quasar | e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
05/12/2025, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Comprobante.Transferencia.exe
Size 831KB
Sample251205-ryr9fahs3c
SHA256 e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6
MD5 c7621bd824231ada140d61c4abfb61bc
SHA1 c5e6a0a4e0906c9f138d1d9d69cae3ee00883a1d
SHA512 5b2ddec347ab4d80c95ed9c93bf164d00d6b30b3ab367b39cb63122abdc0b969bdd5100b6438283bc6a2c46447c7539dbe43ca0ce16976d276c486f33fb3af83
SSDEEP 12288:NTUJVLlMl/WJbWlsZ3A8O/SloAS5M2YQ0mlriPkEywNS1CjJj+OLJYUm:NQJbMl/WJ4sZvfRSimiP8wNe8j+OL+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

flow2 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Flow2

uortyfivev.crabdance.com:61541
flowbilding.ydns.eu:61542

Mutex

QSR_MUTEX_Ihz8zoxeWkCh22WUgn

Attributes

encryption_key
JAwPkLkrYHQ5FOlCC6kF
install_name
apiac.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
datedl
subdirectory
appiec

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/5284-4-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Executes dropped EXE 27 IoCs

pid	Process
5104	apiac.exe
5000	apiac.exe
5056	apiac.exe
3120	apiac.exe
3532	apiac.exe
948	apiac.exe
2800	apiac.exe
1572	apiac.exe
5580	apiac.exe
3372	apiac.exe
2912	apiac.exe
6104	apiac.exe
5484	apiac.exe
4728	apiac.exe
5188	apiac.exe
2344	apiac.exe
3756	apiac.exe
4772	apiac.exe
2008	apiac.exe
6076	apiac.exe
2792	apiac.exe
560	apiac.exe
5412	apiac.exe
3516	apiac.exe
2752	apiac.exe
4124	apiac.exe
2392	apiac.exe

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com
19	ip-api.com
21	ip-api.com
1	ip-api.com
7	api.ipify.org
10	ip-api.com
13	ip-api.com
15	ip-api.com

Suspicious use of SetThreadContext 22 IoCs

description	pid	Process	procid_target
PID 3848 set thread context of 5284	3848	Comprobante.Transferencia.exe	78
PID 3848 set thread context of 5480	3848	Comprobante.Transferencia.exe	79
PID 5104 set thread context of 5000	5104	apiac.exe	84
PID 5104 set thread context of 5056	5104	apiac.exe	85
PID 6020 set thread context of 760	6020	Comprobante.Transferencia.exe	91
PID 6020 set thread context of 4512	6020	Comprobante.Transferencia.exe	92
PID 3120 set thread context of 948	3120	apiac.exe	106
PID 3120 set thread context of 2800	3120	apiac.exe	107
PID 3532 set thread context of 1572	3532	apiac.exe	109
PID 3532 set thread context of 5580	3532	apiac.exe	110
PID 3372 set thread context of 2912	3372	apiac.exe	117
PID 3372 set thread context of 6104	3372	apiac.exe	118
PID 5484 set thread context of 4728	5484	apiac.exe	128
PID 5484 set thread context of 5188	5484	apiac.exe	129
PID 2344 set thread context of 3756	2344	apiac.exe	139
PID 2344 set thread context of 4772	2344	apiac.exe	140
PID 2008 set thread context of 6076	2008	apiac.exe	148
PID 2008 set thread context of 2792	2008	apiac.exe	149
PID 560 set thread context of 5412	560	apiac.exe	157
PID 560 set thread context of 3516	560	apiac.exe	158
PID 2752 set thread context of 4124	2752	apiac.exe	166
PID 2752 set thread context of 2392	2752	apiac.exe	167

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4412	5000	WerFault.exe	84
5852	760	WerFault.exe	91
1480	948	WerFault.exe	106
5204	1572	WerFault.exe	109
1856	5580	WerFault.exe	110
4764	6104	WerFault.exe	118
5788	4728	WerFault.exe	128
4520	4124	WerFault.exe	166

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Comprobante.Transferencia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Comprobante.Transferencia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Comprobante.Transferencia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Comprobante.Transferencia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Comprobante.Transferencia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apiac.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2148	PING.EXE
3824	PING.EXE
2544	PING.EXE
3716	PING.EXE
5604	PING.EXE
4264	PING.EXE

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
4264	PING.EXE
2148	PING.EXE
3824	PING.EXE
2544	PING.EXE
3716	PING.EXE
5604	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5196	schtasks.exe
5808	schtasks.exe
1644	schtasks.exe
3276	schtasks.exe
3300	schtasks.exe
1988	schtasks.exe
3092	schtasks.exe
2064	schtasks.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	Comprobante.Transferencia.exe
Token: SeDebugPrivilege	5480	Comprobante.Transferencia.exe
Token: SeDebugPrivilege	5104	apiac.exe
Token: SeDebugPrivilege	6020	Comprobante.Transferencia.exe
Token: SeDebugPrivilege	5056	apiac.exe
Token: SeDebugPrivilege	4512	Comprobante.Transferencia.exe
Token: SeDebugPrivilege	3120	apiac.exe
Token: SeDebugPrivilege	3532	apiac.exe
Token: SeDebugPrivilege	2800	apiac.exe
Token: SeDebugPrivilege	3372	apiac.exe
Token: SeDebugPrivilege	5484	apiac.exe
Token: SeDebugPrivilege	5188	apiac.exe
Token: SeDebugPrivilege	2344	apiac.exe
Token: SeDebugPrivilege	3756	apiac.exe
Token: SeDebugPrivilege	2008	apiac.exe
Token: SeDebugPrivilege	6076	apiac.exe
Token: SeDebugPrivilege	560	apiac.exe
Token: SeDebugPrivilege	5412	apiac.exe
Token: SeDebugPrivilege	2752	apiac.exe
Token: SeDebugPrivilege	2392	apiac.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 5284	3848	Comprobante.Transferencia.exe	78
PID 3848 wrote to memory of 5284	3848	Comprobante.Transferencia.exe	78
PID 3848 wrote to memory of 5284	3848	Comprobante.Transferencia.exe	78
PID 3848 wrote to memory of 5284	3848	Comprobante.Transferencia.exe	78
PID 3848 wrote to memory of 5284	3848	Comprobante.Transferencia.exe	78
PID 3848 wrote to memory of 5480	3848	Comprobante.Transferencia.exe	79
PID 3848 wrote to memory of 5480	3848	Comprobante.Transferencia.exe	79
PID 3848 wrote to memory of 5480	3848	Comprobante.Transferencia.exe	79
PID 3848 wrote to memory of 5480	3848	Comprobante.Transferencia.exe	79
PID 3848 wrote to memory of 5480	3848	Comprobante.Transferencia.exe	79
PID 5480 wrote to memory of 1644	5480	Comprobante.Transferencia.exe	81
PID 5480 wrote to memory of 5104	5480	Comprobante.Transferencia.exe	83
PID 5104 wrote to memory of 5000	5104	apiac.exe	84
PID 5104 wrote to memory of 5000	5104	apiac.exe	84
PID 5104 wrote to memory of 5000	5104	apiac.exe	84
PID 5104 wrote to memory of 5000	5104	apiac.exe	84
PID 5104 wrote to memory of 5000	5104	apiac.exe	84
PID 5104 wrote to memory of 5056	5104	apiac.exe	85
PID 5104 wrote to memory of 5056	5104	apiac.exe	85
PID 5104 wrote to memory of 5056	5104	apiac.exe	85
PID 5104 wrote to memory of 5056	5104	apiac.exe	85
PID 5104 wrote to memory of 5056	5104	apiac.exe	85
PID 6020 wrote to memory of 760	6020	Comprobante.Transferencia.exe	91
PID 6020 wrote to memory of 760	6020	Comprobante.Transferencia.exe	91
PID 6020 wrote to memory of 760	6020	Comprobante.Transferencia.exe	91
PID 6020 wrote to memory of 760	6020	Comprobante.Transferencia.exe	91
PID 6020 wrote to memory of 760	6020	Comprobante.Transferencia.exe	91
PID 6020 wrote to memory of 4512	6020	Comprobante.Transferencia.exe	92
PID 6020 wrote to memory of 4512	6020	Comprobante.Transferencia.exe	92
PID 6020 wrote to memory of 4512	6020	Comprobante.Transferencia.exe	92
PID 6020 wrote to memory of 4512	6020	Comprobante.Transferencia.exe	92
PID 6020 wrote to memory of 4512	6020	Comprobante.Transferencia.exe	92
PID 5056 wrote to memory of 3276	5056	apiac.exe	95
PID 5056 wrote to memory of 6028	5056	apiac.exe	97
PID 6028 wrote to memory of 2772	6028	cmd.exe	99
PID 4512 wrote to memory of 3300	4512	Comprobante.Transferencia.exe	100
PID 6028 wrote to memory of 4264	6028	cmd.exe	102
PID 4512 wrote to memory of 3532	4512	Comprobante.Transferencia.exe	105
PID 3120 wrote to memory of 948	3120	apiac.exe	106
PID 3120 wrote to memory of 948	3120	apiac.exe	106
PID 3120 wrote to memory of 948	3120	apiac.exe	106
PID 3120 wrote to memory of 948	3120	apiac.exe	106
PID 3120 wrote to memory of 948	3120	apiac.exe	106
PID 3120 wrote to memory of 2800	3120	apiac.exe	107
PID 3120 wrote to memory of 2800	3120	apiac.exe	107
PID 3120 wrote to memory of 2800	3120	apiac.exe	107
PID 3120 wrote to memory of 2800	3120	apiac.exe	107
PID 3120 wrote to memory of 2800	3120	apiac.exe	107
PID 3532 wrote to memory of 1572	3532	apiac.exe	109
PID 3532 wrote to memory of 1572	3532	apiac.exe	109
PID 3532 wrote to memory of 1572	3532	apiac.exe	109
PID 3532 wrote to memory of 1572	3532	apiac.exe	109
PID 3532 wrote to memory of 1572	3532	apiac.exe	109
PID 3532 wrote to memory of 5580	3532	apiac.exe	110
PID 3532 wrote to memory of 5580	3532	apiac.exe	110
PID 3532 wrote to memory of 5580	3532	apiac.exe	110
PID 3532 wrote to memory of 5580	3532	apiac.exe	110
PID 3532 wrote to memory of 5580	3532	apiac.exe	110
PID 6028 wrote to memory of 3372	6028	cmd.exe	116
PID 3372 wrote to memory of 2912	3372	apiac.exe	117
PID 3372 wrote to memory of 2912	3372	apiac.exe	117
PID 3372 wrote to memory of 2912	3372	apiac.exe	117
PID 3372 wrote to memory of 2912	3372	apiac.exe	117
PID 3372 wrote to memory of 2912	3372	apiac.exe	117

C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
"C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
  C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5284
- C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
  C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "datedl" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1644
- - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
    "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
      C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
      4⤵
      Executes dropped EXE
      PID:5000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 96
        5⤵
        Program crash
        
        PID:4412
  - - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
      C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "datedl" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3276
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Q52FXwi7QJ99.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6028
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4264
      - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        7⤵
        Executes dropped EXE
        
        PID:6104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 92
        8⤵
        Program crash
        
        PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5000 -ip 5000
1⤵
PID:5028

C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
  C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
  2⤵
  PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 92
    3⤵
    - Program crash
    PID:5852
- C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
  C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "datedl" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Comprobante.Transferencia.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3300
- - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
    "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
      C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
      4⤵
      Executes dropped EXE
      PID:1572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 92
        5⤵
        Program crash
        
        PID:5204
  - - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
      C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
      4⤵
      Executes dropped EXE
      PID:5580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5580 -s 28
        5⤵
        Program crash
        
        PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 760 -ip 760
1⤵
PID:2388

C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
  C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
  2⤵
  - Executes dropped EXE
  PID:948
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 92
    3⤵
    - Program crash
    PID:1480
- C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
  C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2800
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "datedl" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yVSIuxdNu6vk.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2992
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:4540
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2148
  - - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
      "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
    - - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        5⤵
        Executes dropped EXE
        
        PID:4728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 92
        6⤵
        Program crash
        
        PID:5788
    - - C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5188
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "datedl" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe" /rl HIGHEST /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3092
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\znkQj6mWLf7r.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1520
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3824
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3756
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "datedl" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe" /rl HIGHEST /f
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2064
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CINSWzLPxdnQ.bat" "
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3820
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2544
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:6076
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "datedl" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe" /rl HIGHEST /f
        12⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5196
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wMCJ2EhJJ32N.bat" "
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3716
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:560
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5412
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "datedl" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe" /rl HIGHEST /f
        15⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5808
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6BGkC4mATCWD.bat" "
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:6072
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5604
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        "C:\Users\Admin\AppData\Roaming\appiec\apiac.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        17⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 92
        18⤵
        Program crash
        
        PID:4520
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2392
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3516
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        
        C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 948 -ip 948
1⤵
PID:5400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1572 -ip 1572
1⤵
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5580 -ip 5580
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6104 -ip 6104
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4728 -ip 4728
1⤵
PID:3160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4124 -ip 4124
1⤵
PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Comprobante.Transferencia.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Comprobante.Transferencia.exe.log
Size 522B
SHA256 350261a6a7833f6458afb68e269a81535688c206effdd060a7c5faf4722f92f2
MD5 04e57f032fed9fe38ead2610e0bbdee5
SHA1 cda5084ea7200cab586876fe32b5ee8f97f79c54
SHA512 337086831d262add581747af302f9e5b4976ffb38115163285413d19c13e7fc87c813ddfc752f864218cbed0756f61805d3c1666e78da13b20541e1494692884
MD5 SHA1 SHA512

Submit Download

6BGkC4mATCWD.bat

Path C:\Users\Admin\AppData\Local\Temp\6BGkC4mATCWD.bat
Size 206B
SHA256 1540645a5f9a08f58e887c444f8bc529398f770b3b76252f07c3d36e1bbb81a3
MD5 f9f68975503276e6144980eaf01bd4cf
SHA1 4e5aa027aae83861f9f40b41151e1826507d3755
SHA512 24690a04084278cadad4976db853e8f84f377a623c5fa216c181493c8bd7aab56b3b4871261099700769c62f31424c76b16e0381ac4ae196399d48113a8c1be0
MD5 SHA1 SHA512

Submit Download

CINSWzLPxdnQ.bat

Path C:\Users\Admin\AppData\Local\Temp\CINSWzLPxdnQ.bat
Size 206B
SHA256 384409329a4f184b484082676d3edc48870abed7432714b13a334ddd5fafa7ae
MD5 f50a6f7a2ea369aec9b7f56d2d83f95e
SHA1 1b381a00dc7358911a2343f605f3f2dc3b76db98
SHA512 2764779cc967a0d44760805603a9058c40149b2dcc4034d236e71e0f3247a7fd9f956beb68abe6942dcae9e0dd5ab48427276386d8c0ce549bf5306ff3641838
MD5 SHA1 SHA512

Submit Download

Q52FXwi7QJ99.bat

Path C:\Users\Admin\AppData\Local\Temp\Q52FXwi7QJ99.bat
Size 206B
SHA256 62f662fe3810e6feda509073ede1df02e9763dccb0e33582d30ee7676b565630
MD5 1713f5fc802aa15809b77b26c2534c1f
SHA1 6a5fcaae9373016229b4f71cf4c51591740fbcec
SHA512 07a5e193a10443b3d12455922fec3ad8336d0d9323bc32c0a89cdd43f37829a4f710661662a129f9fee84fb841c09f9096246ec91e809d1e344c7d28c2c1b0d4
MD5 SHA1 SHA512

Submit Download

wMCJ2EhJJ32N.bat

Path C:\Users\Admin\AppData\Local\Temp\wMCJ2EhJJ32N.bat
Size 206B
SHA256 488fe5b0292ed1ee659a268d72a84d79ec9bf7eb8ae954f7ea1decd0983c67c9
MD5 857f23d94a10c61eda2f9c30fcb8ff56
SHA1 ae892109aa2b82011701e7cfe77f41004e60b282
SHA512 0599f241481440b3182777cca22a6d76ae8a0bbed3df4617ab3b1ce9e87be33d17fd0b686c7f49d8fc210220aea4907bd39b82f1737df96fd6983250ff5a3029
MD5 SHA1 SHA512

Submit Download

yVSIuxdNu6vk.bat

Path C:\Users\Admin\AppData\Local\Temp\yVSIuxdNu6vk.bat
Size 206B
SHA256 d515a6543b72b9b2aec64ff07e8a453f3f7cd5865e41ad3a3aad0d4409693ea6
MD5 c984f25d5b8b0ef4ebd477f4157d9aed
SHA1 79d61b4f3154d7bf4aa73121b24982c8602687a1
SHA512 da36ca77133ba0b6213c5f80ae102ef617b7cda67618d8284d7270f2c4368cf6bfca0af4826d28422110388925d454300ae70e3367aba7a670789b3f7b5333e9
MD5 SHA1 SHA512

Submit Download

znkQj6mWLf7r.bat

Path C:\Users\Admin\AppData\Local\Temp\znkQj6mWLf7r.bat
Size 206B
SHA256 6ef6627c5c3939ba70f6f3040bf76ed38b8a4f5b87841d9e103720ba149b4dc2
MD5 332605897c8287905a494408ec43bfbb
SHA1 f0862e70e43360ee3cc390b5d2a50afe59050cd9
SHA512 9ba908622f48bb8e68aabe7452c2a3e11e2d6392c28ef22719df9ff1c5106edbe126cf34dc1a8910dce69c6ce03d04004e6446fb3b51601824ea7a1c83276ed0
MD5 SHA1 SHA512

Submit Download

apiac.exe

Path C:\Users\Admin\AppData\Roaming\appiec\apiac.exe
Size 831KB
SHA256 e084e80abf2e13a02f8e611406a499fd25fcbd84951ca9bff62f72c6897cb4d6
MD5 c7621bd824231ada140d61c4abfb61bc
SHA1 c5e6a0a4e0906c9f138d1d9d69cae3ee00883a1d
SHA512 5b2ddec347ab4d80c95ed9c93bf164d00d6b30b3ab367b39cb63122abdc0b969bdd5100b6438283bc6a2c46447c7539dbe43ca0ce16976d276c486f33fb3af83
SSDEEP 12288:NTUJVLlMl/WJbWlsZ3A8O/SloAS5M2YQ0mlriPkEywNS1CjJj+OLJYUm:NQJbMl/WJ4sZvfRSimiP8wNe8j+OL+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3848-3-0x0000000004E40000-0x0000000004EDC000-memory.dmp

Download

memory/3848-0-0x00000000002D0000-0x00000000003A6000-memory.dmp

Download

memory/3848-2-0x0000000004F10000-0x0000000004F20000-memory.dmp

Download

memory/3848-1-0x00000000073A0000-0x000000000748E000-memory.dmp

Download

memory/5284-11-0x00000000052F0000-0x0000000005356000-memory.dmp

Download

memory/5284-9-0x00000000052E0000-0x00000000052F0000-memory.dmp

Download

memory/5284-4-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/5480-7-0x0000000005860000-0x0000000005E06000-memory.dmp

Download

memory/5480-14-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/5480-13-0x0000000006190000-0x00000000061A2000-memory.dmp

Download

memory/5480-10-0x0000000005350000-0x0000000005360000-memory.dmp

Download

memory/5480-8-0x0000000005360000-0x00000000053F2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads