quasar | ae5470b407120f90cd4c830260c8e965877199368d4a2982ff1a1769a2e08682

Resubmissions

17-01-2025 19:13

250117-xxlcdszpbv 10

17-01-2025 19:09

250117-xt892sznbw 10

Analysis

max time kernel
144s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-01-2025 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DiscordXploit.exe
Size

3.3MB
MD5

95da0645204d22bd9daf4e337ebeeaaa
SHA1

58182d8cf8e83335a5b7312d0d4af79f4bd64212
SHA256

ae5470b407120f90cd4c830260c8e965877199368d4a2982ff1a1769a2e08682
SHA512

9257076c55b3cc6100f3299766bf7bf0be1e0b330c1cadca1d7ca46ff859e4afefeff3635fc15811cc2c7d6debd2fcb808cf5f96314c681b1dbc32d2a7305f9e
SSDEEP

49152:jv2lL26AaNeWgPhlmVqvMQ7XSK2BVOzho9vJxOoGdzTHHB72eh2NTsd:jv2L26AaNeWgPhlmVqkQ7XSKS8oond

Score

10^/10

quasar client0001 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

client0001

hxp7-48924.portmap.host:48924

Mutex

dfda6d3b-23ed-4a2b-b0c4-4361d434ec5c

Attributes

encryption_key
0F17464091E1835B99CC4D3E93D8043B9AE2FAF4
install_name
Windows-Graphics-Loader.exe
log_directory
Logs
reconnect_delay
10000
startup_key
Windows Graphics Loader
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 8 IoCs

resource	yara_rule
behavioral1/memory/2376-1-0x0000000000C60000-0x0000000000FA8000-memory.dmp	family_quasar
behavioral1/files/0x000f000000016d3f-6.dat	family_quasar
behavioral1/memory/2972-8-0x00000000011D0000-0x0000000001518000-memory.dmp	family_quasar
behavioral1/memory/2808-23-0x0000000001370000-0x00000000016B8000-memory.dmp	family_quasar
behavioral1/memory/1320-55-0x00000000002D0000-0x0000000000618000-memory.dmp	family_quasar
behavioral1/memory/2272-66-0x0000000000A50000-0x0000000000D98000-memory.dmp	family_quasar
behavioral1/memory/2588-99-0x0000000000070000-0x00000000003B8000-memory.dmp	family_quasar
behavioral1/memory/2744-110-0x0000000000C50000-0x0000000000F98000-memory.dmp	family_quasar

Executes dropped EXE 13 IoCs

pid	Process
2972	Windows-Graphics-Loader.exe
2808	Windows-Graphics-Loader.exe
980	Windows-Graphics-Loader.exe
2832	Windows-Graphics-Loader.exe
1320	Windows-Graphics-Loader.exe
2272	Windows-Graphics-Loader.exe
1828	Windows-Graphics-Loader.exe
876	Windows-Graphics-Loader.exe
2588	Windows-Graphics-Loader.exe
2744	Windows-Graphics-Loader.exe
2548	Windows-Graphics-Loader.exe
2792	Windows-Graphics-Loader.exe
1232	Windows-Graphics-Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
924	PING.EXE
2540	PING.EXE
1360	PING.EXE
2328	PING.EXE
2872	PING.EXE
2968	PING.EXE
2736	PING.EXE
2260	PING.EXE
2640	PING.EXE
2180	PING.EXE
1868	PING.EXE
2636	PING.EXE
2448	PING.EXE

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
2636	PING.EXE
2180	PING.EXE
2260	PING.EXE
924	PING.EXE
1360	PING.EXE
2328	PING.EXE
2872	PING.EXE
2968	PING.EXE
2448	PING.EXE
2640	PING.EXE
2736	PING.EXE
2540	PING.EXE
1868	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2872	schtasks.exe
2776	schtasks.exe
396	schtasks.exe
1648	schtasks.exe
2900	schtasks.exe
2256	schtasks.exe
1468	schtasks.exe
2908	schtasks.exe
2116	schtasks.exe
3008	schtasks.exe
1844	schtasks.exe
2252	schtasks.exe
1392	schtasks.exe
2592	schtasks.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	DiscordXploit.exe
Token: SeDebugPrivilege	2972	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2808	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	980	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2832	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1320	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2272	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1828	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	876	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2588	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2744	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2548	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2792	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1232	Windows-Graphics-Loader.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2972	Windows-Graphics-Loader.exe
2808	Windows-Graphics-Loader.exe
980	Windows-Graphics-Loader.exe
2832	Windows-Graphics-Loader.exe
1320	Windows-Graphics-Loader.exe
2272	Windows-Graphics-Loader.exe
1828	Windows-Graphics-Loader.exe
876	Windows-Graphics-Loader.exe
2588	Windows-Graphics-Loader.exe
2744	Windows-Graphics-Loader.exe
2548	Windows-Graphics-Loader.exe
2792	Windows-Graphics-Loader.exe
1232	Windows-Graphics-Loader.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
2972	Windows-Graphics-Loader.exe
2808	Windows-Graphics-Loader.exe
980	Windows-Graphics-Loader.exe
2832	Windows-Graphics-Loader.exe
1320	Windows-Graphics-Loader.exe
2272	Windows-Graphics-Loader.exe
1828	Windows-Graphics-Loader.exe
876	Windows-Graphics-Loader.exe
2588	Windows-Graphics-Loader.exe
2744	Windows-Graphics-Loader.exe
2548	Windows-Graphics-Loader.exe
2792	Windows-Graphics-Loader.exe
1232	Windows-Graphics-Loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2872	2376	DiscordXploit.exe	29
PID 2376 wrote to memory of 2872	2376	DiscordXploit.exe	29
PID 2376 wrote to memory of 2872	2376	DiscordXploit.exe	29
PID 2376 wrote to memory of 2972	2376	DiscordXploit.exe	31
PID 2376 wrote to memory of 2972	2376	DiscordXploit.exe	31
PID 2376 wrote to memory of 2972	2376	DiscordXploit.exe	31
PID 2972 wrote to memory of 3008	2972	Windows-Graphics-Loader.exe	32
PID 2972 wrote to memory of 3008	2972	Windows-Graphics-Loader.exe	32
PID 2972 wrote to memory of 3008	2972	Windows-Graphics-Loader.exe	32
PID 2972 wrote to memory of 2868	2972	Windows-Graphics-Loader.exe	34
PID 2972 wrote to memory of 2868	2972	Windows-Graphics-Loader.exe	34
PID 2972 wrote to memory of 2868	2972	Windows-Graphics-Loader.exe	34
PID 2868 wrote to memory of 2936	2868	cmd.exe	36
PID 2868 wrote to memory of 2936	2868	cmd.exe	36
PID 2868 wrote to memory of 2936	2868	cmd.exe	36
PID 2868 wrote to memory of 2736	2868	cmd.exe	37
PID 2868 wrote to memory of 2736	2868	cmd.exe	37
PID 2868 wrote to memory of 2736	2868	cmd.exe	37
PID 2868 wrote to memory of 2808	2868	cmd.exe	38
PID 2868 wrote to memory of 2808	2868	cmd.exe	38
PID 2868 wrote to memory of 2808	2868	cmd.exe	38
PID 2808 wrote to memory of 2776	2808	Windows-Graphics-Loader.exe	39
PID 2808 wrote to memory of 2776	2808	Windows-Graphics-Loader.exe	39
PID 2808 wrote to memory of 2776	2808	Windows-Graphics-Loader.exe	39
PID 2808 wrote to memory of 1612	2808	Windows-Graphics-Loader.exe	41
PID 2808 wrote to memory of 1612	2808	Windows-Graphics-Loader.exe	41
PID 2808 wrote to memory of 1612	2808	Windows-Graphics-Loader.exe	41
PID 1612 wrote to memory of 2112	1612	cmd.exe	43
PID 1612 wrote to memory of 2112	1612	cmd.exe	43
PID 1612 wrote to memory of 2112	1612	cmd.exe	43
PID 1612 wrote to memory of 2260	1612	cmd.exe	44
PID 1612 wrote to memory of 2260	1612	cmd.exe	44
PID 1612 wrote to memory of 2260	1612	cmd.exe	44
PID 1612 wrote to memory of 980	1612	cmd.exe	45
PID 1612 wrote to memory of 980	1612	cmd.exe	45
PID 1612 wrote to memory of 980	1612	cmd.exe	45
PID 980 wrote to memory of 1468	980	Windows-Graphics-Loader.exe	46
PID 980 wrote to memory of 1468	980	Windows-Graphics-Loader.exe	46
PID 980 wrote to memory of 1468	980	Windows-Graphics-Loader.exe	46
PID 980 wrote to memory of 2792	980	Windows-Graphics-Loader.exe	48
PID 980 wrote to memory of 2792	980	Windows-Graphics-Loader.exe	48
PID 980 wrote to memory of 2792	980	Windows-Graphics-Loader.exe	48
PID 2792 wrote to memory of 1880	2792	cmd.exe	50
PID 2792 wrote to memory of 1880	2792	cmd.exe	50
PID 2792 wrote to memory of 1880	2792	cmd.exe	50
PID 2792 wrote to memory of 924	2792	cmd.exe	51
PID 2792 wrote to memory of 924	2792	cmd.exe	51
PID 2792 wrote to memory of 924	2792	cmd.exe	51
PID 2792 wrote to memory of 2832	2792	cmd.exe	52
PID 2792 wrote to memory of 2832	2792	cmd.exe	52
PID 2792 wrote to memory of 2832	2792	cmd.exe	52
PID 2832 wrote to memory of 2908	2832	Windows-Graphics-Loader.exe	53
PID 2832 wrote to memory of 2908	2832	Windows-Graphics-Loader.exe	53
PID 2832 wrote to memory of 2908	2832	Windows-Graphics-Loader.exe	53
PID 2832 wrote to memory of 1784	2832	Windows-Graphics-Loader.exe	55
PID 2832 wrote to memory of 1784	2832	Windows-Graphics-Loader.exe	55
PID 2832 wrote to memory of 1784	2832	Windows-Graphics-Loader.exe	55
PID 1784 wrote to memory of 2596	1784	cmd.exe	57
PID 1784 wrote to memory of 2596	1784	cmd.exe	57
PID 1784 wrote to memory of 2596	1784	cmd.exe	57
PID 1784 wrote to memory of 2636	1784	cmd.exe	58
PID 1784 wrote to memory of 2636	1784	cmd.exe	58
PID 1784 wrote to memory of 2636	1784	cmd.exe	58
PID 1784 wrote to memory of 1320	1784	cmd.exe	59

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DiscordXploit.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordXploit.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2872
- C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3008
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\4nqWrMMvAfMM.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2936
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2736
  - - C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2776
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\nho2U6xkA18Y.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1612
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2112
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2260
      - C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1468
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\iSIPaGEOfrH6.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1880
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:924
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2908
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PKuwmrG3Dtwg.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2596
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2636
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1320
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2252
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\thg4uzrFLIna.bat" "
        11⤵
        
        PID:1736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1256
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2540
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2272
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:396
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\SPlhrvCZTp7r.bat" "
        13⤵
        
        PID:1480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:860
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1360
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1828
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1844
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\JPdIjIaDdmS2.bat" "
        15⤵
        
        PID:1020
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:700
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2328
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:876
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1648
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\eDbGqP3glIGd.bat" "
        17⤵
        
        PID:2824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2960
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2872
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2588
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2116
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\KomD9x7Bq1Vw.bat" "
        19⤵
        
        PID:2376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2936
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2968
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2744
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2900
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\IDSM1u0481hw.bat" "
        21⤵
        
        PID:1804
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:956
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2448
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2548
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1392
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MsFBHpU5DOBR.bat" "
        23⤵
        
        PID:796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2984
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2640
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2792
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2592
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\gOH4j4EvW8cA.bat" "
        25⤵
        
        PID:3024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2280
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2180
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1232
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2256
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Qv3BZygWN2XN.bat" "
        27⤵
        
        PID:1860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4nqWrMMvAfMM.bat

Filesize
224B

MD5
34ae4f816fffa8fd815247d221d03e98

SHA1
3a70458b9a2ffa1fb06380e4f56836a40edb673e

SHA256
a59baa27bd20f46dcc9256866ec0e7680b3d0f47cb50eab0a2712fde5abe0712

SHA512
61e429ed388c315ec0aa3b889977f8304d58c658d9f5637d0fe73aa74677909cf9dead793defaf14f6af988e7b477fb39a22c3016949897c35c274c02fe80313

Download Submit
C:\Users\Admin\AppData\Local\Temp\IDSM1u0481hw.bat

Filesize
224B

MD5
9d6b0f4e6eb380cb837cad71107b261c

SHA1
276765aaa9e0ad842303af8aad6abb067739a5d6

SHA256
df86b2633d3972d21fa2e184af7fb95989ceb97600e1e38d488408ca56c0fab4

SHA512
98a72eeb184cb0ea5d337384b87d13e0ca9e5890bf76c2bf1cb0ddcdd20ee1074aea07a6955af4bc2ed83e3a7abe744caee10a96cb3b0a7541f972eae2c1c8a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\JPdIjIaDdmS2.bat

Filesize
224B

MD5
b621604f322971df9b51db519de3b2a3

SHA1
7694b8cf363c689052c584b00f960e8d08366a41

SHA256
858742488d678a005ac0d0b63060c08f98a84ae0abacc607395807efefaf8c75

SHA512
21f2bdbb32455fcbf1daac03486b2d52b2392cc58bdfe047fd2dd0bc4153f82779bd1dc309e373cd3615bfb8ec3a1d6c7d839c330406f6ccc3ee7ffa74e82d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\KomD9x7Bq1Vw.bat

Filesize
224B

MD5
ea2c0992afb999bd1f157973167c6242

SHA1
df15e638641e2ccb11bfe018b8ee391fd78d257f

SHA256
3158eb34ec5b39933258ffb20211d30108e16f776f7564724ec17c44e7a0f65b

SHA512
355bb66034a391443929983cd8d76acc6ed5515902533e3b9a57926573ae1da0841ed795b4f522ff22862c6e61baa43cc92513c82339f92da371a99785b67912

Download Submit
C:\Users\Admin\AppData\Local\Temp\MsFBHpU5DOBR.bat

Filesize
224B

MD5
9ec8be10dc48c16a8e9af53b4f73d1ce

SHA1
1223bee41e7bde1b225da252738e62cd71c6eb58

SHA256
6b2fda0b488dc1767480d4d09132168f557139342ad5a3861b21b44e81f1f407

SHA512
e216e6913ef9e21201f21ddf1d039d979b619f7d8865eb8188da5d56dd83397a64510f6d5c115fa6b70450c838e26c36d79cf607ccfb70d9d45d18a2e7eaa0c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\PKuwmrG3Dtwg.bat

Filesize
224B

MD5
21692dc154441e4ea28c6c39d500bd96

SHA1
e416f810d07c401aeb40e60db8515c9c263aadbc

SHA256
8e141e4e8c9f8a00b55d623061991d4434bd6b5d77744da75184a59cccbbdea5

SHA512
9ebb835e5230585ecfbfdaed1f56fcc523e1534223bf9946cd4c350bc35c85d3bc5600dffef8488698e51c94d3bedf5ccf235204d8dfed3b34c1c98a105be66f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qv3BZygWN2XN.bat

Filesize
224B

MD5
3690fbfd5d174d8c3062163d2cb9b30e

SHA1
63730cb9c9379d4e4dc12b623b208d02bdd8d51c

SHA256
c733a137940fc495bc3120c1e6a621c2f73c014bc463480230a4921128f5487c

SHA512
e8deaf70c5f08559d009f9ea6a39fda1ff07fb3fc809622c05bc704f91e5a08a35ca468c4552548b4e5b0443bab071b7b72c5fde037153d0201087a7cf674a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\SPlhrvCZTp7r.bat

Filesize
224B

MD5
73b19c5c0bdb37d27f27ed9ea94ccc4c

SHA1
344916deb82b82fa8c000ba0838a9f5ba2e5a90d

SHA256
82d45051403bf383b31fe22b96d8050312dc9c6e55f96df231e97f0000a844ff

SHA512
81d8d6a1caa3b8c85960f8ff55b4e18cce2efb80540b9f8de72c2704df8654f4502fffb7f25efa5676ff6128b0d7e345764d158713ac69fc28b77c5120e98208

Download Submit
C:\Users\Admin\AppData\Local\Temp\eDbGqP3glIGd.bat

Filesize
224B

MD5
c49c6bc8aea0de19f473947e972fb96a

SHA1
2e63a0a03466857f4a5439d3eb52ab4b72e88829

SHA256
3e1e5a5f2a5be6adbc37d9038068164a24d87a439cd0e6af9c33040372f3caf6

SHA512
05fe8a25dea08757d2eede074ab451531be38a7dc87f2c787a7186169f3228f307cbe981ae812de9b5d0c7718fd2c1aef2493344e4e5aba4a08d1a2a3ab02b71

Download Submit
C:\Users\Admin\AppData\Local\Temp\gOH4j4EvW8cA.bat

Filesize
224B

MD5
9fccaa36638dd1d4219aba015e52d890

SHA1
4af93d828b180ba4031029aa3df0d5b13403b419

SHA256
c196ce4bdce03399490ce17737322ab2aefdbc04ebf4944ea28541dad479319e

SHA512
cc3e8847aa84a645fe855649c5a5075c44e224cee58db23eb3feda61fde1d9c999459bfefb11c817ad29b2ad590be9518f14ea37942585d859b6ff021cbe799e

Download Submit
C:\Users\Admin\AppData\Local\Temp\iSIPaGEOfrH6.bat

Filesize
224B

MD5
9e2287b552c23aa602dbec0695e59734

SHA1
8a2b2cc93cdd8a04fec9ffd57584937a98e9f8d1

SHA256
18f607110da24a05f7035b518cc16a466ad28a868c3b569013f45dec1f630fd7

SHA512
a655303d7bbed5ce97d1cf04486cb1c41436472a7d630949f2f4360e011199acc8d84d8b4cb62d4d2ec64e88fcdd3fb1e3bdc6633bb7a3a4f18ebeae7a604915

Download Submit
C:\Users\Admin\AppData\Local\Temp\nho2U6xkA18Y.bat

Filesize
224B

MD5
a1b7c0b6734448e65b4a11581d48b5c8

SHA1
c7d83df089ee14449d4066de13401053691c1bcf

SHA256
e89b719902a9e394514f5a47fcb0a65d06d512b99e617638445315f77a94d900

SHA512
21e5c2092c13b54342715ebbb8d02ad5fdf670828f634bb32d1e543c3e91db4645f4952f05b43a31c87f1b1b77cf8cf7951c1a6fbc321621467025b10a7d90f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\thg4uzrFLIna.bat

Filesize
224B

MD5
a6dfba1cf733b8976c588c1ac386f8e0

SHA1
0056aa5eefe47611fdbc6fc735434bd4c4a57f0e

SHA256
dea585678d14c8c164508f6caa5560252f9c93fd2e9c4eb5f88396bba7d36863

SHA512
46ba31112dd99b4b32880bf0deedfa114b2afa620a4ad44e3189bafcce4ed5239fd5a83c701cf9a52e2e607c3b2b85347f718cea249456f689075a6942f661d9

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe

Filesize
3.3MB

MD5
95da0645204d22bd9daf4e337ebeeaaa

SHA1
58182d8cf8e83335a5b7312d0d4af79f4bd64212

SHA256
ae5470b407120f90cd4c830260c8e965877199368d4a2982ff1a1769a2e08682

SHA512
9257076c55b3cc6100f3299766bf7bf0be1e0b330c1cadca1d7ca46ff859e4afefeff3635fc15811cc2c7d6debd2fcb808cf5f96314c681b1dbc32d2a7305f9e

Download Submit
memory/1320-55-0x00000000002D0000-0x0000000000618000-memory.dmp

Filesize
3.3MB

Download
memory/2272-66-0x0000000000A50000-0x0000000000D98000-memory.dmp

Filesize
3.3MB

Download
memory/2376-2-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2376-0-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2376-1-0x0000000000C60000-0x0000000000FA8000-memory.dmp

Filesize
3.3MB

Download
memory/2376-21-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2588-99-0x0000000000070000-0x00000000003B8000-memory.dmp

Filesize
3.3MB

Download
memory/2744-110-0x0000000000C50000-0x0000000000F98000-memory.dmp

Filesize
3.3MB

Download
memory/2808-23-0x0000000001370000-0x00000000016B8000-memory.dmp

Filesize
3.3MB

Download
memory/2972-9-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2972-10-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2972-19-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2972-8-0x00000000011D0000-0x0000000001518000-memory.dmp

Filesize
3.3MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads