quasar | 36ea2fb6f0b7279ea15e54dba6d2c41a00bc3f56e26a59e1bf21867865b2e2db

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27-12-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RevsExternal.exe
Size

3.1MB
MD5

abdb9928a2443e939fd0e3b2758fac86
SHA1

963518e3d31b32ade1faa2d3ad4a5f29f4a94718
SHA256

36ea2fb6f0b7279ea15e54dba6d2c41a00bc3f56e26a59e1bf21867865b2e2db
SHA512

3b21a68634fe6c467de89614a7719aed29d664d83857dc3f9684eaa96a155e349aa471bf2bd7a526e201de4805ce2072224de0bb6763490fce6da61b089eb2bb
SSDEEP

49152:Xvluf2NUaNmwzPWlvdaKM7ZxTwi0zBBxLSoGd5THHB72eh2NT:Xvwf2NUaNmwzPWlvdaB7ZxTwJz8

Score

10^/10

quasar aurareal discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

AuraReal

tcp://auraboyy-27610.portmap.host:23133 => 4782:23133

Mutex

23455755-5d9f-40df-b240-406c00706fe9

Attributes

encryption_key
2482B7514A53EC61E5CFC0A64CF01CDEB49C6056
install_name
Win64.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Extras

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral1/memory/2324-1-0x0000000000E60000-0x0000000001184000-memory.dmp	family_quasar
behavioral1/files/0x0009000000016d3f-6.dat	family_quasar
behavioral1/memory/2372-10-0x0000000001260000-0x0000000001584000-memory.dmp	family_quasar

Executes dropped EXE 13 IoCs

pid	Process
2372	Win64.exe
2896	Win64.exe
2340	Win64.exe
2960	Win64.exe
1980	Win64.exe
1556	Win64.exe
1944	Win64.exe
2872	Win64.exe
2676	Win64.exe
1656	Win64.exe
3012	Win64.exe
1164	Win64.exe
2400	Win64.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	RevsExternal.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File created	C:\Windows\system32\Extras\Win64.exe	RevsExternal.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe
File opened for modification	C:\Windows\system32\Extras\Win64.exe	Win64.exe
File opened for modification	C:\Windows\system32\Extras	RevsExternal.exe
File opened for modification	C:\Windows\system32\Extras	Win64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3056	PING.EXE
1160	PING.EXE
2380	PING.EXE
2568	PING.EXE
1380	PING.EXE
2516	PING.EXE
2068	PING.EXE
2428	PING.EXE
1620	PING.EXE
2840	PING.EXE
2000	PING.EXE
1968	PING.EXE
2568	PING.EXE

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
1160	PING.EXE
1620	PING.EXE
1380	PING.EXE
2068	PING.EXE
2568	PING.EXE
2428	PING.EXE
2516	PING.EXE
3056	PING.EXE
2380	PING.EXE
2840	PING.EXE
2568	PING.EXE
2000	PING.EXE
1968	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1384	schtasks.exe
1760	schtasks.exe
2944	schtasks.exe
1504	schtasks.exe
1512	schtasks.exe
1596	schtasks.exe
2276	schtasks.exe
1932	schtasks.exe
1692	schtasks.exe
1312	schtasks.exe
2164	schtasks.exe
2116	schtasks.exe
2312	schtasks.exe
2792	schtasks.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	RevsExternal.exe
Token: SeDebugPrivilege	2372	Win64.exe
Token: SeDebugPrivilege	2896	Win64.exe
Token: SeDebugPrivilege	2340	Win64.exe
Token: SeDebugPrivilege	2960	Win64.exe
Token: SeDebugPrivilege	1980	Win64.exe
Token: SeDebugPrivilege	1556	Win64.exe
Token: SeDebugPrivilege	1944	Win64.exe
Token: SeDebugPrivilege	2872	Win64.exe
Token: SeDebugPrivilege	2676	Win64.exe
Token: SeDebugPrivilege	1656	Win64.exe
Token: SeDebugPrivilege	3012	Win64.exe
Token: SeDebugPrivilege	1164	Win64.exe
Token: SeDebugPrivilege	2400	Win64.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2372	Win64.exe
2896	Win64.exe
2340	Win64.exe
2960	Win64.exe
1980	Win64.exe
1556	Win64.exe
1944	Win64.exe
2872	Win64.exe
2676	Win64.exe
1656	Win64.exe
3012	Win64.exe
1164	Win64.exe
2400	Win64.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
2372	Win64.exe
2896	Win64.exe
2340	Win64.exe
2960	Win64.exe
1980	Win64.exe
1556	Win64.exe
1944	Win64.exe
2872	Win64.exe
2676	Win64.exe
1656	Win64.exe
3012	Win64.exe
1164	Win64.exe
2400	Win64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1760	2324	RevsExternal.exe	30
PID 2324 wrote to memory of 1760	2324	RevsExternal.exe	30
PID 2324 wrote to memory of 1760	2324	RevsExternal.exe	30
PID 2324 wrote to memory of 2372	2324	RevsExternal.exe	32
PID 2324 wrote to memory of 2372	2324	RevsExternal.exe	32
PID 2324 wrote to memory of 2372	2324	RevsExternal.exe	32
PID 2372 wrote to memory of 1692	2372	Win64.exe	34
PID 2372 wrote to memory of 1692	2372	Win64.exe	34
PID 2372 wrote to memory of 1692	2372	Win64.exe	34
PID 2372 wrote to memory of 2788	2372	Win64.exe	36
PID 2372 wrote to memory of 2788	2372	Win64.exe	36
PID 2372 wrote to memory of 2788	2372	Win64.exe	36
PID 2788 wrote to memory of 2796	2788	cmd.exe	38
PID 2788 wrote to memory of 2796	2788	cmd.exe	38
PID 2788 wrote to memory of 2796	2788	cmd.exe	38
PID 2788 wrote to memory of 2840	2788	cmd.exe	39
PID 2788 wrote to memory of 2840	2788	cmd.exe	39
PID 2788 wrote to memory of 2840	2788	cmd.exe	39
PID 2788 wrote to memory of 2896	2788	cmd.exe	40
PID 2788 wrote to memory of 2896	2788	cmd.exe	40
PID 2788 wrote to memory of 2896	2788	cmd.exe	40
PID 2896 wrote to memory of 2792	2896	Win64.exe	41
PID 2896 wrote to memory of 2792	2896	Win64.exe	41
PID 2896 wrote to memory of 2792	2896	Win64.exe	41
PID 2896 wrote to memory of 2044	2896	Win64.exe	43
PID 2896 wrote to memory of 2044	2896	Win64.exe	43
PID 2896 wrote to memory of 2044	2896	Win64.exe	43
PID 2044 wrote to memory of 2656	2044	cmd.exe	45
PID 2044 wrote to memory of 2656	2044	cmd.exe	45
PID 2044 wrote to memory of 2656	2044	cmd.exe	45
PID 2044 wrote to memory of 2568	2044	cmd.exe	46
PID 2044 wrote to memory of 2568	2044	cmd.exe	46
PID 2044 wrote to memory of 2568	2044	cmd.exe	46
PID 2044 wrote to memory of 2340	2044	cmd.exe	47
PID 2044 wrote to memory of 2340	2044	cmd.exe	47
PID 2044 wrote to memory of 2340	2044	cmd.exe	47
PID 2340 wrote to memory of 1504	2340	Win64.exe	48
PID 2340 wrote to memory of 1504	2340	Win64.exe	48
PID 2340 wrote to memory of 1504	2340	Win64.exe	48
PID 2340 wrote to memory of 2024	2340	Win64.exe	50
PID 2340 wrote to memory of 2024	2340	Win64.exe	50
PID 2340 wrote to memory of 2024	2340	Win64.exe	50
PID 2024 wrote to memory of 1488	2024	cmd.exe	52
PID 2024 wrote to memory of 1488	2024	cmd.exe	52
PID 2024 wrote to memory of 1488	2024	cmd.exe	52
PID 2024 wrote to memory of 2000	2024	cmd.exe	53
PID 2024 wrote to memory of 2000	2024	cmd.exe	53
PID 2024 wrote to memory of 2000	2024	cmd.exe	53
PID 2024 wrote to memory of 2960	2024	cmd.exe	54
PID 2024 wrote to memory of 2960	2024	cmd.exe	54
PID 2024 wrote to memory of 2960	2024	cmd.exe	54
PID 2960 wrote to memory of 1312	2960	Win64.exe	55
PID 2960 wrote to memory of 1312	2960	Win64.exe	55
PID 2960 wrote to memory of 1312	2960	Win64.exe	55
PID 2960 wrote to memory of 2236	2960	Win64.exe	57
PID 2960 wrote to memory of 2236	2960	Win64.exe	57
PID 2960 wrote to memory of 2236	2960	Win64.exe	57
PID 2236 wrote to memory of 2424	2236	cmd.exe	59
PID 2236 wrote to memory of 2424	2236	cmd.exe	59
PID 2236 wrote to memory of 2424	2236	cmd.exe	59
PID 2236 wrote to memory of 1380	2236	cmd.exe	60
PID 2236 wrote to memory of 1380	2236	cmd.exe	60
PID 2236 wrote to memory of 1380	2236	cmd.exe	60
PID 2236 wrote to memory of 1980	2236	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RevsExternal.exe
"C:\Users\Admin\AppData\Local\Temp\RevsExternal.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1760
- C:\Windows\system32\Extras\Win64.exe
  "C:\Windows\system32\Extras\Win64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1692
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\3NtEIVcISHB5.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2796
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2840
  - - C:\Windows\system32\Extras\Win64.exe
      "C:\Windows\system32\Extras\Win64.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2792
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PfLTCLXijm9v.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2044
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2656
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2568
      - C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1504
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\TYgvwDHEMKgu.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1488
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2000
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1312
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\lNleHYCxfWJq.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2424
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1380
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1980
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1512
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PmsDNaM5tJ89.bat" "
        11⤵
        
        PID:1412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2088
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1968
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1556
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2164
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\kvG8NOOfzKSB.bat" "
        13⤵
        
        PID:1896
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2556
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2516
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1944
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1596
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sRY1mcnWUG24.bat" "
        15⤵
        
        PID:2604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2196
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2068
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2872
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1384
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Quni7ORJ31nf.bat" "
        17⤵
        
        PID:2864
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2912
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3056
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2676
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2116
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\vs6fEYUxCVGA.bat" "
        19⤵
        
        PID:3024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1460
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2568
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1656
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2944
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\O3Yl3DMVdHxc.bat" "
        21⤵
        
        PID:2000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2636
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2428
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3012
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2276
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\NnM5xsIcWnPW.bat" "
        23⤵
        
        PID:676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:960
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1160
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1164
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1932
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\THsS1syrvOVE.bat" "
        25⤵
        
        PID:1356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:840
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2380
        
        C:\Windows\system32\Extras\Win64.exe
        
        "C:\Windows\system32\Extras\Win64.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2400
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Windows\system32\Extras\Win64.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2312
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\wXxr8yNjPf9S.bat" "
        27⤵
        
        PID:2492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1896
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3NtEIVcISHB5.bat

Filesize
195B

MD5
3101ae7842b861f9d0b2a1c5237f189f

SHA1
5c902b38ed15a96529f2598799aade2c9998244f

SHA256
caafe2824504ad42e63a64d4582819ead29c689bffeb51067ecfb46e0223e218

SHA512
92c8578dfd74a7c82d4a86158e9b6e93db496ba6b1e1b5724ba6396d6bfcf7dc0037114636c511cf95799367d3dd8c6934e60ed8d499e768ec01524e4fff96ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\NnM5xsIcWnPW.bat

Filesize
195B

MD5
2efb6451fbb8dd6a7dbc6ea2709aa4f3

SHA1
6b2b1bd4557881bd33a02712f6856a50b9933a96

SHA256
3fe48c3f4375236b76451a430ab367f259d656032e7b16c774d4a678c6dff46e

SHA512
075c1335e7bb04d8128c5e4cfd036329d0ff5023c73911d2059b305f00dfc734308ecd87d1131737a26ff50318827d773987aa137c8310d0e9b3ec763181a157

Download Submit
C:\Users\Admin\AppData\Local\Temp\O3Yl3DMVdHxc.bat

Filesize
195B

MD5
1a8fa90c77ee4a2e58e28ed49b5638cc

SHA1
fc36b1d0990f6bb7cce54ffaa3ca0e8a5d9eca8b

SHA256
5b958dd62fd8d269747ea41efb3a3fe51a0ef47d5434de34bda0e17981768288

SHA512
dbf36435f8d5c221ff16a8a1b28b1c431731651aad020dfeac93d8f048bd9eca1c029ab104a370971407a05bf4999822cf5d07eaa4f79c06e4c9b53d3610b4e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\PfLTCLXijm9v.bat

Filesize
195B

MD5
9e299399f59c145406af0668a2a68137

SHA1
b2ed9217d208f0c704589c5c48612c0328fffbb5

SHA256
c2f0672dd1f79b2c297745ca1a30fa2efc22240b9aae80996b3e878e66ef74f0

SHA512
5c4d0a29a399f79f07185e570cdc69a668c95d4034dc9c712baea461ddc4458991b67d99f4a37a1cf8bb9065bac3c45fb176572297817dab2b7d8df201af5d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\PmsDNaM5tJ89.bat

Filesize
195B

MD5
6069b1c1119f86dae980b13d5d867c2b

SHA1
de9d6de18607743be401f9b5ef1a04a6552234fa

SHA256
2ffbca72f9cf86164d876c17c8d1122ec214891978b68d4e4c158e890ee10674

SHA512
1cc959ea9aad00e5962852dd608e7f8e3516b16f5f98678cdba55bafe166b6bb93fe2716840c5e54e24f819caecae996592e04adbcd087d66387a2477995d490

Download Submit
C:\Users\Admin\AppData\Local\Temp\Quni7ORJ31nf.bat

Filesize
195B

MD5
154c537354c2b4d26be50de961cfc41b

SHA1
698d08c05815560fc12062553bd14010b8e69440

SHA256
b02747aefa2bc42a229413c826717c80ca2f6fbaa89ec36ae60ee9b5d9300b8d

SHA512
2d1f27bd1163f77573848126d90a841d02c02e8db1727f98104397c0178fd30289519618199775680ca97135a39af1cf297e6778a45c21eb4b16a515b7be76c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\THsS1syrvOVE.bat

Filesize
195B

MD5
aed5e87baf034b0ab471c8d8a6aca707

SHA1
c385d5d4c6fbbb49af5e9d9967d9a9de7245dc8b

SHA256
535293a28dd8fdb9c9936f5236f82af30ba6e8aabb7c86686d749dfa695b9734

SHA512
732c50f9ead39a9d6b41509019ed95dce93b65bca79ae887634da093e6b8e181b62fb59bd4efc85d03b109737250ffcba8a4547abf11d2a51b4021652b7eb230

Download Submit
C:\Users\Admin\AppData\Local\Temp\TYgvwDHEMKgu.bat

Filesize
195B

MD5
edfaadd54d4258e9bc3c7cc2cd9badf4

SHA1
ff5b3695c568e60cf196d14a69aa5975918ed773

SHA256
7c41e9557da1eb7b4401e2122251120271d52f9c7ad1719d5e60891dcc8cb270

SHA512
1b67956ad619bad42e63bf6f4a2e1b37c76c140f6d0817be33f58ff047969d48b7e56b1d6d3b6c0e13348013eabf9e3d309de7c313c4ae75b68ed32e872d968b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kvG8NOOfzKSB.bat

Filesize
195B

MD5
9298338d1bf6492ca033f224aae314ae

SHA1
9131870e6505a0e5a9be4b22f15dd9b6287859b2

SHA256
4eae7fc1bae324501cb8cd22ecbb1ecd91d9c153bdd9f344966636237bdd1320

SHA512
637336405dad6fb89ab8bc014be9a63420a66f0ad7f0476ec1ba06eca4a3c17fc26ecdee34f8e0346bec78da9f9f4927fdcf6980d072e76eca6e439d734bfef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lNleHYCxfWJq.bat

Filesize
195B

MD5
6f55301b281860010b832aeecbcf5b4d

SHA1
3160a498607d68a4e6773df7c471a2c5815da42a

SHA256
92ec651c262ad1f67cafa97940451d1d1c26c4766d8b0fff346b1926633b07c7

SHA512
e925ff28a65d6f5e5dc1d0b616c62d5e33aff4bec8f061b5d99b523d44887e98751629aba5433bd43da50d399951c8fcfb83c89079b1e4bfcf63ef685c96007a

Download Submit
C:\Users\Admin\AppData\Local\Temp\sRY1mcnWUG24.bat

Filesize
195B

MD5
eaa2b848135bd8101f2b37c0a2ed7963

SHA1
66b4385ad1e5fb0f7a063e8e13ec23db314dab86

SHA256
8c2fa4371ddf550ace8d1f61c3a5448ea122a74e135b714659267d75834f7d22

SHA512
35b7b0eadbf440b004db5c8244e87ca13cab7c8676e2f71024f844c04d807b8e83bcba35d3caf05f2732850712ede305f102187d693178c028bb0d795e6bb87c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vs6fEYUxCVGA.bat

Filesize
195B

MD5
1e12d7c9e3bc2ee525bec377eae1271d

SHA1
51a59d44caa9d641c7166dbe59ba77a7bf7da71c

SHA256
8c633e9ee0e44ed4308bff6bc3269f6bfe7effe32020a77555d10c5ea58c5bd0

SHA512
d97467d1249ffb8d4fef9782cd5bd50a12b589b480c57abb06f9dfcfd941071f84d60a1afac09e2bf64c6ff6a037f3fb750256138983c8747329abaeab676fa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\wXxr8yNjPf9S.bat

Filesize
195B

MD5
df0c6da00ca99e93507491f44be65714

SHA1
5653046bfa505b03375520bdcca812dce176c45b

SHA256
b4c03eae2b33bc34cdfec007916d11151e68769dc02f27c61278689db7e9033c

SHA512
9f5216cce8ab87fa896e956e530bd92214732ae8c79b9dddb7de4c768205aeae098c9cca9fc7ee7193b3170712743a0f02cff9f23c6dced313a342504445c7bb

Download Submit
C:\Windows\System32\Extras\Win64.exe

Filesize
3.1MB

MD5
abdb9928a2443e939fd0e3b2758fac86

SHA1
963518e3d31b32ade1faa2d3ad4a5f29f4a94718

SHA256
36ea2fb6f0b7279ea15e54dba6d2c41a00bc3f56e26a59e1bf21867865b2e2db

SHA512
3b21a68634fe6c467de89614a7719aed29d664d83857dc3f9684eaa96a155e349aa471bf2bd7a526e201de4805ce2072224de0bb6763490fce6da61b089eb2bb

Download Submit
memory/2324-0-0x000007FEF5DD3000-0x000007FEF5DD4000-memory.dmp

Filesize
4KB

Download
memory/2324-8-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2324-2-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2324-1-0x0000000000E60000-0x0000000001184000-memory.dmp

Filesize
3.1MB

Download
memory/2372-10-0x0000000001260000-0x0000000001584000-memory.dmp

Filesize
3.1MB

Download
memory/2372-9-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2372-11-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2372-21-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads