quasar | 5b41a8ac5a68ab33e4891ea03533e8ea650c16dd669d277decae2f00217a1e4d

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

563F7_Client-built.exe
Size

3.1MB
MD5

fa5f99ff110280efe85f4663cfb3d6b8
SHA1

ad2d6d8006aee090a4ad5f08ec3425c6353c07d1
SHA256

5b41a8ac5a68ab33e4891ea03533e8ea650c16dd669d277decae2f00217a1e4d
SHA512

a3b898f758060f124c443422c6dc88ba80d9892890b25d21e37a1d3947cd4b9dbef403382ee6e28c1007785a63c5fa387f7d00403db433eb59c03d0b2a88b50e
SSDEEP

49152:evkt62XlaSFNWPjljiFa2RoUYIYiaJpFZwk/zLoGdWr1THHB72eh2NT:ev462XlaSFNWPjljiFXRoUYIlaj

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

havocc.ddns.net:4782

Mutex

6a533ca9-c745-463c-8bba-b6aaa9eb7fab

Attributes

encryption_key
CB213225C623A8CB39D3E1628CD4D7E7D686A7F3
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Discord
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 7 IoCs

resource	yara_rule
behavioral1/memory/2116-1-0x00000000001C0000-0x00000000004E4000-memory.dmp	family_quasar
behavioral1/files/0x000800000001960c-5.dat	family_quasar
behavioral1/memory/2396-9-0x0000000001350000-0x0000000001674000-memory.dmp	family_quasar
behavioral1/memory/2976-33-0x0000000000860000-0x0000000000B84000-memory.dmp	family_quasar
behavioral1/memory/1908-44-0x0000000000D90000-0x00000000010B4000-memory.dmp	family_quasar
behavioral1/memory/272-55-0x0000000000ED0000-0x00000000011F4000-memory.dmp	family_quasar
behavioral1/memory/1020-66-0x0000000001370000-0x0000000001694000-memory.dmp	family_quasar

Executes dropped EXE 11 IoCs

pid	Process
2396	Client.exe
2956	Client.exe
2976	Client.exe
1908	Client.exe
272	Client.exe
1020	Client.exe
1620	Client.exe
2396	Client.exe
1740	Client.exe
2976	Client.exe
520	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3020	PING.EXE
1956	PING.EXE
2280	PING.EXE
2752	PING.EXE
1044	PING.EXE
1736	PING.EXE
2820	PING.EXE
3036	PING.EXE
2256	PING.EXE
112	PING.EXE

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
1956	PING.EXE
3036	PING.EXE
1736	PING.EXE
1044	PING.EXE
112	PING.EXE
3020	PING.EXE
2820	PING.EXE
2280	PING.EXE
2752	PING.EXE
2256	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2864	schtasks.exe
2756	schtasks.exe
2192	schtasks.exe
2888	schtasks.exe
2968	schtasks.exe
2292	schtasks.exe
2144	schtasks.exe
2536	schtasks.exe
2556	schtasks.exe
1748	schtasks.exe
2076	schtasks.exe
1348	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	563F7_Client-built.exe
Token: SeDebugPrivilege	2396	Client.exe
Token: SeDebugPrivilege	2956	Client.exe
Token: SeDebugPrivilege	2976	Client.exe
Token: SeDebugPrivilege	1908	Client.exe
Token: SeDebugPrivilege	272	Client.exe
Token: SeDebugPrivilege	1020	Client.exe
Token: SeDebugPrivilege	1620	Client.exe
Token: SeDebugPrivilege	2396	Client.exe
Token: SeDebugPrivilege	1740	Client.exe
Token: SeDebugPrivilege	2976	Client.exe
Token: SeDebugPrivilege	520	Client.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2396	Client.exe
2956	Client.exe
2976	Client.exe
1908	Client.exe
272	Client.exe
1020	Client.exe
1620	Client.exe
2396	Client.exe
1740	Client.exe
2976	Client.exe
520	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2292	2116	563F7_Client-built.exe	30
PID 2116 wrote to memory of 2292	2116	563F7_Client-built.exe	30
PID 2116 wrote to memory of 2292	2116	563F7_Client-built.exe	30
PID 2116 wrote to memory of 2396	2116	563F7_Client-built.exe	32
PID 2116 wrote to memory of 2396	2116	563F7_Client-built.exe	32
PID 2116 wrote to memory of 2396	2116	563F7_Client-built.exe	32
PID 2396 wrote to memory of 2864	2396	Client.exe	33
PID 2396 wrote to memory of 2864	2396	Client.exe	33
PID 2396 wrote to memory of 2864	2396	Client.exe	33
PID 2396 wrote to memory of 2840	2396	Client.exe	35
PID 2396 wrote to memory of 2840	2396	Client.exe	35
PID 2396 wrote to memory of 2840	2396	Client.exe	35
PID 2840 wrote to memory of 3048	2840	cmd.exe	37
PID 2840 wrote to memory of 3048	2840	cmd.exe	37
PID 2840 wrote to memory of 3048	2840	cmd.exe	37
PID 2840 wrote to memory of 2752	2840	cmd.exe	38
PID 2840 wrote to memory of 2752	2840	cmd.exe	38
PID 2840 wrote to memory of 2752	2840	cmd.exe	38
PID 2840 wrote to memory of 2956	2840	cmd.exe	39
PID 2840 wrote to memory of 2956	2840	cmd.exe	39
PID 2840 wrote to memory of 2956	2840	cmd.exe	39
PID 2956 wrote to memory of 2756	2956	Client.exe	40
PID 2956 wrote to memory of 2756	2956	Client.exe	40
PID 2956 wrote to memory of 2756	2956	Client.exe	40
PID 2956 wrote to memory of 956	2956	Client.exe	42
PID 2956 wrote to memory of 956	2956	Client.exe	42
PID 2956 wrote to memory of 956	2956	Client.exe	42
PID 956 wrote to memory of 2324	956	cmd.exe	44
PID 956 wrote to memory of 2324	956	cmd.exe	44
PID 956 wrote to memory of 2324	956	cmd.exe	44
PID 956 wrote to memory of 3036	956	cmd.exe	45
PID 956 wrote to memory of 3036	956	cmd.exe	45
PID 956 wrote to memory of 3036	956	cmd.exe	45
PID 956 wrote to memory of 2976	956	cmd.exe	46
PID 956 wrote to memory of 2976	956	cmd.exe	46
PID 956 wrote to memory of 2976	956	cmd.exe	46
PID 2976 wrote to memory of 1348	2976	Client.exe	47
PID 2976 wrote to memory of 1348	2976	Client.exe	47
PID 2976 wrote to memory of 1348	2976	Client.exe	47
PID 2976 wrote to memory of 1676	2976	Client.exe	49
PID 2976 wrote to memory of 1676	2976	Client.exe	49
PID 2976 wrote to memory of 1676	2976	Client.exe	49
PID 1676 wrote to memory of 396	1676	cmd.exe	51
PID 1676 wrote to memory of 396	1676	cmd.exe	51
PID 1676 wrote to memory of 396	1676	cmd.exe	51
PID 1676 wrote to memory of 2256	1676	cmd.exe	52
PID 1676 wrote to memory of 2256	1676	cmd.exe	52
PID 1676 wrote to memory of 2256	1676	cmd.exe	52
PID 1676 wrote to memory of 1908	1676	cmd.exe	53
PID 1676 wrote to memory of 1908	1676	cmd.exe	53
PID 1676 wrote to memory of 1908	1676	cmd.exe	53
PID 1908 wrote to memory of 2144	1908	Client.exe	54
PID 1908 wrote to memory of 2144	1908	Client.exe	54
PID 1908 wrote to memory of 2144	1908	Client.exe	54
PID 1908 wrote to memory of 744	1908	Client.exe	56
PID 1908 wrote to memory of 744	1908	Client.exe	56
PID 1908 wrote to memory of 744	1908	Client.exe	56
PID 744 wrote to memory of 1844	744	cmd.exe	58
PID 744 wrote to memory of 1844	744	cmd.exe	58
PID 744 wrote to memory of 1844	744	cmd.exe	58
PID 744 wrote to memory of 1044	744	cmd.exe	59
PID 744 wrote to memory of 1044	744	cmd.exe	59
PID 744 wrote to memory of 1044	744	cmd.exe	59
PID 744 wrote to memory of 272	744	cmd.exe	60

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\563F7_Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\563F7_Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2292
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\LY2VSf67KEdX.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3048
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2752
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2756
    - - C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\lgwyN173p8xf.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:956
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2324
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3036
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1348
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\WAMPeQ5sfF1C.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:396
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2256
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1908
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2144
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\2lpPhGz1dQNi.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1844
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1044
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:272
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2536
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\bNF1qbxybyDP.bat" "
        11⤵
        
        PID:796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:940
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:112
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1020
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2192
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\gKC7NACxW1Ok.bat" "
        13⤵
        
        PID:2308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1528
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1736
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1620
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2556
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\93k5Kbytz2ia.bat" "
        15⤵
        
        PID:2856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2136
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3020
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2396
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2888
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PQ3K6xqP9C9S.bat" "
        17⤵
        
        PID:2348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1784
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1956
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2968
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\uC0Im6Aje4fy.bat" "
        19⤵
        
        PID:3016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2160
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2820
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2976
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1748
        
        C:\Windows\system32\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\jQMLDnRFoNEC.bat" "
        21⤵
        
        PID:2512
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2368
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2280
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:520
        
        C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "Discord" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2lpPhGz1dQNi.bat

Filesize
207B

MD5
8ac5d795ea30ead54c580adee0a50d5b

SHA1
2b29f29938bd8bbf04bd35f889c7b7b3d19d191d

SHA256
f86248ec1ff2c479dd76898cefaa43cbc615cf17339b86fb01f633cd60810d71

SHA512
16da2cc57db54bcc974d44aec07aebde2cf9238d78537eae9042c247c7b5879a994dd684971720dac1fa27d454ad6a5908212855922b73715c1a0969c7c92a5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\93k5Kbytz2ia.bat

Filesize
207B

MD5
46073edbcdd38f495665cc0f402a6baa

SHA1
d279548da0b8bfc4fefa3e3462bfd99b594d4bd0

SHA256
6142065c6043c53a1b5a31164f40e9be84ab94b2ea87b4d04007a2fddfdf5994

SHA512
cb0ac6770bd62bab8b2df831183c0ba5044ed2698fd0f4c9eecda31eab42f6f46dd4600a6e5df46175624268544acf8210d400f691512d39fe692758af2415bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\LY2VSf67KEdX.bat

Filesize
207B

MD5
4632b33559de7f6e4231b50f980bb350

SHA1
065d19c7b1fba35a0ca3c24bc35446fc5f4523e8

SHA256
9ece67d74b6bdb3c6f8b8cd720aec16bdc2ec881847644de9b32bc125da48391

SHA512
141bb13ce92f6fbd79770932738ea70abb82234c19c10a62603bf5a4bdaa5a36e04ef84ee9cb4b6744ed3c17a60c51b31c827a28759324ef9ed794b1e4425fb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\PQ3K6xqP9C9S.bat

Filesize
207B

MD5
d26fbf5a14144b5632b52c60330722de

SHA1
663fb260839808a6a8c9d6d9299ca1a2df1f65c4

SHA256
1abd08cf61437ece1c80d9c003399810d609c3da3fdc3318d908d4e069831b8e

SHA512
a24cd35c1db5895d805f8a37f70a92d145eeaf9cca8f8d203a45806dae096dd58d996015dc6695a7c1b34518d6b4f24b5601ed4fcfc94a93e1e9238907211b93

Download Submit
C:\Users\Admin\AppData\Local\Temp\WAMPeQ5sfF1C.bat

Filesize
207B

MD5
bc1bcd886d55d1acbcae8a2c3d4b2d17

SHA1
e0099146b6721656c97c2e29722533d20adc024f

SHA256
a34b38061bbbbe7dd65ffbdc9b637ab721c6452c9863d5c97c088854497eaf7c

SHA512
163831ef7ef5d19d674a97d208e376f0caaeb50e0b0a904d94bc07b8f8c60318aff27a02220a0d1cc2ca2045d945917beb92c0218c1823852962d697ac9bb35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bNF1qbxybyDP.bat

Filesize
207B

MD5
5e6d3bb4a37ef110febb93d06aeeaa4b

SHA1
ec3a5afd64821e12482bad462d1a4305a09fb116

SHA256
48033991b6ff2a0c8304ef57d530d687d6f95e77eead59fa77f9593fbd580b59

SHA512
171587b6717c2e7affbbc6f084f60e03f0a55ac63d43066fb5f63323784e66b27758b1836347751eed597db1cdd45f67207e2e3aeb12c598e75669303f19087e

Download Submit
C:\Users\Admin\AppData\Local\Temp\gKC7NACxW1Ok.bat

Filesize
207B

MD5
5441a0d6079090143c959336188bd05b

SHA1
f397eaa67ec729638c2d62599a4a7b9eb16b472e

SHA256
8b51b5b1f4665a7aad96f79906a590060849eeca36426d0a45af4f66a6ef596c

SHA512
0e0ebc9451f84edae1565ddda7fab49af1c3acd0c685d7fc86e3b856ac044574d58f0bad60551ef22476e2a4ba46dd542284aa3dc383d0d8b70b1648d3ff6258

Download Submit
C:\Users\Admin\AppData\Local\Temp\jQMLDnRFoNEC.bat

Filesize
207B

MD5
bf4d706cab07916702bf001de855de6f

SHA1
8a5348753f1f23f24eaa68c919b560810cf1645e

SHA256
0b695b69bf19354baf3381be710c9f40bf2c5f543bfbdf422502d6a0ea537a24

SHA512
36dfac3eb121bc7490ca5da2f0fb790f2d786a2f42649fd6e84ec460a50ac3faf64c0349367e71092e142c732593c335354b492da911db3147099a7ea3e61df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\lgwyN173p8xf.bat

Filesize
207B

MD5
40584fcca32906451f9812b09661ab50

SHA1
a4a6c1824d18ae8d46b94bfc8f73df53da45bfb1

SHA256
76bfae977435f93003466174273c94220d823308416dde202c2a9060472318dd

SHA512
ea70b2b3b152fade58f71fba97ffab1f888a5c6bdee1fe967258389aac73df477850a047a1092d76ef8c02d0d202cf9706332e39d5eab53a862ff697293b44bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\uC0Im6Aje4fy.bat

Filesize
207B

MD5
a83611ee40526b4d957760f11d5ef7da

SHA1
1ba5d798d0c87a81bad4d45f622fbdeb8be05c89

SHA256
f38ba71dc6b288175585526b466b243fd52a5170b1dbef8d4fdddebad02724a1

SHA512
28e59cb0985802085a3dcfc82789c268c786c30986dda76a710a9632c2baea1bd0395a75cb97d5e98071d2363e004c29ffb04450eadecf84fb304d36052bf315

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
3.1MB

MD5
fa5f99ff110280efe85f4663cfb3d6b8

SHA1
ad2d6d8006aee090a4ad5f08ec3425c6353c07d1

SHA256
5b41a8ac5a68ab33e4891ea03533e8ea650c16dd669d277decae2f00217a1e4d

SHA512
a3b898f758060f124c443422c6dc88ba80d9892890b25d21e37a1d3947cd4b9dbef403382ee6e28c1007785a63c5fa387f7d00403db433eb59c03d0b2a88b50e

Download Submit
memory/272-55-0x0000000000ED0000-0x00000000011F4000-memory.dmp

Filesize
3.1MB

Download
memory/1020-66-0x0000000001370000-0x0000000001694000-memory.dmp

Filesize
3.1MB

Download
memory/1908-44-0x0000000000D90000-0x00000000010B4000-memory.dmp

Filesize
3.1MB

Download
memory/2116-0-0x000007FEF6183000-0x000007FEF6184000-memory.dmp

Filesize
4KB

Download
memory/2116-10-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-2-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2116-1-0x00000000001C0000-0x00000000004E4000-memory.dmp

Filesize
3.1MB

Download
memory/2396-21-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2396-11-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2396-9-0x0000000001350000-0x0000000001674000-memory.dmp

Filesize
3.1MB

Download
memory/2396-8-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmp

Filesize
9.9MB

Download
memory/2976-33-0x0000000000860000-0x0000000000B84000-memory.dmp

Filesize
3.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads