quasar | ae5470b407120f90cd4c830260c8e965877199368d4a2982ff1a1769a2e08682

Resubmissions

17-01-2025 19:13

250117-xxlcdszpbv 10

17-01-2025 19:09

250117-xt892sznbw 10

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-01-2025 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DiscordXploit.exe
Size

3.3MB
MD5

95da0645204d22bd9daf4e337ebeeaaa
SHA1

58182d8cf8e83335a5b7312d0d4af79f4bd64212
SHA256

ae5470b407120f90cd4c830260c8e965877199368d4a2982ff1a1769a2e08682
SHA512

9257076c55b3cc6100f3299766bf7bf0be1e0b330c1cadca1d7ca46ff859e4afefeff3635fc15811cc2c7d6debd2fcb808cf5f96314c681b1dbc32d2a7305f9e
SSDEEP

49152:jv2lL26AaNeWgPhlmVqvMQ7XSK2BVOzho9vJxOoGdzTHHB72eh2NTsd:jv2L26AaNeWgPhlmVqkQ7XSKS8oond

Score

10^/10

quasar client0001 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

client0001

hxp7-48924.portmap.host:48924

Mutex

dfda6d3b-23ed-4a2b-b0c4-4361d434ec5c

Attributes

encryption_key
0F17464091E1835B99CC4D3E93D8043B9AE2FAF4
install_name
Windows-Graphics-Loader.exe
log_directory
Logs
reconnect_delay
10000
startup_key
Windows Graphics Loader
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4804-1-0x0000000000950000-0x0000000000C98000-memory.dmp	family_quasar
behavioral2/files/0x0008000000023cbb-6.dat	family_quasar

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Windows-Graphics-Loader.exe

Executes dropped EXE 14 IoCs

pid	Process
2064	Windows-Graphics-Loader.exe
3980	Windows-Graphics-Loader.exe
1496	Windows-Graphics-Loader.exe
1440	Windows-Graphics-Loader.exe
1848	Windows-Graphics-Loader.exe
1500	Windows-Graphics-Loader.exe
3332	Windows-Graphics-Loader.exe
3944	Windows-Graphics-Loader.exe
2660	Windows-Graphics-Loader.exe
3068	Windows-Graphics-Loader.exe
4392	Windows-Graphics-Loader.exe
2728	Windows-Graphics-Loader.exe
2532	Windows-Graphics-Loader.exe
4896	Windows-Graphics-Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4548	PING.EXE
836	PING.EXE
2556	PING.EXE
4016	PING.EXE
2864	PING.EXE
1484	PING.EXE
1712	PING.EXE
1124	PING.EXE
2960	PING.EXE
2716	PING.EXE
2564	PING.EXE
2024	PING.EXE
1988	PING.EXE
4400	PING.EXE

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
2564	PING.EXE
2556	PING.EXE
836	PING.EXE
1484	PING.EXE
4016	PING.EXE
4400	PING.EXE
2864	PING.EXE
4548	PING.EXE
2024	PING.EXE
1712	PING.EXE
1988	PING.EXE
1124	PING.EXE
2960	PING.EXE
2716	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3952	schtasks.exe
64	schtasks.exe
2608	schtasks.exe
3016	schtasks.exe
4420	schtasks.exe
4804	schtasks.exe
2864	schtasks.exe
4140	schtasks.exe
4824	schtasks.exe
3468	schtasks.exe
3820	schtasks.exe
3608	schtasks.exe
392	schtasks.exe
4976	schtasks.exe
3780	schtasks.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4804	DiscordXploit.exe
Token: SeDebugPrivilege	2064	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	3980	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1496	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1440	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1848	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	1500	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	3332	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2660	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	3068	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	4392	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2728	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	2532	Windows-Graphics-Loader.exe
Token: SeDebugPrivilege	4896	Windows-Graphics-Loader.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
2064	Windows-Graphics-Loader.exe
3980	Windows-Graphics-Loader.exe
1496	Windows-Graphics-Loader.exe
1440	Windows-Graphics-Loader.exe
1848	Windows-Graphics-Loader.exe
1500	Windows-Graphics-Loader.exe
3332	Windows-Graphics-Loader.exe
2660	Windows-Graphics-Loader.exe
3068	Windows-Graphics-Loader.exe
4392	Windows-Graphics-Loader.exe
2728	Windows-Graphics-Loader.exe
2532	Windows-Graphics-Loader.exe
4896	Windows-Graphics-Loader.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
2064	Windows-Graphics-Loader.exe
3980	Windows-Graphics-Loader.exe
1496	Windows-Graphics-Loader.exe
1440	Windows-Graphics-Loader.exe
1848	Windows-Graphics-Loader.exe
1500	Windows-Graphics-Loader.exe
3332	Windows-Graphics-Loader.exe
2660	Windows-Graphics-Loader.exe
3068	Windows-Graphics-Loader.exe
4392	Windows-Graphics-Loader.exe
2728	Windows-Graphics-Loader.exe
2532	Windows-Graphics-Loader.exe
4896	Windows-Graphics-Loader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 3952	4804	DiscordXploit.exe	84
PID 4804 wrote to memory of 3952	4804	DiscordXploit.exe	84
PID 4804 wrote to memory of 2064	4804	DiscordXploit.exe	86
PID 4804 wrote to memory of 2064	4804	DiscordXploit.exe	86
PID 2064 wrote to memory of 3820	2064	Windows-Graphics-Loader.exe	87
PID 2064 wrote to memory of 3820	2064	Windows-Graphics-Loader.exe	87
PID 2064 wrote to memory of 3992	2064	Windows-Graphics-Loader.exe	89
PID 2064 wrote to memory of 3992	2064	Windows-Graphics-Loader.exe	89
PID 3992 wrote to memory of 3976	3992	cmd.exe	91
PID 3992 wrote to memory of 3976	3992	cmd.exe	91
PID 3992 wrote to memory of 2864	3992	cmd.exe	92
PID 3992 wrote to memory of 2864	3992	cmd.exe	92
PID 3992 wrote to memory of 3980	3992	cmd.exe	94
PID 3992 wrote to memory of 3980	3992	cmd.exe	94
PID 3980 wrote to memory of 3608	3980	Windows-Graphics-Loader.exe	95
PID 3980 wrote to memory of 3608	3980	Windows-Graphics-Loader.exe	95
PID 3980 wrote to memory of 4876	3980	Windows-Graphics-Loader.exe	98
PID 3980 wrote to memory of 4876	3980	Windows-Graphics-Loader.exe	98
PID 4876 wrote to memory of 4856	4876	cmd.exe	100
PID 4876 wrote to memory of 4856	4876	cmd.exe	100
PID 4876 wrote to memory of 4548	4876	cmd.exe	101
PID 4876 wrote to memory of 4548	4876	cmd.exe	101
PID 4876 wrote to memory of 1496	4876	cmd.exe	110
PID 4876 wrote to memory of 1496	4876	cmd.exe	110
PID 1496 wrote to memory of 392	1496	Windows-Graphics-Loader.exe	111
PID 1496 wrote to memory of 392	1496	Windows-Graphics-Loader.exe	111
PID 1496 wrote to memory of 4404	1496	Windows-Graphics-Loader.exe	116
PID 1496 wrote to memory of 4404	1496	Windows-Graphics-Loader.exe	116
PID 4404 wrote to memory of 4012	4404	cmd.exe	118
PID 4404 wrote to memory of 4012	4404	cmd.exe	118
PID 4404 wrote to memory of 836	4404	cmd.exe	119
PID 4404 wrote to memory of 836	4404	cmd.exe	119
PID 4404 wrote to memory of 1440	4404	cmd.exe	127
PID 4404 wrote to memory of 1440	4404	cmd.exe	127
PID 1440 wrote to memory of 4804	1440	Windows-Graphics-Loader.exe	128
PID 1440 wrote to memory of 4804	1440	Windows-Graphics-Loader.exe	128
PID 1440 wrote to memory of 2752	1440	Windows-Graphics-Loader.exe	131
PID 1440 wrote to memory of 2752	1440	Windows-Graphics-Loader.exe	131
PID 2752 wrote to memory of 4484	2752	cmd.exe	133
PID 2752 wrote to memory of 4484	2752	cmd.exe	133
PID 2752 wrote to memory of 2960	2752	cmd.exe	134
PID 2752 wrote to memory of 2960	2752	cmd.exe	134
PID 2752 wrote to memory of 1848	2752	cmd.exe	136
PID 2752 wrote to memory of 1848	2752	cmd.exe	136
PID 1848 wrote to memory of 2864	1848	Windows-Graphics-Loader.exe	137
PID 1848 wrote to memory of 2864	1848	Windows-Graphics-Loader.exe	137
PID 1848 wrote to memory of 1448	1848	Windows-Graphics-Loader.exe	140
PID 1848 wrote to memory of 1448	1848	Windows-Graphics-Loader.exe	140
PID 1448 wrote to memory of 4648	1448	cmd.exe	142
PID 1448 wrote to memory of 4648	1448	cmd.exe	142
PID 1448 wrote to memory of 2716	1448	cmd.exe	143
PID 1448 wrote to memory of 2716	1448	cmd.exe	143
PID 1448 wrote to memory of 1500	1448	cmd.exe	146
PID 1448 wrote to memory of 1500	1448	cmd.exe	146
PID 1500 wrote to memory of 2608	1500	Windows-Graphics-Loader.exe	147
PID 1500 wrote to memory of 2608	1500	Windows-Graphics-Loader.exe	147
PID 1500 wrote to memory of 2736	1500	Windows-Graphics-Loader.exe	150
PID 1500 wrote to memory of 2736	1500	Windows-Graphics-Loader.exe	150
PID 2736 wrote to memory of 1008	2736	cmd.exe	152
PID 2736 wrote to memory of 1008	2736	cmd.exe	152
PID 2736 wrote to memory of 2564	2736	cmd.exe	153
PID 2736 wrote to memory of 2564	2736	cmd.exe	153
PID 2736 wrote to memory of 3332	2736	cmd.exe	155
PID 2736 wrote to memory of 3332	2736	cmd.exe	155

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DiscordXploit.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordXploit.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3952
- C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SfpINFfLGKvN.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3976
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2864
  - - C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3980
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3608
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TV21wZDddszI.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4876
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4856
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4548
      - C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QW9sDxZMKwyf.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4012
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:836
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N5od84DlvpQk.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4484
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2960
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1848
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QgyoGWeYWaxJ.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2716
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZUCgumC3VV4R.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1008
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2564
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3332
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8GMUNchOAtq8.bat" "
        15⤵
        
        PID:3376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4620
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1484
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\n2d2XHRVpMg0.bat" "
        17⤵
        
        PID:2276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2920
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2024
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2660
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4140
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\X67kv1AmOrkW.bat" "
        19⤵
        
        PID:1080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3608
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2556
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3068
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\556RyOQqCX0D.bat" "
        21⤵
        
        PID:3832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:4152
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4016
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4392
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:64
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s6MdjbZxIKVr.bat" "
        23⤵
        
        PID:4052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1712
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2728
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EQkheECaMMVZ.bat" "
        25⤵
        
        PID:768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1988
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2532
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pZo27tuk1vfP.bat" "
        27⤵
        
        PID:4880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:636
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1124
        
        C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4896
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Graphics Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YvLfVpbdlBNW.bat" "
        29⤵
        
        PID:212
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3428
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Windows-Graphics-Loader.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\556RyOQqCX0D.bat

Filesize
224B

MD5
2c1cb63182bcd56a8a458a34e6e9864f

SHA1
cec67f5984461b926213dde847fba5ae1142a15f

SHA256
52b6d149861ba127c7cf92fb497ccb80a412b87f699ab375c2a282a3e2957f71

SHA512
b35509d171a1f3d79a8b47ec4aedba743eb124d921062753a5386f0f03f938fdd227c0747e5650b3fb9698713842c9a6f44db06198e896d794c4a6b715cb19ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\8GMUNchOAtq8.bat

Filesize
224B

MD5
312c0cc63cbb3d3550a364e69e732019

SHA1
feef8fb9850b99613bf059be8ece8a9130e74f7e

SHA256
aa86c3942fc3e27a315cb58d98e6626dd9ee7bebffb6da499784062c91975422

SHA512
ab99045652fa4d95e524760c5c84e26af7f10d9afdd917a8b3aeafc2edb1e99c7e86eecfc49b2797387e93ff71dd9de3de7da699e658bc7919ff8bd85aa0e943

Download Submit
C:\Users\Admin\AppData\Local\Temp\EQkheECaMMVZ.bat

Filesize
224B

MD5
d1d08fc00da0fcea3f38cc8f1b4f2155

SHA1
31b29c0b87e1a94aa934d616ade35746ccf83656

SHA256
cbc5de08b503675060478a74d48bd9adcc9d420653eb3fbf957461ef80cb0b85

SHA512
1892b469f846c7212601935953f8b84921730f99c34ee62f94876bf0dfc7d28873ebc71005a29133cca3605d772801036dafa7379e06c69459d53834be12326b

Download Submit
C:\Users\Admin\AppData\Local\Temp\N5od84DlvpQk.bat

Filesize
224B

MD5
b0813badef7389362903b9a0d4512295

SHA1
aaee1d8efca67a2c387ccf72b5c762ef780c74d4

SHA256
a4be397f9db2e90bcb5947567f86bc70b67d9bc001198d1007f482682c4d32c5

SHA512
69aff1bbfe751f152edfaa57eeca3396e1c8513328041b63fd0b463a258fe06ab2a6fda9024f60a7ab7fe00d79262502a21e48172b0234be70a04898f643d590

Download Submit
C:\Users\Admin\AppData\Local\Temp\QW9sDxZMKwyf.bat

Filesize
224B

MD5
6084ba4f186393d0424b659a9420b6e9

SHA1
43ad06e41f218522fc450fe056d4acc4ca42ea7f

SHA256
b32876918579fa1accd9601f5f1b96daded9e6fd214c9d2b47c817fb487866c9

SHA512
b7a774095592ecc3e4b9071fec4b5d1f82a2fa584c98b91467ff958aef534f14419668b61d66128446370ecb799bd2d31287c2cf861000f0f294d4149b14ed3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\QgyoGWeYWaxJ.bat

Filesize
224B

MD5
60bf0a66d029b806699558675a47bb5e

SHA1
b968c397dce48c25465ac0627bd4374e49b62d5e

SHA256
452fa97865ddf17dd3a21d2f9ea45881c0e49891c6531efa113d401566731d45

SHA512
0546bb5fa4cc442c5dc46c747cf424961a6fc8141d66075a6a55e9d8bb49b7f519442f2aab6eb0475c74700ee81d7ed4a226584a06f69395e62b8453ac3cbc6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SfpINFfLGKvN.bat

Filesize
224B

MD5
e224d5d7ee4a9ec38a3f07edd728d0e2

SHA1
651ea5536b59e7406aed4ddb701092c5bbcaa764

SHA256
43029d2a73a0d3ecd76af2edd9793b1e5363859c2456ffa4750cb19840c77089

SHA512
4a4fa25de47c4c44c397ef60dcdb8a37f8d43719f751abb47cbbf1309c8e3da77375dfa601fc4959e5a7217a7ac43211fb5d4968441d656dadecdeb58559b587

Download Submit
C:\Users\Admin\AppData\Local\Temp\TV21wZDddszI.bat

Filesize
224B

MD5
bcee812d7b7c4da80fb65d7f78c74b5e

SHA1
eabf5d730f9777fce29d9be981af42f601e6213b

SHA256
58d352a59613dbf848f09d3c6634f630756bbdb61cf99b0bb174c90fe6e189d4

SHA512
7071ac7dc202a73d2025a9ec9b8f2f5a2f7cbe7f9b714d62fcad7c0321e44408343cbce32474f133059b02a602360f556056fc300c9471a35243b43e0e5ae2e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\X67kv1AmOrkW.bat

Filesize
224B

MD5
e7793551625c263532770fc94997aadc

SHA1
02c1b0ebe502afc50b1380941d6b569d045173db

SHA256
56d1f2c1b771d09091d6df239310174973d9fa008aabd947aa8dde391e658f57

SHA512
6186f83af8d20118945a4f7cb6fe97894893fbe5f5f87c5f77121e3cdc921ed523e58fd5bff3d3743eb3aa67b4f03b1ae649e532256708b31621d171473bf969

Download Submit
C:\Users\Admin\AppData\Local\Temp\YvLfVpbdlBNW.bat

Filesize
224B

MD5
5ec6425aa89a9ac4b73c925343933cbb

SHA1
5b98fa600edc764de645ec2603a0ce479a007d9c

SHA256
271ebdfa04868c5f6e8d628fdd1b015098555bf69419186bf687e05b43e848ba

SHA512
fc9d5c4559d89427eda6562e11e967f7bf55db0de0444661f5a07bfd0081902265efab665d1e48b2d321b515dc111217070b9aebe48798835cdd7c2d3f5d3d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZUCgumC3VV4R.bat

Filesize
224B

MD5
6730059df0ba4eac2fe60c181313868b

SHA1
482e7faf1b4f10dbfff58777f85f901cac5d2b78

SHA256
207868a6d1eb63df128d0a3e39b7dad23e4ae349362516b2f0ed7faaef9e59e8

SHA512
e32c22dafe38fb2ba64f11ff31bc1ee26621d40ec8f0136a197c78be42b74ba17be4f3289ba2a3f40eadf235e1384a0b81e1bb5e0ab36fe3a8f1f4c87c9dbfcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\pZo27tuk1vfP.bat

Filesize
224B

MD5
ac8ff3bee62f67f9f90f33a8fc9d16e1

SHA1
436d96a88b10f9171daccb94c3c8cd57e3b45c09

SHA256
4141cf010153af22120ee826797797629a57f72af6b1adb8d7983811156f6850

SHA512
2175c9d3c24ffad7a341eb28d144a67377bc735e710e17b63976a088bebf23396a96c3a12af11f33cb7e9d4ace42c91d41905c799877cbe6c92987b8d61843a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\s6MdjbZxIKVr.bat

Filesize
224B

MD5
dfa7e116541e6f6550499d15437429a0

SHA1
cf9b3cfdaa589e0b7857b3755decbfd2bae64fec

SHA256
6824cd4aa6724e09a8422942d6ee8911d851eb22b6946c95c4d1cc7a2b5171fe

SHA512
26ce107c7d5cea19af8e2093b34354e9cc03e5807fd9a378d4e81559e5610500a1aeb90d2346a896c6135e8a1f926c4f8ac2d6c70058f115181e2babd7ccd149

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Windows-Graphics-Loader.exe

Filesize
3.3MB

MD5
95da0645204d22bd9daf4e337ebeeaaa

SHA1
58182d8cf8e83335a5b7312d0d4af79f4bd64212

SHA256
ae5470b407120f90cd4c830260c8e965877199368d4a2982ff1a1769a2e08682

SHA512
9257076c55b3cc6100f3299766bf7bf0be1e0b330c1cadca1d7ca46ff859e4afefeff3635fc15811cc2c7d6debd2fcb808cf5f96314c681b1dbc32d2a7305f9e

Download Submit
memory/2064-11-0x00007FF91E910000-0x00007FF91F3D1000-memory.dmp

Filesize
10.8MB

Download
memory/2064-10-0x00007FF91E910000-0x00007FF91F3D1000-memory.dmp

Filesize
10.8MB

Download
memory/2064-18-0x00007FF91E910000-0x00007FF91F3D1000-memory.dmp

Filesize
10.8MB

Download
memory/2064-12-0x000000001BEA0000-0x000000001BEF0000-memory.dmp

Filesize
320KB

Download
memory/2064-13-0x000000001C5C0000-0x000000001C672000-memory.dmp

Filesize
712KB

Download
memory/4804-9-0x00007FF91E910000-0x00007FF91F3D1000-memory.dmp

Filesize
10.8MB

Download
memory/4804-0-0x00007FF91E913000-0x00007FF91E915000-memory.dmp

Filesize
8KB

Download
memory/4804-2-0x00007FF91E910000-0x00007FF91F3D1000-memory.dmp

Filesize
10.8MB

Download
memory/4804-1-0x0000000000950000-0x0000000000C98000-memory.dmp

Filesize
3.3MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads