quasar | fc1b2c9e8e203602a211e743b346018f63a4e08cea3d8b3c47ef5aada058b6af

Analysis

max time kernel
149s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
maybe-protected.exe
Size 1001KB
Sample240420-jmdynsce4v
SHA256 fc1b2c9e8e203602a211e743b346018f63a4e08cea3d8b3c47ef5aada058b6af
MD5 97f32d572e7eab88f7505d885fe02f31
SHA1 163421fb9df8991f11e6f7d6000b6f7c3473352d
SHA512 944dedd47c76e94d8475d2b09ddf9096f5f5af229cb73b73ff844cd571f26ddf5744a5147c87820df56f5b82113e5cd5c30e927f88e59c43ca5820ebfd4dd842
SSDEEP 24576:BLp59CUu8FvFG0NmJw/BGtV+lELZwjGHldzNDtLpz87:/59CUu8FvYR7HTz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar spyware trojan

Malware Config

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/412-1-0x0000000000230000-0x0000000000330000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	maybe-protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	maybe-protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	maybe-protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	maybe-protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	maybe-protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	maybe-protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	maybe-protected.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	maybe-protected.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
38	ip-api.com
71	ip-api.com
73	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
396	schtasks.exe
2892	schtasks.exe
988	schtasks.exe
4552	schtasks.exe
4756	schtasks.exe
4028	schtasks.exe
4764	schtasks.exe
4436	schtasks.exe

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
1972	PING.EXE
3172	PING.EXE
4784	PING.EXE
5116	PING.EXE
4752	PING.EXE
4940	PING.EXE
1624	PING.EXE
4128	PING.EXE

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	412	maybe-protected.exe
Token: SeDebugPrivilege	2304	maybe-protected.exe
Token: SeDebugPrivilege	4000	maybe-protected.exe
Token: SeDebugPrivilege	3128	maybe-protected.exe
Token: SeDebugPrivilege	4280	maybe-protected.exe
Token: SeDebugPrivilege	4996	maybe-protected.exe
Token: SeDebugPrivilege	388	maybe-protected.exe
Token: SeDebugPrivilege	4100	maybe-protected.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2892	412	maybe-protected.exe	94
PID 412 wrote to memory of 2892	412	maybe-protected.exe	94
PID 412 wrote to memory of 2892	412	maybe-protected.exe	94
PID 412 wrote to memory of 1728	412	maybe-protected.exe	96
PID 412 wrote to memory of 1728	412	maybe-protected.exe	96
PID 412 wrote to memory of 1728	412	maybe-protected.exe	96
PID 1728 wrote to memory of 3728	1728	cmd.exe	98
PID 1728 wrote to memory of 3728	1728	cmd.exe	98
PID 1728 wrote to memory of 3728	1728	cmd.exe	98
PID 1728 wrote to memory of 4784	1728	cmd.exe	99
PID 1728 wrote to memory of 4784	1728	cmd.exe	99
PID 1728 wrote to memory of 4784	1728	cmd.exe	99
PID 1728 wrote to memory of 2304	1728	cmd.exe	103
PID 1728 wrote to memory of 2304	1728	cmd.exe	103
PID 1728 wrote to memory of 2304	1728	cmd.exe	103
PID 2304 wrote to memory of 988	2304	maybe-protected.exe	105
PID 2304 wrote to memory of 988	2304	maybe-protected.exe	105
PID 2304 wrote to memory of 988	2304	maybe-protected.exe	105
PID 2304 wrote to memory of 4456	2304	maybe-protected.exe	109
PID 2304 wrote to memory of 4456	2304	maybe-protected.exe	109
PID 2304 wrote to memory of 4456	2304	maybe-protected.exe	109
PID 4456 wrote to memory of 2572	4456	cmd.exe	111
PID 4456 wrote to memory of 2572	4456	cmd.exe	111
PID 4456 wrote to memory of 2572	4456	cmd.exe	111
PID 4456 wrote to memory of 5116	4456	cmd.exe	112
PID 4456 wrote to memory of 5116	4456	cmd.exe	112
PID 4456 wrote to memory of 5116	4456	cmd.exe	112
PID 4456 wrote to memory of 4000	4456	cmd.exe	113
PID 4456 wrote to memory of 4000	4456	cmd.exe	113
PID 4456 wrote to memory of 4000	4456	cmd.exe	113
PID 4000 wrote to memory of 4552	4000	maybe-protected.exe	114
PID 4000 wrote to memory of 4552	4000	maybe-protected.exe	114
PID 4000 wrote to memory of 4552	4000	maybe-protected.exe	114
PID 4000 wrote to memory of 392	4000	maybe-protected.exe	116
PID 4000 wrote to memory of 392	4000	maybe-protected.exe	116
PID 4000 wrote to memory of 392	4000	maybe-protected.exe	116
PID 392 wrote to memory of 844	392	cmd.exe	118
PID 392 wrote to memory of 844	392	cmd.exe	118
PID 392 wrote to memory of 844	392	cmd.exe	118
PID 392 wrote to memory of 4752	392	cmd.exe	119
PID 392 wrote to memory of 4752	392	cmd.exe	119
PID 392 wrote to memory of 4752	392	cmd.exe	119
PID 392 wrote to memory of 3128	392	cmd.exe	120
PID 392 wrote to memory of 3128	392	cmd.exe	120
PID 392 wrote to memory of 3128	392	cmd.exe	120
PID 3128 wrote to memory of 4756	3128	maybe-protected.exe	121
PID 3128 wrote to memory of 4756	3128	maybe-protected.exe	121
PID 3128 wrote to memory of 4756	3128	maybe-protected.exe	121
PID 3128 wrote to memory of 1816	3128	maybe-protected.exe	123
PID 3128 wrote to memory of 1816	3128	maybe-protected.exe	123
PID 3128 wrote to memory of 1816	3128	maybe-protected.exe	123
PID 1816 wrote to memory of 3728	1816	cmd.exe	125
PID 1816 wrote to memory of 3728	1816	cmd.exe	125
PID 1816 wrote to memory of 3728	1816	cmd.exe	125
PID 1816 wrote to memory of 4940	1816	cmd.exe	126
PID 1816 wrote to memory of 4940	1816	cmd.exe	126
PID 1816 wrote to memory of 4940	1816	cmd.exe	126
PID 1816 wrote to memory of 4280	1816	cmd.exe	127
PID 1816 wrote to memory of 4280	1816	cmd.exe	127
PID 1816 wrote to memory of 4280	1816	cmd.exe	127
PID 4280 wrote to memory of 4028	4280	maybe-protected.exe	128
PID 4280 wrote to memory of 4028	4280	maybe-protected.exe	128
PID 4280 wrote to memory of 4028	4280	maybe-protected.exe	128
PID 4280 wrote to memory of 4336	4280	maybe-protected.exe	130

C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe
"C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SGO2s3dmEB0s.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:3728
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:4784
- - C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe
    "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:988
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\b2YR7XZSe9xe.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2572
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4000
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe" /rl HIGHEST /f
        6⤵
        Creates scheduled task(s)
        
        PID:4552
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\esGbcPLuIOus.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        
        PID:844
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:4756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lVx1C29QuLCb.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe" /rl HIGHEST /f
        10⤵
        Creates scheduled task(s)
        
        PID:4028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R2efi3cYYjqC.bat" "
        10⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe" /rl HIGHEST /f
        12⤵
        Creates scheduled task(s)
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2eDrQzSa0IQ7.bat" "
        12⤵
        
        PID:512
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        13⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:388
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe" /rl HIGHEST /f
        14⤵
        Creates scheduled task(s)
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ww9jZ9IJvx5d.bat" "
        14⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4100
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "WindowsAudioHelper" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\maybe-protected.exe" /rl HIGHEST /f
        16⤵
        Creates scheduled task(s)
        
        PID:396
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ns2vKsGp2x07.bat" "
        16⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        17⤵
        
        PID:924
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

maybe-protected.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\maybe-protected.exe.log
Size 1KB
SHA256 f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
MD5 10eab9c2684febb5327b6976f2047587
SHA1 a12ed54146a7f5c4c580416aecb899549712449e
SHA512 7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
MD5 SHA1 SHA512

Submit Download

2eDrQzSa0IQ7.bat

Path C:\Users\Admin\AppData\Local\Temp\2eDrQzSa0IQ7.bat
Size 212B
SHA256 4321edc49c12a1f60594b94013513f46813ba1812b629cc5daba7fe087fa34e1
MD5 8e7b077cdaf8336b27e57aec74a99d86
SHA1 686f59d93806bba33200c1dbd33d083d8f3de799
SHA512 e1d09f071397e8c8907bdf91528ff8bdca4dc3cdfa560e486dd18f343411265cf66b9b129a9bcd42cc8fa39d5b1bbbae8cb703daed26859f88f0afe974a555e1
MD5 SHA1 SHA512

Submit Download

Ns2vKsGp2x07.bat

Path C:\Users\Admin\AppData\Local\Temp\Ns2vKsGp2x07.bat
Size 212B
SHA256 ab1a547d114ac6b0d36c5eddf791349317a3ec305f61816f75fb5df5bb8f7bd6
MD5 b01a4e0a129c4b6cec9223c5cfe400c6
SHA1 1dceda52be1924d156187dcf5feb874ddacab61f
SHA512 c0e047e93a3cd4903b5bb7dd06307cca4d161b0b9d7e1baabe8671c1de906630e7776884d6df1af16ba4b636ced9ff06742bc7768003639355b0e7ea23b19853
MD5 SHA1 SHA512

Submit Download

R2efi3cYYjqC.bat

Path C:\Users\Admin\AppData\Local\Temp\R2efi3cYYjqC.bat
Size 212B
SHA256 bc186e884de6c2c5e1a9b4fa13b9abce174203e8ebd7546dd370ab4d777af7ad
MD5 fb3abfb402cc7988c226bd2ca8ad936e
SHA1 aa08658a921a459cf98c1f57793521ce551ac248
SHA512 993bc6033fb9301a45b54655c03822370e20ba9be2b8b8c5a3e016df7defed51ab29cc38529fd825736c5bb12beaa3a59c4813c72b8d8f5dee3256d659c2b44d
MD5 SHA1 SHA512

Submit Download

SGO2s3dmEB0s.bat

Path C:\Users\Admin\AppData\Local\Temp\SGO2s3dmEB0s.bat
Size 212B
SHA256 f885466d9d5f9b8fc784624a8cda9789e6124cef285ceb9048f2955a988ad5c3
MD5 d5374bb16ed1109b685052ba57397811
SHA1 413cf26b12c7598f2226887f664598217dba4537
SHA512 ef49611807298416bbe136ae6e7d4e737eb89df6a992fb6b7c67cd7a339a5afd949f2cd1456a2db28526eadbdad0efb069ba423e0b1a96141ad66fa87a0feb84
MD5 SHA1 SHA512

Submit Download

b2YR7XZSe9xe.bat

Path C:\Users\Admin\AppData\Local\Temp\b2YR7XZSe9xe.bat
Size 212B
SHA256 61a9773b6ff682f0425b348aefb5cb34737f6418a77dceaa556e9fce45aecae6
MD5 a6467d86de21016e2ced837393a4a22b
SHA1 8fff86e9faebca039edd1670fa15fc0eb2ecaaf7
SHA512 ab506d227da5253d77436ea30ef0c24cc6c9afae1d83dc56f6461184935baff435dea207e91da2f239ae7a941206bef2f2b5ab74157a1f6f342df89055219e60
MD5 SHA1 SHA512

Submit Download

esGbcPLuIOus.bat

Path C:\Users\Admin\AppData\Local\Temp\esGbcPLuIOus.bat
Size 212B
SHA256 ef4c17667774db718cf68ed2cba37f82fcf017494f7158c61b1a6542c3d97795
MD5 950097cbc24dbd279575be0ffaabe168
SHA1 1e301035ab1cfe950126758b86a7ec5c861da718
SHA512 940c35ff664b2584ef6ea45e5c42566a74f3586c764c405cd252b6b0480cd7b6a66c0332d4dc51410db8be3914e4cc06be394bf56c644409de2cb98117f44667
MD5 SHA1 SHA512

Submit Download

lVx1C29QuLCb.bat

Path C:\Users\Admin\AppData\Local\Temp\lVx1C29QuLCb.bat
Size 212B
SHA256 0d35153566a2e53183ef02b1ad96e2d0c64ff0677b75448d1f536c07810ca4d0
MD5 51f8f4fb0f488565df701f0e7daad197
SHA1 7ad314d7aa2b6828dc8c385711edb1a92edb730c
SHA512 e7981de4186f111639c2983a1a8345ecaadecf9343759b7a0f5ebb3772b9568b2d5d0567fb3ee763b24f3d81b415631c3d1bd267e7e7cc9f3b593dd7f3e9344b
MD5 SHA1 SHA512

Submit Download

ww9jZ9IJvx5d.bat

Path C:\Users\Admin\AppData\Local\Temp\ww9jZ9IJvx5d.bat
Size 212B
SHA256 03f765b371324fb88b6a6142ea6826285bdd18b88168f9277e8c1a6c0565b905
MD5 d2fb59b863c538246d259610135ad20a
SHA1 c5bd1785f2beb4d44c5108fa9e86681547b5e9e8
SHA512 069f318cb169c3e7b4c61c5b4fe9fa983170587ec5e24164ea4aa81094401fc9227468dc4df0c9ae01a9f33ad0521625361062d74c4a44e1bd2b5efc1d7a574c
MD5 SHA1 SHA512

Submit Download

memory/388-57-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/388-52-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/388-53-0x0000000005810000-0x0000000005820000-memory.dmp

Download

memory/412-15-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/412-3-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Download

memory/412-2-0x00000000052D0000-0x0000000005874000-memory.dmp

Download

memory/412-8-0x0000000006180000-0x00000000061BC000-memory.dmp

Download

memory/412-4-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Download

memory/412-1-0x0000000000230000-0x0000000000330000-memory.dmp

Download

memory/412-5-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/412-7-0x0000000005D40000-0x0000000005D52000-memory.dmp

Download

memory/412-0-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/412-6-0x0000000005160000-0x00000000051C6000-memory.dmp

Download

memory/412-10-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Download

memory/2304-17-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/2304-22-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/2304-18-0x0000000005170000-0x0000000005180000-memory.dmp

Download

memory/3128-36-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/3128-32-0x0000000005160000-0x0000000005170000-memory.dmp

Download

memory/3128-31-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/4000-25-0x0000000003460000-0x0000000003470000-memory.dmp

Download

memory/4000-29-0x0000000074C10000-0x00000000753C0000-memory.dmp

Download

memory/4000-24-0x0000000074C10000-0x00000000753C0000-memory.dmp

Download

memory/4100-59-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/4100-60-0x0000000005960000-0x0000000005970000-memory.dmp

Download

memory/4100-65-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/4280-38-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/4280-44-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/4280-39-0x0000000005800000-0x0000000005810000-memory.dmp

Download

memory/4996-46-0x00000000051C0000-0x00000000051D0000-memory.dmp

Download

memory/4996-50-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

memory/4996-45-0x0000000074C20000-0x00000000753D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads