quasar | 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861

Analysis

max time kernel
144s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2022, 18:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OliwciaPrivInstaller.exe
Size 348KB
Sample221226-w9lcgsdd67
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

jebacdisaskurwysyna-33409.portmap.io:33409

Mutex

QSR_MUTEX_Ee4l0fQjTiryzphwaO

Attributes

encryption_key
UQAQ2KDh5xIXFPqVH1cJ
install_name
cmd.exe
log_directory
NET. Framework
reconnect_delay
3000
startup_key
Windows
subdirectory
Microsoft

Signatures

Quasar RAT 4 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

flow	ioc	pid	Process
		2604	schtasks.exe
13	ip-api.com		Process not Found
107	ip-api.com		Process not Found
110	ip-api.com		Process not Found

Quasar payload 15 IoCs

resource	yara_rule
behavioral2/memory/4664-132-0x0000000000470000-0x00000000004CE000-memory.dmp	family_quasar
behavioral2/files/0x0007000000022e2f-141.dat	family_quasar
behavioral2/files/0x0007000000022e2f-140.dat	family_quasar
behavioral2/files/0x0007000000022e2f-149.dat	family_quasar
behavioral2/files/0x0007000000022e2f-157.dat	family_quasar
behavioral2/files/0x0007000000022e2f-165.dat	family_quasar
behavioral2/files/0x0007000000022e2f-173.dat	family_quasar
behavioral2/files/0x0007000000022e2f-181.dat	family_quasar
behavioral2/files/0x0007000000022e2f-189.dat	family_quasar
behavioral2/files/0x0007000000022e2f-197.dat	family_quasar
behavioral2/files/0x0007000000022e2f-205.dat	family_quasar
behavioral2/files/0x0007000000022e2f-213.dat	family_quasar
behavioral2/files/0x0007000000022e2f-221.dat	family_quasar
behavioral2/files/0x0007000000022e2f-229.dat	family_quasar
behavioral2/files/0x0007000000022e2f-237.dat	family_quasar

Executes dropped EXE 13 IoCs

pid	Process
4320	cmd.exe
2196	cmd.exe
3624	cmd.exe
4148	cmd.exe
1684	cmd.exe
1600	cmd.exe
2432	cmd.exe
4088	cmd.exe
5108	cmd.exe
4152	cmd.exe
228	cmd.exe
3544	cmd.exe
2436	cmd.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com
107	ip-api.com
110	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 13 IoCs

pid	pid_target	Process	procid_target
4168	4320	WerFault.exe	83
3652	2196	WerFault.exe	93
960	3624	WerFault.exe	102
3264	4148	WerFault.exe	118
2952	1684	WerFault.exe	127
4940	1600	WerFault.exe	136
3140	2432	WerFault.exe	145
4404	4088	WerFault.exe	154
4284	5108	WerFault.exe	163
2044	4152	WerFault.exe	172
3360	228	WerFault.exe	181
1692	3544	WerFault.exe	190
3968	2436	WerFault.exe	199

Creates scheduled task(s) 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4824	schtasks.exe
384	schtasks.exe
736	schtasks.exe
3180	schtasks.exe
4832	schtasks.exe
2276	schtasks.exe
316	schtasks.exe
532	schtasks.exe
4704	schtasks.exe
2604	schtasks.exe
4788	schtasks.exe
2972	schtasks.exe
3828	schtasks.exe
4404	schtasks.exe

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
1972	PING.EXE
4840	PING.EXE
2844	PING.EXE
2584	PING.EXE
3960	PING.EXE
2036	PING.EXE
3924	PING.EXE
880	PING.EXE
3400	PING.EXE
4740	PING.EXE
4868	PING.EXE
1364	PING.EXE
2596	PING.EXE

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	OliwciaPrivInstaller.exe
Token: SeDebugPrivilege	4320	cmd.exe
Token: SeDebugPrivilege	2196	cmd.exe
Token: SeDebugPrivilege	3624	cmd.exe
Token: SeDebugPrivilege	4148	cmd.exe
Token: SeDebugPrivilege	1684	cmd.exe
Token: SeDebugPrivilege	1600	cmd.exe
Token: SeDebugPrivilege	2432	cmd.exe
Token: SeDebugPrivilege	4088	cmd.exe
Token: SeDebugPrivilege	5108	cmd.exe
Token: SeDebugPrivilege	4152	cmd.exe
Token: SeDebugPrivilege	228	cmd.exe
Token: SeDebugPrivilege	3544	cmd.exe
Token: SeDebugPrivilege	2436	cmd.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4320	cmd.exe
2196	cmd.exe
3624	cmd.exe
4148	cmd.exe
1684	cmd.exe
1600	cmd.exe
2432	cmd.exe
4088	cmd.exe
5108	cmd.exe
4152	cmd.exe
228	cmd.exe
3544	cmd.exe
2436	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 2604	4664	OliwciaPrivInstaller.exe	81
PID 4664 wrote to memory of 2604	4664	OliwciaPrivInstaller.exe	81
PID 4664 wrote to memory of 2604	4664	OliwciaPrivInstaller.exe	81
PID 4664 wrote to memory of 4320	4664	OliwciaPrivInstaller.exe	83
PID 4664 wrote to memory of 4320	4664	OliwciaPrivInstaller.exe	83
PID 4664 wrote to memory of 4320	4664	OliwciaPrivInstaller.exe	83
PID 4320 wrote to memory of 4824	4320	cmd.exe	84
PID 4320 wrote to memory of 4824	4320	cmd.exe	84
PID 4320 wrote to memory of 4824	4320	cmd.exe	84
PID 4320 wrote to memory of 5048	4320	cmd.exe	86
PID 4320 wrote to memory of 5048	4320	cmd.exe	86
PID 4320 wrote to memory of 5048	4320	cmd.exe	86
PID 5048 wrote to memory of 1712	5048	cmd.exe	89
PID 5048 wrote to memory of 1712	5048	cmd.exe	89
PID 5048 wrote to memory of 1712	5048	cmd.exe	89
PID 5048 wrote to memory of 1972	5048	cmd.exe	91
PID 5048 wrote to memory of 1972	5048	cmd.exe	91
PID 5048 wrote to memory of 1972	5048	cmd.exe	91
PID 5048 wrote to memory of 2196	5048	cmd.exe	93
PID 5048 wrote to memory of 2196	5048	cmd.exe	93
PID 5048 wrote to memory of 2196	5048	cmd.exe	93
PID 2196 wrote to memory of 316	2196	cmd.exe	94
PID 2196 wrote to memory of 316	2196	cmd.exe	94
PID 2196 wrote to memory of 316	2196	cmd.exe	94
PID 2196 wrote to memory of 2100	2196	cmd.exe	96
PID 2196 wrote to memory of 2100	2196	cmd.exe	96
PID 2196 wrote to memory of 2100	2196	cmd.exe	96
PID 2100 wrote to memory of 3816	2100	cmd.exe	99
PID 2100 wrote to memory of 3816	2100	cmd.exe	99
PID 2100 wrote to memory of 3816	2100	cmd.exe	99
PID 2100 wrote to memory of 3400	2100	cmd.exe	101
PID 2100 wrote to memory of 3400	2100	cmd.exe	101
PID 2100 wrote to memory of 3400	2100	cmd.exe	101
PID 2100 wrote to memory of 3624	2100	cmd.exe	102
PID 2100 wrote to memory of 3624	2100	cmd.exe	102
PID 2100 wrote to memory of 3624	2100	cmd.exe	102
PID 3624 wrote to memory of 3828	3624	cmd.exe	103
PID 3624 wrote to memory of 3828	3624	cmd.exe	103
PID 3624 wrote to memory of 3828	3624	cmd.exe	103
PID 3624 wrote to memory of 1588	3624	cmd.exe	106
PID 3624 wrote to memory of 1588	3624	cmd.exe	106
PID 3624 wrote to memory of 1588	3624	cmd.exe	106
PID 1588 wrote to memory of 2760	1588	cmd.exe	110
PID 1588 wrote to memory of 2760	1588	cmd.exe	110
PID 1588 wrote to memory of 2760	1588	cmd.exe	110
PID 1588 wrote to memory of 4740	1588	cmd.exe	111
PID 1588 wrote to memory of 4740	1588	cmd.exe	111
PID 1588 wrote to memory of 4740	1588	cmd.exe	111
PID 1588 wrote to memory of 4148	1588	cmd.exe	118
PID 1588 wrote to memory of 4148	1588	cmd.exe	118
PID 1588 wrote to memory of 4148	1588	cmd.exe	118
PID 4148 wrote to memory of 4404	4148	cmd.exe	119
PID 4148 wrote to memory of 4404	4148	cmd.exe	119
PID 4148 wrote to memory of 4404	4148	cmd.exe	119
PID 4148 wrote to memory of 544	4148	cmd.exe	121
PID 4148 wrote to memory of 544	4148	cmd.exe	121
PID 4148 wrote to memory of 544	4148	cmd.exe	121
PID 544 wrote to memory of 956	544	cmd.exe	125
PID 544 wrote to memory of 956	544	cmd.exe	125
PID 544 wrote to memory of 956	544	cmd.exe	125
PID 544 wrote to memory of 4868	544	cmd.exe	126
PID 544 wrote to memory of 4868	544	cmd.exe	126
PID 544 wrote to memory of 4868	544	cmd.exe	126
PID 544 wrote to memory of 1684	544	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\OliwciaPrivInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\OliwciaPrivInstaller.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\OliwciaPrivInstaller.exe" /rl HIGHEST /f
  2⤵
  - Quasar RAT
  - Creates scheduled task(s)
  PID:2604
- C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8d4PzLceRFbv.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5048
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:1712
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:1972
  - - C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2196
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:316
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H3uMr0KsW7XF.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3816
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:3400
      - C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3624
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        7⤵
        Creates scheduled task(s)
        
        PID:3828
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QUkIif27czTY.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1588
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:4740
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        8⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        9⤵
        Creates scheduled task(s)
        
        PID:4404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\24oRHnUKzSoW.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        
        PID:956
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:4868
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        10⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1684
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        11⤵
        Creates scheduled task(s)
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yLEFGAxGp0F4.bat" "
        11⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:1364
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        12⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1600
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        13⤵
        Creates scheduled task(s)
        
        PID:384
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0BN8hgYLHDwz.bat" "
        13⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:4840
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        14⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2432
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        15⤵
        Creates scheduled task(s)
        
        PID:532
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qvqP86Fruzmj.bat" "
        15⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:2844
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        16⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4088
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        17⤵
        Creates scheduled task(s)
        
        PID:4704
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\smyHZcpwNDSf.bat" "
        17⤵
        
        PID:956
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:2584
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        18⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5108
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        19⤵
        Creates scheduled task(s)
        
        PID:736
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4EdxD1hVzt5s.bat" "
        19⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:3960
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        20⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4152
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        21⤵
        Creates scheduled task(s)
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MBFCRNKSnLJv.bat" "
        21⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        22⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:2036
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        22⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:228
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        23⤵
        Creates scheduled task(s)
        
        PID:2972
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WlzqvXyVVDdy.bat" "
        23⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:2596
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        24⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3544
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        25⤵
        Creates scheduled task(s)
        
        PID:4832
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6rtAhTpeBh51.bat" "
        25⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:3924
        
        C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe"
        26⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Windows" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe" /rl HIGHEST /f
        27⤵
        Creates scheduled task(s)
        
        PID:2276
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OoVOvpSa09I3.bat" "
        27⤵
        
        PID:532
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        28⤵
        
        PID:376
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        28⤵
        Runs ping.exe
        
        PID:880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 2208
        27⤵
        Program crash
        
        PID:3968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 2212
        25⤵
        Program crash
        
        PID:1692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 228 -s 2208
        23⤵
        Program crash
        
        PID:3360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 2208
        21⤵
        Program crash
        
        PID:2044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 2208
        19⤵
        Program crash
        
        PID:4284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4088 -s 2240
        17⤵
        Program crash
        
        PID:4404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 2216
        15⤵
        Program crash
        
        PID:3140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 2208
        13⤵
        Program crash
        
        PID:4940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 2216
        11⤵
        Program crash
        
        PID:2952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 1656
        9⤵
        Program crash
        
        PID:3264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 2224
        7⤵
        Program crash
        
        PID:960
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 2240
        5⤵
        Program crash
        
        PID:3652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 1960
    3⤵
    - Program crash
    PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4320 -ip 4320
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2196 -ip 2196
1⤵
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3624 -ip 3624
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4148 -ip 4148
1⤵
PID:1360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1684 -ip 1684
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 1600 -ip 1600
1⤵
PID:3860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2432 -ip 2432
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4088 -ip 4088
1⤵
PID:2532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5108 -ip 5108
1⤵
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4152 -ip 4152
1⤵
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 228 -ip 228
1⤵
PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3544 -ip 3544
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2436 -ip 2436
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BN8hgYLHDwz.bat

Path C:\Users\Admin\AppData\Local\Temp\0BN8hgYLHDwz.bat
Size 207B
SHA256 86eac88bd12c6087b101bbed21e30f3a0401eeaf0668b2a799708364be76c053
MD5 404ff69b78f99abfb044587c09bec81e
SHA1 71ddcc8425bff335a57af990f1d52d0f09025c2e
SHA512 7b4be9fd42021327a09c782278cf66076e4285b2ede5e986e6a9e918d98ffad56589aae1f270183571819b194fe6db1c54cb5ec43e2666bb762d56c68d61eed8
MD5 SHA1 SHA512

Submit Download

24oRHnUKzSoW.bat

Path C:\Users\Admin\AppData\Local\Temp\24oRHnUKzSoW.bat
Size 207B
SHA256 03f665e212356f8cc706fc98e4775981b219ccde672c7a58f5b70b0d921c1ba2
MD5 1fe296c74ab4b8c5caf27942fbfd9473
SHA1 eeafef66d041b99df6bdf0c17209b82f818a175b
SHA512 e4b5c7329e7e1bab0f1bbb3c4ee4bf7c3953842af0bda50fb46c58162c2279b8689d38ec88262f967f959d91536bc69e22322f7f5a97498444632a2b3a6bab92
MD5 SHA1 SHA512

Submit Download

4EdxD1hVzt5s.bat

Path C:\Users\Admin\AppData\Local\Temp\4EdxD1hVzt5s.bat
Size 207B
SHA256 3444475141e19ba6cf4d1b8b110c4c5d02e87a4ee20b047afaa2243476009708
MD5 679c8b30b8fc24d1ec8241b58ae9a2e4
SHA1 e28cd98415b9ed1d4e67a64d75166addeb22283c
SHA512 ca5dbfdfcf49130b8e994f55fc3f8cadcbed56e76a5eb1c58e94e2439cc2efee997a1e056902f63a69e1fe9d20fde714264f34b7a8211c0a1f0c17f08d2be541
MD5 SHA1 SHA512

Submit Download

6rtAhTpeBh51.bat

Path C:\Users\Admin\AppData\Local\Temp\6rtAhTpeBh51.bat
Size 207B
SHA256 a69a8a12a12463aecec3939e5a0a20ceff1aa96a5e94b931239c430c313939a5
MD5 3666c89a8942dfd65562b22e004b22dd
SHA1 e91bb6e9772b20c87bf502048f20ba39f2c15ba0
SHA512 5ebf6923c4173aa15b3e6839a130f690defa75ed534cceb837f3df78787bb32fd335a90447d85a2651ea50996168e2099d873706997806423bcf76c55384ce3e
MD5 SHA1 SHA512

Submit Download

8d4PzLceRFbv.bat

Path C:\Users\Admin\AppData\Local\Temp\8d4PzLceRFbv.bat
Size 207B
SHA256 7769bedb003093239a9e19b7fe7c21288126eaad308b34af422ab7982097767e
MD5 f57426cccc3e99a2a5fdbfb128a41d0b
SHA1 a3067c082935216af8b7a2dcdaaf947f8c6e5d6f
SHA512 c00a2f4a6cf8d37d875cbc7055e5f3b63c38437d8f1e17441c0420f95f7dd05fa0e7438bc7c39754b882b78b0e275d9a02e6cff44a696570ac9e763c39487018
MD5 SHA1 SHA512

Submit Download

H3uMr0KsW7XF.bat

Path C:\Users\Admin\AppData\Local\Temp\H3uMr0KsW7XF.bat
Size 207B
SHA256 ec753623dc52c9a09d7336deac6cfd802abfb8e52a2b837f16836a6d8a84dfd6
MD5 9dc1bcbb9d307a22aac625a6f874f522
SHA1 73e8c67573be0466fbc99d3f7d7d00a720b3c82a
SHA512 9c1659cc86f8144b0dae20dab9ebf73ed5ad17a70c6b4bdcc15f6e7ed4327d272c3e15eedac7f41a9915722fd828b2f7cf787ddc04a32a123b2a01399e9bc94a
MD5 SHA1 SHA512

Submit Download

MBFCRNKSnLJv.bat

Path C:\Users\Admin\AppData\Local\Temp\MBFCRNKSnLJv.bat
Size 207B
SHA256 08a4d45ca28c1e7a82025542b75e5a210c4846b1aa159065048ced64a628335e
MD5 2c5a44b4a5560b2a0367c536870c9edc
SHA1 82eba07f8129693e6de9181f1fe7df703c13f897
SHA512 8235af7cb6165a26ce235edf04a17460400ae9b8f62bfd6977656fd795c3e639dff2c565f8b109497012f4ff9e34d11a078dd7050d92e48ea3d0757c064c0de9
MD5 SHA1 SHA512

Submit Download

OoVOvpSa09I3.bat

Path C:\Users\Admin\AppData\Local\Temp\OoVOvpSa09I3.bat
Size 207B
SHA256 12466311475aac31d1cc7936e7866d7638e0b4832dd6704f50b210b50ee8063e
MD5 70655f6e92d50676ac54c7d53eb00787
SHA1 28b9efc2edfea0a6468044c3d310457113ab14de
SHA512 2e9e0ad741caa5a734d6e829727c54f25b8bde6c069b01fa3a6dc71b47f6b6c77ea855ed81d62a9f8ec906e9090f102d87b8c0e24bfd88ab3bd73758b4ab2b2a
MD5 SHA1 SHA512

Submit Download

QUkIif27czTY.bat

Path C:\Users\Admin\AppData\Local\Temp\QUkIif27czTY.bat
Size 207B
SHA256 cd90bfe2dd761a800e36158aff1ca092fd1790d20dda73e679a56ff4924999cb
MD5 69535ceef23a29bb7231e9fba34e1593
SHA1 5d718f01e010a85d5256b69ea113e7f5b5b574d8
SHA512 83a563f5f566e8323ab953cc8d2dd50f48e3b9bd8b572a653781cb6e8ff9544617172302bad993e0358359fffd4a9bee437d5cb0bc599cb5a1df9f2a324de47e
MD5 SHA1 SHA512

Submit Download

WlzqvXyVVDdy.bat

Path C:\Users\Admin\AppData\Local\Temp\WlzqvXyVVDdy.bat
Size 207B
SHA256 c4c1cf55365e634cfaa88dc69c249729a0331621b455c7194b2dde435b1145a1
MD5 57f6f426e10d95fc98a685a24ea281d8
SHA1 1cbc83186afa2b74d2730bcdd9615406c71a4865
SHA512 a9eef7ae4cb49f831b4295130fe98ae56f419a6ca2c9b521e29ddc7e389ff702ecb96265194f85addddc2a9313a074f7fedafecd1638db29d3a40ea91a87e9b7
MD5 SHA1 SHA512

Submit Download

qvqP86Fruzmj.bat

Path C:\Users\Admin\AppData\Local\Temp\qvqP86Fruzmj.bat
Size 207B
SHA256 9376c6d9cda10edcf4b2501ac4b406919e4dd0a051c4a0a86e349abda5779417
MD5 44586b453708af31f3438033cc682aa7
SHA1 d66ad360995323e428eebf0d396060f7bd61fe0c
SHA512 25bee5fb1ac00029ce50e21cef4065f69eec90459cf675dc00040fd54ab48eb9fe56d6aa55bbe54167e1332ee9ea1319fd14bff96eefb8c222441e8bac0f2381
MD5 SHA1 SHA512

Submit Download

smyHZcpwNDSf.bat

Path C:\Users\Admin\AppData\Local\Temp\smyHZcpwNDSf.bat
Size 207B
SHA256 de393f0e7501d993a8efa2724da28e06a0b767efb4f4b34d9cc5baa096b6e9ab
MD5 b52518cb19b010fc1e097b51f9d0798b
SHA1 9116abbb0961e0cb8da2c71e680f16dd92787739
SHA512 da5a003f09d07ce756dd7d930c33b7e7c5a729c75b4be753e7422f4ecbd2d89c75a0077046b78eae072a5fdf07f09f53b0b5bdb50c183479fc421acfcffdd749
MD5 SHA1 SHA512

Submit Download

yLEFGAxGp0F4.bat

Path C:\Users\Admin\AppData\Local\Temp\yLEFGAxGp0F4.bat
Size 207B
SHA256 55fc160f9d337d727acd556a2672d24a90b5bdb3aba162114ad3e99010721690
MD5 e6c2d7a15565f9d206c8db131d483bf8
SHA1 b48bd820662b11fd4649f2bb7e1a21226fdcf5e4
SHA512 a0ef51340c3c7b2cdd53212277e215e71c1de48d03ba30e077472918812f737cca9bd0c746e33fedbb2c0177666dd655e86695d55cc9fc5e6bb2934a36a3590c
MD5 SHA1 SHA512

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

cmd.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\cmd.exe
Size 348KB
SHA256 7a1ad31508f2ea1d7abc2907977eaf32537f09994d1622b3e2e733649905c861
MD5 436fa243bbfed63a99b8e9f866cd80e5
SHA1 94f8ab2f1abc5b1cd90cc3b66630767ef999c16a
SHA512 c6158952ea04c98e3027268411dce0088c349288e6f5c6eb37c57d719fb56451bad4a1e691450e7db859f4ea27a0bcb284a46e417c02b9092b0c40517d0952f2
SSDEEP 6144:JkMNHXf500MgJq4ZnLZU50ibmgXZhssO4FUA/i:fd50yquLZHqXZhssO4FUA6
MD5 SHA1 SHA512 SSDEEP

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 5e234266030d4d1cf46e05ce520b89cd532fa0e1975dfb6fe66a01290ac39288
MD5 af77c3296b4f89f69bd3e44b2413e6f0
SHA1 bbad265196b843d7886d97c515ec4bbd0ed2e351
SHA512 5a00860c14bff95a3ce8511fa3af9029c5b5ea1b344daba329cc015a437b5d4e52d46349607a4c4cd7908192d04d61e670f4c61f1ac6783a82494f13a201380a
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 54d1bc9b980ad277c14cbb3f5586f2329568de139f541f71fa93b8e5f21478a4
MD5 2b21f21f33e3bad2d5d41e6f5569e864
SHA1 9a3de5e888d016d82be677c4ee272a2b876a66c9
SHA512 2567a7021decf492c28be8ae9b580f61e11d842a74b4d212f249bbad7d9b47d3eb312e08df6c1edbf69304945af4cf03b4c0a63b003c0f9d5778710e4ce9f39a
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 80e47fa3e7eb03ec08544e32fd87c3a463c55e7f311a14159b206be653b14c17
MD5 8c73cfdd6fb4dea786f2be02fa795733
SHA1 03001b300aa1e2bc4c2ae7706dd79464dc9902c5
SHA512 acd5d927ea45a9881e9bcd82a1d5c0d2b32ef9b636be1550a16e8122915cbb0759a0d01d55bf7a405e4da1355745acd9e190592473ae139a61ed31cbcf6a155d
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 546f34452d3484c349bbd09dd7bc59a7b6fd52134ebaeacffd3631b37860eb2b
MD5 24ae376fbd4ec465d9dcc7c19685f6ab
SHA1 909ae22f4c3d41777227e8f3e62e43a7015b713a
SHA512 3551430af59dd5e722b1748f983dc6d501888ad3349e90c26a47b6b71d211d7f436751f9e5401a5764721a7b46a9bffe47cbe9011fc6efbd9a1735adebd517a8
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 0775e7c013f5381c046626dc89527eaae013a23cbf191e2e8efdeec2c83c12ae
MD5 397275e4116a1b8e5d09582d02b63226
SHA1 09202330b8d9988278d0daa5d1ef5507d7045b24
SHA512 16b4479f33c50d007f0ed16a9d56f6ba3753e8af6b9463ad16345f10aa2a58f2155109a9ddd7e6ca2cf8009f24471a6e3e7866aae1e36eb58d5c8d8542560b97
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 8b95517c69e53c5998ece77e95ab5f9257aefd34e969e17d129c2e72ae2d6992
MD5 fbea544ad5fdec946c939adc05472aee
SHA1 29f9f1c09bae1327382f8e2ee998ae0f54dc9356
SHA512 8a5daeb6d6d0eca3810bc2c88092306ebd27445bd1db4c0cf78f9b9a0fd4e1da837f01a4f1eca95aba5d07a56ced0db272556697692ea8cf4fc1b0df2b720340
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 4b06380b729ad19b0aae29e8dc6f87d6a08e165c95aa6388c324799db2753328
MD5 0bea6c6b4b1cbabe9485ab3e2fbd211f
SHA1 bfcf580310d7bb6e1cc086ea041c131f7d673290
SHA512 9989c6a5b56dc0c36aa0a5552ff444cfb7bf3307e4edf780125b6e39de5865087506ae8c040000fd4e1e9013c2839c9486bcf93a3e2364c9ae38e8916773ebc9
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 cb795463936e5b5c0b272210903bc5943c24f6a7ec5013aa3565618294dda7e1
MD5 04a607882b80407e6581ae674c6d4959
SHA1 e17e5bef7232ae157c3aff1bc9b3b87c733dcb23
SHA512 51f77cc77f1057e01382bf62fee914f1fa12ec683839981f12b3e571eaa909d2fa0cb0ef54793ee93577a22dd37d7f4b19f0fcbb73af20df125031aa444905f5
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 7e18b34811f0beb452b369d7373610ee06575f247ce2eb980bd8829a49431df3
MD5 37fb80d4f1e759f46b0117d920bb932e
SHA1 a3032ed7276d91214413d293f2ec7b293fcb9aea
SHA512 a43fb10141375f065cd088a122dabfec7d7ed5af2592c43df5b7b5e39fee4ef0a1663db8a29def2c4ff0df7878b00e151fbf5ac9c295a809567f6283c3208e90
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 ecf48964473bab125726bc8cc88a08d8cab1ac8885e2196572654dac51340a65
MD5 10b0e3d3e3cce09998565b8e1b908f26
SHA1 7304efe58ca5ba739747346cac853aeafaeb4120
SHA512 2bde04e5b2ecfe3f581c1afa4756f55029df5c828de3e1025396785681fee2b9cca629e5a04ccaa292ebdf08752f669927257ef2ceb60f17d8c4c1549302580d
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 b52766220699d0438a374e15243647c62c1a25621f434b81b9a0c2f09b3f9abe
MD5 8a6562d11ebe4113b9066b8067179cb0
SHA1 72bfd6a6e34e72ee4666bc8c78553af5f68ef4d5
SHA512 b7e9c3532dc6eaea1a9067b5cfb45469052e4f6a47077faeefea00c8f9a045ac44f8b86466a658a3c31fb12d2fdafb7e15025bac2a5dc8f96f5497aa980a7f3f
MD5 SHA1 SHA512

Submit Download

12-26-2022

Path C:\Users\Admin\AppData\Roaming\NET. Framework\12-26-2022
Size 224B
SHA256 dad8f8110bbf51ea9d53e12a2a991b7b5fbef233486c903c37a906df1f52ae12
MD5 eb75e46544c488c83e3252c70d17b514
SHA1 9271e7a802909472d7ed62f4a6b98963534c34f1
SHA512 1a6b21cb43aa4789fd83ef59a9d59a808b40119c6fd412d49f84cd0fa7029fcdcf37358c57945639e36fa8080c6d3fb66e89e6e7d128ac1cac5ddc7880483594
MD5 SHA1 SHA512

Submit Download

memory/4320-143-0x0000000006C20000-0x0000000006C2A000-memory.dmp

Download

memory/4664-137-0x00000000060E0000-0x000000000611C000-memory.dmp

Download

memory/4664-132-0x0000000000470000-0x00000000004CE000-memory.dmp

Download

memory/4664-136-0x0000000005500000-0x0000000005512000-memory.dmp

Download

memory/4664-134-0x0000000004E80000-0x0000000004F12000-memory.dmp

Download

memory/4664-135-0x0000000004F20000-0x0000000004F86000-memory.dmp

Download

memory/4664-133-0x00000000055B0000-0x0000000005B54000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads