quasar | 8f56584766e1e447c0436b9f7ef4ac2ecd7424715feb08fc6d99e6c176217c81

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

quasar office04 discovery spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

biseo-48321.portmap.host:48321

14.243.221.170:2654

Mutex

cb74f432-50f1-4947-8163-7687a0292fb0

Attributes

encryption_key
D1BBEF3C04D88FE8F97EE2745041632CE9C760EE
install_name
Svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Svchost
subdirectory
Svchost

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0002000000021ed4-44.dat	family_quasar
behavioral1/memory/3672-52-0x00000000002A0000-0x00000000005C4000-memory.dmp	family_quasar
behavioral1/files/0x0003000000000707-83.dat	family_quasar
behavioral1/memory/620-90-0x00000000005B0000-0x00000000008D4000-memory.dmp	family_quasar

Downloads MZ/PE file 3 IoCs

flow	pid	Process
55	1972	4363463463464363463463463.exe
16	1972	4363463463464363463463463.exe
71	1972	4363463463464363463463463.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	Svchost.exe

Executes dropped EXE 10 IoCs

pid	Process
2060	adm_atu.exe
3672	Client-built.exe
4508	Svchost.exe
3096	Svchost.exe
4976	Svchost.exe
620	Runtime%20Broker.exe
4224	Svchost.exe
2396	Svchost.exe
4480	Svchost.exe
4748	Svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
54	raw.githubusercontent.com
55	raw.githubusercontent.com

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023cbf-10.dat	upx
behavioral1/memory/2060-13-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2060-30-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2060-39-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adm_atu.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4080	PING.EXE
1660	PING.EXE
2468	PING.EXE
2064	PING.EXE
2164	PING.EXE
4700	PING.EXE
4292	PING.EXE

Runs ping.exe 1 TTPs 7 IoCs

Remote System Discovery

T1018

pid	Process
1660	PING.EXE
2468	PING.EXE
2064	PING.EXE
2164	PING.EXE
4700	PING.EXE
4292	PING.EXE
4080	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2988	schtasks.exe
4332	schtasks.exe
4400	schtasks.exe
464	schtasks.exe
4080	schtasks.exe
4680	schtasks.exe
1616	schtasks.exe
2476	schtasks.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	4363463463464363463463463.exe
Token: SeDebugPrivilege	3672	Client-built.exe
Token: SeDebugPrivilege	4508	Svchost.exe
Token: SeDebugPrivilege	3096	Svchost.exe
Token: SeDebugPrivilege	4976	Svchost.exe
Token: SeDebugPrivilege	620	Runtime%20Broker.exe
Token: SeDebugPrivilege	4224	Svchost.exe
Token: SeDebugPrivilege	2396	Svchost.exe
Token: SeDebugPrivilege	4480	Svchost.exe
Token: SeDebugPrivilege	4748	Svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2060	1972	4363463463464363463463463.exe	99
PID 1972 wrote to memory of 2060	1972	4363463463464363463463463.exe	99
PID 1972 wrote to memory of 2060	1972	4363463463464363463463463.exe	99
PID 1972 wrote to memory of 3672	1972	4363463463464363463463463.exe	103
PID 1972 wrote to memory of 3672	1972	4363463463464363463463463.exe	103
PID 3672 wrote to memory of 4332	3672	Client-built.exe	104
PID 3672 wrote to memory of 4332	3672	Client-built.exe	104
PID 3672 wrote to memory of 4508	3672	Client-built.exe	106
PID 3672 wrote to memory of 4508	3672	Client-built.exe	106
PID 4508 wrote to memory of 4400	4508	Svchost.exe	107
PID 4508 wrote to memory of 4400	4508	Svchost.exe	107
PID 4508 wrote to memory of 3560	4508	Svchost.exe	110
PID 4508 wrote to memory of 3560	4508	Svchost.exe	110
PID 3560 wrote to memory of 3128	3560	cmd.exe	112
PID 3560 wrote to memory of 3128	3560	cmd.exe	112
PID 3560 wrote to memory of 1660	3560	cmd.exe	113
PID 3560 wrote to memory of 1660	3560	cmd.exe	113
PID 3560 wrote to memory of 3096	3560	cmd.exe	115
PID 3560 wrote to memory of 3096	3560	cmd.exe	115
PID 3096 wrote to memory of 464	3096	Svchost.exe	116
PID 3096 wrote to memory of 464	3096	Svchost.exe	116
PID 3096 wrote to memory of 1752	3096	Svchost.exe	119
PID 3096 wrote to memory of 1752	3096	Svchost.exe	119
PID 1752 wrote to memory of 3528	1752	cmd.exe	121
PID 1752 wrote to memory of 3528	1752	cmd.exe	121
PID 1752 wrote to memory of 2468	1752	cmd.exe	122
PID 1752 wrote to memory of 2468	1752	cmd.exe	122
PID 1752 wrote to memory of 4976	1752	cmd.exe	124
PID 1752 wrote to memory of 4976	1752	cmd.exe	124
PID 4976 wrote to memory of 4080	4976	Svchost.exe	125
PID 4976 wrote to memory of 4080	4976	Svchost.exe	125
PID 4976 wrote to memory of 5028	4976	Svchost.exe	128
PID 4976 wrote to memory of 5028	4976	Svchost.exe	128
PID 5028 wrote to memory of 888	5028	cmd.exe	130
PID 5028 wrote to memory of 888	5028	cmd.exe	130
PID 5028 wrote to memory of 2064	5028	cmd.exe	131
PID 5028 wrote to memory of 2064	5028	cmd.exe	131
PID 1972 wrote to memory of 620	1972	4363463463464363463463463.exe	133
PID 1972 wrote to memory of 620	1972	4363463463464363463463463.exe	133
PID 5028 wrote to memory of 4224	5028	cmd.exe	134
PID 5028 wrote to memory of 4224	5028	cmd.exe	134
PID 4224 wrote to memory of 4680	4224	Svchost.exe	135
PID 4224 wrote to memory of 4680	4224	Svchost.exe	135
PID 4224 wrote to memory of 4008	4224	Svchost.exe	138
PID 4224 wrote to memory of 4008	4224	Svchost.exe	138
PID 4008 wrote to memory of 4532	4008	cmd.exe	140
PID 4008 wrote to memory of 4532	4008	cmd.exe	140
PID 4008 wrote to memory of 2164	4008	cmd.exe	141
PID 4008 wrote to memory of 2164	4008	cmd.exe	141
PID 4008 wrote to memory of 2396	4008	cmd.exe	143
PID 4008 wrote to memory of 2396	4008	cmd.exe	143
PID 2396 wrote to memory of 1616	2396	Svchost.exe	144
PID 2396 wrote to memory of 1616	2396	Svchost.exe	144
PID 2396 wrote to memory of 1308	2396	Svchost.exe	147
PID 2396 wrote to memory of 1308	2396	Svchost.exe	147
PID 1308 wrote to memory of 3176	1308	cmd.exe	149
PID 1308 wrote to memory of 3176	1308	cmd.exe	149
PID 1308 wrote to memory of 4700	1308	cmd.exe	150
PID 1308 wrote to memory of 4700	1308	cmd.exe	150
PID 1308 wrote to memory of 4480	1308	cmd.exe	152
PID 1308 wrote to memory of 4480	1308	cmd.exe	152
PID 4480 wrote to memory of 2476	4480	Svchost.exe	153
PID 4480 wrote to memory of 2476	4480	Svchost.exe	153
PID 4480 wrote to memory of 5076	4480	Svchost.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2060
- C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4332
- - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
    "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4400
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gUSd9LjTsydx.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3560
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3128
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1660
    - - C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3096
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:464
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kgeqTkv8jQEw.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3528
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2468
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9IcNPfZWUpYj.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:888
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2064
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4680
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CTsvZHeM0WnJ.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2164
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\45qpLfIjo3Xf.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3176
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4700
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4480
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GQFd5C0wbT9m.bat" "
        14⤵
        
        PID:5076
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1920
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4292
        
        C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
        15⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4748
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Lo0g7okaSe42.bat" "
        16⤵
        
        PID:4524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:3688
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4080
- C:\Users\Admin\AppData\Local\Temp\Files\Runtime%20Broker.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Runtime%20Broker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Svchost.exe.log

Filesize
2KB

MD5
8f0271a63446aef01cf2bfc7b7c7976b

SHA1
b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7

SHA256
da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c

SHA512
78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\45qpLfIjo3Xf.bat

Filesize
209B

MD5
4edaac69fa688cdbc053be82724b0a0e

SHA1
658bbc652a6ed1d136e4f097bda2ad8f8ecf1db7

SHA256
69bac7e792aa4792954ee56f5f6b7404cc7647d09b99d39c32e99db2e51cab8a

SHA512
b443e661c983a061f95ae23a044cb3ca66520960cd279eb63619bbfdb50bc9c21915f5e16cf1c4f82e156fca76ec87afef1f77a5e0f43291467947b4cf3d6401

Download Submit
C:\Users\Admin\AppData\Local\Temp\9IcNPfZWUpYj.bat

Filesize
209B

MD5
7560e30806640ff76abdace6d6161004

SHA1
255fc5b7b9d9571a1280a4ad3d5d65a06539a4fb

SHA256
6beb516848e5a2f7790490576af51de5a5b3327de8b865afce427a987775a84c

SHA512
6ba2b0ba2b7df9d3cd391674ba9fccf6d1f51db519789d849cbd00b974fac238e2625deab61b67fe1727724ca40694de854250e18656f2eb71c04481cc54561e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CTsvZHeM0WnJ.bat

Filesize
209B

MD5
0c82b32c5310adcb05510ee7cf2309c1

SHA1
8fa242646123fbe0dd20b9faba5de6526215c18b

SHA256
66234e613c6d3e54e42237fca8c05d72a5871b895b51fb0da750b9f31a7b2137

SHA512
a0dd8eb120be08cccf67a45fb626eb9e43a9537e7d79e54e78112c92b540d9a1f5c3e9d45d7107bb7f2307c750a26e6a77cf3b90fa1bd47f34efea15cdcdd0d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\FE56A.tmp

Filesize
127B

MD5
294317134d9f8c66330f71049ee83041

SHA1
710c07c3bffa3a3939edc0bc8d00e57fe31cf1c8

SHA256
5d91d78ba765b994ce05b94ad50eadd2d18689077b25e5452fcbf551656d7267

SHA512
9e5ae4669a677ccd4778feafc29436e295b6b4fb1fbdf6ac103f81699b1fc41d7c71f551d53b9358aeb62bcf4446cec1e052e0f3c73118f26760f9c09fed45d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe

Filesize
3.1MB

MD5
f9fd797dbef56a3900d2fe9d0a6e2e86

SHA1
c5d002cc63bd21fa35fdad428ca4c909f34c4309

SHA256
b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e

SHA512
c4d170855397e2e62d754883b2caab00d14f58787463924141d2077997ee03b25cd752565354c1c4cbace637cf1c053c45a162d0b61b31caa73f1ec70b998ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Runtime%20Broker.exe

Filesize
3.1MB

MD5
6f154cc5f643cc4228adf17d1ff32d42

SHA1
10efef62da024189beb4cd451d3429439729675b

SHA256
bf901de5b54a593b3d90a2bcfdf0a963ba52381f542bf33299bdfcc3b5b2afff

SHA512
050fc8a9a852d87f22296be8fe4067d6fabefc2dec408da3684a0deb31983617e8ba42494d3dbe75207d0810dec7ae1238b17b23ed71668cc099a31e1f6539d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\adm_atu.exe

Filesize
5.9MB

MD5
557401ef9c2dc1c5af9441e015c38db3

SHA1
af1fd1da7c1c90ba1416651fc64390b0eea5aad4

SHA256
79d55475a80f2635c1e56b45b0f9f28834bda1c1828a69fe14b4a47f7175e4be

SHA512
3976c255508ea86411076a4becff60ad11d8d13e15bc0b49489d0f95110755ab27830d0ec6e094097a5f8221a8840cf4a9024f9f0090b14284375359aec72ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\GQFd5C0wbT9m.bat

Filesize
209B

MD5
375c381096a1ee19a411783155b0629f

SHA1
7ee3b28e44e456c2b9a087496a2a23de6b35a80d

SHA256
e09bb9dd8bcac62b7418f4785b3fc2ab762c701c25a53d119e802a57f230e7b0

SHA512
61e4a45ba8f06df1f0d55771f3ab1c738160759d982425525a0333ac6c8aa773ee542601e429b1ca9f6aec07239e10404870721761b4e1ca48ab1ec06397c122

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lo0g7okaSe42.bat

Filesize
209B

MD5
502a487edd68c14c2dab1cfdabd2664a

SHA1
fb8e2b0bf820ac4367f8cebedec216b41b06b839

SHA256
65fd2553ef0dd2da984095cc503014cf2ba1679e371aea2ece7f5f3fa273d0c7

SHA512
5f48a6afbcfc9b62741e03c1939d1d68e4e40e3691965c293ac4c0dbba6e2ec20ea3b2be76be87e12a1fd1847d3eb1e7a9ee1d7190d70496dab507ed602d2a91

Download Submit
C:\Users\Admin\AppData\Local\Temp\gUSd9LjTsydx.bat

Filesize
209B

MD5
d2955636478ead79d0116c20b8a64185

SHA1
c7ebe112e792b3d71996abb55750493483f6e4c9

SHA256
8c6ce36f2c48239becab7cb397b86707bc50ead4d08bd6da55aa4c16e9cc3554

SHA512
ac9618d57f06a186e396a8c99545c94b4c05ca5842b0249876f837ae717ced25f80d1ae3a724a7ba4408ad99c2c171ef29d9d8bdba68abd3b94e06b64607a0a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\kgeqTkv8jQEw.bat

Filesize
209B

MD5
07c5d41873d4361183274980cb215ebb

SHA1
84318b4eb750ce3c110dc27cf58b4dca1d994a55

SHA256
a6fe7f2af4c5ac907bd42ec6b8d737aea3330de7b158bd800fdc9e1665e2b9d0

SHA512
c0689b40fd0623aeb2ed09fe65ae4eb93dfdc4c6b95aa77e9d273d58d9697dd4dd3436eb7f89b8336e73de60dab289e479a2c00b51ec4e938277da9821ddcbcd

Download Submit
memory/620-90-0x00000000005B0000-0x00000000008D4000-memory.dmp

Filesize
3.1MB

Download
memory/1972-2-0x00000000058D0000-0x000000000596C000-memory.dmp

Filesize
624KB

Download
memory/1972-5-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/1972-3-0x0000000074660000-0x0000000074E10000-memory.dmp

Filesize
7.7MB

Download
memory/1972-1-0x0000000000F10000-0x0000000000F18000-memory.dmp

Filesize
32KB

Download
memory/1972-4-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1972-0-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/2060-13-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2060-39-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2060-30-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3672-60-0x00007FF91D620000-0x00007FF91E0E1000-memory.dmp

Filesize
10.8MB

Download
memory/3672-53-0x00007FF91D620000-0x00007FF91E0E1000-memory.dmp

Filesize
10.8MB

Download
memory/3672-52-0x00000000002A0000-0x00000000005C4000-memory.dmp

Filesize
3.1MB

Download
memory/3672-51-0x00007FF91D623000-0x00007FF91D625000-memory.dmp

Filesize
8KB

Download
memory/4508-62-0x000000001CCC0000-0x000000001CD72000-memory.dmp

Filesize
712KB

Download
memory/4508-61-0x000000001C390000-0x000000001C3E0000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads