quasar | 8f2f7929d4d3d04be498567f02d567521ce4c5e7a1d400c4f64f4c2bd78ddcb9

Analysis

max time kernel
145s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04fd43a2fbf40610f559b11414d1a71e.exe
Size

3.1MB
MD5

04fd43a2fbf40610f559b11414d1a71e
SHA1

dc7608bd69368ac5a62a9d8e287cc89c31fa750f
SHA256

8f2f7929d4d3d04be498567f02d567521ce4c5e7a1d400c4f64f4c2bd78ddcb9
SHA512

dff106b855eb7ee3c9278d9d60ef4b303c670fc976781f9b6318615e60fb513e95aa09e258c36d140d93968951299b963bca3957e7037a0f0ea95e945f631e55
SSDEEP

49152:mvDI22SsaNYfdPBldt698dBcjHrQV37ar77oGd+VXTHHB72eh2NT:mv822SsaNYfdPBldt6+dBcjHK3w

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

pringelsy-41920.portmap.host:41920

Mutex

63621aac-ae17-49da-9413-459827e68061

Attributes

encryption_key
4F2985A1DF21C9CA0E34D9186E1BC62AF4B58C14
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Opera GX
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1752-1-0x0000000000EA0000-0x00000000011C4000-memory.dmp	family_quasar
C:\Windows\system32\SubDir\Client.exe	family_quasar
behavioral1/memory/1956-8-0x0000000000DB0000-0x00000000010D4000-memory.dmp	family_quasar
behavioral1/memory/2584-22-0x0000000000ED0000-0x00000000011F4000-memory.dmp	family_quasar
behavioral1/memory/3020-34-0x00000000002A0000-0x00000000005C4000-memory.dmp	family_quasar
behavioral1/memory/1320-45-0x0000000001250000-0x0000000001574000-memory.dmp	family_quasar
behavioral1/memory/904-77-0x0000000000390000-0x00000000006B4000-memory.dmp	family_quasar
behavioral1/memory/2540-88-0x0000000000340000-0x0000000000664000-memory.dmp	family_quasar
behavioral1/memory/2568-101-0x00000000000B0000-0x00000000003D4000-memory.dmp	family_quasar
behavioral1/memory/1828-113-0x0000000001140000-0x0000000001464000-memory.dmp	family_quasar
behavioral1/memory/332-134-0x00000000001C0000-0x00000000004E4000-memory.dmp	family_quasar
behavioral1/memory/2240-145-0x0000000000110000-0x0000000000434000-memory.dmp	family_quasar
behavioral1/memory/1200-156-0x0000000000EB0000-0x00000000011D4000-memory.dmp	family_quasar

Executes dropped EXE 15 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

pid	process
1956	Client.exe
2584	Client.exe
3020	Client.exe
1320	Client.exe
484	Client.exe
796	Client.exe
904	Client.exe
2540	Client.exe
2568	Client.exe
1828	Client.exe
1272	Client.exe
332	Client.exe
2240	Client.exe
1200	Client.exe
2448	Client.exe

Drops file in System32 directory 33 IoCs

Processes:

Client.exeClient.exeClient.exe04fd43a2fbf40610f559b11414d1a71e.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

description	ioc	process
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	04fd43a2fbf40610f559b11414d1a71e.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	04fd43a2fbf40610f559b11414d1a71e.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	04fd43a2fbf40610f559b11414d1a71e.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXE

pid process

2172 PING.EXE
1448 PING.EXE
448 PING.EXE
448 PING.EXE
2520 PING.EXE
1668 PING.EXE
2644 PING.EXE
1316 PING.EXE
2844 PING.EXE
2212 PING.EXE
2896 PING.EXE
1524 PING.EXE
2744 PING.EXE
3064 PING.EXE
688 PING.EXE

pid	process
2172	PING.EXE
1448	PING.EXE
448	PING.EXE
448	PING.EXE
2520	PING.EXE
1668	PING.EXE
2644	PING.EXE
1316	PING.EXE
2844	PING.EXE
2212	PING.EXE
2896	PING.EXE
1524	PING.EXE
2744	PING.EXE
3064	PING.EXE
688	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
492	schtasks.exe
2336	schtasks.exe
2744	schtasks.exe
2600	schtasks.exe
1944	schtasks.exe
2872	schtasks.exe
1772	schtasks.exe
824	schtasks.exe
2456	schtasks.exe
2132	schtasks.exe
1772	schtasks.exe
2988	schtasks.exe
2560	schtasks.exe
964	schtasks.exe
2424	schtasks.exe
1496	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

04fd43a2fbf40610f559b11414d1a71e.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

description	pid	process
Token: SeDebugPrivilege	1752	04fd43a2fbf40610f559b11414d1a71e.exe
Token: SeDebugPrivilege	1956	Client.exe
Token: SeDebugPrivilege	2584	Client.exe
Token: SeDebugPrivilege	3020	Client.exe
Token: SeDebugPrivilege	1320	Client.exe
Token: SeDebugPrivilege	484	Client.exe
Token: SeDebugPrivilege	796	Client.exe
Token: SeDebugPrivilege	904	Client.exe
Token: SeDebugPrivilege	2540	Client.exe
Token: SeDebugPrivilege	2568	Client.exe
Token: SeDebugPrivilege	1828	Client.exe
Token: SeDebugPrivilege	1272	Client.exe
Token: SeDebugPrivilege	332	Client.exe
Token: SeDebugPrivilege	2240	Client.exe
Token: SeDebugPrivilege	1200	Client.exe
Token: SeDebugPrivilege	2448	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

pid	process
1956	Client.exe
2584	Client.exe
3020	Client.exe
1320	Client.exe
484	Client.exe
796	Client.exe
904	Client.exe
2540	Client.exe
2568	Client.exe
1828	Client.exe
1272	Client.exe
332	Client.exe
2240	Client.exe
1200	Client.exe
2448	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

Processes:

Client.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exeClient.exe

pid	process
1956	Client.exe
2584	Client.exe
3020	Client.exe
1320	Client.exe
484	Client.exe
796	Client.exe
904	Client.exe
2540	Client.exe
2568	Client.exe
1828	Client.exe
1272	Client.exe
332	Client.exe
2240	Client.exe
1200	Client.exe
2448	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

04fd43a2fbf40610f559b11414d1a71e.exeClient.execmd.exeClient.execmd.exeClient.execmd.exeClient.execmd.exe

description	pid	process	target process
PID 1752 wrote to memory of 2424	1752	04fd43a2fbf40610f559b11414d1a71e.exe	schtasks.exe
PID 1752 wrote to memory of 2424	1752	04fd43a2fbf40610f559b11414d1a71e.exe	schtasks.exe
PID 1752 wrote to memory of 2424	1752	04fd43a2fbf40610f559b11414d1a71e.exe	schtasks.exe
PID 1752 wrote to memory of 1956	1752	04fd43a2fbf40610f559b11414d1a71e.exe	Client.exe
PID 1752 wrote to memory of 1956	1752	04fd43a2fbf40610f559b11414d1a71e.exe	Client.exe
PID 1752 wrote to memory of 1956	1752	04fd43a2fbf40610f559b11414d1a71e.exe	Client.exe
PID 1956 wrote to memory of 2744	1956	Client.exe	schtasks.exe
PID 1956 wrote to memory of 2744	1956	Client.exe	schtasks.exe
PID 1956 wrote to memory of 2744	1956	Client.exe	schtasks.exe
PID 1956 wrote to memory of 2828	1956	Client.exe	cmd.exe
PID 1956 wrote to memory of 2828	1956	Client.exe	cmd.exe
PID 1956 wrote to memory of 2828	1956	Client.exe	cmd.exe
PID 2828 wrote to memory of 2560	2828	cmd.exe	chcp.com
PID 2828 wrote to memory of 2560	2828	cmd.exe	chcp.com
PID 2828 wrote to memory of 2560	2828	cmd.exe	chcp.com
PID 2828 wrote to memory of 2844	2828	cmd.exe	PING.EXE
PID 2828 wrote to memory of 2844	2828	cmd.exe	PING.EXE
PID 2828 wrote to memory of 2844	2828	cmd.exe	PING.EXE
PID 2828 wrote to memory of 2584	2828	cmd.exe	Client.exe
PID 2828 wrote to memory of 2584	2828	cmd.exe	Client.exe
PID 2828 wrote to memory of 2584	2828	cmd.exe	Client.exe
PID 2584 wrote to memory of 2600	2584	Client.exe	schtasks.exe
PID 2584 wrote to memory of 2600	2584	Client.exe	schtasks.exe
PID 2584 wrote to memory of 2600	2584	Client.exe	schtasks.exe
PID 2584 wrote to memory of 2876	2584	Client.exe	cmd.exe
PID 2584 wrote to memory of 2876	2584	Client.exe	cmd.exe
PID 2584 wrote to memory of 2876	2584	Client.exe	cmd.exe
PID 2876 wrote to memory of 2900	2876	cmd.exe	chcp.com
PID 2876 wrote to memory of 2900	2876	cmd.exe	chcp.com
PID 2876 wrote to memory of 2900	2876	cmd.exe	chcp.com
PID 2876 wrote to memory of 2896	2876	cmd.exe	PING.EXE
PID 2876 wrote to memory of 2896	2876	cmd.exe	PING.EXE
PID 2876 wrote to memory of 2896	2876	cmd.exe	PING.EXE
PID 2876 wrote to memory of 3020	2876	cmd.exe	Client.exe
PID 2876 wrote to memory of 3020	2876	cmd.exe	Client.exe
PID 2876 wrote to memory of 3020	2876	cmd.exe	Client.exe
PID 3020 wrote to memory of 1944	3020	Client.exe	schtasks.exe
PID 3020 wrote to memory of 1944	3020	Client.exe	schtasks.exe
PID 3020 wrote to memory of 1944	3020	Client.exe	schtasks.exe
PID 3020 wrote to memory of 1460	3020	Client.exe	cmd.exe
PID 3020 wrote to memory of 1460	3020	Client.exe	cmd.exe
PID 3020 wrote to memory of 1460	3020	Client.exe	cmd.exe
PID 1460 wrote to memory of 2800	1460	cmd.exe	chcp.com
PID 1460 wrote to memory of 2800	1460	cmd.exe	chcp.com
PID 1460 wrote to memory of 2800	1460	cmd.exe	chcp.com
PID 1460 wrote to memory of 2520	1460	cmd.exe	PING.EXE
PID 1460 wrote to memory of 2520	1460	cmd.exe	PING.EXE
PID 1460 wrote to memory of 2520	1460	cmd.exe	PING.EXE
PID 1460 wrote to memory of 1320	1460	cmd.exe	Client.exe
PID 1460 wrote to memory of 1320	1460	cmd.exe	Client.exe
PID 1460 wrote to memory of 1320	1460	cmd.exe	Client.exe
PID 1320 wrote to memory of 1772	1320	Client.exe	schtasks.exe
PID 1320 wrote to memory of 1772	1320	Client.exe	schtasks.exe
PID 1320 wrote to memory of 1772	1320	Client.exe	schtasks.exe
PID 1320 wrote to memory of 2308	1320	Client.exe	cmd.exe
PID 1320 wrote to memory of 2308	1320	Client.exe	cmd.exe
PID 1320 wrote to memory of 2308	1320	Client.exe	cmd.exe
PID 2308 wrote to memory of 2976	2308	cmd.exe	chcp.com
PID 2308 wrote to memory of 2976	2308	cmd.exe	chcp.com
PID 2308 wrote to memory of 2976	2308	cmd.exe	chcp.com
PID 2308 wrote to memory of 1668	2308	cmd.exe	PING.EXE
PID 2308 wrote to memory of 1668	2308	cmd.exe	PING.EXE
PID 2308 wrote to memory of 1668	2308	cmd.exe	PING.EXE
PID 2308 wrote to memory of 484	2308	cmd.exe	Client.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\04fd43a2fbf40610f559b11414d1a71e.exe
"C:\Users\Admin\AppData\Local\Temp\04fd43a2fbf40610f559b11414d1a71e.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2424

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\qTObb8YqXQOX.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:2560

C:\Windows\system32\PING.EXE
ping -n 10 localhost
4⤵
- Runs ping.exe
PID:2844

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
5⤵
- Scheduled Task/Job: Scheduled Task
PID:2600

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\vfg6GirJIhnS.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:2876

C:\Windows\system32\chcp.com
chcp 65001
6⤵
PID:2900

C:\Windows\system32\PING.EXE
ping -n 10 localhost
6⤵
- Runs ping.exe
PID:2896

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
7⤵
- Scheduled Task/Job: Scheduled Task
PID:1944

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\jeesL5uFSwAY.bat" "
7⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\system32\chcp.com
chcp 65001
8⤵
PID:2800

C:\Windows\system32\PING.EXE
ping -n 10 localhost
8⤵
- Runs ping.exe
PID:2520

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
9⤵
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\OhmzXD7fZbRW.bat" "
9⤵
- Suspicious use of WriteProcessMemory
PID:2308

C:\Windows\system32\chcp.com
chcp 65001
10⤵
PID:2976

C:\Windows\system32\PING.EXE
ping -n 10 localhost
10⤵
- Runs ping.exe
PID:1668

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:484

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
11⤵
- Scheduled Task/Job: Scheduled Task
PID:1496

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\z00gst6TZ9Dw.bat" "
11⤵
PID:308

C:\Windows\system32\chcp.com
chcp 65001
12⤵
PID:2392

C:\Windows\system32\PING.EXE
ping -n 10 localhost
12⤵
- Runs ping.exe
PID:448

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:796

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
13⤵
- Scheduled Task/Job: Scheduled Task
PID:492

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\bTnTtITzJWsQ.bat" "
13⤵
PID:1656

C:\Windows\system32\chcp.com
chcp 65001
14⤵
PID:2436

C:\Windows\system32\PING.EXE
ping -n 10 localhost
14⤵
- Runs ping.exe
PID:2172

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:904

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
15⤵
- Scheduled Task/Job: Scheduled Task
PID:2988

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\WcWucdgEEDS4.bat" "
15⤵
PID:1600

C:\Windows\system32\chcp.com
chcp 65001
16⤵
PID:1028

C:\Windows\system32\PING.EXE
ping -n 10 localhost
16⤵
- Runs ping.exe
PID:2644

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2540

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
17⤵
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\hc6sWRrgy8u4.bat" "
17⤵
PID:1840

C:\Windows\system32\chcp.com
chcp 65001
18⤵
PID:2552

C:\Windows\system32\PING.EXE
ping -n 10 localhost
18⤵
- Runs ping.exe
PID:2212

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2568

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
19⤵
- Scheduled Task/Job: Scheduled Task
PID:2872

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\Cj3O71KSAE5h.bat" "
19⤵
PID:2788

C:\Windows\system32\chcp.com
chcp 65001
20⤵
PID:1528

C:\Windows\system32\PING.EXE
ping -n 10 localhost
20⤵
- Runs ping.exe
PID:1448

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1828

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
21⤵
- Scheduled Task/Job: Scheduled Task
PID:2336

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\63ehJacFDLDA.bat" "
21⤵
PID:1432

C:\Windows\system32\chcp.com
chcp 65001
22⤵
PID:1016

C:\Windows\system32\PING.EXE
ping -n 10 localhost
22⤵
- Runs ping.exe
PID:1316

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1272

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
23⤵
- Scheduled Task/Job: Scheduled Task
PID:1772

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\9hoeSppY0Gdx.bat" "
23⤵
PID:2968

C:\Windows\system32\chcp.com
chcp 65001
24⤵
PID:592

C:\Windows\system32\PING.EXE
ping -n 10 localhost
24⤵
- Runs ping.exe
PID:688

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
24⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:332

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
25⤵
- Scheduled Task/Job: Scheduled Task
PID:824

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\OF9LaaGjwZPP.bat" "
25⤵
PID:1284

C:\Windows\system32\chcp.com
chcp 65001
26⤵
PID:1912

C:\Windows\system32\PING.EXE
ping -n 10 localhost
26⤵
- Runs ping.exe
PID:448

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2240

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
27⤵
- Scheduled Task/Job: Scheduled Task
PID:964

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\7pEN4g61rau7.bat" "
27⤵
PID:1340

C:\Windows\system32\chcp.com
chcp 65001
28⤵
PID:1780

C:\Windows\system32\PING.EXE
ping -n 10 localhost
28⤵
- Runs ping.exe
PID:1524

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
28⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1200

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
29⤵
- Scheduled Task/Job: Scheduled Task
PID:2456

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\mT8KNaa0xePw.bat" "
29⤵
PID:2740

C:\Windows\system32\chcp.com
chcp 65001
30⤵
PID:2320

C:\Windows\system32\PING.EXE
ping -n 10 localhost
30⤵
- Runs ping.exe
PID:2744

C:\Windows\system32\SubDir\Client.exe
"C:\Windows\system32\SubDir\Client.exe"
30⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2448

C:\Windows\system32\schtasks.exe
"schtasks" /create /tn "Opera GX" /sc ONLOGON /tr "C:\Windows\system32\SubDir\Client.exe" /rl HIGHEST /f
31⤵
- Scheduled Task/Job: Scheduled Task
PID:2132

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\83hPpPTKS7vX.bat" "
31⤵
PID:2712

C:\Windows\system32\chcp.com
chcp 65001
32⤵
PID:2728

C:\Windows\system32\PING.EXE
ping -n 10 localhost
32⤵
- Runs ping.exe
PID:3064

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\63ehJacFDLDA.bat
Filesize
196B

MD5
868d73d33b62f8b97eee6749a36ec7df

SHA1
153baae662fa3026a64d4a313098844a861a09af

SHA256
2c555e5ec821489346e4e869aca832465f40d8d6e4920489475631b487dd070e

SHA512
187f3b5012465049ba53fe73b210253fb6b98d17af195b8e7838fa7988b59d0c56b6a5b260ba5086d2cc46eb4cdb90e198188a5f0fa46e639d65a3a98fb495b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7pEN4g61rau7.bat
Filesize
196B

MD5
2747ecaac991835bf30db0e662059969

SHA1
4c8f46dfb527895e4541bc22681b2ce0e2744526

SHA256
f5bac7cc92fe76067ed571aca7a6a25c47beaaa14bb01c24ac680ac4885b67c7

SHA512
2cf58d1bbe420071c22638b89e74d4721dc6def546dddd8a9b23643127715a824daee2e0a054fdf2994cad52037bcb74c1d283d48aadb4fda8e8367d4cdbdffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\83hPpPTKS7vX.bat
Filesize
196B

MD5
48be0908c8ecebddd34cc528267ad9a6

SHA1
f8eae24cfdb6e555ed48fa8a6a85411954d43106

SHA256
ce2f2575a10484acc9cad4bd2f20522cec005784f406be6806626d1b47c3e010

SHA512
de52b23d074814b750080a0a453401b8c9b2114aae4ca0cbfa0bbf6e32c2d3652bcb8245299243df3363bf7be1bbf8ffed41f1d05774fd59d65397977ab51d3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\9hoeSppY0Gdx.bat
Filesize
196B

MD5
c09d4b38a76fa6d9ab51182bf703805a

SHA1
cc1549c86586426a3ad91e6fab8da2283f85d655

SHA256
5cea2d732d4ebe7f80664c3664add2a4df5b10599a57d77f38f0b61d7d9081eb

SHA512
ee48d647ad8b4a77e6c519fec7a7be144c7f026932ecd647b6d83a191b59c57dcf28c4011174b328f43d9a39f8335c366976b3914848435859edc3fc0b6e1c89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cj3O71KSAE5h.bat
Filesize
196B

MD5
c93346266a4f577159d6b451d8bc2527

SHA1
108215fa69a34fe5ea58103bf8be3d27b84029bf

SHA256
a1e28126293d2f899f0c33e25804a987bbf4f037a6db7eb7f68180ef53bb4d8e

SHA512
84dfbe6865c1275b708f71b6aef368849390ddb1d41c1cd803e2e6a7335a6880edc4f0e8edb8c4c1f77f29b9da5c7751d4dc0317d2e5bda11781e16b695f7ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\OF9LaaGjwZPP.bat
Filesize
196B

MD5
daecca773e308f1bd53a6bd2aad8c89b

SHA1
8578535b8f70bf2cfa01defa88d0c54b19e70262

SHA256
1543ebe26ce0bbdc05faf3641c2dfdf412a976ddd6f5f72ed5e4f90353a35a30

SHA512
f6f5b73d5d0cab19d3844c55217317cb1e8d11d8b6418872429c7b134c34df4ea8b1ace9a6d6d90c6d5c0dceb5615a47a767ae6bd1d432249610585682638532

Download Submit
C:\Users\Admin\AppData\Local\Temp\OhmzXD7fZbRW.bat
Filesize
196B

MD5
722d91a01b553a39840d6e51f9f5de12

SHA1
b62b923bf89fd8a578c81a080c07cd5d868892e6

SHA256
8ccfcac88c5474478ccb8a3bd01aad07753d13c82c7e7a8e85d43c5a3e5c6ef9

SHA512
932d61b2895356fe56af7587ab02a67c124f4362be16057380a83c957dff1ade7f153929032f533904fb485712cfa93dc41665b214a0c2c5d2d1af7a6d5d78d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\WcWucdgEEDS4.bat
Filesize
196B

MD5
59169ee3eb4c3f57958ec5801de7b331

SHA1
0e70e99cb8597a7cda0c409037c79d38860eb180

SHA256
686b0d22ff5080859538e9d3bd845ad9642ac5ba52b49c773ed2b5432190a278

SHA512
690c088203a4c3ead055b5836d375afa0ef3bf57f78e8290e30ed9a5cfb98accb6fc3d9be86ef46f281d5cf477a9afc0f9fdf18b1381464d71e7efa1bf3f9245

Download Submit
C:\Users\Admin\AppData\Local\Temp\bTnTtITzJWsQ.bat
Filesize
196B

MD5
3fa9048c376e04f80da97b2ba00198a4

SHA1
01439846ba7d1b46f05e4edfccfc41db7ace5e3b

SHA256
d680f9ac052988e7663cd655726b9b29c90237aed4f6ed8a68139f674351fa69

SHA512
d2d80c60b7a41e334712899016593c900455b757dfdd8e0f5a48dbcfb3655bd2553bdb748b91014c02f8e298b046b54065d9fcec301feb710394ec3df2288849

Download Submit
C:\Users\Admin\AppData\Local\Temp\hc6sWRrgy8u4.bat
Filesize
196B

MD5
5d0936177e96450ab256bf05a7d6e23f

SHA1
3811be871958a0ab032c07029b046e62a6535aa6

SHA256
ec0d306123dc37a487f5b1e4b5c67ecfe5616620a8efcc11ae8a7043fb73d0ad

SHA512
b9c4fffeb56e751b6a2c1dfdfa84c9d66c02d61577a527a3fed8dd3ab5d1881444cf846667c8a5a93be61cd4ca5ed24826fb68a2b0432e7b4b7acc93860bdc5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jeesL5uFSwAY.bat
Filesize
196B

MD5
7b3fa454da85dec3c0da2b816b9cb53c

SHA1
6c70ec3b7d77e502efd9e26cdba5511ba5337949

SHA256
1e1759b920cfabf6b4aef2b2230629ef33ad1ec6a1ef69490f45706e845ab56e

SHA512
cac14c470a56c66fd005992351da743e2eabc95a25f6585a9344aeb300e1b87e44b7c3d928fc563ce2e813aa561920794082c887a626039778de58f83ff762c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\mT8KNaa0xePw.bat
Filesize
196B

MD5
d062d990193def4c96f9abbd3f978918

SHA1
80facfc8d30e4a4147b7c261ab8ea2df142ce018

SHA256
33dcece008ccfe4c078fe9dd6535388e0cfcf2c8da7defab6851fcde129172c6

SHA512
679d5fe2a6e21c4927830e4e488a834c35b671018e6f858ff30d75a2084375eacc5b1c0d1b6f7cf278355135e16efab598607ae0790723533aee768e812f930b

Download Submit
C:\Users\Admin\AppData\Local\Temp\qTObb8YqXQOX.bat
Filesize
196B

MD5
0df7494d31557f5487b0cf79e8bf223e

SHA1
a03d9ce73cab83d4c5a74531ec386a2dabe3bc6c

SHA256
e6ecad0b687c30d7a6cd73b8237f4a7a754a1ceea5b2c99fdfc271eed5f7d05e

SHA512
1251700f43ffb029a3d84bcf7c4ca3f4a9a81438d3ada1f726cff2f6bb965d913d8bb5e5dcbe07c6b8d4f42f3a3b38f4887d45aabd235967cc192ac06ca9a7fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\vfg6GirJIhnS.bat
Filesize
196B

MD5
322b08f0b4ab25620c1c419739ef1d16

SHA1
abfcf8c2ac7f5c8b8de22e1bbc5d7ae8d7d42c98

SHA256
2baf066e32bce398ac7433c6a0af246820931133d1980325cd47b33374f9096b

SHA512
d700065499644ab45b6311aaf26976988f2593329589268d7fd85621f90ea3fdb43bf2674a6dd7791c8602071d5cc5957d660d978d60a42e0ff74110463c42b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\z00gst6TZ9Dw.bat
Filesize
196B

MD5
1ac39f6b2d7adf89642ffc6a7c9bf55a

SHA1
44a1f6045c84b924dcb7657a02e5fd334c362a81

SHA256
20c05779f6adcd371459a54b3efee41e00458791536a8833dee2893f1c58ecfe

SHA512
2833813eef9c12c0d8faccb80081f2159b19e5739c05258e0bbe272d3d3db8496a60e08db3852fd02751a01b48455bc9c765b78c0b54174a5e1d3b940ae5880a

Download Submit
C:\Windows\system32\SubDir\Client.exe
Filesize
3.1MB

MD5
04fd43a2fbf40610f559b11414d1a71e

SHA1
dc7608bd69368ac5a62a9d8e287cc89c31fa750f

SHA256
8f2f7929d4d3d04be498567f02d567521ce4c5e7a1d400c4f64f4c2bd78ddcb9

SHA512
dff106b855eb7ee3c9278d9d60ef4b303c670fc976781f9b6318615e60fb513e95aa09e258c36d140d93968951299b963bca3957e7037a0f0ea95e945f631e55

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/332-134-0x00000000001C0000-0x00000000004E4000-memory.dmp

Filesize
3.1MB

Download
memory/904-77-0x0000000000390000-0x00000000006B4000-memory.dmp

Filesize
3.1MB

Download
memory/1200-156-0x0000000000EB0000-0x00000000011D4000-memory.dmp

Filesize
3.1MB

Download
memory/1320-45-0x0000000001250000-0x0000000001574000-memory.dmp

Filesize
3.1MB

Download
memory/1752-1-0x0000000000EA0000-0x00000000011C4000-memory.dmp

Filesize
3.1MB

Download
memory/1752-2-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

Filesize
9.9MB

Download
memory/1752-32-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

Filesize
9.9MB

Download
memory/1752-0-0x000007FEF53C3000-0x000007FEF53C4000-memory.dmp

Filesize
4KB

Download
memory/1828-113-0x0000000001140000-0x0000000001464000-memory.dmp

Filesize
3.1MB

Download
memory/1956-9-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

Filesize
9.9MB

Download
memory/1956-10-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

Filesize
9.9MB

Download
memory/1956-20-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

Filesize
9.9MB

Download
memory/1956-8-0x0000000000DB0000-0x00000000010D4000-memory.dmp

Filesize
3.1MB

Download
memory/2240-145-0x0000000000110000-0x0000000000434000-memory.dmp

Filesize
3.1MB

Download
memory/2540-88-0x0000000000340000-0x0000000000664000-memory.dmp

Filesize
3.1MB

Download
memory/2568-101-0x00000000000B0000-0x00000000003D4000-memory.dmp

Filesize
3.1MB

Download
memory/2584-22-0x0000000000ED0000-0x00000000011F4000-memory.dmp

Filesize
3.1MB

Download
memory/3020-34-0x00000000002A0000-0x00000000005C4000-memory.dmp

Filesize
3.1MB

Download