quasar | 733436d5bc6464c09757584b8609fa28898f2622412e55421ebdab550e02e4ea

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 20:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240425-yzm5faeb21
SHA256 733436d5bc6464c09757584b8609fa28898f2622412e55421ebdab550e02e4ea
MD5 c9732d408949b3d82ac9a957d399e0bb
SHA1 413c3d019088c910fd0bf9566c970bbe6757c33b
SHA512 1f3d9b8cc4e04fdc6e56f687e7dd69a964581adf5f3f6b2ee03484d33d70f6487005046ff07cc2fbccb9be9ac80fc2c20906da07b4f0afcbb54581c42a9da45d
SSDEEP 49152:avUt62XlaSFNWPjljiFa2RoUYIocRJ6UbR3LoGdW01THHB72eh2NT:avI62XlaSFNWPjljiFXRoUYIocRJ6e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

ZE:4782

Mutex

911e182a-c76f-4c94-979c-4ba6b3b24941

Attributes

encryption_key
EFF71D9D44DB5A6D9B14E191FC8CC16A1F4043B2
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 9 IoCs

resource	yara_rule
behavioral1/memory/2808-0-0x0000000000CC0000-0x0000000000FE4000-memory.dmp	family_quasar
behavioral1/memory/2564-13-0x0000000001290000-0x00000000015B4000-memory.dmp	family_quasar
behavioral1/memory/812-26-0x00000000000D0000-0x00000000003F4000-memory.dmp	family_quasar
behavioral1/memory/1152-40-0x0000000000970000-0x0000000000C94000-memory.dmp	family_quasar
behavioral1/memory/1956-54-0x0000000000CD0000-0x0000000000FF4000-memory.dmp	family_quasar
behavioral1/memory/1828-68-0x0000000001280000-0x00000000015A4000-memory.dmp	family_quasar
behavioral1/memory/2976-81-0x0000000000060000-0x0000000000384000-memory.dmp	family_quasar
behavioral1/memory/3068-94-0x00000000010C0000-0x00000000013E4000-memory.dmp	family_quasar
behavioral1/memory/2480-108-0x0000000001140000-0x0000000001464000-memory.dmp	family_quasar

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
368	PING.EXE
2264	PING.EXE
2700	PING.EXE
2776	PING.EXE
2536	PING.EXE
2916	PING.EXE
1592	PING.EXE
2856	PING.EXE
2280	PING.EXE
2396	PING.EXE
1168	PING.EXE

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	Client-built.exe
Token: SeDebugPrivilege	2564	Client-built.exe
Token: SeDebugPrivilege	812	Client-built.exe
Token: SeDebugPrivilege	1152	Client-built.exe
Token: SeDebugPrivilege	1956	Client-built.exe
Token: SeDebugPrivilege	1828	Client-built.exe
Token: SeDebugPrivilege	2976	Client-built.exe
Token: SeDebugPrivilege	3068	Client-built.exe
Token: SeDebugPrivilege	2480	Client-built.exe
Token: SeDebugPrivilege	2552	Client-built.exe
Token: SeDebugPrivilege	2304	Client-built.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2808	Client-built.exe
2564	Client-built.exe
812	Client-built.exe
1152	Client-built.exe
1956	Client-built.exe
1828	Client-built.exe
2976	Client-built.exe
3068	Client-built.exe
2480	Client-built.exe
2552	Client-built.exe
2304	Client-built.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
2808	Client-built.exe
2564	Client-built.exe
812	Client-built.exe
1152	Client-built.exe
1956	Client-built.exe
1828	Client-built.exe
2976	Client-built.exe
3068	Client-built.exe
2480	Client-built.exe
2552	Client-built.exe
2304	Client-built.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2808	Client-built.exe
2564	Client-built.exe
812	Client-built.exe
1152	Client-built.exe
1956	Client-built.exe
1828	Client-built.exe
2976	Client-built.exe
3068	Client-built.exe
2480	Client-built.exe
2552	Client-built.exe
2304	Client-built.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2440	2808	Client-built.exe	28
PID 2808 wrote to memory of 2440	2808	Client-built.exe	28
PID 2808 wrote to memory of 2440	2808	Client-built.exe	28
PID 2440 wrote to memory of 2532	2440	cmd.exe	30
PID 2440 wrote to memory of 2532	2440	cmd.exe	30
PID 2440 wrote to memory of 2532	2440	cmd.exe	30
PID 2440 wrote to memory of 2536	2440	cmd.exe	31
PID 2440 wrote to memory of 2536	2440	cmd.exe	31
PID 2440 wrote to memory of 2536	2440	cmd.exe	31
PID 2440 wrote to memory of 2564	2440	cmd.exe	32
PID 2440 wrote to memory of 2564	2440	cmd.exe	32
PID 2440 wrote to memory of 2564	2440	cmd.exe	32
PID 2564 wrote to memory of 2152	2564	Client-built.exe	33
PID 2564 wrote to memory of 2152	2564	Client-built.exe	33
PID 2564 wrote to memory of 2152	2564	Client-built.exe	33
PID 2152 wrote to memory of 2352	2152	cmd.exe	35
PID 2152 wrote to memory of 2352	2152	cmd.exe	35
PID 2152 wrote to memory of 2352	2152	cmd.exe	35
PID 2152 wrote to memory of 2396	2152	cmd.exe	36
PID 2152 wrote to memory of 2396	2152	cmd.exe	36
PID 2152 wrote to memory of 2396	2152	cmd.exe	36
PID 2152 wrote to memory of 812	2152	cmd.exe	39
PID 2152 wrote to memory of 812	2152	cmd.exe	39
PID 2152 wrote to memory of 812	2152	cmd.exe	39
PID 812 wrote to memory of 2144	812	Client-built.exe	40
PID 812 wrote to memory of 2144	812	Client-built.exe	40
PID 812 wrote to memory of 2144	812	Client-built.exe	40
PID 2144 wrote to memory of 2184	2144	cmd.exe	42
PID 2144 wrote to memory of 2184	2144	cmd.exe	42
PID 2144 wrote to memory of 2184	2144	cmd.exe	42
PID 2144 wrote to memory of 1168	2144	cmd.exe	43
PID 2144 wrote to memory of 1168	2144	cmd.exe	43
PID 2144 wrote to memory of 1168	2144	cmd.exe	43
PID 2144 wrote to memory of 1152	2144	cmd.exe	44
PID 2144 wrote to memory of 1152	2144	cmd.exe	44
PID 2144 wrote to memory of 1152	2144	cmd.exe	44
PID 1152 wrote to memory of 1708	1152	Client-built.exe	45
PID 1152 wrote to memory of 1708	1152	Client-built.exe	45
PID 1152 wrote to memory of 1708	1152	Client-built.exe	45
PID 1708 wrote to memory of 1112	1708	cmd.exe	47
PID 1708 wrote to memory of 1112	1708	cmd.exe	47
PID 1708 wrote to memory of 1112	1708	cmd.exe	47
PID 1708 wrote to memory of 1592	1708	cmd.exe	48
PID 1708 wrote to memory of 1592	1708	cmd.exe	48
PID 1708 wrote to memory of 1592	1708	cmd.exe	48
PID 1708 wrote to memory of 1956	1708	cmd.exe	49
PID 1708 wrote to memory of 1956	1708	cmd.exe	49
PID 1708 wrote to memory of 1956	1708	cmd.exe	49
PID 1956 wrote to memory of 2724	1956	Client-built.exe	50
PID 1956 wrote to memory of 2724	1956	Client-built.exe	50
PID 1956 wrote to memory of 2724	1956	Client-built.exe	50
PID 2724 wrote to memory of 2848	2724	cmd.exe	52
PID 2724 wrote to memory of 2848	2724	cmd.exe	52
PID 2724 wrote to memory of 2848	2724	cmd.exe	52
PID 2724 wrote to memory of 2916	2724	cmd.exe	53
PID 2724 wrote to memory of 2916	2724	cmd.exe	53
PID 2724 wrote to memory of 2916	2724	cmd.exe	53
PID 2724 wrote to memory of 1828	2724	cmd.exe	54
PID 2724 wrote to memory of 1828	2724	cmd.exe	54
PID 2724 wrote to memory of 1828	2724	cmd.exe	54
PID 1828 wrote to memory of 2984	1828	Client-built.exe	55
PID 1828 wrote to memory of 2984	1828	Client-built.exe	55
PID 1828 wrote to memory of 2984	1828	Client-built.exe	55
PID 2984 wrote to memory of 1948	2984	cmd.exe	57

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\sIoKX8xt3yIY.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2532
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:2536
- - C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\PPAJPk5OYnUm.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2152
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2352
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:812
      - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\21NRgodThqMB.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2184
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\lNTgFmPB8E5t.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1112
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        Runs ping.exe
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        9⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\g2KIafhWD7gZ.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2848
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        11⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\llFlJaCTCTqd.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1948
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        Runs ping.exe
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        13⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\FNvPHTT8PN04.bat" "
        14⤵
        
        PID:892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        Runs ping.exe
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        15⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\QDJqT0KZEEiT.bat" "
        16⤵
        
        PID:2684
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:2524
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        Runs ping.exe
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        17⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2480
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AuQ7vKvfY5mb.bat" "
        18⤵
        
        PID:1556
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:2376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        Runs ping.exe
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        19⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2552
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4jHUU36SHEOZ.bat" "
        20⤵
        
        PID:572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:2944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        Runs ping.exe
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Client-built.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
        21⤵
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:2304
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CrWuAT57X1p4.bat" "
        22⤵
        
        PID:764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        Runs ping.exe
        
        PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21NRgodThqMB.bat

Path C:\Users\Admin\AppData\Local\Temp\21NRgodThqMB.bat
Size 209B
SHA256 6d0ff437d70a709c30e94da2d2a741bfd42c841775493fd17c71a735d38cba0f
MD5 b3257f1f9cddae3b08f57230f0b2180c
SHA1 5eab44b390d79468d82347af580f57a90c2c901f
SHA512 5b92be297235a88244797d37e3ff51ff8a387955699a360f5c85eec8042a9f8bdf28e7603bc1e8e48b4fb4550c50ea001fc5d27a8121019b545605144d7cbd4f
MD5 SHA1 SHA512

Submit Download

4jHUU36SHEOZ.bat

Path C:\Users\Admin\AppData\Local\Temp\4jHUU36SHEOZ.bat
Size 209B
SHA256 6526ff4469de1216e426da4ea95a2a222a40c9ef3fa76104ce87a8c371a1eb39
MD5 7b4f52b77c462baedb0f3cf89b17ba21
SHA1 cc688e4ae3cee295b279b566b2f1a2971abc1266
SHA512 bcc4f10e404666a71284d2eaf9139548bb873fcf4a8fda2ba1a2e6e5e7103ada889e09d2f864f5af59b4310c3d5ef3039dfb2abf49e35f82e8420e19552d31f6
MD5 SHA1 SHA512

Submit Download

AuQ7vKvfY5mb.bat

Path C:\Users\Admin\AppData\Local\Temp\AuQ7vKvfY5mb.bat
Size 209B
SHA256 ccdaec82e868384ffb697676b8bfd6678d61156eb119632024def5b454856c43
MD5 f5e492b7042ecca55fac14852aa73956
SHA1 e3e42cea59f2997e48ef146a6aac9abbf2d9b6b8
SHA512 38611b761aa516f6423d2a2ce67eba64fd7c78b67ad0583a8c4fda4dfdf3b4a3a97d1b4bb10f791d0a063af6d568f9ebaa704703ab372ff1cf7773c0d122271e
MD5 SHA1 SHA512

Submit Download

CrWuAT57X1p4.bat

Path C:\Users\Admin\AppData\Local\Temp\CrWuAT57X1p4.bat
Size 209B
SHA256 171d4b5122092e0095d85aa92b2bfc34a2bcde617ca21d45fab4476bcf4ef08b
MD5 1e6605d119905a0f3bc68e5f353215c1
SHA1 eb51654417b16633a28362e1e2bea991a1ed0949
SHA512 0aab2f1d5833ca931da7b08eb9bf6a8a4420274c666ec4fb52df9de0126552a8e54979e6e136127705767d56be9cb894c1c7146d8b715ac105b69d95c3b6589f
MD5 SHA1 SHA512

Submit Download

FNvPHTT8PN04.bat

Path C:\Users\Admin\AppData\Local\Temp\FNvPHTT8PN04.bat
Size 209B
SHA256 e6e15b0610fd4092f6c7844cbeeb6486bc2480cdeed6bd5fa5d8ca052f9edb9e
MD5 9c8749644278edbd46d9c5335f9492f0
SHA1 9d4f164e698ad301d9b88a307db9a51e19c57e50
SHA512 bbae22083c58bedd8a59b8b02e39afc98aaec94f8feb5bcca485e963173dc5a877c88b812f46247434cf507c17c9e2c0898772491571bddcc6d5631e6c79e4ee
MD5 SHA1 SHA512

Submit Download

PPAJPk5OYnUm.bat

Path C:\Users\Admin\AppData\Local\Temp\PPAJPk5OYnUm.bat
Size 209B
SHA256 b22ad5c4aff2d91b029a903cf76c88ef36d31b156568eeaa18d371983c705cbb
MD5 931ee033ec8b23534ed3753a0ad2ac9c
SHA1 b7fb19af52fa410d40285b58e74a43e1c024bb26
SHA512 6f89611e78d7bd61776f5b8d272b6967ed309893dbddb1c95b329742678861c1aee7e9ff14ed8029f82048179ef4ab90d5a0cbacc9cb7e20b8a83f0aa3e9da4e
MD5 SHA1 SHA512

Submit Download

QDJqT0KZEEiT.bat

Path C:\Users\Admin\AppData\Local\Temp\QDJqT0KZEEiT.bat
Size 209B
SHA256 cf761ad9fb995b713119844abde55e9eaa491f243d37a752a79ff657a727ecec
MD5 0b78772a1efe20889cc73229b2980249
SHA1 6887c4de07dcc425ef7666198ce6b96588ae9d69
SHA512 3b68701a91ce354413334ba9a4e52bbca7306650765e2844b6815fca094549e55ecd2e2a9b247f285389aac775bc4b4d2e6feadd7ae81e71e6b779a5c23e34d1
MD5 SHA1 SHA512

Submit Download

g2KIafhWD7gZ.bat

Path C:\Users\Admin\AppData\Local\Temp\g2KIafhWD7gZ.bat
Size 209B
SHA256 b4c4df98160189cec9c2a55b4b8defc1e17e3108ba8ac62cbf1f29e955aeaf69
MD5 5f10bc99bca65322af92ccf9cd4ab767
SHA1 c59859a707c53a932e1acaf2addd341f78fced55
SHA512 2adfa2b1195888c789bda35b5b08ddbf1d23836862392c7564222775f19422938a5eaa17c6d4deb5991c8c2c07cd8b1ce4ec41316c489286bf782f0d02d2dced
MD5 SHA1 SHA512

Submit Download

lNTgFmPB8E5t.bat

Path C:\Users\Admin\AppData\Local\Temp\lNTgFmPB8E5t.bat
Size 209B
SHA256 a1ff7f1d4cb62119632ce45d0cba40fbebe4fd3e1b6be0c9ae3efd6a6b1c9bca
MD5 b2c90a701f788ff5c608bc080d961796
SHA1 cdbaedcbc47f334f9ce1a7fe7400c96bf042cc99
SHA512 83980c9acab9db700e29c4fde8e88b286a16340d19162087953d2a6c9ac52add4636cb758b8efbb6f78fcf1cef0cd104ea7b5bc364a230c32c9a770353ce84eb
MD5 SHA1 SHA512

Submit Download

llFlJaCTCTqd.bat

Path C:\Users\Admin\AppData\Local\Temp\llFlJaCTCTqd.bat
Size 209B
SHA256 69bb81b1746414521ad18b7ad53ec94948301e2514d90c2fa26c2d6904702c55
MD5 fe860f64c1d93db34b2102ebe54bd0e5
SHA1 8319c9267009949635b8d88f032b13228f37530a
SHA512 9e8556a1ea0ed97316adab03ed5ecc0a1b75f08b8a40e765c14103083b02a31ae4a28dc717410520a826e561a61cfe9107e3b1cbd38ea324d9db6eacaba3be7f
MD5 SHA1 SHA512

Submit Download

sIoKX8xt3yIY.bat

Path C:\Users\Admin\AppData\Local\Temp\sIoKX8xt3yIY.bat
Size 209B
SHA256 177c92573f1874ba5a2801a6c70a0b1d664cfd04232e6c5ac131d35e8e6173cb
MD5 6e0dc376dde88fe39d0b4d67099fd44e
SHA1 baacd32bddd470c7145965d0bc9aa2399a42eb94
SHA512 ef8585a92d090ed034d80bd12204bf687e9d3fb3962a0005c79677bb6b8622bc3e93eba25c9f299c3365705a4a34262a40cce8d5e552e00509641316c049e51d
MD5 SHA1 SHA512

Submit Download

memory/812-26-0x00000000000D0000-0x00000000003F4000-memory.dmp

Download

memory/812-28-0x0000000002190000-0x0000000002210000-memory.dmp

Download

memory/812-27-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/812-39-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/1152-40-0x0000000000970000-0x0000000000C94000-memory.dmp

Download

memory/1152-41-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/1152-42-0x000000001B320000-0x000000001B3A0000-memory.dmp

Download

memory/1152-53-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/1828-69-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/1828-80-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/1828-68-0x0000000001280000-0x00000000015A4000-memory.dmp

Download

memory/1956-55-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/1956-56-0x000000001B180000-0x000000001B200000-memory.dmp

Download

memory/1956-54-0x0000000000CD0000-0x0000000000FF4000-memory.dmp

Download

memory/1956-67-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/2304-134-0x0000000000DA0000-0x0000000000E20000-memory.dmp

Download

memory/2304-143-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/2304-133-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/2480-119-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/2480-110-0x000000001B3D0000-0x000000001B450000-memory.dmp

Download

memory/2480-109-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/2480-108-0x0000000001140000-0x0000000001464000-memory.dmp

Download

memory/2552-121-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/2552-122-0x000000001B310000-0x000000001B390000-memory.dmp

Download

memory/2552-132-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/2564-15-0x000000001B300000-0x000000001B380000-memory.dmp

Download

memory/2564-13-0x0000000001290000-0x00000000015B4000-memory.dmp

Download

memory/2564-25-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/2564-14-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/2808-12-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/2808-2-0x000000001B270000-0x000000001B2F0000-memory.dmp

Download

memory/2808-1-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/2808-0-0x0000000000CC0000-0x0000000000FE4000-memory.dmp

Download

memory/2976-93-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/2976-82-0x000007FEF53D0000-0x000007FEF5DBC000-memory.dmp

Download

memory/2976-81-0x0000000000060000-0x0000000000384000-memory.dmp

Download

memory/3068-107-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/3068-96-0x0000000000DC0000-0x0000000000E40000-memory.dmp

Download

memory/3068-95-0x000007FEF49E0000-0x000007FEF53CC000-memory.dmp

Download

memory/3068-94-0x00000000010C0000-0x00000000013E4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads