Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20250610-en - resource tags
- submitted
18/07/2025, 14:32
General
- Target 05a5192a4c1d2bb3ce1da9bb585ff5b9eae77c431453443c9a732811180b62dc_unpacked.exe
- Size 1.0MB
- Sample250718-rwpers1kx9
- SHA256 feb286c00bac69c600917fe088321491a185c4adac8bf620d92f751e1c27a28f
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.3.0.0
Botnet
-
firefox
C2
-
grigori.ddns.net:5555
Mutex
-
MUTEX_fXWPTQsXq0qoVReldc
Attributes
-
encryption_key
0yPcCrwC7TgqqEYKrt5e
-
install_name
firfox.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
firefox
-
subdirectory
firfox
Signatures
- Quasar RAT 6 IoCs
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Executes dropped EXE 17 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 13 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 13 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\05a5192a4c1d2bb3ce1da9bb585ff5b9eae77c431453443c9a732811180b62dc_unpacked.exe"C:\Users\Admin\AppData\Local\Temp\05a5192a4c1d2bb3ce1da9bb585ff5b9eae77c431453443c9a732811180b62dc_unpacked.exe"1⤵
- Quasar RAT
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\now.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\now.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZMWNIT.exe"C:\Users\Admin\AppData\Local\Temp\ZMWNIT.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\ZMWNIT.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pDjZChcfhVgk.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650016⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost6⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f7⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gISxnozSOF2e.bat" "7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650018⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost8⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f9⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FmWApshI3nxX.bat" "9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 6500110⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost10⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f11⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1LHzr2JhXmid.bat" "11⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500112⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost12⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cKV1fJdctIXR.bat" "13⤵
-
C:\Windows\SysWOW64\chcp.comchcp 6500114⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost14⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f15⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3ijMV2cEEDJ1.bat" "15⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500116⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f17⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fhxOJJw9Zj7p.bat" "17⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500118⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost18⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f19⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\24NzMIlROqDW.bat" "19⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500120⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost20⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f21⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xBt6j9IYbPFK.bat" "21⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500122⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost22⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f23⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M3SWYKju6UEv.bat" "23⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500124⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost24⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f25⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kRr7aJYDvbJb.bat" "25⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500126⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost26⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f27⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4nTzqYDBEuhO.bat" "27⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500128⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost28⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"C:\Users\Admin\AppData\Roaming\firfox\firfox.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "firefox" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\firfox\firfox.exe" /rl HIGHEST /f29⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jnVkRZhQ6ED6.bat" "29⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\chcp.comchcp 6500130⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost30⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 227229⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5164 -s 226427⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 228025⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6136 -s 229223⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 173221⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 227619⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 227217⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 227215⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 174413⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 228411⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 17689⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 22447⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 22805⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WSCript.exeWSCript C:\Users\Admin\AppData\Local\Temp\HTNYEL.vbs3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\B14.exe"C:\Users\Admin\AppData\Local\Temp\B14.exe" C:\Users\Admin\AppData\Local\Temp\05a5192a4c1d2bb3ce1da9bb585ff5b9eae77c431453443c9a732811180b62dc_unpacked.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Equity Office Properties Trust\Equity Office Properties Trust.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Windata\MDZYTH.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windata\MDZYTH.exeC:\Users\Admin\AppData\Roaming\Windata\MDZYTH.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4672 -ip 46721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1228 -ip 12281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 980 -ip 9801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1748 -ip 17481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5240 -ip 52401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1832 -ip 18321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1760 -ip 17601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5904 -ip 59041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3924 -ip 39241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6136 -ip 61361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 800 -ip 8001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5164 -ip 51641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4248 -ip 42481⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
1LHzr2JhXmid.bat
24NzMIlROqDW.bat
3ijMV2cEEDJ1.bat
4nTzqYDBEuhO.bat
B14.exe
FmWApshI3nxX.bat
HTNYEL.vbs
M3SWYKju6UEv.bat
ZMWNIT.exe
cKV1fJdctIXR.bat
fhxOJJw9Zj7p.bat
gISxnozSOF2e.bat
jnVkRZhQ6ED6.bat
kRr7aJYDvbJb.bat
pDjZChcfhVgk.bat
xBt6j9IYbPFK.bat
07-18-2025
07-18-2025
07-18-2025
07-18-2025
07-18-2025
07-18-2025
07-18-2025
07-18-2025
07-18-2025
07-18-2025
07-18-2025
07-18-2025
now.exe
memory/1108-2-0x0000000074860000-0x0000000074E11000-memory.dmp
memory/1108-1-0x0000000074860000-0x0000000074E11000-memory.dmp
memory/1108-0-0x0000000074861000-0x0000000074862000-memory.dmp
memory/1108-3-0x0000000074860000-0x0000000074E11000-memory.dmp
memory/4672-76-0x00000000069F0000-0x00000000069FA000-memory.dmp
memory/5016-29-0x0000000074861000-0x0000000074862000-memory.dmp
memory/5016-30-0x0000000074860000-0x0000000074E11000-memory.dmp
memory/5016-82-0x0000000074860000-0x0000000074E11000-memory.dmp
memory/5156-175-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-25-0x00000000004C8000-0x00000000004C9000-memory.dmp
memory/5156-123-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-81-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-107-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-131-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-171-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-163-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-139-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-99-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-14-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-147-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-91-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-83-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-155-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5156-115-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5348-47-0x00000000009C0000-0x0000000000A1E000-memory.dmp
memory/5348-48-0x0000000005990000-0x0000000005F36000-memory.dmp
memory/5348-49-0x0000000005540000-0x00000000055D2000-memory.dmp
memory/5348-52-0x00000000055E0000-0x0000000005646000-memory.dmp
memory/5348-59-0x00000000061F0000-0x0000000006202000-memory.dmp
memory/5348-60-0x0000000006840000-0x000000000687C000-memory.dmp
memory/5660-67-0x0000000000400000-0x00000000004C9000-memory.dmp
memory/5660-74-0x0000000000400000-0x00000000004C9000-memory.dmp