quasar | 5f1ded6b39eecb4e4575ce1150a7d665a5c2a2df6a98ff331d586c13cdb1340e

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 21:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240406-1hta8scd94
SHA256 5f1ded6b39eecb4e4575ce1150a7d665a5c2a2df6a98ff331d586c13cdb1340e
MD5 3b48c30ba23cb29292137d95f1712461
SHA1 af660f0cbb50a5af4dcfc1f00821737bf90dc095
SHA512 b054f3a1f9118cca872560e28fc4cf9de10b9edc0c27a529fc07b835c82d0c5e53fad2e589950dcc1982c22f97ff85060c3bd258a00234cbf6620f0c73cdf1a7
SSDEEP 49152:tvaET2mbaBm3/PxlL/uJIXpQ1H4CC1JbLoGdSu50THHB72eh2NT:tvDT2mbaBm3/PxlL/u+XpQ1H4Ce
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

Enslotheya-26488.portmap.io:26488
Enslotheya-26488.portmap.io:4782
Enslotheya-26934.portmap.io:4782
Enslotheya-26934.portmap.io:26934
That1funnykid-39791.portmap.io:4782:4782
That1funnykid-39791.portmap.io:4782

Mutex

ec2ccd18-ac18-48f3-9617-54036c5add5d

Attributes

encryption_key
796C698C50C0E8D256FFF2870E20F871851BAB42
install_name
SubDir.exe
log_directory
Logs
reconnect_delay
1000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2116-0-0x0000000000D00000-0x0000000001024000-memory.dmp	family_quasar
behavioral2/files/0x000700000002320a-6.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	SubDir.exe

Executes dropped EXE 15 IoCs

pid	Process
2352	SubDir.exe
1700	SubDir.exe
3016	SubDir.exe
808	SubDir.exe
3408	SubDir.exe
3664	SubDir.exe
4376	SubDir.exe
1580	SubDir.exe
2960	SubDir.exe
3632	SubDir.exe
3908	SubDir.exe
380	SubDir.exe
3404	SubDir.exe
4488	SubDir.exe
1516	SubDir.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
2632	PING.EXE
2528	PING.EXE
1408	PING.EXE
1164	PING.EXE
3992	PING.EXE
744	PING.EXE
1156	PING.EXE
4304	PING.EXE
2892	PING.EXE
944	PING.EXE
1752	PING.EXE
4852	PING.EXE
556	PING.EXE
4400	PING.EXE
4016	PING.EXE

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	Client-built.exe
Token: SeDebugPrivilege	2352	SubDir.exe
Token: SeDebugPrivilege	1700	SubDir.exe
Token: SeDebugPrivilege	3016	SubDir.exe
Token: SeDebugPrivilege	808	SubDir.exe
Token: SeDebugPrivilege	3408	SubDir.exe
Token: SeDebugPrivilege	3664	SubDir.exe
Token: SeDebugPrivilege	4376	SubDir.exe
Token: SeDebugPrivilege	1580	SubDir.exe
Token: SeDebugPrivilege	2960	SubDir.exe
Token: SeDebugPrivilege	3632	SubDir.exe
Token: SeDebugPrivilege	3908	SubDir.exe
Token: SeDebugPrivilege	380	SubDir.exe
Token: SeDebugPrivilege	3404	SubDir.exe
Token: SeDebugPrivilege	4488	SubDir.exe
Token: SeDebugPrivilege	1516	SubDir.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2352	2116	Client-built.exe	89
PID 2116 wrote to memory of 2352	2116	Client-built.exe	89
PID 2352 wrote to memory of 4616	2352	SubDir.exe	90
PID 2352 wrote to memory of 4616	2352	SubDir.exe	90
PID 4616 wrote to memory of 4232	4616	cmd.exe	92
PID 4616 wrote to memory of 4232	4616	cmd.exe	92
PID 4616 wrote to memory of 556	4616	cmd.exe	93
PID 4616 wrote to memory of 556	4616	cmd.exe	93
PID 4616 wrote to memory of 1700	4616	cmd.exe	101
PID 4616 wrote to memory of 1700	4616	cmd.exe	101
PID 1700 wrote to memory of 932	1700	SubDir.exe	102
PID 1700 wrote to memory of 932	1700	SubDir.exe	102
PID 932 wrote to memory of 1620	932	cmd.exe	104
PID 932 wrote to memory of 1620	932	cmd.exe	104
PID 932 wrote to memory of 1408	932	cmd.exe	105
PID 932 wrote to memory of 1408	932	cmd.exe	105
PID 932 wrote to memory of 3016	932	cmd.exe	106
PID 932 wrote to memory of 3016	932	cmd.exe	106
PID 3016 wrote to memory of 3824	3016	SubDir.exe	107
PID 3016 wrote to memory of 3824	3016	SubDir.exe	107
PID 3824 wrote to memory of 772	3824	cmd.exe	109
PID 3824 wrote to memory of 772	3824	cmd.exe	109
PID 3824 wrote to memory of 4400	3824	cmd.exe	110
PID 3824 wrote to memory of 4400	3824	cmd.exe	110
PID 3824 wrote to memory of 808	3824	cmd.exe	112
PID 3824 wrote to memory of 808	3824	cmd.exe	112
PID 808 wrote to memory of 3080	808	SubDir.exe	113
PID 808 wrote to memory of 3080	808	SubDir.exe	113
PID 3080 wrote to memory of 4980	3080	cmd.exe	115
PID 3080 wrote to memory of 4980	3080	cmd.exe	115
PID 3080 wrote to memory of 2892	3080	cmd.exe	116
PID 3080 wrote to memory of 2892	3080	cmd.exe	116
PID 3080 wrote to memory of 3408	3080	cmd.exe	117
PID 3080 wrote to memory of 3408	3080	cmd.exe	117
PID 3408 wrote to memory of 3984	3408	SubDir.exe	118
PID 3408 wrote to memory of 3984	3408	SubDir.exe	118
PID 3984 wrote to memory of 1656	3984	cmd.exe	120
PID 3984 wrote to memory of 1656	3984	cmd.exe	120
PID 3984 wrote to memory of 744	3984	cmd.exe	121
PID 3984 wrote to memory of 744	3984	cmd.exe	121
PID 3984 wrote to memory of 3664	3984	cmd.exe	122
PID 3984 wrote to memory of 3664	3984	cmd.exe	122
PID 3664 wrote to memory of 556	3664	SubDir.exe	123
PID 3664 wrote to memory of 556	3664	SubDir.exe	123
PID 556 wrote to memory of 1528	556	cmd.exe	125
PID 556 wrote to memory of 1528	556	cmd.exe	125
PID 556 wrote to memory of 1164	556	cmd.exe	126
PID 556 wrote to memory of 1164	556	cmd.exe	126
PID 556 wrote to memory of 4376	556	cmd.exe	127
PID 556 wrote to memory of 4376	556	cmd.exe	127
PID 4376 wrote to memory of 3004	4376	SubDir.exe	128
PID 4376 wrote to memory of 3004	4376	SubDir.exe	128
PID 3004 wrote to memory of 4600	3004	cmd.exe	130
PID 3004 wrote to memory of 4600	3004	cmd.exe	130
PID 3004 wrote to memory of 3992	3004	cmd.exe	131
PID 3004 wrote to memory of 3992	3004	cmd.exe	131
PID 3004 wrote to memory of 1580	3004	cmd.exe	132
PID 3004 wrote to memory of 1580	3004	cmd.exe	132
PID 1580 wrote to memory of 2380	1580	SubDir.exe	133
PID 1580 wrote to memory of 2380	1580	SubDir.exe	133
PID 2380 wrote to memory of 2468	2380	cmd.exe	135
PID 2380 wrote to memory of 2468	2380	cmd.exe	135
PID 2380 wrote to memory of 2632	2380	cmd.exe	136
PID 2380 wrote to memory of 2632	2380	cmd.exe	136

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zdHZZk08axDI.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4232
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:556
  - - C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hVI3jPAd8MoD.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:932
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1620
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:1408
      - C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pQ32qUgLUA21.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:772
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:4400
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QrJaQQPHKmXI.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:2892
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lf5LAWcLUAWs.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1656
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:744
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JQ1NuWSYASo1.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1528
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:1164
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hgmimblu89rY.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4600
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:3992
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GYlCrKUL7ImQ.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2468
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:2632
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XTwdXXXjc01a.bat" "
        19⤵
        
        PID:628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:2528
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r5qazAyTxQUI.bat" "
        21⤵
        
        PID:540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2116
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        Runs ping.exe
        
        PID:4016
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3908
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\p0AdLvpnknDH.bat" "
        23⤵
        
        PID:1448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1968
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        Runs ping.exe
        
        PID:1156
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vA2W70q410CK.bat" "
        25⤵
        
        PID:4492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4612
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        Runs ping.exe
        
        PID:944
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A0YybTJNDsuJ.bat" "
        27⤵
        
        PID:3808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4432
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        Runs ping.exe
        
        PID:1752
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7HRnwjHuTmJ0.bat" "
        29⤵
        
        PID:2460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3512
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        Runs ping.exe
        
        PID:4304
        
        C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A3d7kgXkBdfi.bat" "
        31⤵
        
        PID:1580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:4444
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        Runs ping.exe
        
        PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SubDir.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SubDir.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

7HRnwjHuTmJ0.bat

Path C:\Users\Admin\AppData\Local\Temp\7HRnwjHuTmJ0.bat
Size 207B
SHA256 948b60555a4c2ef1957ec6ee3f972d1ecf80271d9c2483a59e9999be1fb58039
MD5 440beb5b7100e9184984e780ab9fb51b
SHA1 c8644d833cc2bd3711b229d268b33e6d7a732e8d
SHA512 4b222a505430f7737a5995aac501d8558f0cf9cc4b2d222e4a3968c8320c88b459fa587d6863eb84113c12f8baa3d47a6214ffe19ec4a2fd39ed866b55f5a856
MD5 SHA1 SHA512

Submit Download

A0YybTJNDsuJ.bat

Path C:\Users\Admin\AppData\Local\Temp\A0YybTJNDsuJ.bat
Size 207B
SHA256 7a354f6e06afcbad7b49387a971230e6c5425855e3dc24d192ccde747b20bd96
MD5 0a09a40da90b51ceacfda35ef3b5466f
SHA1 ee103323b1111243d7d7fc4ca11b15c18dedd6da
SHA512 4d5097b9a06fd60ff7baf5db1fa5503bd65a5d48bd6676f22ff9771dbc2ccd5990b63efd37260b7e7f57b0f236ff3fd194a7ee352636e55e49fa365918b80d44
MD5 SHA1 SHA512

Submit Download

A3d7kgXkBdfi.bat

Path C:\Users\Admin\AppData\Local\Temp\A3d7kgXkBdfi.bat
Size 207B
SHA256 8331d166e21e625711e9bb6391033eceedfedad78ca55ec3e0a40cd3ee781f3f
MD5 24fb952ce4e929f5d10dfff3a286a9a0
SHA1 ed1604c27be03ead1f6ea871903f74323e5c7062
SHA512 50068e0ecb6b61e48fdaf54de06780a2c5c45bdcc2f7c9aa9b16e6c0ce225f8ea049a076860781b83b6ce3b3240bcd318393446ecefd13ab18ecc9ee96ae33ac
MD5 SHA1 SHA512

Submit Download

GYlCrKUL7ImQ.bat

Path C:\Users\Admin\AppData\Local\Temp\GYlCrKUL7ImQ.bat
Size 207B
SHA256 ac087dc044875f28f1e01abf0bcc41009846e106b7e9eea92df39fe2c1f648c0
MD5 b22a3af3db5c8c6fdbd1252570a1c1d7
SHA1 c5b4560316c6fd9293cff3b9943ded6a406f850c
SHA512 994cf400a55a5dad7a9bc4fcc1a6460966a1aa3a3fb18343183a390d40336861538942255fbdd0dc5f035a1e10068b367c0fc2fd2f129b341c84ffe3fb3443e6
MD5 SHA1 SHA512

Submit Download

Hgmimblu89rY.bat

Path C:\Users\Admin\AppData\Local\Temp\Hgmimblu89rY.bat
Size 207B
SHA256 914254028aa90a206d163144ad7532190de3e82bcd7a56c3b9206dd5a8b677f8
MD5 00bf9c2be6f2b8f029ebe325eb83c984
SHA1 5055aac82e89a5b19480d4410a3afe73604e3203
SHA512 63e21f840009952dad509627ed9a2fd161526c80fa588f39cf26f58f836794dca8e152f351c880ebc39861e00964436c2c92044e497ecb90db57738d244d469d
MD5 SHA1 SHA512

Submit Download

JQ1NuWSYASo1.bat

Path C:\Users\Admin\AppData\Local\Temp\JQ1NuWSYASo1.bat
Size 207B
SHA256 ec2e15b97eeeac5ac843c0cefa97170c8d10e87240ed7f93e482789d19fde221
MD5 ba9f7b68e76d07c760dbcf73b8957e41
SHA1 e977583c966fa09e158f7c7f448b2e336e9a89be
SHA512 9c6f9752f0926e386ffa2e884fc812e10409cdb6689cd94e3cf3a7dd733abf4fb15f427ab16e95a1f95146adb75bb4fe52bd333ebe815e07d91b469e999b2e93
MD5 SHA1 SHA512

Submit Download

QrJaQQPHKmXI.bat

Path C:\Users\Admin\AppData\Local\Temp\QrJaQQPHKmXI.bat
Size 207B
SHA256 ea2e658364715aaf64b7c0c93b3f88b0928c8f74b322801e703ae553afe8810f
MD5 60712cc929dcb7c6db79554e9be62d1a
SHA1 f411382a184059d189c939584904db114ba73d9c
SHA512 3efc16b80639d25ba567ec0caec0acd92bb9491fc1fa444db1a3d7bca2ea067086ecf577579cc83cfc08aebf12e99b2f606fb244b2fc9675304be23437c8be1a
MD5 SHA1 SHA512

Submit Download

XTwdXXXjc01a.bat

Path C:\Users\Admin\AppData\Local\Temp\XTwdXXXjc01a.bat
Size 207B
SHA256 604b50e773a4d4e1c2c2ef1e0130c5fc9e2ec8549cbce6130f71b71f328cbac5
MD5 28e26c406dd6d2f5773122a17ca00c62
SHA1 7cba4a5601386ae4a483f34d99fa39b6a94c4b31
SHA512 396293cd231aefd4272ac963a38e7ef5fff44be2b3909c9640f283dd41922625cd226e1f4d531d3499b9cb1477b089a8a3486640c9e2c52a4c68b97b36a5d9ee
MD5 SHA1 SHA512

Submit Download

hVI3jPAd8MoD.bat

Path C:\Users\Admin\AppData\Local\Temp\hVI3jPAd8MoD.bat
Size 207B
SHA256 ff80bd3dd8b3da8d992d40a6b052822f6f30bf68c9a19bb41d451659f955a7e9
MD5 a1ff8e8b282ec527330e8b1d9051b20b
SHA1 2fc0d84d551e9affbb89ab5095ed6ddda0c27870
SHA512 fde6685705d2d6f238d7411e7c94c510609b178ec6a8f82d2876497ded5f3f15dd3ddee8e911b519ac63fe24265624331c7d717c6556b7835e967cc61fec153e
MD5 SHA1 SHA512

Submit Download

lf5LAWcLUAWs.bat

Path C:\Users\Admin\AppData\Local\Temp\lf5LAWcLUAWs.bat
Size 207B
SHA256 64d0b8df221b798bd95b4a8e802abcbd2b373e10e06a36cbdb9a014b90deb9d8
MD5 f1b03011badfc2b0706e85467f6d1268
SHA1 50afa6f08e8273f4a5bc6dcb0e7639b963f59ff2
SHA512 f70165ae499ad98054ad75f54c977bcbbd5b79014c3f8310a049d206df7fa81c37612971067a460a3e5714d5c44708fd9ac59b41caf361500b542ebf7a7d28b6
MD5 SHA1 SHA512

Submit Download

p0AdLvpnknDH.bat

Path C:\Users\Admin\AppData\Local\Temp\p0AdLvpnknDH.bat
Size 207B
SHA256 233472cd4bc8c823c09b588719896f28548bbb9fb1c7fb372168a0213b68ed95
MD5 39fcb1179e8687b38e34db4462814d04
SHA1 feed37d6a298e229b65fca965fb39af67b555cc4
SHA512 c2b1d48b1d3352dce3db2c5444f76672edfa41674afdc5055439a1c37b1cd129476fa268f2ec4641766bf7211a6c7286677867faa1ff14dde356b366a3a084b0
MD5 SHA1 SHA512

Submit Download

pQ32qUgLUA21.bat

Path C:\Users\Admin\AppData\Local\Temp\pQ32qUgLUA21.bat
Size 207B
SHA256 c603b3e05ce698957212e2bf11e673e0cfc474a7f1f5cc787a2c3a0f2cbab8c6
MD5 d8b7caf9409f5abbf087a8b0295bd2dd
SHA1 b75afa0990c9cee0dbb0e6bde2a7c2b78084239c
SHA512 4313d0cbeb269a971905c24871ef1660f88ef88bc7c4d152a1706f4f70bfad94c2c7e0a4ff471f1ac9047e596194f465c3afb9abaf5df5b468f4dc46bb73c5ed
MD5 SHA1 SHA512

Submit Download

r5qazAyTxQUI.bat

Path C:\Users\Admin\AppData\Local\Temp\r5qazAyTxQUI.bat
Size 207B
SHA256 c7efbba7a67e254986f3e613e88d5dbf49d8224ea8a706de38dd546b9e1133f8
MD5 b64d857362aabde9fe1937737c347137
SHA1 5f8d49ffff6129d8c511725b5399858d78dc60d7
SHA512 5fd97e5cdafa896cfa05fbac5e6154a99e74726527ee8eb5865d8d65cdc932d63a736dc46a29dfa14836531df307daf0400724d2564454c31ec6a22c037f96ab
MD5 SHA1 SHA512

Submit Download

vA2W70q410CK.bat

Path C:\Users\Admin\AppData\Local\Temp\vA2W70q410CK.bat
Size 207B
SHA256 67ab1d2bc18fb89f290ab01a9e829a844dedebd1e5bb87c482e3476648796acb
MD5 b911bdab4d095c038f91966fac203ddb
SHA1 67024cb72e65584c392efc397fef39277503f9e7
SHA512 039a1a7d6e20483b3e0726ba432c66af0884dedd91685efa0f98da73380b1a870de81f25d24d165d9d3e218ad70c9c12c961eb3f051e21231ef609a001a7f7df
MD5 SHA1 SHA512

Submit Download

zdHZZk08axDI.bat

Path C:\Users\Admin\AppData\Local\Temp\zdHZZk08axDI.bat
Size 207B
SHA256 e19e5dfde5868cf83dcbe878fc019f950a36913accc6b0df978523a9969a57f2
MD5 9f3985504ce395d42bc903df43092c9c
SHA1 1dd657e9f0ece1426942e7fc8ac52504a8526bba
SHA512 1a33d3e6ebdeec73f07abef7b40dfd5e195fb40a9ed99acb7545a54a617fe92aab0f3c3a67a94de2aa8160d4d9a5e2283e6d3847dbd5bfcb74909a4493953040
MD5 SHA1 SHA512

Submit Download

SubDir.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\SubDir.exe
Size 3.1MB
SHA256 5f1ded6b39eecb4e4575ce1150a7d665a5c2a2df6a98ff331d586c13cdb1340e
MD5 3b48c30ba23cb29292137d95f1712461
SHA1 af660f0cbb50a5af4dcfc1f00821737bf90dc095
SHA512 b054f3a1f9118cca872560e28fc4cf9de10b9edc0c27a529fc07b835c82d0c5e53fad2e589950dcc1982c22f97ff85060c3bd258a00234cbf6620f0c73cdf1a7
SSDEEP 49152:tvaET2mbaBm3/PxlL/uJIXpQ1H4CC1JbLoGdSu50THHB72eh2NT:tvDT2mbaBm3/PxlL/u+XpQ1H4Ce
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-101-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

memory/380-106-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

memory/380-102-0x0000000001A80000-0x0000000001A90000-memory.dmp

Download

memory/808-37-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/808-38-0x000000001B2B0000-0x000000001B2C0000-memory.dmp

Download

memory/808-42-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/1516-126-0x000000001B340000-0x000000001B350000-memory.dmp

Download

memory/1516-125-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

memory/1516-130-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

memory/1580-69-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/1580-74-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/1580-70-0x0000000000F30000-0x0000000000F40000-memory.dmp

Download

memory/1700-22-0x000000001BA80000-0x000000001BA90000-memory.dmp

Download

memory/1700-21-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/1700-26-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/2116-1-0x00007FFAEA3A0000-0x00007FFAEAE61000-memory.dmp

Download

memory/2116-2-0x000000001BCF0000-0x000000001BD00000-memory.dmp

Download

memory/2116-0-0x0000000000D00000-0x0000000001024000-memory.dmp

Download

memory/2116-9-0x00007FFAEA3A0000-0x00007FFAEAE61000-memory.dmp

Download

memory/2352-12-0x000000001B5C0000-0x000000001B672000-memory.dmp

Download

memory/2352-8-0x00007FFAEA3A0000-0x00007FFAEAE61000-memory.dmp

Download

memory/2352-10-0x000000001B000000-0x000000001B010000-memory.dmp

Download

memory/2352-11-0x000000001AF70000-0x000000001AFC0000-memory.dmp

Download

memory/2352-18-0x00007FFAEA3A0000-0x00007FFAEAE61000-memory.dmp

Download

memory/2960-77-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/2960-78-0x000000001B4A0000-0x000000001B4B0000-memory.dmp

Download

memory/2960-82-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/3016-30-0x000000001BE60000-0x000000001BE70000-memory.dmp

Download

memory/3016-29-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/3016-34-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/3404-109-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

memory/3404-114-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

memory/3404-110-0x0000000002880000-0x0000000002890000-memory.dmp

Download

memory/3408-45-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/3408-46-0x0000000001470000-0x0000000001480000-memory.dmp

Download

memory/3408-50-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/3632-86-0x000000001BF50000-0x000000001BF60000-memory.dmp

Download

memory/3632-85-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/3632-90-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/3664-53-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/3664-58-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/3664-54-0x00000000028D0000-0x00000000028E0000-memory.dmp

Download

memory/3908-98-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

memory/3908-94-0x000000001B2C0000-0x000000001B2D0000-memory.dmp

Download

memory/3908-93-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

memory/4376-61-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/4376-62-0x000000001B270000-0x000000001B280000-memory.dmp

Download

memory/4376-66-0x00007FFAE9E50000-0x00007FFAEA911000-memory.dmp

Download

memory/4488-117-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

memory/4488-118-0x000000001BB70000-0x000000001BB80000-memory.dmp

Download

memory/4488-122-0x00007FFAEA050000-0x00007FFAEAB11000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads