quasar | 38be048dda9dfebcea59c2cbf3cf2abb971b96636aefabc8cafa5359efb63bc2

Analysis

max time kernel
75s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 03:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Solara V3/SolaraV3.exe
Size

3.1MB
MD5

3db0c6fb25d98ede3749c5c296227708
SHA1

5d7843d185e9d7f56490bd03094f49c1444fa92a
SHA256

604e26e36c395712913a141ef96bc461385eea54d2182d170196dfee458ea82f
SHA512

461df5b25d7d14d340729177a987f254425d0bf57ca6f00853278d7640c40b6e52966a6465c0add70193fce2fc7a66555f1338e6a3f9eb28e85f3f5bab64b452
SSDEEP

49152:xvrI22SsaNYfdPBldt698dBcjHE82wvBx5ZoGdD3THHB72eh2NT:xvU22SsaNYfdPBldt6+dBcjHiwr

Score

10^/10

quasar robot discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

robot

tcp://quasarrat12345-50279.portmap.host:50279

Mutex

5b3b6ef6-1f5c-4cf2-a902-f38fc18c6f74

Attributes

encryption_key
044C06AD5B6394C7D3CCD0919FA2C67D30EA87D4
install_name
SolaraV3.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3908-1-0x0000000000CE0000-0x0000000001008000-memory.dmp	family_quasar
behavioral2/files/0x000a000000023b96-6.dat	family_quasar

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SolaraV3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SolaraV3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SolaraV3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SolaraV3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SolaraV3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SolaraV3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SolaraV3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	SolaraV3.exe

Executes dropped EXE 8 IoCs

pid	Process
2244	SolaraV3.exe
1676	SolaraV3.exe
2228	SolaraV3.exe
4952	SolaraV3.exe
2900	SolaraV3.exe
4704	SolaraV3.exe
1316	SolaraV3.exe
924	SolaraV3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3408	PING.EXE
4876	PING.EXE
1488	PING.EXE
4544	PING.EXE
1672	PING.EXE
2808	PING.EXE
216	PING.EXE
2912	PING.EXE

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
4876	PING.EXE
1488	PING.EXE
4544	PING.EXE
1672	PING.EXE
2808	PING.EXE
216	PING.EXE
2912	PING.EXE
3408	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3248	schtasks.exe
4108	schtasks.exe
4424	schtasks.exe
3732	schtasks.exe
4952	schtasks.exe
2600	schtasks.exe
776	schtasks.exe
2808	schtasks.exe
4936	schtasks.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3908	SolaraV3.exe
Token: SeDebugPrivilege	2244	SolaraV3.exe
Token: SeDebugPrivilege	1676	SolaraV3.exe
Token: SeDebugPrivilege	2228	SolaraV3.exe
Token: SeDebugPrivilege	4952	SolaraV3.exe
Token: SeDebugPrivilege	2900	SolaraV3.exe
Token: SeDebugPrivilege	4704	SolaraV3.exe
Token: SeDebugPrivilege	1316	SolaraV3.exe
Token: SeDebugPrivilege	924	SolaraV3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4952	3908	SolaraV3.exe	83
PID 3908 wrote to memory of 4952	3908	SolaraV3.exe	83
PID 3908 wrote to memory of 2244	3908	SolaraV3.exe	85
PID 3908 wrote to memory of 2244	3908	SolaraV3.exe	85
PID 2244 wrote to memory of 2600	2244	SolaraV3.exe	86
PID 2244 wrote to memory of 2600	2244	SolaraV3.exe	86
PID 2244 wrote to memory of 3564	2244	SolaraV3.exe	88
PID 2244 wrote to memory of 3564	2244	SolaraV3.exe	88
PID 3564 wrote to memory of 3696	3564	cmd.exe	90
PID 3564 wrote to memory of 3696	3564	cmd.exe	90
PID 3564 wrote to memory of 216	3564	cmd.exe	91
PID 3564 wrote to memory of 216	3564	cmd.exe	91
PID 3564 wrote to memory of 1676	3564	cmd.exe	101
PID 3564 wrote to memory of 1676	3564	cmd.exe	101
PID 1676 wrote to memory of 3248	1676	SolaraV3.exe	102
PID 1676 wrote to memory of 3248	1676	SolaraV3.exe	102
PID 1676 wrote to memory of 1336	1676	SolaraV3.exe	105
PID 1676 wrote to memory of 1336	1676	SolaraV3.exe	105
PID 1336 wrote to memory of 4116	1336	cmd.exe	107
PID 1336 wrote to memory of 4116	1336	cmd.exe	107
PID 1336 wrote to memory of 2912	1336	cmd.exe	108
PID 1336 wrote to memory of 2912	1336	cmd.exe	108
PID 1336 wrote to memory of 2228	1336	cmd.exe	115
PID 1336 wrote to memory of 2228	1336	cmd.exe	115
PID 2228 wrote to memory of 776	2228	SolaraV3.exe	116
PID 2228 wrote to memory of 776	2228	SolaraV3.exe	116
PID 2228 wrote to memory of 4648	2228	SolaraV3.exe	118
PID 2228 wrote to memory of 4648	2228	SolaraV3.exe	118
PID 4648 wrote to memory of 3504	4648	cmd.exe	121
PID 4648 wrote to memory of 3504	4648	cmd.exe	121
PID 4648 wrote to memory of 3408	4648	cmd.exe	122
PID 4648 wrote to memory of 3408	4648	cmd.exe	122
PID 4648 wrote to memory of 4952	4648	cmd.exe	126
PID 4648 wrote to memory of 4952	4648	cmd.exe	126
PID 4952 wrote to memory of 2808	4952	SolaraV3.exe	127
PID 4952 wrote to memory of 2808	4952	SolaraV3.exe	127
PID 4952 wrote to memory of 2600	4952	SolaraV3.exe	130
PID 4952 wrote to memory of 2600	4952	SolaraV3.exe	130
PID 2600 wrote to memory of 2692	2600	cmd.exe	132
PID 2600 wrote to memory of 2692	2600	cmd.exe	132
PID 2600 wrote to memory of 4876	2600	cmd.exe	133
PID 2600 wrote to memory of 4876	2600	cmd.exe	133
PID 2600 wrote to memory of 2900	2600	cmd.exe	136
PID 2600 wrote to memory of 2900	2600	cmd.exe	136
PID 2900 wrote to memory of 4108	2900	SolaraV3.exe	137
PID 2900 wrote to memory of 4108	2900	SolaraV3.exe	137
PID 2900 wrote to memory of 2688	2900	SolaraV3.exe	140
PID 2900 wrote to memory of 2688	2900	SolaraV3.exe	140
PID 2688 wrote to memory of 4868	2688	cmd.exe	142
PID 2688 wrote to memory of 4868	2688	cmd.exe	142
PID 2688 wrote to memory of 1488	2688	cmd.exe	143
PID 2688 wrote to memory of 1488	2688	cmd.exe	143
PID 2688 wrote to memory of 4704	2688	cmd.exe	145
PID 2688 wrote to memory of 4704	2688	cmd.exe	145
PID 4704 wrote to memory of 4424	4704	SolaraV3.exe	146
PID 4704 wrote to memory of 4424	4704	SolaraV3.exe	146
PID 4704 wrote to memory of 4800	4704	SolaraV3.exe	148
PID 4704 wrote to memory of 4800	4704	SolaraV3.exe	148
PID 4800 wrote to memory of 3028	4800	cmd.exe	151
PID 4800 wrote to memory of 3028	4800	cmd.exe	151
PID 4800 wrote to memory of 4544	4800	cmd.exe	152
PID 4800 wrote to memory of 4544	4800	cmd.exe	152
PID 4800 wrote to memory of 1316	4800	cmd.exe	154
PID 4800 wrote to memory of 1316	4800	cmd.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Solara V3\SolaraV3.exe
"C:\Users\Admin\AppData\Local\Temp\Solara V3\SolaraV3.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4952
- C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AlfFspXr6oUJ.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3696
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:216
  - - C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1676
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3248
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s58clwEcgqiO.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1336
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4116
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2912
      - C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2228
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AY8jF2NUkJ1O.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3504
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3408
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oObI3hiV5f1A.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2692
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4876
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\75VDv8yIuuPc.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4868
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1488
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4N0gC8McEqVU.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4544
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vzrGQNyJYk5w.bat" "
        15⤵
        
        PID:708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:756
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1672
        
        C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Windows Update" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vAoch81vk9IX.bat" "
        17⤵
        
        PID:2884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SolaraV3.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Temp\4N0gC8McEqVU.bat

Filesize
209B

MD5
28fc9cf6f36c590c304112831d2042fe

SHA1
3af58c00439a9ae7c5be170ce2a09c92ee913ed5

SHA256
da58064137a41e1b66b8ee6d853324f6a38067678c331b0985f5a460c9dfcbcd

SHA512
d39171a5e630e0374c9267bf92b930756c72e84e9e45897b5911dd87e1c9738d50bfbccdb1cf9c56c5ef83b0bffde0057d36ffcad37dddc6eeff40c9d3b04539

Download Submit
C:\Users\Admin\AppData\Local\Temp\75VDv8yIuuPc.bat

Filesize
209B

MD5
0ce927033a5c88d7f4b2e8735fd0b923

SHA1
e3e9885a5ec17c6f5dc165cb3fb32f285cc547e7

SHA256
0f820c37172e4b1cc930ab3bfc7577275cf40c79448a820cc1cf5e63d3463433

SHA512
700fbb03c8b2fbdfe113a0cb80eac8f0137b81bf2b0ee432d0b3238d9de0ecb68491d97f339369f719cb68ba1e9a7fdfd0da6bafaee2c3fe3db28c341447f106

Download Submit
C:\Users\Admin\AppData\Local\Temp\AY8jF2NUkJ1O.bat

Filesize
209B

MD5
c0fbb4e229cf2eb2a071b2bcfde9ca3a

SHA1
2aa665279bedbc4d45af6f1bcecddf719a8ebe52

SHA256
c75883486bb79f5f12d0e56d466b336f2f7fee6575d764dbaf2058587e429943

SHA512
94b752c7ebcc7837e203d1d28c5df152941e2a47d1efb6b1db6a11ceb2e1f1b664ce3f9e6d9939bd3cdf6be453cb06c9d7ad2891dc2c56beb4146bff13afccdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\AlfFspXr6oUJ.bat

Filesize
209B

MD5
b6b10247c29fa5cc3556a64283cd0cd1

SHA1
b6dca5bf2ba6b9bee20098456b1dce9c0bf1d675

SHA256
4d6ac4150d74957004aca46663bbfccfe99b6387067194032d2774ee26cb0694

SHA512
2b1fab50287c3d1fcd17ecdefe0fc98468cd13e6cec876b740057daf9ba238bd24efff748a2d7100c22212482259636367e9512f987d5f5751171ccf6c995445

Download Submit
C:\Users\Admin\AppData\Local\Temp\oObI3hiV5f1A.bat

Filesize
209B

MD5
ea7d56b1381cc9e0bf52defc2bf56f56

SHA1
2f663b85e0b07cd9bafa0a9ac82b2119fa35b213

SHA256
23783688010dad1fa49d5535cde4d22ae4c6b46e9df14ab35f536387ab5202a7

SHA512
5484128f37138d83bf8c46b6adef41b8e8d2f1e3fab650db5c7955a6fe5efa6deb885988e912bf4579c1de4103705df219ff7250fcf8176e53d60a7886393ed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\s58clwEcgqiO.bat

Filesize
209B

MD5
8869069a5bb5f59e81a4a58c57f21128

SHA1
2d7ce2d895a35cd064ce714c9beec07ea54d61a9

SHA256
e84ef407dc2da83c7f26bdee260551d1c6d7ac39bb58c143f2f7405e12c4d285

SHA512
1a8c2a5f3a0d8aa0826ed1bd426c12d36297f21635a7a32dca2af24717f97b77e306a359a844b12a3f6bd93ba46a70fdd7b962de5eb9a55322b2cc3eaaf1f272

Download Submit
C:\Users\Admin\AppData\Local\Temp\vAoch81vk9IX.bat

Filesize
209B

MD5
f50c108cabd5f71257d412d37bd5ab1b

SHA1
ab1d2e1b231b6fd4c9efa1ea1a946d5d8b416e14

SHA256
614aca1b9d1ecdd020a4227c9fde5c8245f89f4f6bb015429b4f3d1b2946d215

SHA512
92692bf4fb3c6cbfe0383437d216ebf13d8df1d5db711443708720100a627949623079c0e645bf226a7316e245945cbac790854eb09b9d0ee488e2f60cacb0f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\vzrGQNyJYk5w.bat

Filesize
209B

MD5
f920a72f7948e01637de03ae7562d6d7

SHA1
1c726975aea7709b2e8940262cff25be20a03546

SHA256
4c35f27d1b56a5a8948663137ddf73272cb4c287d97abcb7da06798e278f72df

SHA512
422af4840134930092296d5cededf6142840d4657ed8ef6f4a00b72dd7499db01f9f3bc7f0005ae9faad13fc2b1ce23375264863e6943df727ae8b122d7362a9

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\SolaraV3.exe

Filesize
3.1MB

MD5
3db0c6fb25d98ede3749c5c296227708

SHA1
5d7843d185e9d7f56490bd03094f49c1444fa92a

SHA256
604e26e36c395712913a141ef96bc461385eea54d2182d170196dfee458ea82f

SHA512
461df5b25d7d14d340729177a987f254425d0bf57ca6f00853278d7640c40b6e52966a6465c0add70193fce2fc7a66555f1338e6a3f9eb28e85f3f5bab64b452

Download Submit
memory/2244-12-0x00007FFCD4320000-0x00007FFCD4DE1000-memory.dmp

Filesize
10.8MB

Download
memory/2244-13-0x000000001BB10000-0x000000001BB60000-memory.dmp

Filesize
320KB

Download
memory/2244-14-0x000000001BC20000-0x000000001BCD2000-memory.dmp

Filesize
712KB

Download
memory/2244-18-0x00007FFCD4320000-0x00007FFCD4DE1000-memory.dmp

Filesize
10.8MB

Download
memory/2244-11-0x00007FFCD4320000-0x00007FFCD4DE1000-memory.dmp

Filesize
10.8MB

Download
memory/3908-0-0x00007FFCD4323000-0x00007FFCD4325000-memory.dmp

Filesize
8KB

Download
memory/3908-10-0x00007FFCD4320000-0x00007FFCD4DE1000-memory.dmp

Filesize
10.8MB

Download
memory/3908-2-0x00007FFCD4320000-0x00007FFCD4DE1000-memory.dmp

Filesize
10.8MB

Download
memory/3908-1-0x0000000000CE0000-0x0000000001008000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads