quasar | 2787d416bf228915debc5d9c9e058cc246f8da7217c706d8a1fe0cb788a9155b

Analysis

max time kernel
142s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client.exe
Size

3.1MB
MD5

aad11067aa90b9d96958aae378c45747
SHA1

13dc757a06a092ab0ef34482c307604a67fd74b9
SHA256

2787d416bf228915debc5d9c9e058cc246f8da7217c706d8a1fe0cb788a9155b
SHA512

8a2fc9cfc72b7f9fb0ff54292022d738013813f222ebe3d7e54f1d916a6307d7652a5f4276d38550e6c515e637358b039a3f784e70a187e2d754b60eaff26813
SSDEEP

49152:gvXhBYjCOuDt2d5aKCuVPzlEmVQL0wvwkaE8sV4mzFEoGdCTHHB72eh2NT:gvdt2d5aKCuVPzlEmVQ0wvwfJsVo

Score

10^/10

quasar vm-ku discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

VM-KU

adidya354-21806.portmap.host:21806

Mutex

cf7c4d30-a326-47cc-a5f0-5a19aa014204

Attributes

encryption_key
E50BC33BC56B70B1A2963DE6EA1855A0E0D0FBCE
install_name
Windows Shell Interactive.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Shell Interactive

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 11 IoCs

resource	yara_rule
behavioral1/memory/2936-1-0x00000000002D0000-0x00000000005F4000-memory.dmp	family_quasar
behavioral1/files/0x000b000000012280-6.dat	family_quasar
behavioral1/memory/2704-10-0x0000000000DE0000-0x0000000001104000-memory.dmp	family_quasar
behavioral1/memory/1416-23-0x0000000001320000-0x0000000001644000-memory.dmp	family_quasar
behavioral1/memory/2560-35-0x00000000003D0000-0x00000000006F4000-memory.dmp	family_quasar
behavioral1/memory/2392-46-0x0000000000F00000-0x0000000001224000-memory.dmp	family_quasar
behavioral1/memory/292-68-0x00000000012A0000-0x00000000015C4000-memory.dmp	family_quasar
behavioral1/memory/2152-99-0x0000000000260000-0x0000000000584000-memory.dmp	family_quasar
behavioral1/memory/2812-110-0x0000000000120000-0x0000000000444000-memory.dmp	family_quasar
behavioral1/memory/2032-121-0x0000000001330000-0x0000000001654000-memory.dmp	family_quasar
behavioral1/memory/1276-132-0x0000000001390000-0x00000000016B4000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

pid	Process
2704	Windows Shell Interactive.exe
1416	Windows Shell Interactive.exe
2560	Windows Shell Interactive.exe
2392	Windows Shell Interactive.exe
2184	Windows Shell Interactive.exe
292	Windows Shell Interactive.exe
352	Windows Shell Interactive.exe
2604	Windows Shell Interactive.exe
2152	Windows Shell Interactive.exe
2812	Windows Shell Interactive.exe
2032	Windows Shell Interactive.exe
1276	Windows Shell Interactive.exe
2536	Windows Shell Interactive.exe
3052	Windows Shell Interactive.exe
2828	Windows Shell Interactive.exe

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Client.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File created	C:\Windows\system32\Windows Shell Interactive.exe	Client.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe
File opened for modification	C:\Windows\system32\Windows Shell Interactive.exe	Windows Shell Interactive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2868	PING.EXE
2036	PING.EXE
2796	PING.EXE
2072	PING.EXE
1644	PING.EXE
1044	PING.EXE
1920	PING.EXE
836	PING.EXE
2508	PING.EXE
2236	PING.EXE
2328	PING.EXE
2748	PING.EXE
2296	PING.EXE
1504	PING.EXE
2396	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2072	PING.EXE
1644	PING.EXE
2508	PING.EXE
2796	PING.EXE
2328	PING.EXE
836	PING.EXE
2236	PING.EXE
1920	PING.EXE
2748	PING.EXE
2296	PING.EXE
1504	PING.EXE
1044	PING.EXE
2868	PING.EXE
2396	PING.EXE
2036	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1720	schtasks.exe
2352	schtasks.exe
1808	schtasks.exe
2848	schtasks.exe
1264	schtasks.exe
1800	schtasks.exe
1668	schtasks.exe
2068	schtasks.exe
2896	schtasks.exe
1716	schtasks.exe
2724	schtasks.exe
2236	schtasks.exe
1672	schtasks.exe
1248	schtasks.exe
1524	schtasks.exe
2220	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	Client.exe
Token: SeDebugPrivilege	2704	Windows Shell Interactive.exe
Token: SeDebugPrivilege	1416	Windows Shell Interactive.exe
Token: SeDebugPrivilege	2560	Windows Shell Interactive.exe
Token: SeDebugPrivilege	2392	Windows Shell Interactive.exe
Token: SeDebugPrivilege	2184	Windows Shell Interactive.exe
Token: SeDebugPrivilege	292	Windows Shell Interactive.exe
Token: SeDebugPrivilege	352	Windows Shell Interactive.exe
Token: SeDebugPrivilege	2604	Windows Shell Interactive.exe
Token: SeDebugPrivilege	2152	Windows Shell Interactive.exe
Token: SeDebugPrivilege	2812	Windows Shell Interactive.exe
Token: SeDebugPrivilege	2032	Windows Shell Interactive.exe
Token: SeDebugPrivilege	1276	Windows Shell Interactive.exe
Token: SeDebugPrivilege	2536	Windows Shell Interactive.exe
Token: SeDebugPrivilege	3052	Windows Shell Interactive.exe
Token: SeDebugPrivilege	2828	Windows Shell Interactive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2848	2936	Client.exe	30
PID 2936 wrote to memory of 2848	2936	Client.exe	30
PID 2936 wrote to memory of 2848	2936	Client.exe	30
PID 2936 wrote to memory of 2704	2936	Client.exe	32
PID 2936 wrote to memory of 2704	2936	Client.exe	32
PID 2936 wrote to memory of 2704	2936	Client.exe	32
PID 2704 wrote to memory of 2896	2704	Windows Shell Interactive.exe	33
PID 2704 wrote to memory of 2896	2704	Windows Shell Interactive.exe	33
PID 2704 wrote to memory of 2896	2704	Windows Shell Interactive.exe	33
PID 2704 wrote to memory of 2652	2704	Windows Shell Interactive.exe	35
PID 2704 wrote to memory of 2652	2704	Windows Shell Interactive.exe	35
PID 2704 wrote to memory of 2652	2704	Windows Shell Interactive.exe	35
PID 2652 wrote to memory of 304	2652	cmd.exe	37
PID 2652 wrote to memory of 304	2652	cmd.exe	37
PID 2652 wrote to memory of 304	2652	cmd.exe	37
PID 2652 wrote to memory of 2748	2652	cmd.exe	38
PID 2652 wrote to memory of 2748	2652	cmd.exe	38
PID 2652 wrote to memory of 2748	2652	cmd.exe	38
PID 2652 wrote to memory of 1416	2652	cmd.exe	39
PID 2652 wrote to memory of 1416	2652	cmd.exe	39
PID 2652 wrote to memory of 1416	2652	cmd.exe	39
PID 1416 wrote to memory of 1716	1416	Windows Shell Interactive.exe	40
PID 1416 wrote to memory of 1716	1416	Windows Shell Interactive.exe	40
PID 1416 wrote to memory of 1716	1416	Windows Shell Interactive.exe	40
PID 1416 wrote to memory of 2212	1416	Windows Shell Interactive.exe	42
PID 1416 wrote to memory of 2212	1416	Windows Shell Interactive.exe	42
PID 1416 wrote to memory of 2212	1416	Windows Shell Interactive.exe	42
PID 2212 wrote to memory of 2820	2212	cmd.exe	44
PID 2212 wrote to memory of 2820	2212	cmd.exe	44
PID 2212 wrote to memory of 2820	2212	cmd.exe	44
PID 2212 wrote to memory of 2296	2212	cmd.exe	45
PID 2212 wrote to memory of 2296	2212	cmd.exe	45
PID 2212 wrote to memory of 2296	2212	cmd.exe	45
PID 2212 wrote to memory of 2560	2212	cmd.exe	46
PID 2212 wrote to memory of 2560	2212	cmd.exe	46
PID 2212 wrote to memory of 2560	2212	cmd.exe	46
PID 2560 wrote to memory of 1264	2560	Windows Shell Interactive.exe	47
PID 2560 wrote to memory of 1264	2560	Windows Shell Interactive.exe	47
PID 2560 wrote to memory of 1264	2560	Windows Shell Interactive.exe	47
PID 2560 wrote to memory of 2912	2560	Windows Shell Interactive.exe	49
PID 2560 wrote to memory of 2912	2560	Windows Shell Interactive.exe	49
PID 2560 wrote to memory of 2912	2560	Windows Shell Interactive.exe	49
PID 2912 wrote to memory of 112	2912	cmd.exe	51
PID 2912 wrote to memory of 112	2912	cmd.exe	51
PID 2912 wrote to memory of 112	2912	cmd.exe	51
PID 2912 wrote to memory of 2072	2912	cmd.exe	52
PID 2912 wrote to memory of 2072	2912	cmd.exe	52
PID 2912 wrote to memory of 2072	2912	cmd.exe	52
PID 2912 wrote to memory of 2392	2912	cmd.exe	54
PID 2912 wrote to memory of 2392	2912	cmd.exe	54
PID 2912 wrote to memory of 2392	2912	cmd.exe	54
PID 2392 wrote to memory of 2236	2392	Windows Shell Interactive.exe	55
PID 2392 wrote to memory of 2236	2392	Windows Shell Interactive.exe	55
PID 2392 wrote to memory of 2236	2392	Windows Shell Interactive.exe	55
PID 2392 wrote to memory of 2428	2392	Windows Shell Interactive.exe	57
PID 2392 wrote to memory of 2428	2392	Windows Shell Interactive.exe	57
PID 2392 wrote to memory of 2428	2392	Windows Shell Interactive.exe	57
PID 2428 wrote to memory of 1472	2428	cmd.exe	59
PID 2428 wrote to memory of 1472	2428	cmd.exe	59
PID 2428 wrote to memory of 1472	2428	cmd.exe	59
PID 2428 wrote to memory of 1504	2428	cmd.exe	60
PID 2428 wrote to memory of 1504	2428	cmd.exe	60
PID 2428 wrote to memory of 1504	2428	cmd.exe	60
PID 2428 wrote to memory of 2184	2428	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2848
- C:\Windows\system32\Windows Shell Interactive.exe
  "C:\Windows\system32\Windows Shell Interactive.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2896
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\yjwN1UzxZZFJ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2652
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:304
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2748
  - - C:\Windows\system32\Windows Shell Interactive.exe
      "C:\Windows\system32\Windows Shell Interactive.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1416
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1716
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\3N3tcVsUlA2F.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2212
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2820
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2296
      - C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1264
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\JJNgRJDy04J9.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:112
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2072
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2236
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\V8GvYI0dpvlF.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1472
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1504
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1672
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QpvTQOdhO9PH.bat" "
        11⤵
        
        PID:2488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2140
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1644
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:292
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1248
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\VW75jhynzpwc.bat" "
        13⤵
        
        PID:2292
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2348
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2508
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:352
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1524
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\qt5oPL2HIkVX.bat" "
        15⤵
        
        PID:2828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2916
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2868
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2604
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1800
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\aBBoA95cwU4O.bat" "
        17⤵
        
        PID:3016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2272
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2396
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2152
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2220
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmMicjOwYUJ8.bat" "
        19⤵
        
        PID:2544
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1044
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\twzTNLyUUy8S.bat" "
        21⤵
        
        PID:2912
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1628
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2236
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2032
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2352
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\jo1db04Zk5h6.bat" "
        23⤵
        
        PID:2424
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1504
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2036
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1276
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1668
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\fsly5gAYT0hg.bat" "
        25⤵
        
        PID:1644
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2380
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1920
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2536
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1808
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\qsLUwOpj5glP.bat" "
        27⤵
        
        PID:2512
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2796
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3052
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2724
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\EwpkH2xSlOPi.bat" "
        29⤵
        
        PID:1228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2328
        
        C:\Windows\system32\Windows Shell Interactive.exe
        
        "C:\Windows\system32\Windows Shell Interactive.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2828
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Windows Shell Interactive" /sc ONLOGON /tr "C:\Windows\system32\Windows Shell Interactive.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2068
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QyrEHsSYMpyr.bat" "
        31⤵
        
        PID:2604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2176
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3N3tcVsUlA2F.bat

Filesize
208B

MD5
3c5d38487182526f4ec7fb208c2db24e

SHA1
f23a5e650e4d0864a2c8d1aa396a6aac4ad66e1c

SHA256
e28c5576e29fcb0eb0f1947391b90a2944ab30372a14188107420abe6937a763

SHA512
4b7fcaf6683102ebfcacbd9e5563df09ea1a9b54a017064a4a4f64d8412219f1ccdc1fb1f406799110e0907ae48c36f2d02344b10e9790fb6a4c82c8e171e7a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\EwpkH2xSlOPi.bat

Filesize
208B

MD5
e01e7ce3337a9ff854eab95c23a118ea

SHA1
d825808a7f36e95dbc9df7a025964a6ac5a15794

SHA256
ae7c53f4f81cc4e0e52303607b633e640a28944af269002190f11479fa643385

SHA512
d588ce92db4c1aa8cfc9d1feb9d59a15a764a1b798daf13b63c4e0ac8559eb25bf20c720fda99ce28756f5e7a7f9177ffc164bb5ada275ea79517c262a3e0dd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\JJNgRJDy04J9.bat

Filesize
208B

MD5
3f3d3e31c6268801368907a999b4e78e

SHA1
e300e90ad264c61c28c7e2d2bd6248f85748f759

SHA256
00fa2f9acd525f0f7c45e38218865753bc5d86a2cd6b2662eab69ffe90fb2264

SHA512
cde7842c123850f9b29ad85f77cc27eb66de2e0e6b9bcf92633342b3df6246447441037ba351f86b753026238d9c55d51df30f182bde4cdb921f15c0ed5a4dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\QpvTQOdhO9PH.bat

Filesize
208B

MD5
41f99852aa6faa55884dcfe41e04d07a

SHA1
ba2198125f7a77f4d2620ea3d5ce4965e7a73e55

SHA256
c493979762d096934022cf0f37531b0cf6efa894f7a3978b62868aea500545d9

SHA512
71ee0318edd4feb0cc93cd62149981ef0e0dce2a9e9e8ca7c8f16a9b3808381809d0c1488fe83ce0b4329ee9ceeea846dba30963dfb833108ba02d27280f6198

Download Submit
C:\Users\Admin\AppData\Local\Temp\QyrEHsSYMpyr.bat

Filesize
208B

MD5
5d4e8e6ff02fb7edea02141448149ced

SHA1
b583d5a47b22e8726bd8a7342e62473ab133ef0f

SHA256
5f4d9c0ebffd9d4b763f99a51ede8b8afbe12476ceed436c7e4c7cf456f9d674

SHA512
f43b98300264b3a4d108a7ba9391b1b5c314d742cc2aacd613f2c42ba5136cbe1f5466fc53a0a8a2d781001023c01ceb3209aa62039d9dd592fb83a9c52d600a

Download Submit
C:\Users\Admin\AppData\Local\Temp\V8GvYI0dpvlF.bat

Filesize
208B

MD5
d4d7b3a87ced0518b2003292b541e4c8

SHA1
b7c988ccf877642a0145612c1ff0fa6413cc63a9

SHA256
4ecfb16991c167da496f57cc732ded30574a9fef3d1c7bf2587949b49897dca5

SHA512
08277a5aaf058b1cf187f71cd6909efd6861ce53b33f9d73f5e54976e89645df0dfcedd199b971df3d315f107ec04b16b0af118f61a514c83d90e32d35ec0c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\VW75jhynzpwc.bat

Filesize
208B

MD5
37b513c48cf38b2d7548050ad58428f2

SHA1
3deaed113f25229654c7cd682fb6a8f03fe2a22e

SHA256
554d16d99f6d1c97b529d26eceb1d42a6ddebfa6696ffbfd8b0511455c9b92ff

SHA512
6d1110b932bd5ee9b31daaccedf3269dc754de1da9a9cc9b75cbd2e12cdc1e15300815795bd4544fde05ddc5fd468c2f7f12db43ec48e3ed353027cf3aa50b84

Download Submit
C:\Users\Admin\AppData\Local\Temp\aBBoA95cwU4O.bat

Filesize
208B

MD5
28cd3ebc137811005005cd8cab202d98

SHA1
68eda6da9411d0682e5238ab437bfd185c22dce3

SHA256
5545f6a056cedfab1183cce82a01922f1bd143a63f3b742530f54463bcd8dd1c

SHA512
0a9dc44f9dc2009da193f39adc23cd28eb4ffdbc19b008463c2b33f6200b74f59d1fd0754cace6062fcafc51501c50412429fc6a17a32e4e998e5cac1945a065

Download Submit
C:\Users\Admin\AppData\Local\Temp\fsly5gAYT0hg.bat

Filesize
208B

MD5
48d58f418f8b3d09b75cb13d0a9c5c65

SHA1
333ea36355266740165fb2d7155183eb18db6e1b

SHA256
d0928eb93f86ff532dd2d0764537b98c089a792442b8cb5e86abc51af30e986f

SHA512
8093b0025f1617272d19b07448e4adff61b88b8d74469ea538c7854712747fac814493f77ed110c8b92c8626a025ad2cde7874d187a0848d504f058058929af5

Download Submit
C:\Users\Admin\AppData\Local\Temp\jo1db04Zk5h6.bat

Filesize
208B

MD5
e048702b0f46f23c1be56c5fd6d9890b

SHA1
785997350ffcbe01ce6c61d58c7f20bf7756d022

SHA256
1facc062df508b1f22ec7264d39d61f4901ab80c5dd289804bedb18de57280e9

SHA512
adf56cfca07a09481eee89728c0149b73de68a75b1e8ab23ebb22d762e361b47d1851972f41e9b744cab08a6d5da46ede64e5a3f1fce4b6a514f0380ac3d15c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\qsLUwOpj5glP.bat

Filesize
208B

MD5
0f73f5a84ee184fa7202fb30f48c12ac

SHA1
e398f75cf3427204e62268e9eca2b0f8c677168c

SHA256
1ce97fac109347e8a89ceccb6c2117fa2a4e599cc8c611b013395d6f745b892c

SHA512
690297d9e93104ecb241d129dd2fd0153ad5b144a30736f207da1e00f180d08445c89ab89291c5bb5de3bb0b65b35c66c51ba053160ea9a8817d331826352d7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\qt5oPL2HIkVX.bat

Filesize
208B

MD5
59a1f627204e69fae6e2c260fc0b62ab

SHA1
1bf13dcfc8e9917d3e8aa4c3da9341ba006b0408

SHA256
faf3e53e2ed4dc62f290819ee509495f4f18ee523eb5535f6d3d9e490cbcfa9d

SHA512
caa375c3d43715be53ccfb821442a9e22bba36e2ca46fde681ddca0b5fe6011bce20713f024052bc2916291fde67f0982dcda09dc246d60b6248c1fccdf181ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmMicjOwYUJ8.bat

Filesize
208B

MD5
fc68237febdf95440f06d4f1231a3bf2

SHA1
ac61c6c823a9ad4c28a8d0f6ece194149d851cb4

SHA256
7ec23fea94dbab576790a92cbbac37c29edd190b0192b83446feb6cf3db3c04d

SHA512
aa2d91872959b987bc74c912ab890594bb97def6d0034e1b50dcc1dfdd46ff3c1a563b39b03fd4bdd001521c279b8103f57f5477991fb0f0527201d6a4c77b6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\twzTNLyUUy8S.bat

Filesize
208B

MD5
89d652efea1ec3e9d9f9154fdd43b2ff

SHA1
0da6532c875566e0abc8bc01f63cd47536058324

SHA256
4d81951d0889fb5eb8ee77b1842f0f62dfc375a21dfebe97df3e76a05d31ebc2

SHA512
3f5f99820efa0c9f2c0d0a37e37122cec87111ffb32cd5fea4c5c6e454af88a4ae35d6f118550e5da9f09e14c99bf5351f5bc3375ba029cbc9e430fb1dffa59d

Download Submit
C:\Users\Admin\AppData\Local\Temp\yjwN1UzxZZFJ.bat

Filesize
208B

MD5
eb0085f60758ef69186ae7aaeb2fccea

SHA1
358e0a764594bcbaf9169fc35322a1dd9134bb8c

SHA256
ea40d4c0d921316564d092b86bb829e69ca4fe267878bb295585bbf355b01f46

SHA512
3cc7cf8fe2f65e18c4bd8a0a8032f55e3e041eeedf8d88fddcce7ae3cd2c40af0eb4bfb2e190e3863b485d831dbf20bef0de9daf887396265030cc4b29a1afc1

Download Submit
C:\Windows\System32\Windows Shell Interactive.exe

Filesize
3.1MB

MD5
aad11067aa90b9d96958aae378c45747

SHA1
13dc757a06a092ab0ef34482c307604a67fd74b9

SHA256
2787d416bf228915debc5d9c9e058cc246f8da7217c706d8a1fe0cb788a9155b

SHA512
8a2fc9cfc72b7f9fb0ff54292022d738013813f222ebe3d7e54f1d916a6307d7652a5f4276d38550e6c515e637358b039a3f784e70a187e2d754b60eaff26813

Download Submit
memory/292-68-0x00000000012A0000-0x00000000015C4000-memory.dmp

Filesize
3.1MB

Download
memory/1276-132-0x0000000001390000-0x00000000016B4000-memory.dmp

Filesize
3.1MB

Download
memory/1416-23-0x0000000001320000-0x0000000001644000-memory.dmp

Filesize
3.1MB

Download
memory/2032-121-0x0000000001330000-0x0000000001654000-memory.dmp

Filesize
3.1MB

Download
memory/2152-99-0x0000000000260000-0x0000000000584000-memory.dmp

Filesize
3.1MB

Download
memory/2392-46-0x0000000000F00000-0x0000000001224000-memory.dmp

Filesize
3.1MB

Download
memory/2560-35-0x00000000003D0000-0x00000000006F4000-memory.dmp

Filesize
3.1MB

Download
memory/2704-11-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-10-0x0000000000DE0000-0x0000000001104000-memory.dmp

Filesize
3.1MB

Download
memory/2704-9-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2704-21-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2812-110-0x0000000000120000-0x0000000000444000-memory.dmp

Filesize
3.1MB

Download
memory/2936-8-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2936-0-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

Filesize
4KB

Download
memory/2936-2-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2936-1-0x00000000002D0000-0x00000000005F4000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads