quasar | 2b85704b2d63fe95970f2a35e9f48d9e4a72cd4cdfb6c8127f618bf043332f88

Analysis

max time kernel
104s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2025, 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

436052B37A3752148C885667E34DD9C3.exe
Size

10.7MB
MD5

436052b37a3752148c885667e34dd9c3
SHA1

59dbc9e97fb1c74ae666bc87e9ab2f453f780006
SHA256

2b85704b2d63fe95970f2a35e9f48d9e4a72cd4cdfb6c8127f618bf043332f88
SHA512

c6ef01300bb1350d64e5a4d5f48a1c013f8638ac9240820d2d27e951b0ca4b105ff2ee66a07bb3954178c7df8435dbfb561b7a7112f8f3ec79e63cedb7f4d784
SSDEEP

196608:QPW6IG7f1KCArQWGRhoDyp7t1OCf80nXIQPfMEftec7HsrEha1:w37d6T+97t1OCf80XIxQec7O

Score

10^/10

quasar umbral svchost 2 svchost 3 discovery execution pyinstaller spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

svchost 3

41.216.183.179:3742

Mutex

11b8b70b-ab15-4aab-8132-3e7b18b2b48b

Attributes

encryption_key
0325CE0E85B5B8870BB69FE8C81088DBCBFAC6F7
install_name
startui.exe
log_directory
Logs
reconnect_delay
3000
startup_key
startui
subdirectory
SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

svchost 2

41.216.183.179:3742

Mutex

d018acac-011d-4ca3-b0c3-4fdd7ec2d6d1

Attributes

encryption_key
0325CE0E85B5B8870BB69FE8C81088DBCBFAC6F7
install_name
Host Process for Windows Tasks.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Host Process for Windows Tasks
subdirectory
SubDir

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0003000000000709-1021.dat	family_umbral
behavioral2/memory/5052-1028-0x000002669ED30000-0x000002669ED70000-memory.dmp	family_umbral

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023cae-13.dat	family_quasar
behavioral2/files/0x0007000000023caf-24.dat	family_quasar
behavioral2/memory/3692-53-0x00000000006C0000-0x00000000009E4000-memory.dmp	family_quasar
behavioral2/memory/2204-41-0x00000000009C0000-0x0000000000CE4000-memory.dmp	family_quasar

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Umbral family
umbral

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2492	powershell.exe
4028	powershell.exe
2484	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	436052B37A3752148C885667E34DD9C3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	Host Process for Windows Tasks.exe

Executes dropped EXE 7 IoCs

pid	Process
3228	WormGPT.exe
2204	comsurrogate.exe
3692	svc.exe
2064	WormGPT.exe
2744	Host Process for Windows Tasks.exe
3736	startui.exe
5052	qLhaGMwuEu33.exe

Loads dropped DLL 7 IoCs

pid	Process
2064	WormGPT.exe
2064	WormGPT.exe
2064	WormGPT.exe
2064	WormGPT.exe
2064	WormGPT.exe
2064	WormGPT.exe
2064	WormGPT.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
58	discord.com
59	discord.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	ip-api.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\SubDir\Host Process for Windows Tasks.exe	comsurrogate.exe
File opened for modification	C:\Windows\system32\SubDir\Host Process for Windows Tasks.exe	comsurrogate.exe
File opened for modification	C:\Windows\system32\SubDir	comsurrogate.exe
File opened for modification	C:\Windows\system32\SubDir\Host Process for Windows Tasks.exe	Host Process for Windows Tasks.exe
File opened for modification	C:\Windows\system32\SubDir	Host Process for Windows Tasks.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\SubDir\startui.exe	startui.exe
File opened for modification	C:\Program Files\SubDir	startui.exe
File created	C:\Program Files\SubDir\startui.exe	svc.exe
File opened for modification	C:\Program Files\SubDir\startui.exe	svc.exe
File opened for modification	C:\Program Files\SubDir	svc.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000d000000023ba4-6.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	436052B37A3752148C885667E34DD9C3.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3212	cmd.exe
4160	PING.EXE

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3460	wmic.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	startui.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	startui.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4160	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3056	schtasks.exe
3416	schtasks.exe
4840	schtasks.exe
4872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2492	powershell.exe
2492	powershell.exe
4028	powershell.exe
4028	powershell.exe
2484	powershell.exe
2484	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2204	comsurrogate.exe
Token: SeDebugPrivilege	3692	svc.exe
Token: SeDebugPrivilege	2744	Host Process for Windows Tasks.exe
Token: SeDebugPrivilege	3736	startui.exe
Token: SeDebugPrivilege	5052	qLhaGMwuEu33.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	4028	powershell.exe
Token: SeIncreaseQuotaPrivilege	4064	wmic.exe
Token: SeSecurityPrivilege	4064	wmic.exe
Token: SeTakeOwnershipPrivilege	4064	wmic.exe
Token: SeLoadDriverPrivilege	4064	wmic.exe
Token: SeSystemProfilePrivilege	4064	wmic.exe
Token: SeSystemtimePrivilege	4064	wmic.exe
Token: SeProfSingleProcessPrivilege	4064	wmic.exe
Token: SeIncBasePriorityPrivilege	4064	wmic.exe
Token: SeCreatePagefilePrivilege	4064	wmic.exe
Token: SeBackupPrivilege	4064	wmic.exe
Token: SeRestorePrivilege	4064	wmic.exe
Token: SeShutdownPrivilege	4064	wmic.exe
Token: SeDebugPrivilege	4064	wmic.exe
Token: SeSystemEnvironmentPrivilege	4064	wmic.exe
Token: SeRemoteShutdownPrivilege	4064	wmic.exe
Token: SeUndockPrivilege	4064	wmic.exe
Token: SeManageVolumePrivilege	4064	wmic.exe
Token: 33	4064	wmic.exe
Token: 34	4064	wmic.exe
Token: 35	4064	wmic.exe
Token: 36	4064	wmic.exe
Token: SeIncreaseQuotaPrivilege	4064	wmic.exe
Token: SeSecurityPrivilege	4064	wmic.exe
Token: SeTakeOwnershipPrivilege	4064	wmic.exe
Token: SeLoadDriverPrivilege	4064	wmic.exe
Token: SeSystemProfilePrivilege	4064	wmic.exe
Token: SeSystemtimePrivilege	4064	wmic.exe
Token: SeProfSingleProcessPrivilege	4064	wmic.exe
Token: SeIncBasePriorityPrivilege	4064	wmic.exe
Token: SeCreatePagefilePrivilege	4064	wmic.exe
Token: SeBackupPrivilege	4064	wmic.exe
Token: SeRestorePrivilege	4064	wmic.exe
Token: SeShutdownPrivilege	4064	wmic.exe
Token: SeDebugPrivilege	4064	wmic.exe
Token: SeSystemEnvironmentPrivilege	4064	wmic.exe
Token: SeRemoteShutdownPrivilege	4064	wmic.exe
Token: SeUndockPrivilege	4064	wmic.exe
Token: SeManageVolumePrivilege	4064	wmic.exe
Token: 33	4064	wmic.exe
Token: 34	4064	wmic.exe
Token: 35	4064	wmic.exe
Token: 36	4064	wmic.exe
Token: SeIncreaseQuotaPrivilege	5076	wmic.exe
Token: SeSecurityPrivilege	5076	wmic.exe
Token: SeTakeOwnershipPrivilege	5076	wmic.exe
Token: SeLoadDriverPrivilege	5076	wmic.exe
Token: SeSystemProfilePrivilege	5076	wmic.exe
Token: SeSystemtimePrivilege	5076	wmic.exe
Token: SeProfSingleProcessPrivilege	5076	wmic.exe
Token: SeIncBasePriorityPrivilege	5076	wmic.exe
Token: SeCreatePagefilePrivilege	5076	wmic.exe
Token: SeBackupPrivilege	5076	wmic.exe
Token: SeRestorePrivilege	5076	wmic.exe
Token: SeShutdownPrivilege	5076	wmic.exe
Token: SeDebugPrivilege	5076	wmic.exe
Token: SeSystemEnvironmentPrivilege	5076	wmic.exe
Token: SeRemoteShutdownPrivilege	5076	wmic.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2744	Host Process for Windows Tasks.exe
3736	startui.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 3228	2892	436052B37A3752148C885667E34DD9C3.exe	85
PID 2892 wrote to memory of 3228	2892	436052B37A3752148C885667E34DD9C3.exe	85
PID 2892 wrote to memory of 2204	2892	436052B37A3752148C885667E34DD9C3.exe	87
PID 2892 wrote to memory of 2204	2892	436052B37A3752148C885667E34DD9C3.exe	87
PID 2892 wrote to memory of 3692	2892	436052B37A3752148C885667E34DD9C3.exe	88
PID 2892 wrote to memory of 3692	2892	436052B37A3752148C885667E34DD9C3.exe	88
PID 2204 wrote to memory of 4840	2204	comsurrogate.exe	89
PID 2204 wrote to memory of 4840	2204	comsurrogate.exe	89
PID 3228 wrote to memory of 2064	3228	WormGPT.exe	91
PID 3228 wrote to memory of 2064	3228	WormGPT.exe	91
PID 2204 wrote to memory of 2744	2204	comsurrogate.exe	92
PID 2204 wrote to memory of 2744	2204	comsurrogate.exe	92
PID 3692 wrote to memory of 4872	3692	svc.exe	93
PID 3692 wrote to memory of 4872	3692	svc.exe	93
PID 2064 wrote to memory of 4960	2064	WormGPT.exe	95
PID 2064 wrote to memory of 4960	2064	WormGPT.exe	95
PID 2744 wrote to memory of 3056	2744	Host Process for Windows Tasks.exe	96
PID 2744 wrote to memory of 3056	2744	Host Process for Windows Tasks.exe	96
PID 3692 wrote to memory of 3736	3692	svc.exe	98
PID 3692 wrote to memory of 3736	3692	svc.exe	98
PID 2064 wrote to memory of 1272	2064	WormGPT.exe	99
PID 2064 wrote to memory of 1272	2064	WormGPT.exe	99
PID 3736 wrote to memory of 3416	3736	startui.exe	100
PID 3736 wrote to memory of 3416	3736	startui.exe	100
PID 2744 wrote to memory of 5052	2744	Host Process for Windows Tasks.exe	117
PID 2744 wrote to memory of 5052	2744	Host Process for Windows Tasks.exe	117
PID 5052 wrote to memory of 3560	5052	qLhaGMwuEu33.exe	119
PID 5052 wrote to memory of 3560	5052	qLhaGMwuEu33.exe	119
PID 5052 wrote to memory of 2492	5052	qLhaGMwuEu33.exe	121
PID 5052 wrote to memory of 2492	5052	qLhaGMwuEu33.exe	121
PID 5052 wrote to memory of 4028	5052	qLhaGMwuEu33.exe	123
PID 5052 wrote to memory of 4028	5052	qLhaGMwuEu33.exe	123
PID 5052 wrote to memory of 4064	5052	qLhaGMwuEu33.exe	125
PID 5052 wrote to memory of 4064	5052	qLhaGMwuEu33.exe	125
PID 5052 wrote to memory of 5076	5052	qLhaGMwuEu33.exe	127
PID 5052 wrote to memory of 5076	5052	qLhaGMwuEu33.exe	127
PID 5052 wrote to memory of 4496	5052	qLhaGMwuEu33.exe	129
PID 5052 wrote to memory of 4496	5052	qLhaGMwuEu33.exe	129
PID 5052 wrote to memory of 2484	5052	qLhaGMwuEu33.exe	131
PID 5052 wrote to memory of 2484	5052	qLhaGMwuEu33.exe	131
PID 5052 wrote to memory of 3460	5052	qLhaGMwuEu33.exe	133
PID 5052 wrote to memory of 3460	5052	qLhaGMwuEu33.exe	133
PID 5052 wrote to memory of 3212	5052	qLhaGMwuEu33.exe	135
PID 5052 wrote to memory of 3212	5052	qLhaGMwuEu33.exe	135
PID 3212 wrote to memory of 4160	3212	cmd.exe	137
PID 3212 wrote to memory of 4160	3212	cmd.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3560	attrib.exe

C:\Users\Admin\AppData\Local\Temp\436052B37A3752148C885667E34DD9C3.exe
"C:\Users\Admin\AppData\Local\Temp\436052B37A3752148C885667E34DD9C3.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\WormGPT.exe
  "C:\Users\Admin\AppData\Local\Temp\WormGPT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Users\Admin\AppData\Local\Temp\WormGPT.exe
    "C:\Users\Admin\AppData\Local\Temp\WormGPT.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c
      4⤵
      PID:4960
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:1272
- C:\Users\Admin\AppData\Local\Temp\comsurrogate.exe
  "C:\Users\Admin\AppData\Local\Temp\comsurrogate.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Host Process for Windows Tasks" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Host Process for Windows Tasks.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- - C:\Windows\system32\SubDir\Host Process for Windows Tasks.exe
    "C:\Windows\system32\SubDir\Host Process for Windows Tasks.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Host Process for Windows Tasks" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Host Process for Windows Tasks.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\qLhaGMwuEu33.exe
      "C:\Users\Admin\AppData\Local\Temp\qLhaGMwuEu33.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5052
    - - C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\qLhaGMwuEu33.exe"
        5⤵
        Views/modifies file attributes
        
        PID:3560
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\qLhaGMwuEu33.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4028
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4064
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:4496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2484
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:3460
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\qLhaGMwuEu33.exe" && pause
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3212
      - C:\Windows\system32\PING.EXE
        
        ping localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4160
- C:\Users\Admin\AppData\Local\Temp\svc.exe
  "C:\Users\Admin\AppData\Local\Temp\svc.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "startui" /sc ONLOGON /tr "C:\Program Files\SubDir\startui.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4872
- - C:\Program Files\SubDir\startui.exe
    "C:\Program Files\SubDir\startui.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "startui" /sc ONLOGON /tr "C:\Program Files\SubDir\startui.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
e136966aba3500e5d57bcfc57edb3be1

SHA1
3dc5f1c1888b68da52706fb5fb053a86d5ac4c8d

SHA256
55f1c311ffec50f6d364764298fcb3172f034ad47b32eea2941bdaab95e369b0

SHA512
118f09f6b0a690641abbae52d5e4fa71493553eadcaee9639e59d671ce64576709b3ec3d94e9cfd066f94774590f76de0796d503c73e432f0f3412f5a97aed81

Download Submit
C:\Users\Admin\AppData\Local\Temp\WormGPT.exe

Filesize
8.6MB

MD5
1c2128b3ad0a5dc32f938362e16f6b07

SHA1
eecb906f664ff6a5fc4cded35c274cbcc342fec8

SHA256
2b093e0b16481ff4d090e4502c6ef4d547fb7003a6a07e43fc042a1550f9bb9c

SHA512
21758831af1d641c1f1aad7fb148b16c87ebf00ae5574a3f66542620931088c6ebedc61a92ccb2ffe2f1643792989541eae9180a0bdd672202df7ac455f4350e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32282\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32282\_ctypes.pyd

Filesize
119KB

MD5
ca4cef051737b0e4e56b7d597238df94

SHA1
583df3f7ecade0252fdff608eb969439956f5c4a

SHA256
e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

SHA512
17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32282\_tkinter.pyd

Filesize
63KB

MD5
470364d8abdc5c22828df8e22c095ed2

SHA1
4c707b1061012deb8ce4ab38772a21d3195624c2

SHA256
4262cabac7e97220d0e4bd72deb337ffd9df429860ab298b3e2d5c9223874705

SHA512
70eb15796ead54cdadf696ea6581ff2f979057c3be8c95c12ab89be51c02b2aba591f9ee9671e8c4f376c973b154d0f2e0614498c5835397411c876346429cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32282\base_library.zip

Filesize
1.0MB

MD5
d83e1395c18c93d96645462bb79e86ae

SHA1
7dd7988f499390ce0508e51219f70c8db426c989

SHA256
5a4fa8a060ee1eea1b7e6ea27bba2f4913469c83db0f31ceaec2c17b9a01340d

SHA512
8e011b62c15e207d694182b4e7d5997f60fff0dfb5e7aab7ade93dcd2e8a5493606b1bc03997743e22fc13b5a1a0b44c1b72ca90e63e926f8657755874881ed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32282\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32282\python310.dll

Filesize
4.3MB

MD5
deaf0c0cc3369363b800d2e8e756a402

SHA1
3085778735dd8badad4e39df688139f4eed5f954

SHA256
156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

SHA512
5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32282\tcl86t.dll

Filesize
1.8MB

MD5
75909678c6a79ca2ca780a1ceb00232e

SHA1
39ddbeb1c288335abe910a5011d7034345425f7d

SHA256
fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860

SHA512
91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32282\tcl\encoding\cp1252.enc

Filesize
1KB

MD5
e9117326c06fee02c478027cb625c7d8

SHA1
2ed4092d573289925a5b71625cf43cc82b901daf

SHA256
741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e

SHA512
d0a39bc41adc32f2f20b1a0ebad33bf48dfa6ed5cc1d8f92700cdd431db6c794c09d9f08bb5709b394acf54116c3a1e060e2abcc6b503e1501f8364d3eebcd52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI32282\tk86t.dll

Filesize
1.5MB

MD5
4b6270a72579b38c1cc83f240fb08360

SHA1
1a161a014f57fe8aa2fadaab7bc4f9faaac368de

SHA256
cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08

SHA512
0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cneeqy3w.2ev.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\comsurrogate.exe

Filesize
3.1MB

MD5
026407873fa1c229033246e574724e02

SHA1
888c874808635b0b03456da413b1941c61c33686

SHA256
4531e23ad4f6443dd3e0807007afd811ea1fc6a2a35f423e9ac98bcfc21be996

SHA512
660db81f331c9ff47440d41d2e5062d92ad1fe2b7cc5559ba120c4908b5cd9a253c4fb1da323a1f0f1e7a5ce50d04e9020aec286e3eb399cb3ebdf1b765acc7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\qLhaGMwuEu33.exe

Filesize
227KB

MD5
513c9ed3a690a8568531bc6103b3499b

SHA1
9df50595d7cfb2a48741ab4983d6ac7b2ab89202

SHA256
c9ff36b9f84347e191f8e9e80af044e528dcb57abfdf4abb01e146d4f26be377

SHA512
8d0c47844b514bf16feebee3502e77e7d24755c6c01df6b5279e1c002d8f30d9fdf35b7e75332d3251b0630925dd98310e6be0cf6f6befaa6b4ddfde0ff3e4d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\svc.exe

Filesize
3.1MB

MD5
7776335b8b0d230370ca39602c484a69

SHA1
7705fb56ea438e609a6094bef10bdb2392f55719

SHA256
b6bb8a533c77034b0d4eab34ffa434b1a999cac5f59983680d222f04e437729d

SHA512
0e290749b442e317fe90591a43549a003d7f95c086d220b04eae018209a9785a1754b834d529a5839b15d2aa783edd17e52f4ab2b331e3a14c47d84ebf24899d

Download Submit
memory/2204-177-0x00007FFDF70D0000-0x00007FFDF7B91000-memory.dmp

Filesize
10.8MB

Download
memory/2204-30-0x00007FFDF70D3000-0x00007FFDF70D5000-memory.dmp

Filesize
8KB

Download
memory/2204-992-0x00007FFDF70D0000-0x00007FFDF7B91000-memory.dmp

Filesize
10.8MB

Download
memory/2204-41-0x00000000009C0000-0x0000000000CE4000-memory.dmp

Filesize
3.1MB

Download
memory/2492-1029-0x000001852E940000-0x000001852E962000-memory.dmp

Filesize
136KB

Download
memory/2744-1011-0x000000001B570000-0x000000001B5C0000-memory.dmp

Filesize
320KB

Download
memory/2744-1012-0x000000001BDF0000-0x000000001BEA2000-memory.dmp

Filesize
712KB

Download
memory/2744-1016-0x000000001BD90000-0x000000001BDCC000-memory.dmp

Filesize
240KB

Download
memory/2744-1015-0x000000001BD30000-0x000000001BD42000-memory.dmp

Filesize
72KB

Download
memory/3692-102-0x00007FFDF70D0000-0x00007FFDF7B91000-memory.dmp

Filesize
10.8MB

Download
memory/3692-53-0x00000000006C0000-0x00000000009E4000-memory.dmp

Filesize
3.1MB

Download
memory/3692-1003-0x00007FFDF70D0000-0x00007FFDF7B91000-memory.dmp

Filesize
10.8MB

Download
memory/3692-231-0x00007FFDF70D0000-0x00007FFDF7B91000-memory.dmp

Filesize
10.8MB

Download
memory/5052-1028-0x000002669ED30000-0x000002669ED70000-memory.dmp

Filesize
256KB

Download
memory/5052-1053-0x00000266B94E0000-0x00000266B9556000-memory.dmp

Filesize
472KB

Download
memory/5052-1054-0x00000266B93F0000-0x00000266B940E000-memory.dmp

Filesize
120KB

Download
memory/5052-1069-0x00000266B9470000-0x00000266B947A000-memory.dmp

Filesize
40KB

Download
memory/5052-1070-0x00000266B94A0000-0x00000266B94B2000-memory.dmp

Filesize
72KB

Download