quasar | cd675cca7bf383d16feb82e8e6de88bf8a4cfb5964f0374f9e0efab3a8c5ff46

Analysis

max time kernel
142s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/01/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Size 3.0MB
Sample240116-bdmkfsbae4
SHA256 8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17
MD5 0ccf0702bf00096f2ccf1b2ab139777c
SHA1 843350df58bfe024744cf024d084fc6164bab65a
SHA512 344f838dc8ba4cb404decd5e4a28d0f45372e4d47f94af2274dbf1152a370fbc60ac47bf6b420bce2972a99812499a7e9bcb1035912f51d803f034a6f5a8b5d4
SSDEEP 98304:R7SQa0y65lyV6+rN8Gowev5kDelDYGH9pAa7ddxMMhMUcV/X:Rfj6X
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

mznhr.ddns.net:6565

Mutex

de0a6df5-5d51-4a80-b226-5e720744d91b

Attributes

encryption_key
21C6DB5AB5FB416AE989A08BF955F715B60B010D
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3092-0-0x00000000002A0000-0x00000000005AC000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
2604	PING.EXE
4412	PING.EXE
3816	PING.EXE
1584	PING.EXE
908	PING.EXE
408	PING.EXE
4784	PING.EXE
4420	PING.EXE
2228	PING.EXE
1964	PING.EXE
2392	PING.EXE
5060	PING.EXE
3100	PING.EXE
4812	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 680	3092	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	88
PID 3092 wrote to memory of 680	3092	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	88
PID 680 wrote to memory of 4344	680	cmd.exe	90
PID 680 wrote to memory of 4344	680	cmd.exe	90
PID 680 wrote to memory of 2228	680	cmd.exe	91
PID 680 wrote to memory of 2228	680	cmd.exe	91
PID 680 wrote to memory of 4196	680	cmd.exe	99
PID 680 wrote to memory of 4196	680	cmd.exe	99
PID 4196 wrote to memory of 1360	4196	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	101
PID 4196 wrote to memory of 1360	4196	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	101
PID 1360 wrote to memory of 2380	1360	cmd.exe	102
PID 1360 wrote to memory of 2380	1360	cmd.exe	102
PID 1360 wrote to memory of 4812	1360	cmd.exe	103
PID 1360 wrote to memory of 4812	1360	cmd.exe	103
PID 1360 wrote to memory of 3556	1360	cmd.exe	104
PID 1360 wrote to memory of 3556	1360	cmd.exe	104
PID 3556 wrote to memory of 864	3556	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	105
PID 3556 wrote to memory of 864	3556	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	105
PID 864 wrote to memory of 3312	864	cmd.exe	108
PID 864 wrote to memory of 3312	864	cmd.exe	108
PID 864 wrote to memory of 3816	864	cmd.exe	107
PID 864 wrote to memory of 3816	864	cmd.exe	107
PID 864 wrote to memory of 4472	864	cmd.exe	110
PID 864 wrote to memory of 4472	864	cmd.exe	110
PID 4472 wrote to memory of 3756	4472	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	112
PID 4472 wrote to memory of 3756	4472	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	112
PID 3756 wrote to memory of 2084	3756	cmd.exe	113
PID 3756 wrote to memory of 2084	3756	cmd.exe	113
PID 3756 wrote to memory of 4412	3756	cmd.exe	114
PID 3756 wrote to memory of 4412	3756	cmd.exe	114
PID 3756 wrote to memory of 4944	3756	cmd.exe	115
PID 3756 wrote to memory of 4944	3756	cmd.exe	115
PID 4944 wrote to memory of 4452	4944	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	117
PID 4944 wrote to memory of 4452	4944	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	117
PID 4452 wrote to memory of 2108	4452	cmd.exe	118
PID 4452 wrote to memory of 2108	4452	cmd.exe	118
PID 4452 wrote to memory of 1964	4452	cmd.exe	119
PID 4452 wrote to memory of 1964	4452	cmd.exe	119
PID 4452 wrote to memory of 4136	4452	cmd.exe	120
PID 4452 wrote to memory of 4136	4452	cmd.exe	120
PID 4136 wrote to memory of 1876	4136	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	121
PID 4136 wrote to memory of 1876	4136	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	121
PID 1876 wrote to memory of 3420	1876	cmd.exe	124
PID 1876 wrote to memory of 3420	1876	cmd.exe	124
PID 1876 wrote to memory of 2604	1876	cmd.exe	123
PID 1876 wrote to memory of 2604	1876	cmd.exe	123
PID 1876 wrote to memory of 2100	1876	cmd.exe	125
PID 1876 wrote to memory of 2100	1876	cmd.exe	125
PID 2100 wrote to memory of 4152	2100	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	127
PID 2100 wrote to memory of 4152	2100	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	127
PID 4152 wrote to memory of 4952	4152	cmd.exe	129
PID 4152 wrote to memory of 4952	4152	cmd.exe	129
PID 4152 wrote to memory of 1584	4152	cmd.exe	128
PID 4152 wrote to memory of 1584	4152	cmd.exe	128
PID 4152 wrote to memory of 5036	4152	cmd.exe	130
PID 4152 wrote to memory of 5036	4152	cmd.exe	130
PID 5036 wrote to memory of 748	5036	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	134
PID 5036 wrote to memory of 748	5036	8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe	134
PID 748 wrote to memory of 4276	748	cmd.exe	132
PID 748 wrote to memory of 4276	748	cmd.exe	132
PID 748 wrote to memory of 908	748	cmd.exe	133
PID 748 wrote to memory of 908	748	cmd.exe	133
PID 748 wrote to memory of 3312	748	cmd.exe	135
PID 748 wrote to memory of 3312	748	cmd.exe	135

C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
"C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sNlih08vC9nM.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:680
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4344
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
    "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jtJYQKlmcI4T.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1360
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2380
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:3556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6dOuio7yXpc0.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:864
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:3816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        7⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EiEYvxJrIFxc.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2084
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        9⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VVond2e5oCMT.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        11⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vhrOjpl3D2ks.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1876
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:2604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        13⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PYuybqSA3Lyw.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:1584
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        15⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QLYlfoMIxJq3.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        17⤵
        Checks computer location settings
        
        PID:3312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2LvwqCw0ow4y.bat" "
        18⤵
        
        PID:2368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:2576
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        Runs ping.exe
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        19⤵
        Checks computer location settings
        
        PID:4992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RXpLqYoMuX7p.bat" "
        20⤵
        
        PID:3620
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:2392
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        21⤵
        Checks computer location settings
        
        PID:4304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C6ex8r60Vtcz.bat" "
        22⤵
        
        PID:3756
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:5060
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        23⤵
        Checks computer location settings
        
        PID:5116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sHAbpkFHJW9m.bat" "
        24⤵
        
        PID:1352
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        Runs ping.exe
        
        PID:3100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        25⤵
        Checks computer location settings
        
        PID:2816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3ksnOMs3wPUD.bat" "
        26⤵
        
        PID:3148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        Runs ping.exe
        
        PID:4784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe
        
        "C:\Users\Admin\AppData\Local\Temp\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe"
        27⤵
        Checks computer location settings
        
        PID:1876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vekNZwPCQUZM.bat" "
        28⤵
        
        PID:4936

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:4276

C:\Windows\system32\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:908

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:2948

C:\Windows\system32\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\8a8d5c1b7c15cb5e0ba025c8de5ff2ba6138eca7a6b8407a5962bbd9ec79cf17.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

2LvwqCw0ow4y.bat

Path C:\Users\Admin\AppData\Local\Temp\2LvwqCw0ow4y.bat
Size 261B
SHA256 9097dcd04d6eec6f2e627b9e4abd6494fe0887e9094994517b6379d15a529265
MD5 ad5c312e80e166c6327b6114c4d085da
SHA1 292323b0026d21a304da64f51723137c1b7588ca
SHA512 abbf494b96faf1b13fbb07d14301f6296468b542be10db5cb49ff0a2799fa1e3de5ffe8625f40cfc8be9ca6a872325d660bbc91a776693ff21e42e939137ea0a
MD5 SHA1 SHA512

Submit Download

3ksnOMs3wPUD.bat

Path C:\Users\Admin\AppData\Local\Temp\3ksnOMs3wPUD.bat
Size 261B
SHA256 19514abc1ce770f1dddfa9bb7de6cb8cdb77ede3f5210bc1b5b4b90b3671a95d
MD5 0dc51f26ecf54911f210f4410b9841d3
SHA1 296c7fd180e93ed5d890097f5d4478519903fc4e
SHA512 bc38a88b30b8256e0d7b8ac45276bfc38315ab5f42abbf16d759da8e3ae0cb3566731b9be3c92ec46c20c4fd9a363a465bbab049f42a443b672e186cd88f2bcb
MD5 SHA1 SHA512

Submit Download

6dOuio7yXpc0.bat

Path C:\Users\Admin\AppData\Local\Temp\6dOuio7yXpc0.bat
Size 261B
SHA256 6b68984f0b7530426f38ff3d9c4beadb1eed8a8a416c5537ece411ae00f0eb03
MD5 bbf374d1b852138f7d8962ac134d44b0
SHA1 3dc2a34e51b399ec80d0dd3638920072abb523d0
SHA512 3f469386866b6fb2d4d4200d702ee2122eb50ef598e5d5cd9f18042ac7d467f66dba2199526430a0be053720ac31d5c4c59a22570a0037f271ae12c04dab4be2
MD5 SHA1 SHA512

Submit Download

C6ex8r60Vtcz.bat

Path C:\Users\Admin\AppData\Local\Temp\C6ex8r60Vtcz.bat
Size 261B
SHA256 19511f91eccae7320a56e3e3ed099788a437a018383e6f1e2f2d1fc2c6e0e9e8
MD5 395ec516c6eee5164feee2f7390814de
SHA1 d0f7b6763e0ae94a19266fd67ed1ecfe689992fd
SHA512 d71abdcf5c642ff9738397948e42acfa6f4531e71e213e8e64dde2ee7e84b50c5787ff922f35394f2114abac61f377eb22203d4beb4cf66c89756773d0248331
MD5 SHA1 SHA512

Submit Download

EiEYvxJrIFxc.bat

Path C:\Users\Admin\AppData\Local\Temp\EiEYvxJrIFxc.bat
Size 261B
SHA256 680baf707a169b701c24228b8de26043eb06f8615304a1c9f0830cf80d50ef9a
MD5 e2b9a5851e28b52f88137de33f7c2c54
SHA1 0592fcb68393d4807537533489c37e4ec15b60d7
SHA512 d95ed3b3383e76a3f3246c55b2c9f71407323816ae203c0ce3b2f0a2e1fc45a536e91ce50b17c15073e8956896e1bb4cc6682300ac3bf37ca7005d475e28fdc0
MD5 SHA1 SHA512

Submit Download

PYuybqSA3Lyw.bat

Path C:\Users\Admin\AppData\Local\Temp\PYuybqSA3Lyw.bat
Size 261B
SHA256 0e18b7e2e96eef13232916571f14aeafef1e5000268bcac2fe4486f20b210d72
MD5 75f67fc57694508ea857996acaeaaa42
SHA1 3965617fe40e26d9ff27b72f59bc8b65057be386
SHA512 e2092d864e2baac98cb47e259aca28e33011d5c6b29463590683f0b3e9e4a226c041c1a477685797140771f2e585645cfd8cafc17d796de5a029de94d42d87f0
MD5 SHA1 SHA512

Submit Download

QLYlfoMIxJq3.bat

Path C:\Users\Admin\AppData\Local\Temp\QLYlfoMIxJq3.bat
Size 261B
SHA256 300b4fee10ec7132ac4d1dceb63297706ae4b6da60b2d315ad409909fbc7a17a
MD5 7791f3508f5197ae94a871d46b7f11c1
SHA1 c1ace2da43ad36dea63599ba35a312c22ffbca59
SHA512 f050b69ae51759ad4c2e61f1b8541aac5e07ed3be4f6c1f5fc735b5166147ac6cfebda29e1b9ecef5129c59259c1f58980b83e81847d735a0f8929e2accd61da
MD5 SHA1 SHA512

Submit Download

RXpLqYoMuX7p.bat

Path C:\Users\Admin\AppData\Local\Temp\RXpLqYoMuX7p.bat
Size 261B
SHA256 89a96adc2dc41d38ace650f82c6e45633ae72cd832b4f5762a1f51eef124d4d7
MD5 a3d8b42ddb6c9c329c3229c026a6cc4e
SHA1 d2e5224d5eadf86eefe58a0d30a683657fc1a861
SHA512 983f058beef6aa697499c654678fedfe2b9c3a3a8b1da889e23fed61911cbe3c503828be1e4e8f5af0e73ba342d78f04fa3dae56149698377b77d4e028088ad6
MD5 SHA1 SHA512

Submit Download

VVond2e5oCMT.bat

Path C:\Users\Admin\AppData\Local\Temp\VVond2e5oCMT.bat
Size 261B
SHA256 07ebd00fcd0d50fda0e95950ff1d343dc90c1777ca68418c97b8c42961443cef
MD5 721d2d782384ac0fbdef8d3278500276
SHA1 0a9c42868add7f37046919095a0323d5ddd9fed7
SHA512 9ad5b6faa39907e224f26cc36cf4e9c5491139c2224ecf4ddc7a31f6f58ef411309cd6bda430521725b362042ffd63ac8b3996d49b4347f0f6b9d9a0227f4974
MD5 SHA1 SHA512

Submit Download

jtJYQKlmcI4T.bat

Path C:\Users\Admin\AppData\Local\Temp\jtJYQKlmcI4T.bat
Size 261B
SHA256 6b803c4b308688ff01c934b7812ff23bfa1dffefc391bd0de41576353f2a8c34
MD5 a718dc5aec6425997c7e9ef012c1be79
SHA1 c1d90b19e130d37f978bf579c6aac91914727368
SHA512 43ddfb9e485d1b3959c5b73326c4eff732a951eb9cb8b97c3f858f8ed80d250efde39924744aa625c6626a41c0be39d3d25aa4767e3e8da4c3e7b613dd2071f9
MD5 SHA1 SHA512

Submit Download

sHAbpkFHJW9m.bat

Path C:\Users\Admin\AppData\Local\Temp\sHAbpkFHJW9m.bat
Size 261B
SHA256 9efdbe64c2d619dfc8ed740a7003410c8eb5936c9f05558799234d5939916889
MD5 03bf5595e8233af72a1dc2e90a3eaefb
SHA1 d24a754c45b0a8136c8fbce60eaaf20b41abbdce
SHA512 676868fe3e54a0489fe2f9c3ebfa811538600079b89fd8d2b3b730ff870a89f796359dd1a2984d746ec80371c743107ab8d762be7b33dfade7881708cb938a92
MD5 SHA1 SHA512

Submit Download

sNlih08vC9nM.bat

Path C:\Users\Admin\AppData\Local\Temp\sNlih08vC9nM.bat
Size 261B
SHA256 547190c82fa11890ba6b1d7020a42a9f988c35a63e625f728e44a8595c5c7853
MD5 a4a95af5c488a46dc169e8a4f41ba02d
SHA1 c2858325dcfeb9d0af2eb766b16e3fa483e3cd00
SHA512 2661990e38ce51375f35f1e1286a5bc605e224ebfaca888b7995deb2106586b2e4f2567f0b8da6da59e2863451e57620e717f99b5d6ffe4eab969609022c9911
MD5 SHA1 SHA512

Submit Download

vekNZwPCQUZM.bat

Path C:\Users\Admin\AppData\Local\Temp\vekNZwPCQUZM.bat
Size 261B
SHA256 d65dbcb94291c81a9655965b1bc8d8182e25cd03a7b5d56e30a556654227fce5
MD5 fe37516f7b9b0f03742dc2d121c002c2
SHA1 f7707ef45fae299afaafaaae559bbbbefef024f9
SHA512 29b89eee64311f6247df06a0457a0cce55a9616530d92dabf689757bf093285456641546799ab736ea5ad3f2de83f88c1f7d607967b794c0d6a8159841a47f28
MD5 SHA1 SHA512

Submit Download

vhrOjpl3D2ks.bat

Path C:\Users\Admin\AppData\Local\Temp\vhrOjpl3D2ks.bat
Size 261B
SHA256 b679304b71676979277d3ed7537dcfc2bbbcf0663dd36a7baf8b1d67f8fda7f3
MD5 37b8ef98ea047bb924c1f54fae31ae62
SHA1 f44c5e8b21d207563835d9c9dde19f11be1c40fc
SHA512 85f24048d7999b9d1660af07dacbf547cfc38d7e8358aef85bf8df49575321dd206fc85bfd2421bde00ff0b02b80f5526c989a47810cf95424a47c4e6f5904cc
MD5 SHA1 SHA512

Submit Download

memory/1876-86-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/1876-91-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/2100-48-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/2100-43-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/2816-80-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/2816-85-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/3092-3-0x000000001B110000-0x000000001B160000-memory.dmp

Download

memory/3092-2-0x000000001B190000-0x000000001B1A0000-memory.dmp

Download

memory/3092-10-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/3092-4-0x000000001BB10000-0x000000001BBC2000-memory.dmp

Download

memory/3092-1-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/3092-0-0x00000000002A0000-0x00000000005AC000-memory.dmp

Download

memory/3312-61-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/3312-55-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/3312-56-0x000000001B5D0000-0x000000001B5E0000-memory.dmp

Download

memory/3556-19-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/3556-24-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/4136-42-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/4136-37-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/4196-12-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/4196-13-0x000000001B230000-0x000000001B240000-memory.dmp

Download

memory/4196-18-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/4304-73-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/4304-68-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/4472-30-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/4472-25-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/4944-36-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/4944-31-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/4992-67-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/4992-62-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/5036-54-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/5036-49-0x00007FFC72650000-0x00007FFC73111000-memory.dmp

Download

memory/5116-74-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

memory/5116-79-0x00007FFC72850000-0x00007FFC73311000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads