quasar | 36ea2fb6f0b7279ea15e54dba6d2c41a00bc3f56e26a59e1bf21867865b2e2db

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rev's External.exe
Size

3.1MB
MD5

abdb9928a2443e939fd0e3b2758fac86
SHA1

963518e3d31b32ade1faa2d3ad4a5f29f4a94718
SHA256

36ea2fb6f0b7279ea15e54dba6d2c41a00bc3f56e26a59e1bf21867865b2e2db
SHA512

3b21a68634fe6c467de89614a7719aed29d664d83857dc3f9684eaa96a155e349aa471bf2bd7a526e201de4805ce2072224de0bb6763490fce6da61b089eb2bb
SSDEEP

49152:Xvluf2NUaNmwzPWlvdaKM7ZxTwi0zBBxLSoGd5THHB72eh2NT:Xvwf2NUaNmwzPWlvdaB7ZxTwJz8

Score

10^/10

quasar aurareal discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

AuraReal

tcp://auraboyy-27610.portmap.host:23133 => 4782:23133

Mutex

23455755-5d9f-40df-b240-406c00706fe9

Attributes

encryption_key
2482B7514A53EC61E5CFC0A64CF01CDEB49C6056
install_name
Win64.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Extras

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2380-1-0x0000000000960000-0x0000000000C84000-memory.dmp	family_quasar
behavioral2/files/0x000b000000023b70-6.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Win64.exe

Executes dropped EXE 15 IoCs

pid	Process
3472	Win64.exe
1176	Win64.exe
1328	Win64.exe
4788	Win64.exe
940	Win64.exe
1204	Win64.exe
1924	Win64.exe
2556	Win64.exe
2744	Win64.exe
4172	Win64.exe
4832	Win64.exe
5092	Win64.exe
4860	Win64.exe
1992	Win64.exe
2904	Win64.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Rev's External.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Rev's External.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File created	C:\Windows\system32\Extras\Win64.exe	Rev's External.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
464	PING.EXE
380	PING.EXE
2600	PING.EXE
4516	PING.EXE
2716	PING.EXE
3440	PING.EXE
548	PING.EXE
4300	PING.EXE
4736	PING.EXE
1388	PING.EXE
3396	PING.EXE
3164	PING.EXE
2368	PING.EXE
3188	PING.EXE
3400	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2600	PING.EXE
3396	PING.EXE
4516	PING.EXE
3188	PING.EXE
1388	PING.EXE
4736	PING.EXE
2368	PING.EXE
4300	PING.EXE
3440	PING.EXE
548	PING.EXE
3400	PING.EXE
3164	PING.EXE
464	PING.EXE
2716	PING.EXE
380	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4548	schtasks.exe
1048	schtasks.exe
3064	schtasks.exe
764	schtasks.exe
4628	schtasks.exe
1676	schtasks.exe
4780	schtasks.exe
4812	schtasks.exe
4928	schtasks.exe
2240	schtasks.exe
4172	schtasks.exe
844	schtasks.exe
2380	schtasks.exe
2332	schtasks.exe
2028	schtasks.exe
3532	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	Rev's External.exe
Token: SeDebugPrivilege	3472	Win64.exe
Token: SeDebugPrivilege	1176	Win64.exe
Token: SeDebugPrivilege	1328	Win64.exe
Token: SeDebugPrivilege	4788	Win64.exe
Token: SeDebugPrivilege	940	Win64.exe
Token: SeDebugPrivilege	1204	Win64.exe
Token: SeDebugPrivilege	1924	Win64.exe
Token: SeDebugPrivilege	2556	Win64.exe
Token: SeDebugPrivilege	2744	Win64.exe
Token: SeDebugPrivilege	4172	Win64.exe
Token: SeDebugPrivilege	4832	Win64.exe
Token: SeDebugPrivilege	5092	Win64.exe
Token: SeDebugPrivilege	4860	Win64.exe
Token: SeDebugPrivilege	1992	Win64.exe
Token: SeDebugPrivilege	2904	Win64.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
3472	Win64.exe
1176	Win64.exe
1328	Win64.exe
4788	Win64.exe
940	Win64.exe
1204	Win64.exe
1924	Win64.exe
2556	Win64.exe
2744	Win64.exe
4172	Win64.exe
4832	Win64.exe
5092	Win64.exe
4860	Win64.exe
1992	Win64.exe
2904	Win64.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
3472	Win64.exe
1176	Win64.exe
1328	Win64.exe
4788	Win64.exe
940	Win64.exe
1204	Win64.exe
1924	Win64.exe
2556	Win64.exe
2744	Win64.exe
4172	Win64.exe
4832	Win64.exe
5092	Win64.exe
4860	Win64.exe
1992	Win64.exe
2904	Win64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2332	2380	Rev's External.exe	83
PID 2380 wrote to memory of 2332	2380	Rev's External.exe	83
PID 2380 wrote to memory of 3472	2380	Rev's External.exe	85
PID 2380 wrote to memory of 3472	2380	Rev's External.exe	85
PID 3472 wrote to memory of 3064	3472	Win64.exe	86
PID 3472 wrote to memory of 3064	3472	Win64.exe	86
PID 3472 wrote to memory of 1672	3472	Win64.exe	88
PID 3472 wrote to memory of 1672	3472	Win64.exe	88
PID 1672 wrote to memory of 3636	1672	cmd.exe	90
PID 1672 wrote to memory of 3636	1672	cmd.exe	90
PID 1672 wrote to memory of 4736	1672	cmd.exe	91
PID 1672 wrote to memory of 4736	1672	cmd.exe	91
PID 1672 wrote to memory of 1176	1672	cmd.exe	100
PID 1672 wrote to memory of 1176	1672	cmd.exe	100
PID 1176 wrote to memory of 4172	1176	Win64.exe	101
PID 1176 wrote to memory of 4172	1176	Win64.exe	101
PID 1176 wrote to memory of 2076	1176	Win64.exe	104
PID 1176 wrote to memory of 2076	1176	Win64.exe	104
PID 2076 wrote to memory of 1196	2076	cmd.exe	106
PID 2076 wrote to memory of 1196	2076	cmd.exe	106
PID 2076 wrote to memory of 4516	2076	cmd.exe	107
PID 2076 wrote to memory of 4516	2076	cmd.exe	107
PID 2076 wrote to memory of 1328	2076	cmd.exe	112
PID 2076 wrote to memory of 1328	2076	cmd.exe	112
PID 1328 wrote to memory of 4548	1328	Win64.exe	113
PID 1328 wrote to memory of 4548	1328	Win64.exe	113
PID 1328 wrote to memory of 3424	1328	Win64.exe	116
PID 1328 wrote to memory of 3424	1328	Win64.exe	116
PID 3424 wrote to memory of 3444	3424	cmd.exe	118
PID 3424 wrote to memory of 3444	3424	cmd.exe	118
PID 3424 wrote to memory of 3188	3424	cmd.exe	119
PID 3424 wrote to memory of 3188	3424	cmd.exe	119
PID 3424 wrote to memory of 4788	3424	cmd.exe	128
PID 3424 wrote to memory of 4788	3424	cmd.exe	128
PID 4788 wrote to memory of 2240	4788	Win64.exe	129
PID 4788 wrote to memory of 2240	4788	Win64.exe	129
PID 4788 wrote to memory of 1788	4788	Win64.exe	132
PID 4788 wrote to memory of 1788	4788	Win64.exe	132
PID 1788 wrote to memory of 4736	1788	cmd.exe	134
PID 1788 wrote to memory of 4736	1788	cmd.exe	134
PID 1788 wrote to memory of 464	1788	cmd.exe	135
PID 1788 wrote to memory of 464	1788	cmd.exe	135
PID 1788 wrote to memory of 940	1788	cmd.exe	137
PID 1788 wrote to memory of 940	1788	cmd.exe	137
PID 940 wrote to memory of 844	940	Win64.exe	138
PID 940 wrote to memory of 844	940	Win64.exe	138
PID 940 wrote to memory of 4016	940	Win64.exe	141
PID 940 wrote to memory of 4016	940	Win64.exe	141
PID 4016 wrote to memory of 2344	4016	cmd.exe	143
PID 4016 wrote to memory of 2344	4016	cmd.exe	143
PID 4016 wrote to memory of 2716	4016	cmd.exe	144
PID 4016 wrote to memory of 2716	4016	cmd.exe	144
PID 4016 wrote to memory of 1204	4016	cmd.exe	146
PID 4016 wrote to memory of 1204	4016	cmd.exe	146
PID 1204 wrote to memory of 1048	1204	Win64.exe	147
PID 1204 wrote to memory of 1048	1204	Win64.exe	147
PID 1204 wrote to memory of 3572	1204	Win64.exe	150
PID 1204 wrote to memory of 3572	1204	Win64.exe	150
PID 3572 wrote to memory of 4804	3572	cmd.exe	152
PID 3572 wrote to memory of 4804	3572	cmd.exe	152
PID 3572 wrote to memory of 3440	3572	cmd.exe	153
PID 3572 wrote to memory of 3440	3572	cmd.exe	153
PID 3572 wrote to memory of 1924	3572	cmd.exe	155
PID 3572 wrote to memory of 1924	3572	cmd.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Rev's External.exe
"C:\Users\Admin\AppData\Local\Temp\Rev's External.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2332
- C:\Windows\system32\Extras\Win64.exe
  "C:\Windows\system32\Extras\Win64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HJCEC9ZuTo8Y.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3636
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4736
  - - C:\Windows\system32\Extras\Win64.exe
      "C:\Windows\system32\Extras\Win64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4172
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DuAMn4BDPTJN.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2076
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1196
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4516
      - C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\49wSmssHRvTX.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3444
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3188
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wFx9Jsz1eMt6.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4736
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:464
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hsFEzFg5VUUw.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2344
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2716
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DuqIUb2NtOTx.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3440
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1924
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kwTSyYqeCbBM.bat" "
        15⤵
        
        PID:532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4796
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:548
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2556
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4yrClg40yh1V.bat" "
        17⤵
        
        PID:2896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3808
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:380
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2744
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NQJO2lluWDTB.bat" "
        19⤵
        
        PID:3616
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:5060
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1388
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4172
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0dZUtC7YGOzE.bat" "
        21⤵
        
        PID:4364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2820
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2600
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4832
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GXVPOa98bJEH.bat" "
        23⤵
        
        PID:220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:400
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3396
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5092
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B3MdQ1bkYc4Y.bat" "
        25⤵
        
        PID:3188
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4724
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3400
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4860
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wLsYj1KU4PV9.bat" "
        27⤵
        
        PID:2612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1920
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4300
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1992
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NHFgzds1AKwe.bat" "
        29⤵
        
        PID:4460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4992
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3164
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2904
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZukQySAXK6o7.bat" "
        31⤵
        
        PID:2064
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:3588
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2368

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Win64.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\0dZUtC7YGOzE.bat

Filesize
195B

MD5
d198705e76cec0157ddea62bdeb3ad65

SHA1
47f5126fed7a181443189c2382cd9e3645bba3ab

SHA256
e565d58c2f861b61cd764d6bed35d2288a788e80af4d69d2f423defc0dd993b6

SHA512
08b4552dc578218db2525bf633eb9f939ddc6bbc1a20aff3f7b52313bf8a0318d60a1e6f535828c65d866ba4957a6ec0f07158234d0663f0ba53052663474937

Download Submit
C:\Users\Admin\AppData\Local\Temp\49wSmssHRvTX.bat

Filesize
195B

MD5
9c5de86c8cb5e13acacf144026eb2d21

SHA1
88baebd0ddb8817b4f83f77aced371454857b864

SHA256
fff74a9bf7d465ac68df233338e439bc6ec5c083ba19d01be7835f955fdbdf31

SHA512
3f24bc2c8432ec8415c87f552be2274fdf6f41b732b6724317435c09ad63a9990eb043a25fd67b1e5b0b47424371b3b0c626db1b39efbdb73e65d86924a3597e

Download Submit
C:\Users\Admin\AppData\Local\Temp\4yrClg40yh1V.bat

Filesize
195B

MD5
fa7854b7b7c58015e24c355dd308073a

SHA1
9585d9795626ec755bbd3cb5675e7fb08d06320a

SHA256
078f19e36a5a537cc1986c4555bebf46fb05dbacd4b0643f53903bfe89129cbf

SHA512
c1582975bfc810b74db481298e7f1bb047ea83d2f3debd5d5ee10e22d3106a58f4eec158597add4cab0a2b4871c89cf32dc2fa367897bea2c128631393448667

Download Submit
C:\Users\Admin\AppData\Local\Temp\B3MdQ1bkYc4Y.bat

Filesize
195B

MD5
6ae02e2ce5e098ef91197b8dc25d3121

SHA1
9e48e3945e17bb9887eed15d462db585c1cf5a96

SHA256
c2f946e33cdffa5c504852aa4d89ec9e7a844c99a5d38879e90e4bd8b8d6dd92

SHA512
a397c0ab44f67ee5f56345315b4f6110889bf585ad3f366a85e2f83ca31abd2845210bfe360c8579b240b377b85f6c1f305cab61a403467e1f431efef3475578

Download Submit
C:\Users\Admin\AppData\Local\Temp\DuAMn4BDPTJN.bat

Filesize
195B

MD5
311a448d33a564e1f835a8c53fad04ee

SHA1
ef61c1e430b07462a0c0d5183893b5b3cd72f01c

SHA256
98c383af5163c4a39428966e8ce870fb468fbe434c24cbb2d38aa263bcd6df74

SHA512
c94bbaef7df4d7ea26eea414ac13ca1f22b5ebe67d110d469275a86a2981c12cb1bd339525009518b85715141b9dbfabed38c720625bc0292ad529f1521db325

Download Submit
C:\Users\Admin\AppData\Local\Temp\DuqIUb2NtOTx.bat

Filesize
195B

MD5
8a24dc7f15709ec6d23140923693f673

SHA1
17d036efa4babf03b15bc06d695d235ba2d0e98d

SHA256
5896e6af86ca9167ae21cc445413c8198c34e1682fa3ba3e0dc3d991035c3a7d

SHA512
656aa64e442fd2770078e38e6ce9f561ebe855da7d6ec94cd801d7eb74e8e84bbeee8d8a2d0b742738aad35c1747a3a3bd59d8828159dc39511f4e51e47435bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\GXVPOa98bJEH.bat

Filesize
195B

MD5
dc935a65da1c02191b10de4cef20d35f

SHA1
c3e6191ccd8175a590e6dc48799dc96fd3ef1471

SHA256
6e6c026de47fac04c5cff9fa9929f8981277ff305c2c8db939cc53da58ef7e08

SHA512
e903c117693e4fffb3c0e48c6415f54475a58098a68d05a1f3c15803f8440282f0bd52d6ea722026ae5b0ea878329adb1f9af63b4a3ab9d026f651cfa1824d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\HJCEC9ZuTo8Y.bat

Filesize
195B

MD5
d69847bf27915688b9ceebe1b2ffe024

SHA1
232fccc916a0074eb61b06e1a7cdbb2245b580b9

SHA256
b3ff8fee4979c4704e09cae6d527e0aac83232211470db396b296071533b7417

SHA512
433fbb6e7675164ef9e808edf34ba59cfefa0004657d6d31772f38b3a4d5feba8ee6f92be7450c0b6345d7b182abd6f1bed9d723950a702abb521cfe0919d93f

Download Submit
C:\Users\Admin\AppData\Local\Temp\NHFgzds1AKwe.bat

Filesize
195B

MD5
9b1d7371a77e685f3550814c8bfe27a9

SHA1
f8a3e3df43e51d5801ef5768eca289a75ac1ef16

SHA256
346e459460d9717198111de9450fd30c1a0ca33eef548a7a083a32fca906d41e

SHA512
9a15f540e44a161ef49223790a1c5ae7dab0c82c1ae8f6322523d4fb5f78253dec007a42b89e89ca9a9555997749b47ac1905e355e1631b7abe25d44ca5f7700

Download Submit
C:\Users\Admin\AppData\Local\Temp\NQJO2lluWDTB.bat

Filesize
195B

MD5
08d4805d6d3872537c52b6a0397cff27

SHA1
b7eccd3bfe37c1ae7d290865e132e950ee4635b1

SHA256
c0f8a4bf3598cc2a6902bb5e9736b8f4b5c3f8c273207beca097549b8a4c2d7f

SHA512
e8c77aabaf3bb0d2b0f019e9ab77291c33fa3fe639f73c70bb57dea47efd4ce03624ea5c1da0fca024ede19c181111cc878d43929aa60dbda5c6d30fb4559bca

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZukQySAXK6o7.bat

Filesize
195B

MD5
35eab386c8c35a1bbd10bc380b8fb12f

SHA1
1d102a9bc752a38614af6cc99339ac3d78474a96

SHA256
1a9b09063148076a6f4b3c0b45212f55de2ca8c75c8667bf1cd7a6b360c2cae3

SHA512
cade9a10c42322c6dea6188a24672ba52fdcf787785a884c17f30414ac86d01d7772413f57f3af7256ad4c409c6e1066e67af250d2a28f16516fa1d58d9d007b

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsFEzFg5VUUw.bat

Filesize
195B

MD5
3de2e6e98cdc6afcdaa57a5a01259324

SHA1
948e63c68ef52d805d1095d735a85fe893d157dd

SHA256
877ccb3fa60acf73b9942b5d8aec41d8c9857ecb007df13f105d7a44aca17cff

SHA512
261ea534c615b35ce88821ced44e6cf6cece3d9ae3d0791f1801491acba382e8455f0fc3a7e2d51fb74bad226f34dfe67b5b2752769c9a9a81143867ea62fc74

Download Submit
C:\Users\Admin\AppData\Local\Temp\kwTSyYqeCbBM.bat

Filesize
195B

MD5
9972dd299d54d713178530068a1e0970

SHA1
324e0c79a4851c77f1de0dc9e5dcf9f914ded154

SHA256
e03eff5e2bc9a18d7687852fa34d7a6691dfec7f7832d6e03977ae6ca82b7ff5

SHA512
d282e953eec75173eb0c776ab59ebf141f7f055fdc9856489da516ac1e4e53e59ee08946560533d97715fbdc80ad294af8a85979a0d91085906737538b5a2046

Download Submit
C:\Users\Admin\AppData\Local\Temp\wFx9Jsz1eMt6.bat

Filesize
195B

MD5
d6bdd48b779c9c2dc5c5e646929ededa

SHA1
6b54ed286550eebda7e3b69a6fd05807129b3013

SHA256
17aa64d6ccaea0a6e928bab8b3ffec5f83b5fe6db4c5f74792413614191f7671

SHA512
72054d4e8675a09cfe40626bcd4deebef6cdadd147abc619048515ba06159f17b7dd08df03237b651c88045eb4c4bfe2bcb6379fe12e3d5e7dea783f45246113

Download Submit
C:\Users\Admin\AppData\Local\Temp\wLsYj1KU4PV9.bat

Filesize
195B

MD5
b0f4fa708feac3c3096b5e6285578752

SHA1
998839f33221dfa2089d7936dc07906ff5c9a7be

SHA256
a2e3d286ae4b465d981b32342578798da82550e47fae259727153abf4e48038a

SHA512
f6e2b09f77afc22994bde73a7f5a62904f4b00ab28637aa5689635af4d6af8540e9f5677a3087aa22a46c3d2576e2eee37881ecea70d3da2148fa9504305e66c

Download Submit
C:\Windows\System32\Extras\Win64.exe

Filesize
3.1MB

MD5
abdb9928a2443e939fd0e3b2758fac86

SHA1
963518e3d31b32ade1faa2d3ad4a5f29f4a94718

SHA256
36ea2fb6f0b7279ea15e54dba6d2c41a00bc3f56e26a59e1bf21867865b2e2db

SHA512
3b21a68634fe6c467de89614a7719aed29d664d83857dc3f9684eaa96a155e349aa471bf2bd7a526e201de4805ce2072224de0bb6763490fce6da61b089eb2bb

Download Submit
memory/2380-0-0x00007FFEC95C3000-0x00007FFEC95C5000-memory.dmp

Filesize
8KB

Download
memory/2380-2-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/2380-1-0x0000000000960000-0x0000000000C84000-memory.dmp

Filesize
3.1MB

Download
memory/2380-10-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/3472-18-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/3472-9-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/3472-11-0x00007FFEC95C0000-0x00007FFECA081000-memory.dmp

Filesize
10.8MB

Download
memory/3472-13-0x000000001C2B0000-0x000000001C362000-memory.dmp

Filesize
712KB

Download
memory/3472-12-0x000000001C1A0000-0x000000001C1F0000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads