1
c2846b97139d81745bc193d381c02f50e6972281

SHA256
658a0344c76300da741f1f5d357e1e8f0f3cdac7f0782cf4197c2e66471f090d

SHA512
c582c3fc7dfcf47b3ea15791d773a2aada82876c98912a556ddc213f84330f66250684ea2e624c1ffaba086c638a905b45443cbca38969daf0122a07c42a5bf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\sCRyNsB2hTri.bat

Filesize
196B

MD5
861451e13de7f94bd379121929a95c45

SHA1
2ead066c43b79c2cf1b0c422e58a3bcca3032556

SHA256
987f96255f43ded32521ed789c70d00dfe9daee39952d22823f4a30b1c13757c

SHA512
810beb2b5c6f2555278dc434bcd55f23975aa75fae985f34fb64ee7ea88646bc3990b779313bcb83a2f63439250dd032410c824e6ed8bf1cff8dfdd8743bb132

Download Submit
C:\Users\Admin\AppData\Local\Temp\uSop6KcyXZp2.bat

Filesize
196B

MD5
edf70fbf25fcb366fb767763786bf6c2

SHA1
619ba3db179f0489be253f0eafee7c52eb1d95d8

SHA256
54dc56363c893d171903e50c8bde7b322c8ea420145e8473ad5c4b1828d0a62c

SHA512
5448b82a85d2619ceab911705d8ac49e65431caf32981d81f2492b14fdcc6ffd16be795499dc25ed998b33d5d878f7cdd5c465904a1641ecf2a6b04403a2430d

Download Submit
C:\Users\Admin\AppData\Local\Temp\uWPxAtIx2YZH.bat

Filesize
196B

MD5
190346c085b03e00fd9a6c645c115190

SHA1
5d39802dd97ace2d0066dec06b8e4356f5b45bb4

SHA256
ed981a4963b87817f58741801dd01430aa932f5b48a3a9c82e6ff1ee7c07affc

SHA512
510d4a184dac2834bc08f176337a3f9bcfd3902c6695eef485fcaefec28c7189bfafa5b0fc12a8abfa5884047e801deddb89dde5942886e45e220a01b2a23d39

Download Submit
C:\Users\Admin\AppData\Local\Temp\vGX1iRNZXhnT.bat

Filesize
196B

MD5
f392858fd6c8aabb2c9cb68eebb14fbb

SHA1
6789d928ddb3d2d43312a67cdf5ffe76593901b5

SHA256
7109dbda20907dd89750886d14424b8e7decbc5467e23e75989e821ba990c200

SHA512
19de2aa6da05c0e927393942edc0c568f9b364c6daf4e0fa72ff227d3253b278e66a6e97400c98976bfa79af9735c17d8190dc135fb1ab05235bd60312c8a67e

Download Submit
C:\Users\Admin\AppData\Local\Temp\yfv99r23Q3Gq.bat

Filesize
196B

MD5
a32a7f0457a56cebd01386271cceaf1e

SHA1
77f786e6805251aa5afb5f9f5d3cb77b489d96e4

SHA256
62035c3efcca71eac95f25c4fec649d260539c52ab2ed7f033ed24130672cac8

SHA512
25e5228614ffef5e70be392b7f41112637cbed5194622f71f42a4336329605dd9daa1d5f54e268376ef117a73526246c66a097d59ed8592d1e848b95eaa0456b

Download Submit
C:\Windows\system32\SubDir\Client.exe

Filesize
3.1MB

MD5
747da4cd939f55760c8f05ac18379274

SHA1
8c97e718177a7ebc5be519416092434b1eb703e0

SHA256
3f5ad363ca773fa11543df4a54c4f1b44b19cd1c7eb58a13e1153acd52d523c2

SHA512
9ce808076587fc6be47d851556cba2336572ca8b971ea65546e0ca6cb6908ca32d73f67a9cd42702bc1dece1e0d4a7f4f1516160f31667016d5a51f7acc8d35f

Download Submit
memory/1948-0-0x00007FFB40EF3000-0x00007FFB40EF5000-memory.dmp

Filesize
8KB

Download
memory/1948-9-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

Filesize
10.8MB

Download
memory/1948-2-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

Filesize
10.8MB

Download
memory/1948-1-0x00000000008C0000-0x0000000000BE4000-memory.dmp

Filesize
3.1MB

Download
memory/2032-19-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

Filesize
10.8MB

Download
memory/2032-13-0x000000001BF30000-0x000000001BFE2000-memory.dmp

Filesize
712KB

Download
memory/2032-12-0x000000001BE20000-0x000000001BE70000-memory.dmp

Filesize
320KB

Download
memory/2032-11-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

Filesize
10.8MB

Download
memory/2032-10-0x00007FFB40EF0000-0x00007FFB419B1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads