quasar | de0ec5089d43d47914a08086059d927e19d9f4ea9f4f2fec8325158f58ef3643

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/10/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dkmm qh.exe
Size 3.1MB
Sample261028-jagh2aff73
SHA256 de0ec5089d43d47914a08086059d927e19d9f4ea9f4f2fec8325158f58ef3643
MD5 24b99df4e63fc1fccb6b223bc4d0fdd2
SHA1 069a0038ad2f910619ad2bc203b3dfac9e803207
SHA512 6f5fb8240abac45987d673d0c3b4ffcf8c845657b62a2ed9dac56c5f0609f1c2f73f5f9c4cfe8a17e741a1aa5bb2c4b03bfa8c7ed03a59cf7bb3ed57e0195302
SSDEEP 49152:fvzgo2QSaNpzyPllgamb0CZof/J3IVmcoBx6ioGdLTHHB72eh2NT:fv8o2QSaNpzyPllgamYCZof/J4VPm
TLSH
T180E56B0437F85E33E56BD2B3D5B05026A3F0E82AF363EB1B519167BE1C53B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ok365 client discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

OK365 Client

qh88si.com:443
qh88eu.com:443
qh88.casino:443
qh88eu.com:80
eh88eu.com:8080
qh88si.com:80
qh88si.com:8080
qh88.casino:8080
qh88.casino:80

Mutex

3cb6f7ce-f521-4677-b078-01e1d892b28d

Attributes

encryption_key
71514463CA895B84E7E6B4A4FC68A8243476E095
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
100
startup_key
dkmm
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/4404-0-0x0000000000340000-0x0000000000664000-memory.dmp	family_quasar
behavioral1/files/0x0007000000024462-5.dat	family_quasar

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 12 IoCs

pid	Process
1704	Client.exe
1924	Client.exe
4036	Client.exe
1028	Client.exe
4788	Client.exe
3776	Client.exe
3964	Client.exe
3048	Client.exe
1312	Client.exe
2132	Client.exe
4664	Client.exe
3016	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5092	cmd.exe
4800	cmd.exe
3808	cmd.exe
5116	cmd.exe
4056	cmd.exe
2196	cmd.exe
3368	cmd.exe
4536	cmd.exe
412	cmd.exe
2460	cmd.exe
4348	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1036	PING.EXE
1412	PING.EXE
3436	PING.EXE
5104	PING.EXE
1752	PING.EXE
3280	PING.EXE
3088	PING.EXE
5112	PING.EXE
4684	PING.EXE
3328	PING.EXE
2596	PING.EXE

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
1036	PING.EXE
3088	PING.EXE
5112	PING.EXE
4684	PING.EXE
1412	PING.EXE
3328	PING.EXE
5104	PING.EXE
1752	PING.EXE
3436	PING.EXE
2596	PING.EXE
3280	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3364	schtasks.exe
3748	schtasks.exe
4260	schtasks.exe
3300	schtasks.exe
3964	schtasks.exe
4384	schtasks.exe
4752	schtasks.exe
4052	schtasks.exe
3600	schtasks.exe
4396	schtasks.exe
5044	schtasks.exe
3520	schtasks.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4404	dkmm qh.exe
Token: SeDebugPrivilege	1704	Client.exe
Token: SeDebugPrivilege	1924	Client.exe
Token: SeDebugPrivilege	4036	Client.exe
Token: SeDebugPrivilege	1028	Client.exe
Token: SeDebugPrivilege	4788	Client.exe
Token: SeDebugPrivilege	3776	Client.exe
Token: SeDebugPrivilege	3964	Client.exe
Token: SeDebugPrivilege	3048	Client.exe
Token: SeDebugPrivilege	1312	Client.exe
Token: SeDebugPrivilege	2132	Client.exe
Token: SeDebugPrivilege	4664	Client.exe
Token: SeDebugPrivilege	3016	Client.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
1704	Client.exe
4036	Client.exe
1028	Client.exe
4788	Client.exe
3776	Client.exe
3964	Client.exe
3048	Client.exe
1312	Client.exe
2132	Client.exe
4664	Client.exe
3016	Client.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3300	4404	dkmm qh.exe	84
PID 4404 wrote to memory of 1704	4404	dkmm qh.exe	86
PID 1704 wrote to memory of 3964	1704	Client.exe	90
PID 1704 wrote to memory of 5092	1704	Client.exe	96
PID 5092 wrote to memory of 2764	5092	cmd.exe	98
PID 5092 wrote to memory of 1036	5092	cmd.exe	99
PID 5092 wrote to memory of 4036	5092	cmd.exe	103
PID 4036 wrote to memory of 4396	4036	Client.exe	104
PID 4036 wrote to memory of 3368	4036	Client.exe	106
PID 3368 wrote to memory of 3100	3368	cmd.exe	108
PID 3368 wrote to memory of 3088	3368	cmd.exe	109
PID 3368 wrote to memory of 1028	3368	cmd.exe	110
PID 1028 wrote to memory of 5044	1028	Client.exe	112
PID 1028 wrote to memory of 4536	1028	Client.exe	114
PID 4536 wrote to memory of 2376	4536	cmd.exe	116
PID 4536 wrote to memory of 5112	4536	cmd.exe	117
PID 4536 wrote to memory of 4788	4536	cmd.exe	119
PID 4788 wrote to memory of 4384	4788	Client.exe	120
PID 4788 wrote to memory of 4800	4788	Client.exe	122
PID 4800 wrote to memory of 5096	4800	cmd.exe	124
PID 4800 wrote to memory of 4684	4800	cmd.exe	125
PID 4800 wrote to memory of 3776	4800	cmd.exe	126
PID 3776 wrote to memory of 3520	3776	Client.exe	127
PID 3776 wrote to memory of 3808	3776	Client.exe	129
PID 3808 wrote to memory of 2744	3808	cmd.exe	131
PID 3808 wrote to memory of 1412	3808	cmd.exe	132
PID 3808 wrote to memory of 3964	3808	cmd.exe	133
PID 3964 wrote to memory of 4752	3964	Client.exe	134
PID 3964 wrote to memory of 5116	3964	Client.exe	136
PID 5116 wrote to memory of 3936	5116	cmd.exe	138
PID 5116 wrote to memory of 3436	5116	cmd.exe	139
PID 5116 wrote to memory of 3048	5116	cmd.exe	140
PID 3048 wrote to memory of 4052	3048	Client.exe	141
PID 3048 wrote to memory of 412	3048	Client.exe	143
PID 412 wrote to memory of 1260	412	cmd.exe	145
PID 412 wrote to memory of 3328	412	cmd.exe	146
PID 412 wrote to memory of 1312	412	cmd.exe	147
PID 1312 wrote to memory of 3600	1312	Client.exe	148
PID 1312 wrote to memory of 4056	1312	Client.exe	150
PID 4056 wrote to memory of 4736	4056	cmd.exe	152
PID 4056 wrote to memory of 5104	4056	cmd.exe	153
PID 4056 wrote to memory of 2132	4056	cmd.exe	154
PID 2132 wrote to memory of 3364	2132	Client.exe	155
PID 2132 wrote to memory of 2460	2132	Client.exe	157
PID 2460 wrote to memory of 4540	2460	cmd.exe	159
PID 2460 wrote to memory of 2596	2460	cmd.exe	160
PID 2460 wrote to memory of 4664	2460	cmd.exe	161
PID 4664 wrote to memory of 3748	4664	Client.exe	162
PID 4664 wrote to memory of 2196	4664	Client.exe	164
PID 2196 wrote to memory of 3332	2196	cmd.exe	166
PID 2196 wrote to memory of 1752	2196	cmd.exe	167
PID 2196 wrote to memory of 3016	2196	cmd.exe	168
PID 3016 wrote to memory of 4260	3016	Client.exe	169
PID 3016 wrote to memory of 4348	3016	Client.exe	171
PID 4348 wrote to memory of 1948	4348	cmd.exe	173
PID 4348 wrote to memory of 3280	4348	cmd.exe	174

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dkmm qh.exe
"C:\Users\Admin\AppData\Local\Temp\dkmm qh.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3300
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BcAdOmMJmisE.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2764
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1036
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4036
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4396
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5NOK4blKOAUB.bat" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3368
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3100
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3088
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BmSeh9u7lV3I.bat" "
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5112
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ugfMoEuMq0jk.bat" "
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:5096
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4684
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j3YMVehMAV2Z.bat" "
        11⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2744
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1412
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bKNGbH6BPbE6.bat" "
        13⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3936
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3436
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3048
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8Y1dJkOoGP6s.bat" "
        15⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:412
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1260
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3328
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UVo3X3qPxskZ.bat" "
        17⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4736
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5104
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DdXzYnN1J1Ey.bat" "
        19⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4540
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2596
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b0WQL2RNDQah.bat" "
        21⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3332
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1752
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "dkmm" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VQRvjiYypUn8.bat" "
        23⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1948
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3280

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

5NOK4blKOAUB.bat

Path C:\Users\Admin\AppData\Local\Temp\5NOK4blKOAUB.bat
Size 207B
SHA256 073c0067be0f4af8d25253303c100ceb4325f51d840bb85f2f26796f9d91c617
MD5 68880f93914e436e6bf87185803568a7
SHA1 08b6afb63b6eceee974f502109922ab3b26829cc
SHA512 78c359e47ee7e4353e8c95b8e5fa6d198f234d7bea881ab96aae41fbddd97b1b8001c10f79d0f85748ad183b0bc06b4d83cda9b98b48ece008abe7d3859b637c
TLSH
T163D023512741CD5F49011D471E75B28CB09A04A71F08BD618615489C038784C759F141
MD5 SHA1 SHA512 TLSH

Submit Download

8Y1dJkOoGP6s.bat

Path C:\Users\Admin\AppData\Local\Temp\8Y1dJkOoGP6s.bat
Size 207B
SHA256 a914724c6d7a63f36d14d789eece61d1558cc1e07c5c8bca27b698ed2ea4e66c
MD5 1cb228da254e9aed731eceef27e66bec
SHA1 7adda82fd484a4f3acae46c3db1beb378672c072
SHA512 da104cef7358996c5054d2679ebdc0213ebaeaf19b5fa27e4fd8b5178519e8c9e65225f7914349b7521e60fb3d67b7de73590809e97170e91ab2e74b31728bd6
TLSH
T16BD023012340CE5F550118471DE562CDB0AA04A72F487D6245154CDC438684CF55B141
MD5 SHA1 SHA512 TLSH

Submit Download

BcAdOmMJmisE.bat

Path C:\Users\Admin\AppData\Local\Temp\BcAdOmMJmisE.bat
Size 207B
SHA256 535cf308c474e3e2f758650a4692cc4f4e4dd746b8c8ba57840e337efc346480
MD5 8aeb2ccab69af2dee228c8070a6a4441
SHA1 8ce70283fab678db46a6105d14d969eb07a182d2
SHA512 7f8ac7925da19f443fc63714d85d3a5572028cc6c8ad3260f8ca1e33534771d2a834c8cc2dd50254a01df4ad808f2a3290f6bd76844ac6ddbe6fb4198a87165b
TLSH
T159D023112380CD5E4601184B1DB576C8B0AB04A61F097DB1470148DC138784C759B141
MD5 SHA1 SHA512 TLSH

Submit Download

BmSeh9u7lV3I.bat

Path C:\Users\Admin\AppData\Local\Temp\BmSeh9u7lV3I.bat
Size 207B
SHA256 84e1d7269a86145b114325c7ee45a6382101a0a963ed98f7b1d4a8e165cbe51c
MD5 098a97a506475b93f6debba2f3ca7319
SHA1 0743508848df8af2240c31b25463865c14429df9
SHA512 708437ac5167b37aeff43ce17e020331ac72d24fb41838e25fffe6a9b91b2b42b48ccc40e8a978fd2b4f8177d9bab86cb635952380d087fce82b05a91aa256f3
TLSH
T15AD0230137C0CE5E450119871D65A2CCB0DA04AA3F09FDA14511889C13C694C755F141
MD5 SHA1 SHA512 TLSH

Submit Download

DdXzYnN1J1Ey.bat

Path C:\Users\Admin\AppData\Local\Temp\DdXzYnN1J1Ey.bat
Size 207B
SHA256 c796b81a13d7ddddabfca4f4e484b81843ddff592ccd1e5435435bd97c243b80
MD5 a84e7218953a8c7deaf7c65f0433455d
SHA1 d9ebddc9257f7d91efd15238d3febc964b7c4553
SHA512 d619bdf8047b470582cc1c9f790935904678b95d8ce26d320ee0eeb22404a9ad563b0dde56a7d0637a6ea25383e71cea965e97366d097e848243fddbd4587cc6
TLSH
T1F7D023012345CD5D450118875D65A288B09A04E71F097DA34615489C4396CCC759F181
MD5 SHA1 SHA512 TLSH

Submit Download

UVo3X3qPxskZ.bat

Path C:\Users\Admin\AppData\Local\Temp\UVo3X3qPxskZ.bat
Size 207B
SHA256 481242061c7433af909b27109d51f19678adf8578632b756ea89c314ae5c3d84
MD5 607a34f2f67575402aea3bf499fe7f4c
SHA1 61b1862f4d6ef5172d1b0cf6794811a796da7b6d
SHA512 4afc668ddffad07d4a2a53aa415377ed94cb05b1e2d6ebe0b127384285b3f6a5febff2e08889698d46da0c18ad140370ea9fd61da764a23ce8bf03567b69ee8c
TLSH
T198D022013780CEDEA5101C4B1EA6B78CB0AE04BA2F08BEE28615889C038788CB59B182
MD5 SHA1 SHA512 TLSH

Submit Download

VQRvjiYypUn8.bat

Path C:\Users\Admin\AppData\Local\Temp\VQRvjiYypUn8.bat
Size 207B
SHA256 c58264bb5c35198c39445220a07f6357e893f9d796d5cee4e76a8d50c6fd73cf
MD5 17ef435c236a2df70b54cbf3ca1ba7dd
SHA1 5a16da6ed7ebe03c1f07e93bad0c27d0ddbcad36
SHA512 f634cea8d135e9b386ab682fef9a01a935faa3b28cc1b744f8a7c4dba774c65f675999e27902449abb2c18376caa39ea96b165ce80bbcb70f727acea11ede0c6
TLSH
T1AAD023416340CE5E45041C571D65768CB0AB04AF3F0CBD61850548DC13C684C755B941
MD5 SHA1 SHA512 TLSH

Submit Download

b0WQL2RNDQah.bat

Path C:\Users\Admin\AppData\Local\Temp\b0WQL2RNDQah.bat
Size 207B
SHA256 e289b1df1defbe5f57c1f98011014c20b9d3b16cfc5de78ae21e59f3ec1e5cae
MD5 b608d41a343f6f5300607e1c832b1f1d
SHA1 babe17cf4cbd3b2b36c2742fbbf4bbd7d51ac4c7
SHA512 ee8211e863f0d34fac539a37ecd05cd337b8a9df3b398cefc7b28d1dfd92cb7a364046e34be67666519608fbe4597d99faff4020905d8f642d1b40c842307c7e
TLSH
T1F3D023812340CD5E550018475D656388B0AE04B71F4C7D61451148DC17C6D5C755F142
MD5 SHA1 SHA512 TLSH

Submit Download

bKNGbH6BPbE6.bat

Path C:\Users\Admin\AppData\Local\Temp\bKNGbH6BPbE6.bat
Size 207B
SHA256 0eed5b150952d1883ec051c45ef5dc8235a6b3a6b0256014be3fa85758256672
MD5 a40bf4f0a860183becd7a62b75dc652a
SHA1 be6c653a655a155975283a49682231ebda2de70e
SHA512 c644a9e891b51f97fbb2178a3980948f7a53d1bafcb148df090a13337588f9621fc7527567a3815cf5e27e5006213f35bbe76c07af93c7354a04e840dc7ecdac
TLSH
T108D023412340CD5E550058475E65B38CB09B08A62F0DBD614501889C138698CB59B141
MD5 SHA1 SHA512 TLSH

Submit Download

j3YMVehMAV2Z.bat

Path C:\Users\Admin\AppData\Local\Temp\j3YMVehMAV2Z.bat
Size 207B
SHA256 e8497da57ec874683692877f0a7b3fe96c1fe97347de5854f52fa8f5bda5be4e
MD5 4dc226ae528c5902fe90ce44a5094c60
SHA1 b7daae3c0bbd649223c96a10ced45e5580716e85
SHA512 584b004c027f722625137aa547e563aa77c3f2596cc0306efee250ad9dee4e568255a39b3aeee5c0e2e096c50a904f2c737be942b7f365423632602a0eb27637
TLSH
T126D023413350CD5D850018471E6562C8F09B04AF2F087D72851188DC438695CB55B582
MD5 SHA1 SHA512 TLSH

Submit Download

ugfMoEuMq0jk.bat

Path C:\Users\Admin\AppData\Local\Temp\ugfMoEuMq0jk.bat
Size 207B
SHA256 d46eef8e3487a37084b24e0f06d78079189eec5e30fee8b1b7f19fd5200b953b
MD5 cef1a5df97a395febf6ffa5861739584
SHA1 c07e3a33cd58418586166d9adebc049dbc617ac6
SHA512 ca2ae815ef474c5f4efe5fe164a701439a3b0eed1f1f4b41d3ebc72d41a7937ad0e7f06ced7dfd0286aee580393e14a2adf61892a10cdc976465f9b400cc00f2
TLSH
T1CFD023412381CD9E59001C471DA5678CB0DA04AA3F487D6145064CDC03CB98C755B141
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 de0ec5089d43d47914a08086059d927e19d9f4ea9f4f2fec8325158f58ef3643
MD5 24b99df4e63fc1fccb6b223bc4d0fdd2
SHA1 069a0038ad2f910619ad2bc203b3dfac9e803207
SHA512 6f5fb8240abac45987d673d0c3b4ffcf8c845657b62a2ed9dac56c5f0609f1c2f73f5f9c4cfe8a17e741a1aa5bb2c4b03bfa8c7ed03a59cf7bb3ed57e0195302
SSDEEP 49152:fvzgo2QSaNpzyPllgamb0CZof/J3IVmcoBx6ioGdLTHHB72eh2NT:fv8o2QSaNpzyPllgamYCZof/J4VPm
TLSH
T180E56B0437F85E33E56BD2B3D5B05026A3F0E82AF363EB1B519167BE1C53B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1704-12-0x000000001CCC0000-0x000000001CD72000-memory.dmp

Download

memory/1704-11-0x000000001B9C0000-0x000000001BA10000-memory.dmp

Download

memory/1704-8-0x000000001BC30000-0x000000001BC40000-memory.dmp

Download

memory/4404-0-0x0000000000340000-0x0000000000664000-memory.dmp

Download

memory/4404-1-0x000000001B390000-0x000000001B3A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads