quasar | c5b4397f909ce58780bf0f79b76838eb7a83b2f31c04428db4e420518ba63c83

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-02-06_c52548ea62ad228bc675b6e459c449c2_icedid_xrat.exe
Size 4.6MB
Sample240206-brrfkacbc5
SHA256 c5b4397f909ce58780bf0f79b76838eb7a83b2f31c04428db4e420518ba63c83
MD5 c52548ea62ad228bc675b6e459c449c2
SHA1 30c411b5cdee367a37d783b62a87bbb8d74467dc
SHA512 304cf0ab344979973e0d96ea42da473b7dd63bb55629a8adbbce2aecfb4eed3797d5d8b917254548cf4b5fe684a9e01db73de9d28bc04d8e0b68b8fada6c015b
SSDEEP 98304:6YkEr6ZyvH22SsaNYfdPBldt6+dBcjHk/bzMIbzZ/IbzZR:rW0Y7jsbzPej
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

frp.deitie.asia:5555

Mutex

b827dda2-f30e-4465-be3c-2f1d6a93d4a7

Attributes

encryption_key
465C04B3B0E08D663A071A4F330370E7A7DAD7A4
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 16 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000231e7-3.dat	family_quasar
behavioral2/memory/5092-4-0x0000000000530000-0x0000000000854000-memory.dmp	family_quasar
behavioral2/files/0x000c0000000231e7-2.dat	family_quasar
behavioral2/files/0x0006000000023201-12.dat	family_quasar
behavioral2/files/0x0006000000023201-9.dat	family_quasar
behavioral2/files/0x0006000000023201-10.dat	family_quasar
behavioral2/files/0x0006000000023201-24.dat	family_quasar
behavioral2/files/0x0006000000023201-33.dat	family_quasar
behavioral2/files/0x0006000000023201-41.dat	family_quasar
behavioral2/files/0x0006000000023201-49.dat	family_quasar
behavioral2/files/0x0006000000023201-65.dat	family_quasar
behavioral2/files/0x0006000000023201-73.dat	family_quasar
behavioral2/files/0x0006000000023201-81.dat	family_quasar
behavioral2/files/0x0006000000023201-89.dat	family_quasar
behavioral2/files/0x0006000000023201-97.dat	family_quasar
behavioral2/files/0x0006000000023201-105.dat	family_quasar

Detects Windows executables referencing non-Windows User-Agents 16 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000231e7-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/5092-4-0x0000000000530000-0x0000000000854000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000c0000000231e7-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-12.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-9.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-24.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-33.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-41.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-49.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-65.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-73.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-81.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-89.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-97.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x0006000000023201-105.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 16 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000231e7-3.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5092-4-0x0000000000530000-0x0000000000854000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x000c0000000231e7-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-12.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-9.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-10.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-24.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-33.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-41.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-49.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-65.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-73.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-81.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-89.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-97.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0006000000023201-105.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing common artifacts observed in infostealers 16 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000231e7-3.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/memory/5092-4-0x0000000000530000-0x0000000000854000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x000c0000000231e7-2.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-12.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-9.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-10.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-24.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-33.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-41.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-49.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-65.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-73.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-81.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-89.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-97.dat	INDICATOR_SUSPICIOUS_GENInfoStealer
behavioral2/files/0x0006000000023201-105.dat	INDICATOR_SUSPICIOUS_GENInfoStealer

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	Client.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client_built.exe	2024-02-06_c52548ea62ad228bc675b6e459c449c2_icedid_xrat.exe

Executes dropped EXE 16 IoCs

pid	Process
5092	Client_built.exe
5000	Client.exe
4324	Client.exe
4672	Client.exe
4732	Client.exe
4176	Client.exe
3656	Client.exe
3964	Client.exe
5112	Client.exe
968	Client.exe
3668	Client.exe
2612	Client.exe
3044	Client.exe
2028	Client.exe
4472	Client.exe
1668	Client.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File created	C:\Windows\system32\SubDir\Client.exe	Client_built.exe
File opened for modification	C:\Windows\system32\SubDir	Client_built.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client_built.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir\Client.exe	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe
File opened for modification	C:\Windows\system32\SubDir	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
4468	PING.EXE
3316	PING.EXE
2376	PING.EXE
4992	PING.EXE
4376	PING.EXE
4300	PING.EXE
3660	PING.EXE
3552	PING.EXE
3008	PING.EXE
1600	PING.EXE
2132	PING.EXE
4836	PING.EXE
556	PING.EXE
1460	PING.EXE
4924	PING.EXE

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	Client_built.exe
Token: SeDebugPrivilege	5000	Client.exe
Token: SeDebugPrivilege	4324	Client.exe
Token: SeDebugPrivilege	4672	Client.exe
Token: SeDebugPrivilege	4732	Client.exe
Token: SeDebugPrivilege	4176	Client.exe
Token: SeDebugPrivilege	3656	Client.exe
Token: SeDebugPrivilege	3964	Client.exe
Token: SeDebugPrivilege	5112	Client.exe
Token: SeDebugPrivilege	968	Client.exe
Token: SeDebugPrivilege	3668	Client.exe
Token: SeDebugPrivilege	2612	Client.exe
Token: SeDebugPrivilege	3044	Client.exe
Token: SeDebugPrivilege	2028	Client.exe
Token: SeDebugPrivilege	4472	Client.exe
Token: SeDebugPrivilege	1668	Client.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3664	2024-02-06_c52548ea62ad228bc675b6e459c449c2_icedid_xrat.exe
3664	2024-02-06_c52548ea62ad228bc675b6e459c449c2_icedid_xrat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 5092	3664	2024-02-06_c52548ea62ad228bc675b6e459c449c2_icedid_xrat.exe	86
PID 3664 wrote to memory of 5092	3664	2024-02-06_c52548ea62ad228bc675b6e459c449c2_icedid_xrat.exe	86
PID 5092 wrote to memory of 5000	5092	Client_built.exe	87
PID 5092 wrote to memory of 5000	5092	Client_built.exe	87
PID 5000 wrote to memory of 3792	5000	Client.exe	90
PID 5000 wrote to memory of 3792	5000	Client.exe	90
PID 3792 wrote to memory of 4924	3792	cmd.exe	89
PID 3792 wrote to memory of 4924	3792	cmd.exe	89
PID 3792 wrote to memory of 2376	3792	cmd.exe	91
PID 3792 wrote to memory of 2376	3792	cmd.exe	91
PID 3792 wrote to memory of 4324	3792	cmd.exe	99
PID 3792 wrote to memory of 4324	3792	cmd.exe	99
PID 4324 wrote to memory of 2736	4324	Client.exe	103
PID 4324 wrote to memory of 2736	4324	Client.exe	103
PID 2736 wrote to memory of 4884	2736	cmd.exe	101
PID 2736 wrote to memory of 4884	2736	cmd.exe	101
PID 2736 wrote to memory of 1460	2736	cmd.exe	100
PID 2736 wrote to memory of 1460	2736	cmd.exe	100
PID 2736 wrote to memory of 4672	2736	cmd.exe	104
PID 2736 wrote to memory of 4672	2736	cmd.exe	104
PID 4672 wrote to memory of 1672	4672	Client.exe	106
PID 4672 wrote to memory of 1672	4672	Client.exe	106
PID 1672 wrote to memory of 4376	1672	cmd.exe	108
PID 1672 wrote to memory of 4376	1672	cmd.exe	108
PID 1672 wrote to memory of 4992	1672	cmd.exe	107
PID 1672 wrote to memory of 4992	1672	cmd.exe	107
PID 1672 wrote to memory of 4732	1672	cmd.exe	110
PID 1672 wrote to memory of 4732	1672	cmd.exe	110
PID 4732 wrote to memory of 4944	4732	Client.exe	114
PID 4732 wrote to memory of 4944	4732	Client.exe	114
PID 4944 wrote to memory of 3192	4944	cmd.exe	113
PID 4944 wrote to memory of 3192	4944	cmd.exe	113
PID 4944 wrote to memory of 2132	4944	cmd.exe	112
PID 4944 wrote to memory of 2132	4944	cmd.exe	112
PID 4944 wrote to memory of 4176	4944	cmd.exe	115
PID 4944 wrote to memory of 4176	4944	cmd.exe	115
PID 4176 wrote to memory of 3140	4176	Client.exe	117
PID 4176 wrote to memory of 3140	4176	Client.exe	117
PID 3140 wrote to memory of 1504	3140	cmd.exe	119
PID 3140 wrote to memory of 1504	3140	cmd.exe	119
PID 3140 wrote to memory of 4924	3140	cmd.exe	118
PID 3140 wrote to memory of 4924	3140	cmd.exe	118
PID 3140 wrote to memory of 3656	3140	cmd.exe	120
PID 3140 wrote to memory of 3656	3140	cmd.exe	120
PID 3656 wrote to memory of 712	3656	Client.exe	122
PID 3656 wrote to memory of 712	3656	Client.exe	122
PID 712 wrote to memory of 4884	712	cmd.exe	124
PID 712 wrote to memory of 4884	712	cmd.exe	124
PID 712 wrote to memory of 4836	712	cmd.exe	123
PID 712 wrote to memory of 4836	712	cmd.exe	123
PID 712 wrote to memory of 3964	712	cmd.exe	125
PID 712 wrote to memory of 3964	712	cmd.exe	125
PID 3964 wrote to memory of 436	3964	Client.exe	127
PID 3964 wrote to memory of 436	3964	Client.exe	127
PID 436 wrote to memory of 1472	436	cmd.exe	129
PID 436 wrote to memory of 1472	436	cmd.exe	129
PID 436 wrote to memory of 556	436	cmd.exe	128
PID 436 wrote to memory of 556	436	cmd.exe	128
PID 436 wrote to memory of 5112	436	cmd.exe	130
PID 436 wrote to memory of 5112	436	cmd.exe	130
PID 5112 wrote to memory of 2972	5112	Client.exe	132
PID 5112 wrote to memory of 2972	5112	Client.exe	132
PID 2972 wrote to memory of 2324	2972	cmd.exe	134
PID 2972 wrote to memory of 2324	2972	cmd.exe	134

C:\Users\Admin\AppData\Local\Temp\2024-02-06_c52548ea62ad228bc675b6e459c449c2_icedid_xrat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-06_c52548ea62ad228bc675b6e459c449c2_icedid_xrat.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client_built.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\/Client_built.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\SubDir\Client.exe
    "C:\Windows\system32\SubDir\Client.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\W8SZOPOeCehS.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:2376
    - - C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4324
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OgohJyhO5Lrn.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P0Wc30bLCgls.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:4992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:4376
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H7qn1pblKUIZ.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TlOYqKEqJcIp.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3140
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:4924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1504
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dS9O9FhHE7q4.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:4836
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:4884
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nM4gNeP5tqF0.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1472
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        17⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OwMCkl2t1lIo.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        Runs ping.exe
        
        PID:4468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:2324
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        19⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:968
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LsqUadZ3PX6T.bat" "
        20⤵
        
        PID:4756
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:3552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:1116
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        21⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9sOXAdCaPuxg.bat" "
        22⤵
        
        PID:1884
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:4300
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4284
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        23⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gJ3kknmWZnMe.bat" "
        24⤵
        
        PID:2452
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        Runs ping.exe
        
        PID:3008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:232
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        25⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:3044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BRp5HyLHaJWR.bat" "
        26⤵
        
        PID:4324
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        Runs ping.exe
        
        PID:1600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:3416
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        27⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H0eX8jwBUawQ.bat" "
        28⤵
        
        PID:2532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        Runs ping.exe
        
        PID:3660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:3944
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        29⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PtAwkctGIYBe.bat" "
        30⤵
        
        PID:2736
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        31⤵
        Runs ping.exe
        
        PID:3316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:3604
        
        C:\Windows\system32\SubDir\Client.exe
        
        "C:\Windows\system32\SubDir\Client.exe"
        31⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EkmHFbQg5NUA.bat" "
        32⤵
        
        PID:976
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        33⤵
        Runs ping.exe
        
        PID:4376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:3680

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:4924

C:\Windows\system32\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:1460

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:4884

C:\Windows\system32\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:2132

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

9sOXAdCaPuxg.bat

Path C:\Users\Admin\AppData\Local\Temp\9sOXAdCaPuxg.bat
Size 196B
SHA256 4b97e35fec6602240c80706b45cb13481afb5cf142f68ecd127943ebedaf64d7
MD5 e20c43d7b1e15b9e9179591058b49f2e
SHA1 1d680a878b22eb489705dd0577cd6beebff8b368
SHA512 8b1fea99cb9265d3562d448d3bc47873ceed5aa4dfb0a3c518d240c9e74c50f16cc3fcddd412fd912c996020f00b585c2d028a623ca9fd481118820274591bce
MD5 SHA1 SHA512

Submit Download

BRp5HyLHaJWR.bat

Path C:\Users\Admin\AppData\Local\Temp\BRp5HyLHaJWR.bat
Size 196B
SHA256 2cc2b347bcc8be3de94c2376990be79f88641e48f4df97c5eb81598c53b45c21
MD5 035d10137b87f0df118dfe9b4b9d0393
SHA1 dba48e6e22dfe756339875c2b343288293b2d05b
SHA512 fb438b761d0f72226ed152f66c99e2747b651eb9367ed2b56c26369489ce0a627dc30d89dfcb29a7e9c8f6a82776da81433db93ef08019012f612403a53e4ecf
MD5 SHA1 SHA512

Submit Download

EkmHFbQg5NUA.bat

Path C:\Users\Admin\AppData\Local\Temp\EkmHFbQg5NUA.bat
Size 196B
SHA256 76685fb582cec184409cc41643da775a495b92c43bf04b9ce474707e6ac33639
MD5 db100a38465597af5ffd59c05ca21fec
SHA1 e279fd03d6480d6516a0641041172fd096914ca9
SHA512 7474e15256046d318c110ab383ed317d05f49833e86e088b9e9ab3c0c836bdd5234038afb6883c1a42640dd0a387e63c1803877ff4502be38e85dd008c6a4fb4
MD5 SHA1 SHA512

Submit Download

H0eX8jwBUawQ.bat

Path C:\Users\Admin\AppData\Local\Temp\H0eX8jwBUawQ.bat
Size 196B
SHA256 c0b6e4141c78a792c33c0db1ca148e8704196fe522187dd0a74afa9d851914a4
MD5 888a71849aedc3b362b27864074eef76
SHA1 19e5cc48d9ed5453f4e78cecc7f89e0218fd4d85
SHA512 a1e6e1f6eae5b16c59e4602fad6ee6d6787d20b147c1cb65706d58685b75b720f074a3b2a021abaeb163f65eaae26db19194ef6ffd0315d9a442ce1394059e44
MD5 SHA1 SHA512

Submit Download

H7qn1pblKUIZ.bat

Path C:\Users\Admin\AppData\Local\Temp\H7qn1pblKUIZ.bat
Size 196B
SHA256 fc927a7a8c8e95efdbeffca42ba10ae799d238711c2cfa2d8907cb874a51e081
MD5 cde6ad332dccf2c3c35d18b473d5fbaa
SHA1 d81fa5998e59bbcd9eeb677873ccdd3cac3ea6b9
SHA512 56e0332eb399f24201da1ac187029c89260e6cb3f40d7531bf701efa3e9858f8ec9dd412a11cbd9eb90a7af2058ae28772be4218c6af20b37c2bf33e6a025ff8
MD5 SHA1 SHA512

Submit Download

LsqUadZ3PX6T.bat

Path C:\Users\Admin\AppData\Local\Temp\LsqUadZ3PX6T.bat
Size 196B
SHA256 ff5546423ecc5ff5c5a99c9d21d15a51816ccf42ede09848f660be75aaf0b822
MD5 629f9e8e048d54593817e6ac5400272b
SHA1 d307b4ef286d713ba75e03b32810e1f90ef1cb39
SHA512 335066fa07cf26eb4628b03dcaf66659c0c0b4930e0ef0657e651370c73fc5a99db8b955144a4f9eb9c381632a9f95a3a4acb9a92bdd2f11a0d2e97ef01a5d37
MD5 SHA1 SHA512

Submit Download

OgohJyhO5Lrn.bat

Path C:\Users\Admin\AppData\Local\Temp\OgohJyhO5Lrn.bat
Size 196B
SHA256 caffc4ddfaac2effa98d01326f9216c729608fd47e7ec79671c12296e7c3cf2b
MD5 3b7f32acbeb387f0b222a10a91c67abb
SHA1 9d437c62af883f34e06b684cc760f0c1c84ff9f5
SHA512 084b7acc627dfd670c5c8866b4a48a76992620ebda79ef870fab42850ce074c6f98900b39c81d7bd6d5eaba23f24e89196009bacad6240936ac50114c8b6d93a
MD5 SHA1 SHA512

Submit Download

OwMCkl2t1lIo.bat

Path C:\Users\Admin\AppData\Local\Temp\OwMCkl2t1lIo.bat
Size 196B
SHA256 66f4c29ccda992f5920659805bc0b1f0906df34c163d67ccde6dd76ea88e5fde
MD5 ee0661e0a8c18439f8ffe75a480ffe27
SHA1 77536196542193e541fa828905335f396ccd2995
SHA512 b5637a3283b5c3a3abbf0177d430e78acf5a17c82faa179876cbdda8b30401619dc359b0c963688adde1c102316ef62353dab736a0ba0d19917599f0d4758214
MD5 SHA1 SHA512

Submit Download

P0Wc30bLCgls.bat

Path C:\Users\Admin\AppData\Local\Temp\P0Wc30bLCgls.bat
Size 196B
SHA256 027b8f1036f0074c795e91528a071ae660598bccd74d3b77ef9b6ee8de735702
MD5 17d8eb993549e304127375bb54b3c441
SHA1 af9d3cf05f200ceac33bc9533381a89808b9e947
SHA512 59dee34edd49587900803a24083175c7b1ad9620ec515f209237c3ae17ca4146adb6a1515ac87dfb56e1682951f34f64bb598dee2b3b0db2880907f07d2f8b51
MD5 SHA1 SHA512

Submit Download

PtAwkctGIYBe.bat

Path C:\Users\Admin\AppData\Local\Temp\PtAwkctGIYBe.bat
Size 196B
SHA256 81c4e952119b08e7d3b8ab3be6aa6c4fda1d5df18c939ba43d05d7267cf0e6ad
MD5 b68639ebbfc08efd9608b822d33e19c0
SHA1 03fc299ef0feb87a23a043bb2ac5a0ff4736490e
SHA512 03fee9099c2d58d0d280d4be1fbfb64c36935caa6becd26650300482d9d794c023eb0426ee2267c114c5eb02ec655106e68c5bf7d19fb13f25da053367f9b53b
MD5 SHA1 SHA512

Submit Download

TlOYqKEqJcIp.bat

Path C:\Users\Admin\AppData\Local\Temp\TlOYqKEqJcIp.bat
Size 196B
SHA256 269a672aa137384baabe9819d5ec00a558f8e0e45bd8456e79a0192adf6632f1
MD5 4668ab3f383805af369c160dc488c2db
SHA1 905862330796c0d6441087e2ccf53d969ff910cd
SHA512 90bf5fac116ef508bca8c429ed033f584c30689a04529c66a27b047f9be804fa2ce88de48be3065426a994928dac9e9f1cf04ac2c5d10543dd8f613d0ff8361e
MD5 SHA1 SHA512

Submit Download

W8SZOPOeCehS.bat

Path C:\Users\Admin\AppData\Local\Temp\W8SZOPOeCehS.bat
Size 196B
SHA256 0d7c7919728fbf51816bcd02a3a0d9d4e0aac316c8315c41fb473eac2dd16618
MD5 2336444aa4c0c9121e1df618456ce720
SHA1 77d364a1a2ed011df97a9f26ca6d8d88e5ebcaf6
SHA512 e6b8eb167995ba6d4a39440bf744cb143bb285eba91e9b8ba53346b0237847005beaac2ce7593dd79a980bc0561d32a52822e3f9f83a561afeee27ed037d2736
MD5 SHA1 SHA512

Submit Download

dS9O9FhHE7q4.bat

Path C:\Users\Admin\AppData\Local\Temp\dS9O9FhHE7q4.bat
Size 196B
SHA256 0e72f0d4b0a4b9509af6886b42bc3632fcbc08aad3f07e1f712ea5428cea33f3
MD5 fa01d61e92ed3cae691f8cb467599267
SHA1 6d517f8f5d60011ca978241265f02e8f50d93a63
SHA512 650e933d285df793deebd938c4b3110adf54b0abf04ac28641224330266cda9e5c6bfde8be9cfcdcfa2a519b4a24c13fffee8afc1bbd5ecc6712773b22b00022
MD5 SHA1 SHA512

Submit Download

gJ3kknmWZnMe.bat

Path C:\Users\Admin\AppData\Local\Temp\gJ3kknmWZnMe.bat
Size 196B
SHA256 88652ef3e8bc947bd70bfddb226c330ed1e188a0912a2c7af5123dda5abb6f05
MD5 221864b57f03ee02a5f9be6183908467
SHA1 7c3cd62a98e5a34b7adefd76e88a897fc28911b6
SHA512 fcf238dd011bbaa30ebec292eb1ea476399c488289d7a75ac94f9118cbdeb2d32a0266c1b6b609137669332a4eb2681b611322db3ea77e333096df903be0318d
MD5 SHA1 SHA512

Submit Download

nM4gNeP5tqF0.bat

Path C:\Users\Admin\AppData\Local\Temp\nM4gNeP5tqF0.bat
Size 196B
SHA256 fcf19b88fae768e6a70c023631311891589c6e1cc889c553a98a76523e133463
MD5 af951367e79f72e8d77f7c47de7763a4
SHA1 e53506ae3607b8fd28dd905ce94463ff9c8d7813
SHA512 e98770a99c22dbc5ee965388bb3b98388a3bd5923df2d1e611be11bb7ca5d9796d77e18e313027ea7d38d51c3748d86ec301262c444ad60de5d550bd70e5a2c6
MD5 SHA1 SHA512

Submit Download

Client_built.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client_built.exe
Size 424KB
SHA256 8add4d2cae47ded66d5f3292e041c2ac89424a0468fc42fc8e24b7e145cf698d
MD5 a5f699c305ccf4527760dd56b04084f9
SHA1 0ac2a4c5b1a602095cf783d943b2dcab490aae32
SHA512 330e256e8ce603601299e120ba3c78389aca62bc3d6baae16e586937d632bbeaaeed6d6cc5dfb59e1a992022799414fc12066cdb8d81628e89e2f186155c5704
SSDEEP 6144:2cvgMzKM4ojzT+g5y3DZDDFh3kwJjOGPxf3YWLCazTYJBCnLuTHWz7P:9vgMzKMZqg5y3Dx59tOGPxf5C5i7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client_built.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client_built.exe
Size 465KB
SHA256 cc25b9c2030d6b0908279cbc13f963140818fcac3479cf580c3134e9c75423c1
MD5 e2bc39029155d4841ff2a6ddf2b77ecb
SHA1 f08486100ee04226cf914d6602f61e63e65cf31b
SHA512 ffcc34bd1cda55f5dff74f00b8df012332e14cd54f71b9e45f0f8544b5e14db6323d419557d9ffb11382fb5b77ae4f04309216fa671297918fb35449ff3921be
SSDEEP 6144:2cvgMzKM4ojzT+g5y3DZDDFh3kwJjOGPxf3YWLCazTYJBCnLuTHWz7MbT:9vgMzKMZqg5y3Dx59tOGPxf5C5i43
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 380KB
SHA256 4ac0b1adfd869841b8e9ac1369eb6e96fde3b7ddfb2f93b3f5434a177aa8df9e
MD5 2a6f73fa8f6b75de859710d2c0996585
SHA1 bba40069b6caedb61f7fa4fc16fc8f1bb8482ca5
SHA512 6128d99b8c7c34ed362c9bf1f5c2d796a20834befdf1be7435fe7e1173dc171768255efe12c78e9a314972f02043ccb5a80fbdefa3dd9750da2c1a641b906d9d
SSDEEP 6144:2cvgMzKM4ojzT+g5y3DZDDFh3kwJjOGPxf3YWLCazTYJBCnLuTL:9vgMzKMZqg5y3Dx59tOGPxf5CF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 3.0MB
SHA256 4243a68c15917cd1c7721f05c9215424ab85bed7481cdfceb78aabcfb72d7b3d
MD5 1ec3b8808c07ecf22af09f07e4aa5e0c
SHA1 faa2032ba1b33d7e302129a27a95c897bc021c30
SHA512 8117b97b04e966d445a31d29dc8fb233f0b7dbf3375667835284b3303bc7c8ffa064a94fb2b9291405c2d945b817b575609ffc154c4c111ea43d10c9128698f7
SSDEEP 49152:LvqI22SsaNYfdPBldt698dBcjH2F/qBxELoGdDy0THHB72eh2NTH:LvH22SsaNYfdPBldt6+dBcjHk/bzO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 358KB
SHA256 01f21c76229a3d2e56e48a8e77cde79778a18e3809662f430a6079c5818696e6
MD5 e29954766c5f888208e95c64be863839
SHA1 843d076d5b614789698e2ed71f161c8e3ef7ef71
SHA512 ae28bfd608330e63fe8200d56d5ff2b4757c70af1b943d4ae641dc98dd7d9e9a44ca3907f49f759cd118712976312dbdc428efd0513f425282fadc16380dad5d
SSDEEP 6144:2cvgMzKM4ojzT+g5y3DZDDFh3kwJjOGPxf3YWLCazTYJBCne:9vgMzKMZqg5y3Dx59tOGPxf5Cz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 1.1MB
SHA256 28b27bc892b5c9e42bdea9c692c7760213290cb73a1acd5f69f1b0867208fc90
MD5 82d5eff86b0fa10414f4030e8ff42fa8
SHA1 935d801483a5d5a0c745b4378ed98f65ff4c34ce
SHA512 07a201fb8529a9b78674905dc7b33bd99312395c1681f4a8c46a178c58ec94e0f24696f5f8f523289bd2a6a422bfd270f24ead27b93bdf60fc1f190545a0e1ab
SSDEEP 24576:LvopIA4Wnh2ShqaNYjjjhPBl/lt6/l8Ima:LvqI22SsaNYfdPBldt698da
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 378KB
SHA256 9f17caee3689b0b181656f3267dcc3a46a254f3b7f2285ab64385ceac85cc1e4
MD5 9733b91685ce568f283c59ea5d27e1ba
SHA1 88f4052d435f63130e7873eb7ede5c8818aff8e9
SHA512 74976c812bc23fcd9a66bab867972cccb18f728d683a4d4146d6e71094df81bef56bb9eec0abc691fe737d1df7004e15b84b3ded5f8efe372d60a5624f29bd90
SSDEEP 6144:2cvgMzKM4ojzT+g5y3DZDDFh3kwJjOGPxf3YWLCazTYJBCnLuTT:9vgMzKMZqg5y3Dx59tOGPxf5CJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 3.1MB
SHA256 f5e916891cb6585fb06e655518a64223aae96691f77e768398b32bfd7d9a90e0
MD5 546753310f8867172388cc779b44c1bf
SHA1 a77c47e2d192c1a6af257a2f5edea4cfefefc76b
SHA512 feef354fb21f4bcf5b84d1dbfb5be6754e51c9d18167fe00d01548f4bb8bf0a6f9edc1130a869da3072aa1a65d792017c766045a53a2822ee000f341d0417adc
SSDEEP 49152:LvqI22SsaNYfdPBldt698dBcjH2F/qBxELoGdDy0THHB72eh2NT:LvH22SsaNYfdPBldt6+dBcjHk/bz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 904KB
SHA256 d355fc405b6d9f14af1697c7c5bc3b85fd0f20cfadce75fbfbb4fadec1e96f91
MD5 ba60ccf947bfefc84b736fb8953367b6
SHA1 33ec3e386ccb60c5f8b78240eb34e9064be14258
SHA512 2a41b944e7705138ced7450d739cf06f938104accb8bce16972647f1c1e3f42195e5998120ef90a809d67d1afbc95610fc762f26c8af54647dff26f70ee186eb
SSDEEP 12288:9vgMzKMZqg5y3Dx59tOGPxf5C5i4Wd95D2InhsygA4c4JS3qaNYjjM0v:LvopIA4Wnh2ShqaNYjjjv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 2.5MB
SHA256 3ebfcf78a1c74d96b1569395ef5570a5a4f4169697fbd20316d7e2ce62b619c4
MD5 bd765ce88b2d440171567d8df73e0e13
SHA1 08b9684c92945dcccaf65f4dbdf78ca771a80cb4
SHA512 151b04f288a556e5650ed3989daf3157bd8e673e11aba22eefdeec35a25f1f2fc24791f2dfe6b8cbdd11cb1eff7bb483f81ba77286bac0b0131ea2d58345ef18
SSDEEP 49152:LvqI22SsaNYfdPBldt698dBcjH2F/qBxELoGC:LvH22SsaNYfdPBldt6+dBcjHk/bQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 2.7MB
SHA256 39a7254d1634eb671fed90e902eebbebd2128407425fe782131ba668db555813
MD5 6281bd497ead9c14314ec0f2a02a6c6e
SHA1 68e371f232da8a616be1c6c47c328b18bfb00a7f
SHA512 bd8b0c3014f18e19da34442146e953af0ddca868e31c548568c52f732e35ce872aada49fec7d3ddd064db8adfbfd9f4cd9513f9081b4799bf95eb3094708e92a
SSDEEP 49152:LvqI22SsaNYfdPBldt698dBcjH2F/qBxELoGdDy0m:LvH22SsaNYfdPBldt6+dBcjHk/bzY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 3.0MB
SHA256 aee590fb68daf3196f469a7f35ea5d5004af81f559d3aed24d73c2b316183195
MD5 a9fa202ee88d7e12d160af16ee985d07
SHA1 aa7fff49a8bd2be8f4ebc42398d4754c34d107b8
SHA512 d0173c3ec36b1028ef69ed48d8b0e2ed56528f32fa11cd3c36f6a6a408d6d7c106eceef9dd5f8f67960ebfc3180d2be960791c1ea7208e7a56e79483f353e1d9
SSDEEP 49152:LvqI22SsaNYfdPBldt698dBcjH2F/qBxELoGdDy0THHB72eh2Nn:LvH22SsaNYfdPBldt6+dBcjHk/bzG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 338KB
SHA256 9d45af6ef09cc242b487b58fee2100bcaf40d642afc4c6415faeede8d8e89e7a
MD5 2219330529e6c10be20e2afef510d477
SHA1 70ca8bd1873d772d6075e027c4762a089043b7fa
SHA512 0b4384847c1170dbd093450b3956317a84aa3a1920884c32d5c7472d79b3d8ca530343f864d66320116fbf33c1c49418ca7aa450faf3c0b14ba71ad18b822da5
SSDEEP 6144:2cvgMzKM4ojzT+g5y3DZDDFh3kwJjOGPxf3YWLCazTI:9vgMzKMZqg5y3Dx59tOGPxf5CP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\System32\SubDir\Client.exe
Size 2.9MB
SHA256 7145695abcd682affd8ef0c0eb5bd80e942caeaf52b4babc92987bdb26ae041a
MD5 b349fc04b65f8dd8010bc49f670e44f7
SHA1 14bae9bfd7b3427f7eda92561d51112ca0ddad79
SHA512 d58b0ac6d9d0f5031d276f1abf8281ceb8b9e949cf5186e95b157457db201e18cf18ca1e066e720cb7238db841ad6d237df092fc55207286ecb810c65d4edb7f
SSDEEP 49152:LvqI22SsaNYfdPBldt698dBcjH2F/qBxELoGdDy0THHBd:LvH22SsaNYfdPBldt6+dBcjHk/bzN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client.exe

Path C:\Windows\system32\SubDir\Client.exe
Size 271KB
SHA256 aa495c43f22f544ad268201b70154141333ebb319a3719e1a7fc627261e1c076
MD5 70ac47d3abb033e8b1ad56a8aa7ca82f
SHA1 bcfb49e05b0f2d494ab94647d8cc2fb50afe8b50
SHA512 203c2f380976806479df681f3e43a8fbd377aadc047dd91d02032dab610511b94b49e514a80472cf4f19608cfb47cc7d2c42f3be76d4536ac70dce879e7dc97b
SSDEEP 6144:2cvgMzKM4ojzT+g5y3DZDDFh3kwJjOGPxf3YWO:9vgMzKMZqg5y3Dx59tOGPxf4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/968-88-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/968-83-0x0000000001180000-0x0000000001190000-memory.dmp

Download

memory/968-82-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/1668-130-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/1668-131-0x0000000001510000-0x0000000001520000-memory.dmp

Download

memory/1668-136-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/2028-120-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/2028-114-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/2028-115-0x000000001B830000-0x000000001B840000-memory.dmp

Download

memory/2612-98-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/2612-104-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/2612-99-0x000000001B130000-0x000000001B140000-memory.dmp

Download

memory/3044-112-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/3044-106-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/3044-107-0x00000000033B0000-0x00000000033C0000-memory.dmp

Download

memory/3656-64-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/3656-59-0x000000001B050000-0x000000001B060000-memory.dmp

Download

memory/3656-58-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/3668-96-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/3668-91-0x0000000003180000-0x0000000003190000-memory.dmp

Download

memory/3668-90-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/3964-66-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/3964-72-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/3964-67-0x000000001B600000-0x000000001B610000-memory.dmp

Download

memory/4176-51-0x000000001BB00000-0x000000001BB10000-memory.dmp

Download

memory/4176-50-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/4176-56-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/4324-26-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/4324-32-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/4324-27-0x0000000000B10000-0x0000000000B20000-memory.dmp

Download

memory/4472-122-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/4472-123-0x0000000002720000-0x0000000002730000-memory.dmp

Download

memory/4472-128-0x00007FFF96670000-0x00007FFF97131000-memory.dmp

Download

memory/4672-34-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/4672-40-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/4672-35-0x0000000002590000-0x00000000025A0000-memory.dmp

Download

memory/4732-42-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/4732-43-0x0000000002C40000-0x0000000002C50000-memory.dmp

Download

memory/4732-47-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/5000-15-0x000000001BB70000-0x000000001BB80000-memory.dmp

Download

memory/5000-23-0x00007FFF96900000-0x00007FFF973C1000-memory.dmp

Download

memory/5000-16-0x000000001BB00000-0x000000001BB50000-memory.dmp

Download

memory/5000-17-0x000000001BD30000-0x000000001BDE2000-memory.dmp

Download

memory/5000-13-0x00007FFF96900000-0x00007FFF973C1000-memory.dmp

Download

memory/5092-14-0x00007FFF96900000-0x00007FFF973C1000-memory.dmp

Download

memory/5092-5-0x00007FFF96900000-0x00007FFF973C1000-memory.dmp

Download

memory/5092-6-0x000000001B690000-0x000000001B6A0000-memory.dmp

Download

memory/5092-4-0x0000000000530000-0x0000000000854000-memory.dmp

Download

memory/5112-75-0x000000001B2F0000-0x000000001B300000-memory.dmp

Download

memory/5112-74-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

memory/5112-80-0x00007FFF96550000-0x00007FFF97011000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads