quasar | a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a

Analysis

max time kernel
112s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
Size

375KB
MD5

55029651ecad5f3be071b6abafb56d90
SHA1

a008e8d91c2725eb16e42c3800ace5492a32416e
SHA256

a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a
SHA512

83dc82b2aa027ebd62aeceb15b6ae1e71a72da16f557833b8439cda6dded817799748a06ef7721931626d06b687a57fc4be56f1e8846d6e9a6708ad757afb903
SSDEEP

6144:YbqQ4i1FFiEKZVSQZzs5jQKbgQ203StbjjSQkzaozVVqHk:CpliPScgCy73StbjjSQkVzV0Hk

Score

10^/10

quasar authenticator discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Authenticator

iamaskibiditoilet-58299.portmap.host:58299

Mutex

QSR_MUTEX_bNzknSVeSVx21JnqhQ

Attributes

encryption_key
wAIAzlOLR0d5V3YI1aCM
install_name
Runtime Broker.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Runtime Broker
subdirectory
SubDir

Signatures

Quasar RAT 3 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

description	flow	ioc	Process
Key opened		\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
	15	ip-api.com	Process not Found
	53	ip-api.com	Process not Found

Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1792-1-0x0000000000E60000-0x0000000000EC4000-memory.dmp	family_quasar
behavioral2/files/0x0008000000023c4f-11.dat	family_quasar

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	Runtime Broker.exe

Executes dropped EXE 11 IoCs

pid	Process
4560	Runtime Broker.exe
3920	Runtime Broker.exe
3504	Runtime Broker.exe
3456	Runtime Broker.exe
4552	Runtime Broker.exe
616	Runtime Broker.exe
404	Runtime Broker.exe
2932	Runtime Broker.exe
5016	Runtime Broker.exe
4568	Runtime Broker.exe
1620	Runtime Broker.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	ip-api.com
15	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
1512	4560	WerFault.exe	87
3720	3920	WerFault.exe	98
3112	3504	WerFault.exe	120
3340	3456	WerFault.exe	134
2892	4552	WerFault.exe	145
3100	616	WerFault.exe	156
4112	404	WerFault.exe	168
1436	2932	WerFault.exe	179
4404	5016	WerFault.exe	190
2460	4568	WerFault.exe	201
1512	1620	WerFault.exe	212

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4540	PING.EXE
4032	PING.EXE
1328	PING.EXE
4828	PING.EXE
4928	PING.EXE
2984	PING.EXE
4988	PING.EXE
4404	PING.EXE
3776	PING.EXE
4180	PING.EXE
3596	PING.EXE

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
4928	PING.EXE
2984	PING.EXE
4988	PING.EXE
4404	PING.EXE
4032	PING.EXE
4180	PING.EXE
4828	PING.EXE
3596	PING.EXE
4540	PING.EXE
1328	PING.EXE
3776	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2676	schtasks.exe
4796	schtasks.exe
4300	schtasks.exe
3100	schtasks.exe
4504	schtasks.exe
1272	schtasks.exe
3068	schtasks.exe
3588	schtasks.exe
632	schtasks.exe
4456	schtasks.exe
404	schtasks.exe
2136	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
Token: SeDebugPrivilege	4560	Runtime Broker.exe
Token: SeDebugPrivilege	3920	Runtime Broker.exe
Token: SeDebugPrivilege	3504	Runtime Broker.exe
Token: SeDebugPrivilege	3456	Runtime Broker.exe
Token: SeDebugPrivilege	4552	Runtime Broker.exe
Token: SeDebugPrivilege	616	Runtime Broker.exe
Token: SeDebugPrivilege	404	Runtime Broker.exe
Token: SeDebugPrivilege	2932	Runtime Broker.exe
Token: SeDebugPrivilege	5016	Runtime Broker.exe
Token: SeDebugPrivilege	4568	Runtime Broker.exe
Token: SeDebugPrivilege	1620	Runtime Broker.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4560	Runtime Broker.exe
3920	Runtime Broker.exe
3504	Runtime Broker.exe
3456	Runtime Broker.exe
4552	Runtime Broker.exe
616	Runtime Broker.exe
404	Runtime Broker.exe
2932	Runtime Broker.exe
5016	Runtime Broker.exe
4568	Runtime Broker.exe
1620	Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3588	1792	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	85
PID 1792 wrote to memory of 3588	1792	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	85
PID 1792 wrote to memory of 3588	1792	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	85
PID 1792 wrote to memory of 4560	1792	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	87
PID 1792 wrote to memory of 4560	1792	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	87
PID 1792 wrote to memory of 4560	1792	a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe	87
PID 4560 wrote to memory of 632	4560	Runtime Broker.exe	88
PID 4560 wrote to memory of 632	4560	Runtime Broker.exe	88
PID 4560 wrote to memory of 632	4560	Runtime Broker.exe	88
PID 4560 wrote to memory of 4720	4560	Runtime Broker.exe	90
PID 4560 wrote to memory of 4720	4560	Runtime Broker.exe	90
PID 4560 wrote to memory of 4720	4560	Runtime Broker.exe	90
PID 4720 wrote to memory of 3556	4720	cmd.exe	93
PID 4720 wrote to memory of 3556	4720	cmd.exe	93
PID 4720 wrote to memory of 3556	4720	cmd.exe	93
PID 4720 wrote to memory of 4928	4720	cmd.exe	96
PID 4720 wrote to memory of 4928	4720	cmd.exe	96
PID 4720 wrote to memory of 4928	4720	cmd.exe	96
PID 4720 wrote to memory of 3920	4720	cmd.exe	98
PID 4720 wrote to memory of 3920	4720	cmd.exe	98
PID 4720 wrote to memory of 3920	4720	cmd.exe	98
PID 3920 wrote to memory of 4456	3920	Runtime Broker.exe	100
PID 3920 wrote to memory of 4456	3920	Runtime Broker.exe	100
PID 3920 wrote to memory of 4456	3920	Runtime Broker.exe	100
PID 3920 wrote to memory of 4896	3920	Runtime Broker.exe	102
PID 3920 wrote to memory of 4896	3920	Runtime Broker.exe	102
PID 3920 wrote to memory of 4896	3920	Runtime Broker.exe	102
PID 4896 wrote to memory of 4256	4896	cmd.exe	106
PID 4896 wrote to memory of 4256	4896	cmd.exe	106
PID 4896 wrote to memory of 4256	4896	cmd.exe	106
PID 4896 wrote to memory of 2984	4896	cmd.exe	107
PID 4896 wrote to memory of 2984	4896	cmd.exe	107
PID 4896 wrote to memory of 2984	4896	cmd.exe	107
PID 4896 wrote to memory of 3504	4896	cmd.exe	120
PID 4896 wrote to memory of 3504	4896	cmd.exe	120
PID 4896 wrote to memory of 3504	4896	cmd.exe	120
PID 3504 wrote to memory of 404	3504	Runtime Broker.exe	122
PID 3504 wrote to memory of 404	3504	Runtime Broker.exe	122
PID 3504 wrote to memory of 404	3504	Runtime Broker.exe	122
PID 3504 wrote to memory of 708	3504	Runtime Broker.exe	124
PID 3504 wrote to memory of 708	3504	Runtime Broker.exe	124
PID 3504 wrote to memory of 708	3504	Runtime Broker.exe	124
PID 708 wrote to memory of 3584	708	cmd.exe	128
PID 708 wrote to memory of 3584	708	cmd.exe	128
PID 708 wrote to memory of 3584	708	cmd.exe	128
PID 708 wrote to memory of 4540	708	cmd.exe	129
PID 708 wrote to memory of 4540	708	cmd.exe	129
PID 708 wrote to memory of 4540	708	cmd.exe	129
PID 708 wrote to memory of 3456	708	cmd.exe	134
PID 708 wrote to memory of 3456	708	cmd.exe	134
PID 708 wrote to memory of 3456	708	cmd.exe	134
PID 3456 wrote to memory of 2676	3456	Runtime Broker.exe	136
PID 3456 wrote to memory of 2676	3456	Runtime Broker.exe	136
PID 3456 wrote to memory of 2676	3456	Runtime Broker.exe	136
PID 3456 wrote to memory of 1792	3456	Runtime Broker.exe	138
PID 3456 wrote to memory of 1792	3456	Runtime Broker.exe	138
PID 3456 wrote to memory of 1792	3456	Runtime Broker.exe	138
PID 1792 wrote to memory of 2224	1792	cmd.exe	142
PID 1792 wrote to memory of 2224	1792	cmd.exe	142
PID 1792 wrote to memory of 2224	1792	cmd.exe	142
PID 1792 wrote to memory of 4988	1792	cmd.exe	143
PID 1792 wrote to memory of 4988	1792	cmd.exe	143
PID 1792 wrote to memory of 4988	1792	cmd.exe	143
PID 1792 wrote to memory of 4552	1792	cmd.exe	145

C:\Users\Admin\AppData\Local\Temp\a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe
"C:\Users\Admin\AppData\Local\Temp\a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe"
1⤵
- Quasar RAT
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3588
- C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\v587bhWNEo8f.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:3556
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4928
  - - C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3920
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4456
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nnfbwf2SwV0j.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4896
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4256
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2984
      - C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KJga4CwkV9tI.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:708
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3584
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4540
        
        C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2676
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xMe8lfbQHYNf.bat" "
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2224
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4988
        
        C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4552
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        11⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s0Gq0Bv35AH3.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2124
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2588
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4404
        
        C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:616
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        13⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4300
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wGNMTaXA2E8j.bat" "
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:936
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4032
        
        C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:404
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        15⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2136
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\92HAIg5zisG8.bat" "
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:1788
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:2908
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1328
        
        C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2932
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        17⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4504
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wglVD229dlhn.bat" "
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:1592
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:4316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3776
        
        C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5016
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        19⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\S92ySNagmVvm.bat" "
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:792
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4180
        
        C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4568
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        21⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3100
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KEkM3TxTTFHg.bat" "
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4828
        
        C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe" /rl HIGHEST /f
        23⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3068
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R2lCBHWPXBgr.bat" "
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:2036
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1620 -s 2204
        23⤵
        Program crash
        
        PID:1512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 2220
        21⤵
        Program crash
        
        PID:2460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 1936
        19⤵
        Program crash
        
        PID:4404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 2224
        17⤵
        Program crash
        
        PID:1436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 2204
        15⤵
        Program crash
        
        PID:4112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 2224
        13⤵
        Program crash
        
        PID:3100
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 2200
        11⤵
        Program crash
        
        PID:2892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 2224
        9⤵
        Program crash
        
        PID:3340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 2228
        7⤵
        Program crash
        
        PID:3112
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 2192
        5⤵
        Program crash
        
        PID:3720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 1668
    3⤵
    - Program crash
    PID:1512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4560 -ip 4560
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3920 -ip 3920
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3504 -ip 3504
1⤵
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3456 -ip 3456
1⤵
PID:2932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4552 -ip 4552
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 616 -ip 616
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 404 -ip 404
1⤵
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2932 -ip 2932
1⤵
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5016 -ip 5016
1⤵
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4568 -ip 4568
1⤵
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1620 -ip 1620
1⤵
PID:428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\92HAIg5zisG8.bat

Filesize
215B

MD5
8d443548ad02bc1cb19cef630b73b2eb

SHA1
8c8b091a1d54e1f3d7a413e6aabe02a95ac4376c

SHA256
28521e3f4afcd9ea48689a2a2bd41fdf7f1b4b448b8f493be16442b0ce799bb5

SHA512
93f75864c43853f17953a311c63318204c025764795c59de42806c49ffe62417f315577032349a16532c0f8c3b7c54cbc824e17ba8175bcee083508112caf33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\KEkM3TxTTFHg.bat

Filesize
215B

MD5
e0b05f41a960d89c14f8c1393fa620ce

SHA1
35b8f921bcfab4b20f72b23ca8c2fead1898f67a

SHA256
0ea2099b36777db483b6f4992dc23b8a2f0496a6f0d01c72bb62f6f69a8d51f7

SHA512
e4078cc21c87969faeabea1d0fc412a51dab2d56a86aa767ab3d4397915a961c12953cae14b0afcf43c7d5d5577b3bac05b8d352ed40546e53fed10d579b7283

Download Submit
C:\Users\Admin\AppData\Local\Temp\KJga4CwkV9tI.bat

Filesize
215B

MD5
7cfe1319f90d82e81e957813abc1d320

SHA1
53f2dea8aebb9126c6b4c5646a1dbd51b2b491ff

SHA256
dc12b1ade90d1a9779912c66d035f7e445ef4dce0305314f8b0339add4228acf

SHA512
4866f794c37c4aec331ad5de6270d93a77e1abf35bb07ede606bcbec306514693b255c46ea2680f663a706d27ffd63e9fe56272e202c0ca66d5ae4d058c979b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2lCBHWPXBgr.bat

Filesize
215B

MD5
56650553df59103ff3d833f286e4cf6f

SHA1
f2cf4db91be694607ae62e93dd80df50e32fc8b1

SHA256
47c1cc7f369177d0a75c471d1895511def6b07472bc33fd0bcc11a749969d2ae

SHA512
3bd52dc85f65c160292cbcd5bf685ade55ebc88bac77edf2aeeec4de52215e491cc5951f8b2532d6f0b71335d871457716bf1a74bd41858e604938b526c93b0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\S92ySNagmVvm.bat

Filesize
215B

MD5
57fbefa0474d835934e22eb9850a7ecd

SHA1
0c729aa7d5aa582e1c4180fb73653479c2319add

SHA256
29f39e0328a3c692424301ce94755e8e8fff0c2b1cb3e93bc421af2571b0648d

SHA512
281c04cceb7cb38ee73dd71383bd07ec1df08ff543babbb7478b140571567aad01ecfefcd453bba27ca99be98270652d6204ec51caf5d2a987b9aee4d1b2dc5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nnfbwf2SwV0j.bat

Filesize
215B

MD5
c07cda291566be430caa61ef598df16a

SHA1
95d78460a8eb6471e98fcaf73ed23333ebd6964e

SHA256
e98fcc93b788aad4e8c4c15bc667a3bfa161c94545e85cc420e4ed43aa422ac9

SHA512
41eb3ed8835d77ba9cae4450a2c875831941cd7d428b5291169d5add29dd2e73f15e0e9eacc87bc85a308b2dc1fcaecf9c8405d3535539b88429852cd40a9071

Download Submit
C:\Users\Admin\AppData\Local\Temp\s0Gq0Bv35AH3.bat

Filesize
215B

MD5
48d772b4bef3b7abd994a3c30eec101d

SHA1
93a4bbaf2a4e9370ecee9dc9c8dbdcdd88ac5652

SHA256
ead5922e12a529e75961f72c744a0afed0d810129e0ea1bedbaf7dd9aed85f2e

SHA512
03cc9a0e289c37cbcbfd88b9393fed35fa36e82faa4603be7ed72bd6d36f03d1a6fe0d04e904ea88964cc4c723431ae6848e34eca6525a095f4d71814fdb3b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\v587bhWNEo8f.bat

Filesize
215B

MD5
7022de837716ca04081da2cb37e6bf93

SHA1
c8b1c6fd6ba87509b584985f0d5d71ea1030d44a

SHA256
bad905866e5606b3999105b71dd99141ce8e21b3235990375e39ec2b0db538f1

SHA512
eddb21f261fd0a3b2b08b806e3c875b6570c84addb903d83927d1301a7d413f100071a1046e456c1204c994dcb7d64cc5899e801abb5112e08e20e0bcc87d4ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\wGNMTaXA2E8j.bat

Filesize
215B

MD5
6e559337bb21b6b61b84b9449e6c32e4

SHA1
0875099ac0eebd743358b08cdfc2a1b38eab0a49

SHA256
1e9bdb22161aaf351e07f7176b4684862479e3c44019a17dae9987b5608d46af

SHA512
3cb569929d6139915ff3533f0657d3334ebd4a6990634178434c66d86250fc4aa6dfd1ea08bc8b43d8a55a1ef84ecd93933dff1ad741ab089424261003e784ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\wglVD229dlhn.bat

Filesize
215B

MD5
ffd226e4d7b03da847bdc5f00fb4e6a5

SHA1
0f7d78f1b9b649460c992f97c634eaa6fe6117f8

SHA256
39b5e26d401aaa5b9c278d4722a24420c18faf8b1029ea1b93b1072fe1848af2

SHA512
ea80292476f0196a248db76292d5196d3e5a0b26eb5e082a81cb4e833ff5a17ae7e061edd1e723280c0e9009f57eda9444a955f1dbf8e6d6b57536bc1bfdd2e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\xMe8lfbQHYNf.bat

Filesize
215B

MD5
15fd9376dd6134657677be076ee806fd

SHA1
590aaf788f5c32f65b9a00860c8d3024f7e54b27

SHA256
a17e12e5ef125abf9110fdea59e55b9e52265748f4a5230e0e47a85a913127f6

SHA512
ea2e72aea99ac423c698bdece03428100e7bc0a2610c27a8bd7a05fddb52e8d406884e99f619e92ce002756afb0f2fed02c6862e07adb568daba83bb9662ce1a

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-31-2024

Filesize
224B

MD5
758c5a215794483544bbc3063b97a443

SHA1
db584b048c49f0615f7f92fb12b823d7b3e52dd3

SHA256
f9530efa6d300b6d4373001354d96208441c5e69e4ea154cb2d35cc2bfd2f929

SHA512
29af44142006418a67f65dd5477288a19b3336c5f20f5048f78c0edb88dc170a0170d964e9cc578c7c4f054e3578dd0d33217eba5bbdaf7473f50c004d7468c4

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-31-2024

Filesize
224B

MD5
a573706bcac441c516b2ea739863f1ae

SHA1
48428cb91bb6660bf346518790dbdcb0a9594362

SHA256
e664253aeaf89d4069b02c2a1a1ec9002757798fc8fc179ee42042869afd1efc

SHA512
03deb9c4999407c0572dea2f30238e7dcbe63a99ca9d5ae24af81f28a3f7e0590df00c86ce003d9d50f592a411648426196c894767ca9f1f80b4b9a09c7e6388

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-31-2024

Filesize
224B

MD5
f82a1e7b32023523fa0b8fb1ba1afadc

SHA1
3ea2475ace2b6181db61ea59e9e33cd4924c6de8

SHA256
fd11bbd0bff2d81db5f8c4ad3cd1e234f665b14ccfed285116bf305648fc68c9

SHA512
ec42b752ac8622883072a21b0b3d58ba50f16b24c0036988710419da5de970a2007878bd703ac6b97721d950b67cae314d1315dd8c6dbb99fc73ccb6e318190a

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-31-2024

Filesize
224B

MD5
abd9f11801a0eb8773225226ab56e03c

SHA1
75f412359fc417a437d21f5f6311cf9da0218567

SHA256
32e9265c013fe454dbbaa717daff6c26b9f93d8ed7e98afe6b0875f1ea739220

SHA512
2a2b5daba594e2226a60a093e01efce0feeafc68496596664b8de548a98bdf22d6e2c025f1fa610ab1c342c7de748791ce056d4b7c44a19f3e74093f23ee032d

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-31-2024

Filesize
224B

MD5
980bc749ee856528fa408478c1dabd31

SHA1
f04ef564f1530142caf0d491fb22c7321b4f0ab5

SHA256
0d5e6c740b668f2bdc523ef393fb14bd6a4d0729799b63205e1edcb9778b31bb

SHA512
047a380842d8536ea5e19a13763bef123f47cdeadf15cfcce38f6993c8049c02f2d6f64b0b74ba06d9f5315bbef12ee23a34dde1be7d749a718b139e35edee8e

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-31-2024

Filesize
224B

MD5
e526a0f7dc6f40c9be14476e874dbd5d

SHA1
5c0e2efbe7a60649961a8aa5584dfff8a89c7307

SHA256
50203ca12f234f2cdc5073bac65c084421fd4ae9b163c26354f4c04295044cad

SHA512
439f7c9dc2e129aaddc238d7737d75a4a3280c5539ece26038d289dc0df0b79f8c66b472d67c337c6bbe67e3ac89b83fb1d3b4827943c4d8bcd5cbdbe451c117

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-31-2024

Filesize
224B

MD5
366e868c9fae4034b43ac677cfb26448

SHA1
fb16463e4051f553e0024e334d29bb0e7fe5bddb

SHA256
4256706f5c8c5fb2ab803bd3260610d454af087c15035420835606685c03c8e7

SHA512
0ea31e902615da3eb5da98abf390638ac0713037e7630434bf1fc9f1b0df473d6ad85a3b6236ae7298bb227d317a1da80b05e8ebf5b6427d56eb41912c40133b

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\12-31-2024

Filesize
224B

MD5
a6ce7eea5bef822fe88d5cef0511ac61

SHA1
e6ac3e98adcba7ee2e2d69e103f50df854edc129

SHA256
ae51b414b92e534430ddb9133e07b6e96364e0e7e9062797d2cee9abc9a2ddd0

SHA512
fda4be4f675c44cfdc302606f3300488ca07b032b4c7a83b7e6f7098baaa49b4756f946ac24d2bdd8aa9b1c3154a76e551d05e7d0dcf5a40e0b0a446dc460eea

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Runtime Broker.exe

Filesize
375KB

MD5
55029651ecad5f3be071b6abafb56d90

SHA1
a008e8d91c2725eb16e42c3800ace5492a32416e

SHA256
a87ef622f73e2193432c26ec41124b09acfd2154f6bdebf099e8d9145894f44a

SHA512
83dc82b2aa027ebd62aeceb15b6ae1e71a72da16f557833b8439cda6dded817799748a06ef7721931626d06b687a57fc4be56f1e8846d6e9a6708ad757afb903

Download Submit
memory/1792-7-0x0000000006B20000-0x0000000006B5C000-memory.dmp

Filesize
240KB

Download
memory/1792-1-0x0000000000E60000-0x0000000000EC4000-memory.dmp

Filesize
400KB

Download
memory/1792-6-0x00000000065E0000-0x00000000065F2000-memory.dmp

Filesize
72KB

Download
memory/1792-0-0x00000000750DE000-0x00000000750DF000-memory.dmp

Filesize
4KB

Download
memory/1792-4-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/1792-3-0x00000000058E0000-0x0000000005972000-memory.dmp

Filesize
584KB

Download
memory/1792-14-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/1792-2-0x0000000005DF0000-0x0000000006394000-memory.dmp

Filesize
5.6MB

Download
memory/1792-5-0x0000000005980000-0x00000000059E6000-memory.dmp

Filesize
408KB

Download
memory/4560-18-0x0000000006F70000-0x0000000006F7A000-memory.dmp

Filesize
40KB

Download
memory/4560-16-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/4560-15-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download
memory/4560-23-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads