Analysis
-
max time kernel
899s -
max time network
431s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-01-2025 18:04
General
-
Target
Client-built.exe
-
Size
3.1MB
-
MD5
79069701295f944d67c5f2e0213b3b9c
-
SHA1
589e8b6227ec6ef923f7eb8e4dc96797593f9535
-
SHA256
ff62c26c8faf00f841ddeae1e095b8a65a9cb4e0d2a01879aaa8d767c4550cf8
-
SHA512
472570fbf5ee21c05d9e40aaef32686b5f3f63eba93c7f3efdc23493e74017cea8b2a91a1ac7d8cdbc67fedb18f4dcae20c08fa3b6486807fa38d03dd2114f67
-
SSDEEP
49152:mvjI22SsaNYfdPBldt698dBcjHtqRJ6sbR3LoGdnTHHB72eh2NT:mvc22SsaNYfdPBldt6+dBcjHtqRJ62
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
test-rat
C2
46.125.249.50:4782:4782
Mutex
e2bb43be-2392-4c93-9a3c-dcea173d5afd
Attributes
-
encryption_key
AE2F816185F134AF4E7D747D3E55802DE0F16A45
-
install_name
Virus-Rat.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Defender Update
-
subdirectory
Rat-Test-cx
Signatures
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Runs ping.exe 1 TTPs 64 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o5ut1ZKWNc9n.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qNITi7mkZgOL.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f7⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WnXbfzHhFkro.bat" "7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f9⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zMP2FV7jlgJo.bat" "9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f11⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yjtiikWghi9t.bat" "11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500112⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost12⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f13⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GxS8GTJoqRm6.bat" "13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 6500114⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f15⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tLzoWoiGTXVM.bat" "15⤵
-
C:\Windows\system32\chcp.comchcp 6500116⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f17⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7E1NorHFNcr0.bat" "17⤵
-
C:\Windows\system32\chcp.comchcp 6500118⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost18⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f19⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fjnaJRNvqJZB.bat" "19⤵
-
C:\Windows\system32\chcp.comchcp 6500120⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost20⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f21⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KwrlxlyyR2ti.bat" "21⤵
-
C:\Windows\system32\chcp.comchcp 6500122⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost22⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f23⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u4pFs1VB3i1I.bat" "23⤵
-
C:\Windows\system32\chcp.comchcp 6500124⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f25⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0qhRm6RFPsOM.bat" "25⤵
-
C:\Windows\system32\chcp.comchcp 6500126⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost26⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f27⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3Cl5KNnPlAPU.bat" "27⤵
-
C:\Windows\system32\chcp.comchcp 6500128⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost28⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f29⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qS94VGEpB9bs.bat" "29⤵
-
C:\Windows\system32\chcp.comchcp 6500130⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost30⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f31⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\533xHITsUlS4.bat" "31⤵
-
C:\Windows\system32\chcp.comchcp 6500132⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost32⤵
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f33⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RJdxmeMQ4SW9.bat" "33⤵
-
C:\Windows\system32\chcp.comchcp 6500134⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f35⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dn8Un1qLuiOF.bat" "35⤵
-
C:\Windows\system32\chcp.comchcp 6500136⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost36⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f37⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ynUjBZSbG6JS.bat" "37⤵
-
C:\Windows\system32\chcp.comchcp 6500138⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost38⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f39⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wJoierGNEU8Y.bat" "39⤵
-
C:\Windows\system32\chcp.comchcp 6500140⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost40⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f41⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9Shc3ZJnIySS.bat" "41⤵
-
C:\Windows\system32\chcp.comchcp 6500142⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost42⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f43⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nArQVOLYhzLa.bat" "43⤵
-
C:\Windows\system32\chcp.comchcp 6500144⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost44⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f45⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xeNwWD8aNNNK.bat" "45⤵
-
C:\Windows\system32\chcp.comchcp 6500146⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost46⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f47⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dIlAP5xzPYgE.bat" "47⤵
-
C:\Windows\system32\chcp.comchcp 6500148⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost48⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f49⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AJqPallWYUI1.bat" "49⤵
-
C:\Windows\system32\chcp.comchcp 6500150⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost50⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"50⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f51⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PYc8cKRPRQFB.bat" "51⤵
-
C:\Windows\system32\chcp.comchcp 6500152⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost52⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f53⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VwcWjqp4j04g.bat" "53⤵
-
C:\Windows\system32\chcp.comchcp 6500154⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost54⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f55⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PBaHdvCgfJk0.bat" "55⤵
-
C:\Windows\system32\chcp.comchcp 6500156⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost56⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f57⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aOpjPW3rzITo.bat" "57⤵
-
C:\Windows\system32\chcp.comchcp 6500158⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost58⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f59⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RcFuAlPee7Ry.bat" "59⤵
-
C:\Windows\system32\chcp.comchcp 6500160⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost60⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f61⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tiY91pouirs8.bat" "61⤵
-
C:\Windows\system32\chcp.comchcp 6500162⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost62⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f63⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JSlTRhfBeOvO.bat" "63⤵
-
C:\Windows\system32\chcp.comchcp 6500164⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost64⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f65⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qx4QeBoXSCwF.bat" "65⤵
-
C:\Windows\system32\chcp.comchcp 6500166⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost66⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"66⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f67⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tJjCsXD9tNPa.bat" "67⤵
-
C:\Windows\system32\chcp.comchcp 6500168⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost68⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"68⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f69⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RtkSgWOexLbl.bat" "69⤵
-
C:\Windows\system32\chcp.comchcp 6500170⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost70⤵
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"70⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f71⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9FeeqrlXiKv2.bat" "71⤵
-
C:\Windows\system32\chcp.comchcp 6500172⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost72⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"72⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f73⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p8aSC4JExbQL.bat" "73⤵
-
C:\Windows\system32\chcp.comchcp 6500174⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost74⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"74⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f75⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C7T7k26sRwRQ.bat" "75⤵
-
C:\Windows\system32\chcp.comchcp 6500176⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost76⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"76⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f77⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8BbU3X6SGmHT.bat" "77⤵
-
C:\Windows\system32\chcp.comchcp 6500178⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost78⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"78⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f79⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tCU7kIeE0Km3.bat" "79⤵
-
C:\Windows\system32\chcp.comchcp 6500180⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost80⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"80⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f81⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\THdmeQTh7hvP.bat" "81⤵
-
C:\Windows\system32\chcp.comchcp 6500182⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost82⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"82⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f83⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OzV178P9bJ3O.bat" "83⤵
-
C:\Windows\system32\chcp.comchcp 6500184⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost84⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"84⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f85⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\l4fGFMjlHRim.bat" "85⤵
-
C:\Windows\system32\chcp.comchcp 6500186⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost86⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"86⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f87⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d70ET8bKJK82.bat" "87⤵
-
C:\Windows\system32\chcp.comchcp 6500188⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost88⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"88⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f89⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3IidPMWCrbpK.bat" "89⤵
-
C:\Windows\system32\chcp.comchcp 6500190⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost90⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"90⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f91⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\i0AjtQTLijQ3.bat" "91⤵
-
C:\Windows\system32\chcp.comchcp 6500192⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost92⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"92⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f93⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fhEq9MSH2kMf.bat" "93⤵
-
C:\Windows\system32\chcp.comchcp 6500194⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost94⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"94⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f95⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zy4fKiwkvcdr.bat" "95⤵
-
C:\Windows\system32\chcp.comchcp 6500196⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost96⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"96⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f97⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7Q43tKMVaSKl.bat" "97⤵
-
C:\Windows\system32\chcp.comchcp 6500198⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost98⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"98⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f99⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ahXR3yC6HQ4Q.bat" "99⤵
-
C:\Windows\system32\chcp.comchcp 65001100⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost100⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"100⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f101⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W80omqa2uag2.bat" "101⤵
-
C:\Windows\system32\chcp.comchcp 65001102⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost102⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"102⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f103⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tsGeDtX6YPOY.bat" "103⤵
-
C:\Windows\system32\chcp.comchcp 65001104⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost104⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"104⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f105⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vzrqh3vDiI7g.bat" "105⤵
-
C:\Windows\system32\chcp.comchcp 65001106⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost106⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"106⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f107⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IeR0dgqBFnqF.bat" "107⤵
-
C:\Windows\system32\chcp.comchcp 65001108⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost108⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"108⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f109⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tNXbgquiGwRs.bat" "109⤵
-
C:\Windows\system32\chcp.comchcp 65001110⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost110⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"110⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f111⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H0ZAEdgM9B2I.bat" "111⤵
-
C:\Windows\system32\chcp.comchcp 65001112⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost112⤵
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"112⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f113⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oCJ2DsRGCSWF.bat" "113⤵
-
C:\Windows\system32\chcp.comchcp 65001114⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost114⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"114⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f115⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t3VbdwoWnDjf.bat" "115⤵
-
C:\Windows\system32\chcp.comchcp 65001116⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost116⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"116⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f117⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vkUA0OYaNTlQ.bat" "117⤵
-
C:\Windows\system32\chcp.comchcp 65001118⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost118⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"118⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f119⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EGa6nnDM1KL8.bat" "119⤵
-
C:\Windows\system32\chcp.comchcp 65001120⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost120⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe"120⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Windows Defender Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Rat-Test-cx\Virus-Rat.exe" /rl HIGHEST /f121⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-