Analysis
- max time kernel
22s - max time network
27s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 08:18
Errors
General
- Target 8db0cd1d0244de2a22f748c4d8fdac91f6850f1fef19bc7f2afe1d5cefb5b228.exe
- Size 4.6MB
- Sample260706-j7ncvacs2x
- SHA256 8db0cd1d0244de2a22f748c4d8fdac91f6850f1fef19bc7f2afe1d5cefb5b228
Malware Config
Extracted
-
xworm
-
uchiwa5.duckdns.org:8887
-
176.160.157.96:8887
-
Install_directory
%Temp%
-
install_file
jusched.exe
-
telegram
https://api.telegram.org/bot8448593287:AAFc0LIng6HbvfJ438DToxjA_1MQ2pwqTt8/sendMessage?chat_id=1781548144
Extracted
-
quasar
-
encryption_key
6D4A4249F385558E6764D6D6FE7C7D31F942200B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Quasar payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 2 IoCs
- Stops running service(s) 4 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Power Settings 1 TTPs 6 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8db0cd1d0244de2a22f748c4d8fdac91f6850f1fef19bc7f2afe1d5cefb5b228.exe"C:\Users\Admin\AppData\Local\Temp\8db0cd1d0244de2a22f748c4d8fdac91f6850f1fef19bc7f2afe1d5cefb5b228.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jusched.exe"C:\Users\Admin\AppData\Local\Temp\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\miner.exe"C:\Users\Admin\AppData\Local\Temp\miner.exe"2⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "System"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "System" binpath= "C:\ProgramData\System\System32.exe" start= "auto"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "System"3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\miner.exe"3⤵
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 34⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\update.exeC:\Users\Admin\AppData\Local\Temp\update.exe1⤵
-
C:\ProgramData\System\System32.exeC:\ProgramData\System\System32.exe1⤵
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
-
C:\Windows\System32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Client-built.exe
jusched.exe
miner.exe
update.exe
__PSScriptPolicyTest_e1puhw3g.niu.ps1
memory/2024-4-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/2024-18-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/2024-22-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/2024-10-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/2024-30-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/2024-0-0x00007FF8D7B3F000-0x00007FF8D7B40000-memory.dmp
memory/2024-2-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/2024-1-0x0000000000DD0000-0x0000000001270000-memory.dmp
memory/2024-43-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-55-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-58-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-61-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-60-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-39-0x000002A48EB70000-0x000002A48EB9E000-memory.dmp
memory/3896-69-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-68-0x000002A4A8690000-0x000002A4A8780000-memory.dmp
memory/3896-67-0x000002A4A8690000-0x000002A4A8780000-memory.dmp
memory/3896-65-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-62-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-64-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-63-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-54-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-29-0x000002A48CD70000-0x000002A48CF36000-memory.dmp
memory/3896-56-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/3896-57-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/4368-92-0x0000018630730000-0x00000186307E2000-memory.dmp
memory/4368-97-0x00000186307F0000-0x00000186308E0000-memory.dmp
memory/5448-52-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/5448-53-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/5448-94-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/5448-51-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/5448-50-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/5448-66-0x000000001BC10000-0x000000001BD00000-memory.dmp
memory/5448-49-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/5448-48-0x00007FF8D79B0000-0x00007FF8D8354000-memory.dmp
memory/5448-19-0x00000000009B0000-0x00000000009CA000-memory.dmp
memory/5548-76-0x000001AD28880000-0x000001AD28932000-memory.dmp
memory/5548-75-0x000001AD28860000-0x000001AD2887E000-memory.dmp
memory/5548-72-0x000001AD285A0000-0x000001AD285C2000-memory.dmp
memory/5548-77-0x000001AD28850000-0x000001AD2885A000-memory.dmp
memory/5548-79-0x000001AD28A90000-0x000001AD28B80000-memory.dmp
memory/5668-82-0x0000000140000000-0x000000014002B000-memory.dmp
memory/5668-83-0x0000000140000000-0x000000014002B000-memory.dmp
memory/5668-80-0x0000000140000000-0x000000014002B000-memory.dmp
memory/5668-81-0x0000000140000000-0x000000014002B000-memory.dmp
memory/6060-47-0x0000000002630000-0x000000000263A000-memory.dmp
memory/6060-46-0x0000000004AC0000-0x0000000004B52000-memory.dmp
memory/6060-44-0x0000000000090000-0x000000000009A000-memory.dmp
memory/6060-45-0x00000000051F0000-0x00000000057AA000-memory.dmp