quasar | ce69ec958fdaf36bbfca7e3aa5135927de730ff9dab62da97e112eae60646967

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample240623-h2yqystemc
SHA256 ce69ec958fdaf36bbfca7e3aa5135927de730ff9dab62da97e112eae60646967
MD5 7beb6c4ca4f76487fa87841985d89b1d
SHA1 1e5eac3c277b7fb7f3bd4eb8ad53a18afb25c588
SHA512 a21dabee2b19478c0375ec0d8390a893aa2397571ebc4ac3a8d0b54cec8a0d26d846c2a76bb841b748f75e6ebf3d596bb7ad42f8a6fa624282c18c7bd9213e61
SSDEEP 49152:3vvI22SsaNYfdPBldt698dBcjHOQRJ6UbR3LoGdiTHHB72eh2NT:3vg22SsaNYfdPBldt6+dBcjHOQRJ6e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar hi spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

care-somewhere.gl.at.ply.gg:38177

Mutex

1e96fc68-3845-4d50-9a21-431f60029a14

Attributes

encryption_key
D9185A099F336661ED8D6035D739C63B5B34E3D8
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Update
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4864-1-0x0000000000290000-0x00000000005B4000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023406-5.dat	family_quasar

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 10 IoCs

pid	Process
644	Client.exe
4668	Client.exe
2180	Client.exe
1972	Client.exe
2280	Client.exe
2244	Client.exe
4168	Client.exe
1236	Client.exe
3356	Client.exe
4316	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 9 IoCs

Remote System Discovery

T1018

pid	Process
1756	PING.EXE
5104	PING.EXE
3880	PING.EXE
4320	PING.EXE
1072	PING.EXE
628	PING.EXE
4868	PING.EXE
4108	PING.EXE
2496	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
224	schtasks.exe
3972	schtasks.exe
1612	schtasks.exe
3380	schtasks.exe
1532	schtasks.exe
3380	schtasks.exe
2796	schtasks.exe
3224	schtasks.exe
3580	schtasks.exe
3060	schtasks.exe
3932	schtasks.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	Client-built.exe
Token: SeDebugPrivilege	644	Client.exe
Token: SeDebugPrivilege	4668	Client.exe
Token: SeDebugPrivilege	2180	Client.exe
Token: SeDebugPrivilege	1972	Client.exe
Token: SeDebugPrivilege	2280	Client.exe
Token: SeDebugPrivilege	2244	Client.exe
Token: SeDebugPrivilege	4168	Client.exe
Token: SeDebugPrivilege	1236	Client.exe
Token: SeDebugPrivilege	3356	Client.exe
Token: SeDebugPrivilege	4316	Client.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
644	Client.exe
4668	Client.exe
2180	Client.exe
1972	Client.exe
2280	Client.exe
2244	Client.exe
4168	Client.exe
1236	Client.exe
3356	Client.exe
4316	Client.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
644	Client.exe
4668	Client.exe
2180	Client.exe
1972	Client.exe
2280	Client.exe
2244	Client.exe
4168	Client.exe
1236	Client.exe
3356	Client.exe
4316	Client.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
644	Client.exe
2244	Client.exe
4168	Client.exe
1236	Client.exe
3356	Client.exe
4316	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1532	4864	Client-built.exe	81
PID 4864 wrote to memory of 1532	4864	Client-built.exe	81
PID 4864 wrote to memory of 644	4864	Client-built.exe	83
PID 4864 wrote to memory of 644	4864	Client-built.exe	83
PID 644 wrote to memory of 3580	644	Client.exe	84
PID 644 wrote to memory of 3580	644	Client.exe	84
PID 644 wrote to memory of 1560	644	Client.exe	86
PID 644 wrote to memory of 1560	644	Client.exe	86
PID 1560 wrote to memory of 3084	1560	cmd.exe	88
PID 1560 wrote to memory of 3084	1560	cmd.exe	88
PID 1560 wrote to memory of 4320	1560	cmd.exe	89
PID 1560 wrote to memory of 4320	1560	cmd.exe	89
PID 1560 wrote to memory of 4668	1560	cmd.exe	90
PID 1560 wrote to memory of 4668	1560	cmd.exe	90
PID 4668 wrote to memory of 3380	4668	Client.exe	91
PID 4668 wrote to memory of 3380	4668	Client.exe	91
PID 4668 wrote to memory of 2724	4668	Client.exe	93
PID 4668 wrote to memory of 2724	4668	Client.exe	93
PID 2724 wrote to memory of 4124	2724	cmd.exe	95
PID 2724 wrote to memory of 4124	2724	cmd.exe	95
PID 2724 wrote to memory of 1756	2724	cmd.exe	96
PID 2724 wrote to memory of 1756	2724	cmd.exe	96
PID 2724 wrote to memory of 2180	2724	cmd.exe	99
PID 2724 wrote to memory of 2180	2724	cmd.exe	99
PID 2180 wrote to memory of 2796	2180	Client.exe	100
PID 2180 wrote to memory of 2796	2180	Client.exe	100
PID 2180 wrote to memory of 2104	2180	Client.exe	102
PID 2180 wrote to memory of 2104	2180	Client.exe	102
PID 2104 wrote to memory of 3932	2104	cmd.exe	104
PID 2104 wrote to memory of 3932	2104	cmd.exe	104
PID 2104 wrote to memory of 1072	2104	cmd.exe	105
PID 2104 wrote to memory of 1072	2104	cmd.exe	105
PID 2104 wrote to memory of 1972	2104	cmd.exe	109
PID 2104 wrote to memory of 1972	2104	cmd.exe	109
PID 1972 wrote to memory of 3060	1972	Client.exe	110
PID 1972 wrote to memory of 3060	1972	Client.exe	110
PID 1972 wrote to memory of 3400	1972	Client.exe	112
PID 1972 wrote to memory of 3400	1972	Client.exe	112
PID 3400 wrote to memory of 2004	3400	cmd.exe	114
PID 3400 wrote to memory of 2004	3400	cmd.exe	114
PID 3400 wrote to memory of 628	3400	cmd.exe	115
PID 3400 wrote to memory of 628	3400	cmd.exe	115
PID 3400 wrote to memory of 2280	3400	cmd.exe	118
PID 3400 wrote to memory of 2280	3400	cmd.exe	118
PID 2280 wrote to memory of 224	2280	Client.exe	119
PID 2280 wrote to memory of 224	2280	Client.exe	119
PID 2280 wrote to memory of 2968	2280	Client.exe	121
PID 2280 wrote to memory of 2968	2280	Client.exe	121
PID 2968 wrote to memory of 2440	2968	cmd.exe	123
PID 2968 wrote to memory of 2440	2968	cmd.exe	123
PID 2968 wrote to memory of 4868	2968	cmd.exe	124
PID 2968 wrote to memory of 4868	2968	cmd.exe	124
PID 2968 wrote to memory of 2244	2968	cmd.exe	125
PID 2968 wrote to memory of 2244	2968	cmd.exe	125
PID 2244 wrote to memory of 3972	2244	Client.exe	126
PID 2244 wrote to memory of 3972	2244	Client.exe	126
PID 2244 wrote to memory of 2260	2244	Client.exe	128
PID 2244 wrote to memory of 2260	2244	Client.exe	128
PID 2260 wrote to memory of 4508	2260	cmd.exe	130
PID 2260 wrote to memory of 4508	2260	cmd.exe	130
PID 2260 wrote to memory of 5104	2260	cmd.exe	131
PID 2260 wrote to memory of 5104	2260	cmd.exe	131
PID 2260 wrote to memory of 4168	2260	cmd.exe	132
PID 2260 wrote to memory of 4168	2260	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1532
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OYaXzaNtQ11P.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3084
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      Runs ping.exe
      PID:4320
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tdRefHUvxq1d.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2724
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4124
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:1756
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2796
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sskeTAfrJjvE.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3932
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:1072
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E24xDLwisnsK.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        Runs ping.exe
        
        PID:628
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ex3EJqHXwaP3.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:4868
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TJlB200zb6yb.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:2260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4508
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:5104
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4168
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2WBpuVUMfeYM.bat" "
        15⤵
        
        PID:3012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3448
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        Runs ping.exe
        
        PID:3880
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1236
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ajem7dlfe7fK.bat" "
        17⤵
        
        PID:4976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        Runs ping.exe
        
        PID:4108
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3356
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\51fWUMLbE8vM.bat" "
        19⤵
        
        PID:2456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2052
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        Runs ping.exe
        
        PID:2496
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:4316
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
MD5 SHA1 SHA512

Submit Download

2WBpuVUMfeYM.bat

Path C:\Users\Admin\AppData\Local\Temp\2WBpuVUMfeYM.bat
Size 207B
SHA256 00817139637dcf02591f4c6efe2de0ac9c914c8b228cf9765491bbcbce2c88c1
MD5 bea19f42d78c335f9cffd4ce757c8e12
SHA1 1cd7d90afa96505d00896090e6656062b311242b
SHA512 7ab9ce2374432f0fb17ca4aed4d94fdc67d69870d292f807bf8c6c79990e955251b08014cf9cf2f0c9425a43f1320df5ee614731f090cb4183e09334cd035dde
MD5 SHA1 SHA512

Submit Download

51fWUMLbE8vM.bat

Path C:\Users\Admin\AppData\Local\Temp\51fWUMLbE8vM.bat
Size 207B
SHA256 10af8fb1bb3cfbee88e3451727684ac75bccd49271c2d8881d2493e9540fb557
MD5 ff24414890cbd2dd6aad9d655bb600b8
SHA1 5f4f299aef0d623c78b8f345d3fdf2f88f8333e6
SHA512 8fbd15b570cba652478df58149e956f640e82f110166504f2dd824965bb243531438693b7b3ea1c196a321ca66d1f0674a73b57bcafd546e53d7a22271eb9785
MD5 SHA1 SHA512

Submit Download

E24xDLwisnsK.bat

Path C:\Users\Admin\AppData\Local\Temp\E24xDLwisnsK.bat
Size 207B
SHA256 ec0298cfc44bd11c67b028e6239aaac58a823d65c3ffd247d34b754d77e8a31f
MD5 94e2d68c301b38a13579a3fd3111a748
SHA1 d45566f4fe4a8ded7de3a9d8fdf6aeb340c1974f
SHA512 47e4056028dccc95e2842847ec499148b12a010a274369da2fa3d38b9a639553577936bcc90acdbd917fcc4337a9318eaf46697209e8031ac39fa3039a7b6624
MD5 SHA1 SHA512

Submit Download

Ex3EJqHXwaP3.bat

Path C:\Users\Admin\AppData\Local\Temp\Ex3EJqHXwaP3.bat
Size 207B
SHA256 e88c464ffdbb89796e19cf9350431aea3079f69be175d630e4c672e9f32b4173
MD5 c3bfa66c3d1cbee195afbf18f87b9ab7
SHA1 b7409d641e201f0f2b758ed60e336b87834cc089
SHA512 6ad0231344fa7e797dad693def9bfad264a821fa6781975091b6bf1e0a0eb64dab1375f952e255c578fd83ec4052a3d46adeceab9418ed99b37d1d95986b7168
MD5 SHA1 SHA512

Submit Download

OYaXzaNtQ11P.bat

Path C:\Users\Admin\AppData\Local\Temp\OYaXzaNtQ11P.bat
Size 207B
SHA256 316e34122d76a2bae246413bf2dee4825a406a5864daeaf3a883cef50a8d9754
MD5 63e9bd363032a69144d003a9d4d77221
SHA1 b27b73a10363021aac2603f59e3a670004d19270
SHA512 7284aa93790d540f70b633502f1199397c28112080b2b6492e62544d8d04cde38cc56b7057beb8cee284e514dd375b5f8e0d5fec5dd868fcecbcb6580dfa56d1
MD5 SHA1 SHA512

Submit Download

TJlB200zb6yb.bat

Path C:\Users\Admin\AppData\Local\Temp\TJlB200zb6yb.bat
Size 207B
SHA256 a316057427ac349323145c890c7a5e24b0134e42eb18a7839a3de2f78f144e1b
MD5 e4bb38a3d12433add8f6051b311dac07
SHA1 70bedd733ef98f2147ff24b583402de05f4db53e
SHA512 8fa2be2988c4010e4460d9b896d23b8c3a59d16a81f0596892a3346ee7ec1b9d64e0c5dfcb79fce138eddb7c1be2cbd8446c5657fb0b5263ee2b3bffe0594e18
MD5 SHA1 SHA512

Submit Download

ajem7dlfe7fK.bat

Path C:\Users\Admin\AppData\Local\Temp\ajem7dlfe7fK.bat
Size 207B
SHA256 3d3a318890207702ae6484918344028bc70d35ab770f827e1d9d91cd303c6e34
MD5 7c4c55a5ea152d253d975d251e6331a3
SHA1 d8fb9200d5e9e5c2a643023d49a0f30aee19cfcd
SHA512 c592adfaf576f507ed2f741843e0ad28af209b0c98abda988e15c12307b3f87aa8226b7b44b3626e37ef58fced7fbee80213527e7109cd13166bf0318822241a
MD5 SHA1 SHA512

Submit Download

sskeTAfrJjvE.bat

Path C:\Users\Admin\AppData\Local\Temp\sskeTAfrJjvE.bat
Size 207B
SHA256 5f664371fea73212fd54c633b8a05fc56bd0e0d279b271108d7f7d0eb28623c5
MD5 f9afa164efd6b1f53485acdaf5058374
SHA1 6bedbc4890d6f3623c14e74da29dabb89fb2675c
SHA512 902b4f5af661df8285efc2cfb15edee46f94c362b67196d954a89bed3fa1ddb63a09f3a732b826075484331eaaefdfbf325bfcc4277dd97689b0dd64647f9294
MD5 SHA1 SHA512

Submit Download

tdRefHUvxq1d.bat

Path C:\Users\Admin\AppData\Local\Temp\tdRefHUvxq1d.bat
Size 207B
SHA256 c3c0d08ee9effc09dbe82df2e7ff9529c02ccc85b0df69ad7da7a1d3d0f2349f
MD5 f339d3da0b90f1be7cca707a41be6b68
SHA1 9566710665f1ca3f5e8fc006f5d3edd817e86fa2
SHA512 a4627cef1512dc8293029f6ae44f15a2a22f27bdac1ac3351a8e57b6bac41dbc130aafffe5d4e460918efa2602bf732d58ca447bea4977252db10fe79d94f79e
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 ce69ec958fdaf36bbfca7e3aa5135927de730ff9dab62da97e112eae60646967
MD5 7beb6c4ca4f76487fa87841985d89b1d
SHA1 1e5eac3c277b7fb7f3bd4eb8ad53a18afb25c588
SHA512 a21dabee2b19478c0375ec0d8390a893aa2397571ebc4ac3a8d0b54cec8a0d26d846c2a76bb841b748f75e6ebf3d596bb7ad42f8a6fa624282c18c7bd9213e61
SSDEEP 49152:3vvI22SsaNYfdPBldt698dBcjHOQRJ6UbR3LoGdiTHHB72eh2NT:3vg22SsaNYfdPBldt6+dBcjHOQRJ6e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/644-17-0x00007FFD4F1B0000-0x00007FFD4FC71000-memory.dmp

Download

memory/644-9-0x00007FFD4F1B0000-0x00007FFD4FC71000-memory.dmp

Download

memory/644-10-0x00007FFD4F1B0000-0x00007FFD4FC71000-memory.dmp

Download

memory/644-12-0x000000001E120000-0x000000001E1D2000-memory.dmp

Download

memory/644-11-0x000000001E010000-0x000000001E060000-memory.dmp

Download

memory/4864-8-0x00007FFD4F1B0000-0x00007FFD4FC71000-memory.dmp

Download

memory/4864-0-0x00007FFD4F1B3000-0x00007FFD4F1B5000-memory.dmp

Download

memory/4864-2-0x00007FFD4F1B0000-0x00007FFD4FC71000-memory.dmp

Download

memory/4864-1-0x0000000000290000-0x00000000005B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads