quasar | b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2025, 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe
Size

3.1MB
MD5

25befffc195ce47401f74afbe942f3ff
SHA1

287aacd0350f05308e08c6b4b8b88baf56f56160
SHA256

b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f
SHA512

a28796538d64edaf7d4ba4d19e705211c779230a58b462793dab86ed5f51408feab998cf78ffe808819b4dc27cbaa981cd107887e0d5c7b0fb0f2bbca630973e
SSDEEP

49152:rv+I22SsaNYfdPBldt698dBcjH0gR04RoGdNdTHHB72eh2NT:rvz22SsaNYfdPBldt6+dBcjH0gR0k

Score

10^/10

quasar bot discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

bot

wexos47815-61484.portmap.host:61484

Mutex

06e2bb33-968c-4ca7-97dc-f23fbd5c3092

Attributes

encryption_key
8924CB3C9515DA437A37F5AE598376261E5528FC
install_name
msinfo32.exe
log_directory
Update
reconnect_delay
3000
startup_key
Discordupdate
subdirectory
dll32

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4876-1-0x00000000000C0000-0x00000000003E4000-memory.dmp	family_quasar
behavioral2/files/0x0009000000023cc5-7.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	msinfo32.exe

Executes dropped EXE 15 IoCs

pid	Process
2220	msinfo32.exe
2056	msinfo32.exe
3416	msinfo32.exe
2376	msinfo32.exe
4736	msinfo32.exe
5020	msinfo32.exe
2180	msinfo32.exe
960	msinfo32.exe
1492	msinfo32.exe
2848	msinfo32.exe
4224	msinfo32.exe
1596	msinfo32.exe
4076	msinfo32.exe
3316	msinfo32.exe
4436	msinfo32.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File created	C:\Windows\system32\dll32\msinfo32.exe	b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe
File opened for modification	C:\Windows\system32\dll32	b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32\msinfo32.exe	msinfo32.exe
File opened for modification	C:\Windows\system32\dll32	msinfo32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
884	PING.EXE
1652	PING.EXE
4036	PING.EXE
2508	PING.EXE
912	PING.EXE
4380	PING.EXE
3304	PING.EXE
4428	PING.EXE
3160	PING.EXE
4536	PING.EXE
2008	PING.EXE
3300	PING.EXE
4584	PING.EXE
4476	PING.EXE
4108	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
884	PING.EXE
4584	PING.EXE
4036	PING.EXE
3160	PING.EXE
2008	PING.EXE
3300	PING.EXE
3304	PING.EXE
912	PING.EXE
1652	PING.EXE
4380	PING.EXE
4428	PING.EXE
4476	PING.EXE
4108	PING.EXE
4536	PING.EXE
2508	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3692	schtasks.exe
3224	schtasks.exe
4072	schtasks.exe
4860	schtasks.exe
2368	schtasks.exe
1436	schtasks.exe
1576	schtasks.exe
2872	schtasks.exe
4968	schtasks.exe
2880	schtasks.exe
348	schtasks.exe
3448	schtasks.exe
2540	schtasks.exe
864	schtasks.exe
4104	schtasks.exe
3224	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4876	b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe
Token: SeDebugPrivilege	2220	msinfo32.exe
Token: SeDebugPrivilege	2056	msinfo32.exe
Token: SeDebugPrivilege	3416	msinfo32.exe
Token: SeDebugPrivilege	2376	msinfo32.exe
Token: SeDebugPrivilege	4736	msinfo32.exe
Token: SeDebugPrivilege	5020	msinfo32.exe
Token: SeDebugPrivilege	2180	msinfo32.exe
Token: SeDebugPrivilege	960	msinfo32.exe
Token: SeDebugPrivilege	1492	msinfo32.exe
Token: SeDebugPrivilege	2848	msinfo32.exe
Token: SeDebugPrivilege	4224	msinfo32.exe
Token: SeDebugPrivilege	1596	msinfo32.exe
Token: SeDebugPrivilege	4076	msinfo32.exe
Token: SeDebugPrivilege	3316	msinfo32.exe
Token: SeDebugPrivilege	4436	msinfo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3692	4876	b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe	82
PID 4876 wrote to memory of 3692	4876	b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe	82
PID 4876 wrote to memory of 2220	4876	b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe	84
PID 4876 wrote to memory of 2220	4876	b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe	84
PID 2220 wrote to memory of 2368	2220	msinfo32.exe	85
PID 2220 wrote to memory of 2368	2220	msinfo32.exe	85
PID 2220 wrote to memory of 2036	2220	msinfo32.exe	87
PID 2220 wrote to memory of 2036	2220	msinfo32.exe	87
PID 2036 wrote to memory of 4636	2036	cmd.exe	89
PID 2036 wrote to memory of 4636	2036	cmd.exe	89
PID 2036 wrote to memory of 912	2036	cmd.exe	90
PID 2036 wrote to memory of 912	2036	cmd.exe	90
PID 2036 wrote to memory of 2056	2036	cmd.exe	93
PID 2036 wrote to memory of 2056	2036	cmd.exe	93
PID 2056 wrote to memory of 2540	2056	msinfo32.exe	96
PID 2056 wrote to memory of 2540	2056	msinfo32.exe	96
PID 2056 wrote to memory of 1324	2056	msinfo32.exe	98
PID 2056 wrote to memory of 1324	2056	msinfo32.exe	98
PID 1324 wrote to memory of 1508	1324	cmd.exe	100
PID 1324 wrote to memory of 1508	1324	cmd.exe	100
PID 1324 wrote to memory of 884	1324	cmd.exe	101
PID 1324 wrote to memory of 884	1324	cmd.exe	101
PID 1324 wrote to memory of 3416	1324	cmd.exe	105
PID 1324 wrote to memory of 3416	1324	cmd.exe	105
PID 3416 wrote to memory of 864	3416	msinfo32.exe	106
PID 3416 wrote to memory of 864	3416	msinfo32.exe	106
PID 3416 wrote to memory of 1792	3416	msinfo32.exe	108
PID 3416 wrote to memory of 1792	3416	msinfo32.exe	108
PID 1792 wrote to memory of 4432	1792	cmd.exe	110
PID 1792 wrote to memory of 4432	1792	cmd.exe	110
PID 1792 wrote to memory of 1652	1792	cmd.exe	111
PID 1792 wrote to memory of 1652	1792	cmd.exe	111
PID 1792 wrote to memory of 2376	1792	cmd.exe	114
PID 1792 wrote to memory of 2376	1792	cmd.exe	114
PID 2376 wrote to memory of 348	2376	msinfo32.exe	115
PID 2376 wrote to memory of 348	2376	msinfo32.exe	115
PID 2376 wrote to memory of 4924	2376	msinfo32.exe	117
PID 2376 wrote to memory of 4924	2376	msinfo32.exe	117
PID 4924 wrote to memory of 1936	4924	cmd.exe	119
PID 4924 wrote to memory of 1936	4924	cmd.exe	119
PID 4924 wrote to memory of 4036	4924	cmd.exe	120
PID 4924 wrote to memory of 4036	4924	cmd.exe	120
PID 4924 wrote to memory of 4736	4924	cmd.exe	121
PID 4924 wrote to memory of 4736	4924	cmd.exe	121
PID 4736 wrote to memory of 3224	4736	msinfo32.exe	122
PID 4736 wrote to memory of 3224	4736	msinfo32.exe	122
PID 4736 wrote to memory of 232	4736	msinfo32.exe	124
PID 4736 wrote to memory of 232	4736	msinfo32.exe	124
PID 232 wrote to memory of 3680	232	cmd.exe	126
PID 232 wrote to memory of 3680	232	cmd.exe	126
PID 232 wrote to memory of 4380	232	cmd.exe	127
PID 232 wrote to memory of 4380	232	cmd.exe	127
PID 232 wrote to memory of 5020	232	cmd.exe	128
PID 232 wrote to memory of 5020	232	cmd.exe	128
PID 5020 wrote to memory of 1436	5020	msinfo32.exe	129
PID 5020 wrote to memory of 1436	5020	msinfo32.exe	129
PID 5020 wrote to memory of 3928	5020	msinfo32.exe	131
PID 5020 wrote to memory of 3928	5020	msinfo32.exe	131
PID 3928 wrote to memory of 1980	3928	cmd.exe	133
PID 3928 wrote to memory of 1980	3928	cmd.exe	133
PID 3928 wrote to memory of 3300	3928	cmd.exe	134
PID 3928 wrote to memory of 3300	3928	cmd.exe	134
PID 3928 wrote to memory of 2180	3928	cmd.exe	135
PID 3928 wrote to memory of 2180	3928	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe
"C:\Users\Admin\AppData\Local\Temp\b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3692
- C:\Windows\system32\dll32\msinfo32.exe
  "C:\Windows\system32\dll32\msinfo32.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c3bI9ZseW3Fm.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4636
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:912
  - - C:\Windows\system32\dll32\msinfo32.exe
      "C:\Windows\system32\dll32\msinfo32.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2540
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ECjkA2l2Y1aX.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1324
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1508
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:884
      - C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:864
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o07jz3qdWMMh.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4432
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1652
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wSLiKOJAuMVd.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1936
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4036
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bN69yLh9Kn2F.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3680
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4380
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ROcHeUR3xAbk.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3300
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W5h8Ko9K61Z8.bat" "
        15⤵
        
        PID:2748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1508
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3304
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:960
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mL760cONVRYQ.bat" "
        17⤵
        
        PID:4700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:864
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4428
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fmahQX5cGUpB.bat" "
        19⤵
        
        PID:4540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4300
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4584
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EwlSxJ4RI9iS.bat" "
        21⤵
        
        PID:3308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1740
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4476
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4224
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HRCxic6zCmB5.bat" "
        23⤵
        
        PID:3060
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1420
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3160
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1oJ5yv0mCztw.bat" "
        25⤵
        
        PID:4100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4108
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2880
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mrSWDYssTkGA.bat" "
        27⤵
        
        PID:1516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:704
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4536
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3316
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SHwb4uBV01Yl.bat" "
        29⤵
        
        PID:1716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2512
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2508
        
        C:\Windows\system32\dll32\msinfo32.exe
        
        "C:\Windows\system32\dll32\msinfo32.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Discordupdate" /sc ONLOGON /tr "C:\Windows\system32\dll32\msinfo32.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IofhsbdnhLKp.bat" "
        31⤵
        
        PID:4552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2612
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\msinfo32.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1oJ5yv0mCztw.bat

Filesize
197B

MD5
a7a2399e5fcec96a31753e1ce4c072c3

SHA1
0384d2b18864e9d6554e452067ead0ea00fa393f

SHA256
164046d01159fa3ced160ef38fa305e2091a0b685a0fdbc665535c9fec3e80eb

SHA512
734ce940265995237e611f45a3fc3b009c385ac6f01ad4724f5754ff21203e4f43d4b540c4554841502d73eaf53ee07ff236de21e2217873ce639c2a43e7ee63

Download Submit
C:\Users\Admin\AppData\Local\Temp\ECjkA2l2Y1aX.bat

Filesize
197B

MD5
e46e9f9f8c039efbbe50b60220677afb

SHA1
1d6b54e63def7291320d47a8825925aca128b777

SHA256
bafaf5267d581605cbfcb5f9d89798526d2f6fb8afea0306f773d57d11fb363a

SHA512
c6951a55cf9b0d5d6d52eca87124463482a12d8bfd71ee24df9e84564f8c850b53931777cd78a9a6ea8f52d8198f60e4d085c19371e303b13caeca734e982808

Download Submit
C:\Users\Admin\AppData\Local\Temp\EwlSxJ4RI9iS.bat

Filesize
197B

MD5
97b4da2b9369f9234f25247c498f0108

SHA1
6d2d17ebd4cef5222e17cd40db0c73397b6b0cdd

SHA256
3e2477aff67bb5581ec4d436642de4ec044ec0f6365726aa8311a8ca9aef08a7

SHA512
e4714e1e1df7118a6cfb81f286e2ab2d8447ccfb7c0d1abd0050c6e7a6f5134f11bf4eb63550c523ad7d580e5f7c7c65a0d1fe522ef13ce53a6b2610aa2fdcda

Download Submit
C:\Users\Admin\AppData\Local\Temp\HRCxic6zCmB5.bat

Filesize
197B

MD5
7e0842844068898fad2ec110e0496cc4

SHA1
2ce5c629c9341c78df9c6894cfd87e4fee76a39e

SHA256
b103129e40d9a16a7baa2bd61a4f98e12048ef46cf273100948278a7415e036f

SHA512
41226ae6a387156a1a7ed2b361547ab80724060b99db84e2dbb8601e31bedf317ae312e278aa8b6c0e75b9135061a9264105eac8fa2280815df7db5486580be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IofhsbdnhLKp.bat

Filesize
197B

MD5
38a4aff8ad0d0d40abc427143442e4cc

SHA1
c841603ea2b3a163a9c34305bccd638aaa1a8560

SHA256
74ec63e192110c05642dd4d203a8b840f05dc8c2f23c6495b591312a9a294f2f

SHA512
07e719880632db84cc21622392ec89e084915a528c28580dc3dff2eec5bad68e3235b5356fb8718d62cd3a24ebab367bb6ae06d5344dc981f1b3545cc3d05b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ROcHeUR3xAbk.bat

Filesize
197B

MD5
fbd2d87dd0da4fce0cc30b9d6c880857

SHA1
ed18bde312996839ab4df84c6292d52ea5ffab27

SHA256
ece657d568d5b6b8748d49b26819b6ff82dc963d451c14adec396d5c331701ba

SHA512
f20dac7517670bcd314662338009bbe68159b6244897b7730199cc94e73f41aab6ce2f05ea223211e867f3176cb7eb956e6caac714d228668cdec27e91c8aa6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SHwb4uBV01Yl.bat

Filesize
197B

MD5
30fd59dd90000ef21df7e73f60cae452

SHA1
eaa7b03e9b86a60cde718e49da3fe8c44f0d937e

SHA256
f87f64a1e0306149bf5bfc82302a392b7fe4d343f98c30dcd48bc6aeab763fe4

SHA512
678a7c9e726f65452c75477f95bbf3e378c21c01cbd468aab95b01d3d3c96887f74d1514366e10d3500a70da83269568fa8ea4bc806caba8a139c7cf4f27a5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\W5h8Ko9K61Z8.bat

Filesize
197B

MD5
7de2afac24291f02055d1e3aab827c11

SHA1
90868d3a8fb6c881ec594f877dacaf115ccd4e3a

SHA256
5c7986f5f9b3f9804088ba6cc3aee55f59e21c2f1c6b6f5701daadca80224b6d

SHA512
1d60d7e1c7b7bfbea9bd7ff25563225d77b650f2f29b0dda1ce93f896360dbb8cfd687102f1a2ec68c76ef6105f8f3796bd7a7f26e37fdca020fad8412724f67

Download Submit
C:\Users\Admin\AppData\Local\Temp\bN69yLh9Kn2F.bat

Filesize
197B

MD5
58bdb1d4a2b1658d74c6c2de93ff8121

SHA1
30a07b38e8669516cd65dc4f6577418a6907e2d5

SHA256
1db4e5c521e04d7a67f3db6b4bb927f4c1647d54b116ec0712a2705c1d93cb2c

SHA512
8b0e7609ee31d78b455c77ffa5e63b5f8ae52e6e4a4989e74e5c78f124dc57c9fa78f7e1f43b02a25335f0448634f3dfd3a19b480bcde9ee6c427984db398c2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\c3bI9ZseW3Fm.bat

Filesize
197B

MD5
789feae724ba6f11c307ab668bd630d5

SHA1
5a483a04fbdb74202ca1a80c673adbd9510a7157

SHA256
9e38c4c85b6966d2d7d4b4c19c344376e7aa1e7201a255a6df113bcc9a44bd65

SHA512
2b0c2c14284662a911fe60f501ef5c4eea729fdd67652eb58de97ee241875933c01517ab4eef610a637054753a012c5a6ccf13eaed4c164f2161ea2f24d10d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\fmahQX5cGUpB.bat

Filesize
197B

MD5
4709d2da3e7ea2a3d28322589224cb31

SHA1
fba3f2d6cfc59a087de4b5de3300835730a90a5f

SHA256
cb9f9b14653b1faa5bc03065faf7d3c6024ae5c784bb86200a79735f7738b900

SHA512
d5e4dd1129996edc16510ec80705f61d3fe200310753cfbd521afcbe6fb3e63c8073f0d9aaa0c58ea3ee21e91df699714f7471c2290c2dd8e0297ae8dc6e1289

Download Submit
C:\Users\Admin\AppData\Local\Temp\mL760cONVRYQ.bat

Filesize
197B

MD5
212aaf175725cb9e2457f6d1673df381

SHA1
8d3894197be4e2eee3449c5199d0a97644f9328b

SHA256
fe1ad58438219d57a23e50d31f48bc3cb7b1bb749d454ff94fe5e94f3a9d0db4

SHA512
7a9a21dd365096c2766e13f0a649278b15d13771613e4abf0cd03d5ea77660abb321c503d0c3aed8e818f12f4690e559f3ce8fab704eeb35561d20742493fcb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\mrSWDYssTkGA.bat

Filesize
197B

MD5
eefe34c10d16cf37c9943895b7d5740f

SHA1
2d19cdaf854f95f4ea2925eafb9ee573199ef886

SHA256
f6aaa26318a9ac61c4b6f5fc6f807ddfbe97540b8f847af38093865b9b83397b

SHA512
922b8e3965e3ad4f6955c23e8ae7b6dd5153bcf0e064e59105a12e96d7b0693e0b435a40114f7765a4d643a275a9a5689e08e2b48c17847c70522d228f0a5f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\o07jz3qdWMMh.bat

Filesize
197B

MD5
9729482d26fda9f699dd650203dbb887

SHA1
fbefc0b41a7a9b06aac023f8844f6e30c8bdff28

SHA256
d13c2fd4fa2552298d53e8bb4fdf1e2e98b9244d915c7629306635dddc8d974b

SHA512
a245fbf02595122caf2b0162c857104342456c08b61ac5dea6df3454a048f37911b071197d94657ad4aaf0b44dbbe4745d72b8edf58fc0c79ecc9c7143c32af6

Download Submit
C:\Users\Admin\AppData\Local\Temp\wSLiKOJAuMVd.bat

Filesize
197B

MD5
623979d81b67aa8b07db8024472760e6

SHA1
ce26e22c093958dd5d1910d26048e0dcad258d6c

SHA256
3dcefad34196757d1d99904d229051ef24961e2556d5c9d9b2594f0e55d90ea3

SHA512
8862bd66ccece68dba48926844f4f72f1125c64afc8f113bee78be6b6613668ca3cce4be4773fd945bbbd63e0fa96543342f74afc4119a598fb2a51016c765db

Download Submit
C:\Windows\system32\dll32\msinfo32.exe

Filesize
3.1MB

MD5
25befffc195ce47401f74afbe942f3ff

SHA1
287aacd0350f05308e08c6b4b8b88baf56f56160

SHA256
b67121c19394013d4e3fec0fcb138471e5ee51ebfafb296cc597afc0d256799f

SHA512
a28796538d64edaf7d4ba4d19e705211c779230a58b462793dab86ed5f51408feab998cf78ffe808819b4dc27cbaa981cd107887e0d5c7b0fb0f2bbca630973e

Download Submit
memory/2220-13-0x000000001E000000-0x000000001E0B2000-memory.dmp

Filesize
712KB

Download
memory/2220-11-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2220-9-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2220-12-0x0000000003450000-0x00000000034A0000-memory.dmp

Filesize
320KB

Download
memory/2220-18-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4876-0-0x00007FFC37523000-0x00007FFC37525000-memory.dmp

Filesize
8KB

Download
memory/4876-10-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4876-2-0x00007FFC37520000-0x00007FFC37FE1000-memory.dmp

Filesize
10.8MB

Download
memory/4876-1-0x00000000000C0000-0x00000000003E4000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads