quasar | b8a46aa74b7e451ca9ae336258971d7d46334b37c487da00a6039c1d146f6d62

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Size

365KB
MD5

57e44c04fcf797cc96f11a5e539dcf45
SHA1

ccb1a5049980889cfe8d96ceba005c536d25e017
SHA256

b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc
SHA512

9caf54fb294cd085bbd0337d70a9bfc0b11351a9ea46b0a09fc6a5e869bd8b15a6ea514f758aed9169894c82f271611f1ecb10570f99a0b76a79e28b3b462c95
SSDEEP

6144:Yx6bPXhLApfpIcE/ckl2La1bz4uUYHD7XKj8lxfBA66Ec2KHv:4mhAp8Bl9N4lkmj8RA6pcL

Score

10^/10

quasar win_update_2023 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Win_Update_2023

butterflybourne.ddns.net:4782

Mutex

QSR_MUTEX_zD2aPCc6Z0MX6eOBsy

Attributes

encryption_key
JzQzojcImiy4nU59S0ns
install_name
custom.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Win_Update_2023
subdirectory
SubDir

Signatures

Quasar RAT 5 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

description	flow	ioc	Process
Key opened		\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
	2	ip-api.com	Process not Found
	7	api.ipify.org	Process not Found
	14	ip-api.com	Process not Found
	21	ip-api.com	Process not Found

Quasar family
quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral11/memory/2380-1-0x0000000000CD0000-0x0000000000D32000-memory.dmp	family_quasar
behavioral11/files/0x0038000000012275-6.dat	family_quasar
behavioral11/memory/2728-11-0x0000000001390000-0x00000000013F2000-memory.dmp	family_quasar
behavioral11/memory/1184-34-0x0000000001390000-0x00000000013F2000-memory.dmp	family_quasar
behavioral11/memory/2376-120-0x0000000001390000-0x00000000013F2000-memory.dmp	family_quasar
behavioral11/memory/1028-138-0x0000000001390000-0x00000000013F2000-memory.dmp	family_quasar

Executes dropped EXE 11 IoCs

pid	Process
2728	custom.exe
1184	custom.exe
2008	custom.exe
1528	custom.exe
2788	custom.exe
3012	custom.exe
2376	custom.exe
1028	custom.exe
560	custom.exe
2636	custom.exe
1660	custom.exe

Loads dropped DLL 56 IoCs

pid	Process
2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe
2556	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
1156	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
948	WerFault.exe
1584	WerFault.exe
1584	WerFault.exe
1584	WerFault.exe
1584	WerFault.exe
1584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
584	WerFault.exe
1892	WerFault.exe
1892	WerFault.exe
1892	WerFault.exe
1892	WerFault.exe
1892	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
2168	WerFault.exe
1484	WerFault.exe
1484	WerFault.exe
1484	WerFault.exe
1484	WerFault.exe
1484	WerFault.exe
1584	WerFault.exe
1584	WerFault.exe
1584	WerFault.exe
1584	WerFault.exe
1584	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
3032	WerFault.exe
2372	WerFault.exe
2372	WerFault.exe
2372	WerFault.exe
2372	WerFault.exe
2372	WerFault.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
7	api.ipify.org
14	ip-api.com
21	ip-api.com

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File created	C:\Windows\SysWOW64\SubDir\custom.exe	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
2556	2728	WerFault.exe	33
1156	1184	WerFault.exe	41
948	2008	WerFault.exe	50
1584	1528	WerFault.exe	58
584	2788	WerFault.exe	66
1892	3012	WerFault.exe	74
2168	2376	WerFault.exe	82
1484	1028	WerFault.exe	90
1584	560	WerFault.exe	98
3032	2636	WerFault.exe	106
2372	1660	WerFault.exe	114

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2820	PING.EXE
1612	PING.EXE
2828	PING.EXE
2148	PING.EXE
908	PING.EXE
2572	PING.EXE
2896	PING.EXE
2192	PING.EXE
408	PING.EXE
1712	PING.EXE
764	PING.EXE

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
2896	PING.EXE
2192	PING.EXE
2828	PING.EXE
908	PING.EXE
764	PING.EXE
2820	PING.EXE
2572	PING.EXE
1612	PING.EXE
2148	PING.EXE
408	PING.EXE
1712	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
592	schtasks.exe
1704	schtasks.exe
2656	schtasks.exe
1608	schtasks.exe
2888	schtasks.exe
2296	schtasks.exe
2224	schtasks.exe
2300	schtasks.exe
2144	schtasks.exe
2876	schtasks.exe
2984	schtasks.exe
320	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Token: SeDebugPrivilege	2728	custom.exe
Token: SeDebugPrivilege	1184	custom.exe
Token: SeDebugPrivilege	2008	custom.exe
Token: SeDebugPrivilege	1528	custom.exe
Token: SeDebugPrivilege	2788	custom.exe
Token: SeDebugPrivilege	3012	custom.exe
Token: SeDebugPrivilege	2376	custom.exe
Token: SeDebugPrivilege	1028	custom.exe
Token: SeDebugPrivilege	560	custom.exe
Token: SeDebugPrivilege	2636	custom.exe
Token: SeDebugPrivilege	1660	custom.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2728	custom.exe
1184	custom.exe
2008	custom.exe
1528	custom.exe
2788	custom.exe
3012	custom.exe
2376	custom.exe
1028	custom.exe
560	custom.exe
2636	custom.exe
1660	custom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2888	2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	31
PID 2380 wrote to memory of 2888	2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	31
PID 2380 wrote to memory of 2888	2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	31
PID 2380 wrote to memory of 2888	2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	31
PID 2380 wrote to memory of 2728	2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	33
PID 2380 wrote to memory of 2728	2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	33
PID 2380 wrote to memory of 2728	2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	33
PID 2380 wrote to memory of 2728	2380	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	33
PID 2728 wrote to memory of 592	2728	custom.exe	34
PID 2728 wrote to memory of 592	2728	custom.exe	34
PID 2728 wrote to memory of 592	2728	custom.exe	34
PID 2728 wrote to memory of 592	2728	custom.exe	34
PID 2728 wrote to memory of 2240	2728	custom.exe	36
PID 2728 wrote to memory of 2240	2728	custom.exe	36
PID 2728 wrote to memory of 2240	2728	custom.exe	36
PID 2728 wrote to memory of 2240	2728	custom.exe	36
PID 2728 wrote to memory of 2556	2728	custom.exe	38
PID 2728 wrote to memory of 2556	2728	custom.exe	38
PID 2728 wrote to memory of 2556	2728	custom.exe	38
PID 2728 wrote to memory of 2556	2728	custom.exe	38
PID 2240 wrote to memory of 2364	2240	cmd.exe	39
PID 2240 wrote to memory of 2364	2240	cmd.exe	39
PID 2240 wrote to memory of 2364	2240	cmd.exe	39
PID 2240 wrote to memory of 2364	2240	cmd.exe	39
PID 2240 wrote to memory of 2896	2240	cmd.exe	40
PID 2240 wrote to memory of 2896	2240	cmd.exe	40
PID 2240 wrote to memory of 2896	2240	cmd.exe	40
PID 2240 wrote to memory of 2896	2240	cmd.exe	40
PID 2240 wrote to memory of 1184	2240	cmd.exe	41
PID 2240 wrote to memory of 1184	2240	cmd.exe	41
PID 2240 wrote to memory of 1184	2240	cmd.exe	41
PID 2240 wrote to memory of 1184	2240	cmd.exe	41
PID 1184 wrote to memory of 2296	1184	custom.exe	43
PID 1184 wrote to memory of 2296	1184	custom.exe	43
PID 1184 wrote to memory of 2296	1184	custom.exe	43
PID 1184 wrote to memory of 2296	1184	custom.exe	43
PID 1184 wrote to memory of 1560	1184	custom.exe	45
PID 1184 wrote to memory of 1560	1184	custom.exe	45
PID 1184 wrote to memory of 1560	1184	custom.exe	45
PID 1184 wrote to memory of 1560	1184	custom.exe	45
PID 1184 wrote to memory of 1156	1184	custom.exe	47
PID 1184 wrote to memory of 1156	1184	custom.exe	47
PID 1184 wrote to memory of 1156	1184	custom.exe	47
PID 1184 wrote to memory of 1156	1184	custom.exe	47
PID 1560 wrote to memory of 1908	1560	cmd.exe	48
PID 1560 wrote to memory of 1908	1560	cmd.exe	48
PID 1560 wrote to memory of 1908	1560	cmd.exe	48
PID 1560 wrote to memory of 1908	1560	cmd.exe	48
PID 1560 wrote to memory of 1612	1560	cmd.exe	49
PID 1560 wrote to memory of 1612	1560	cmd.exe	49
PID 1560 wrote to memory of 1612	1560	cmd.exe	49
PID 1560 wrote to memory of 1612	1560	cmd.exe	49
PID 1560 wrote to memory of 2008	1560	cmd.exe	50
PID 1560 wrote to memory of 2008	1560	cmd.exe	50
PID 1560 wrote to memory of 2008	1560	cmd.exe	50
PID 1560 wrote to memory of 2008	1560	cmd.exe	50
PID 2008 wrote to memory of 2224	2008	custom.exe	51
PID 2008 wrote to memory of 2224	2008	custom.exe	51
PID 2008 wrote to memory of 2224	2008	custom.exe	51
PID 2008 wrote to memory of 2224	2008	custom.exe	51
PID 2008 wrote to memory of 1556	2008	custom.exe	53
PID 2008 wrote to memory of 1556	2008	custom.exe	53
PID 2008 wrote to memory of 1556	2008	custom.exe	53
PID 2008 wrote to memory of 1556	2008	custom.exe	53

C:\Users\Admin\AppData\Local\Temp\b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
"C:\Users\Admin\AppData\Local\Temp\b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe"
1⤵
- Quasar RAT
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2888
- C:\Windows\SysWOW64\SubDir\custom.exe
  "C:\Windows\SysWOW64\SubDir\custom.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\1BGfkqgHbHGD.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:2364
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2896
  - - C:\Windows\SysWOW64\SubDir\custom.exe
      "C:\Windows\SysWOW64\SubDir\custom.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1184
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2296
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\lJkfqbFP5hzL.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1560
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1908
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1612
      - C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2224
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\824wEDvAMAgg.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1556
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2192
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1704
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\mVSnogrAPdOO.bat" "
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1740
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2828
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2788
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        11⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2656
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\T0eOAtxUxum0.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:496
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2148
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        13⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2300
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\IZhrkSm2ppKv.bat" "
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:2580
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:1320
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:908
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2376
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        15⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YqkTKkvwCRME.bat" "
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:316
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:408
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1028
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        17⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2876
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zDThu8yNOTDk.bat" "
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:696
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1332
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1712
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:560
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        19⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\Bwczq1AReEgZ.bat" "
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:764
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        21⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\8XIvz4KcYkcI.bat" "
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2068
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:536
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2820
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1660
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        23⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\SKJ68JFu78EQ.bat" "
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 1420
        23⤵
        Loads dropped DLL
        Program crash
        
        PID:2372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 1444
        21⤵
        Loads dropped DLL
        Program crash
        
        PID:3032
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 560 -s 1428
        19⤵
        Loads dropped DLL
        Program crash
        
        PID:1584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 1424
        17⤵
        Loads dropped DLL
        Program crash
        
        PID:1484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 1436
        15⤵
        Loads dropped DLL
        Program crash
        
        PID:2168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 1440
        13⤵
        Loads dropped DLL
        Program crash
        
        PID:1892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1416
        11⤵
        Loads dropped DLL
        Program crash
        
        PID:584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 1424
        9⤵
        Loads dropped DLL
        Program crash
        
        PID:1584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 1428
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1184 -s 1476
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1156
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 1508
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1BGfkqgHbHGD.bat

Filesize
196B

MD5
733a4a94e000c892eb112be4327a6273

SHA1
b679fc16a502d5db240996d37da85819a9f5b4a0

SHA256
eaababe4e8c50d6de53a544421fa2c76382b70aec90601276a0d23d1b462c887

SHA512
a79e045bd4eb1b33dd1c9f65fd160835ca2bafe0170225d95855b5abaaf49d5bbfe0e34eba978e08c73c392988f7acca4cba1877b8aaab84e519020fa4148bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\824wEDvAMAgg.bat

Filesize
196B

MD5
8377673818613f824ef0fadbf593b135

SHA1
b0387982adb67e279b95034cc436f7c2992e076a

SHA256
e19099c7eb378d7c2bd3c00ab4302153fcc82e871a808f85bb30a71bc9ba6a4b

SHA512
178e69fef65d87a4593c2770c81ecc194e90ce467a442f62b6852f82c5b38f78afc7a81cef499f761fb99d1aa23688f7dbe9fe562a35eae3d44c4dcb4cd6d2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\8XIvz4KcYkcI.bat

Filesize
196B

MD5
a3aa4fcd7c5dae18782378ad0abe592f

SHA1
5a8b3a4bb572eeab0eab2d8d618ca38603e6f9f0

SHA256
c60c79cfd4a8a19f8839a3a26151d9e1cd41151534a15bfceee4d9b1fad98ce3

SHA512
fc706cc76b022b41c94fb4c49e859579afbbd35a135b41143bf9282fcd6f83c8337246bdf12f0a88c8091980160c3e883813aa447185ffa59c88ea965665f0d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bwczq1AReEgZ.bat

Filesize
196B

MD5
2eb2e58b18addd1853d5203a7523e877

SHA1
197a0fa23afaeea93eb91911793f5d426502722a

SHA256
4aad49a99eaff1289d00f3e239ab20e10b11dd3895976bc45faffec6cf1c4964

SHA512
5b3e8dbe55d584906a5a32cd5c1c1ff860df9fad203a4819d6f323baf7f36526ba6ac1d3774f05f4aa521ff172fb01e156c863bbf89ac9f9553f1a45502d6bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IZhrkSm2ppKv.bat

Filesize
196B

MD5
8ee0ffc46cec631d19b80fb9a209c93c

SHA1
31ec196919950a471f98ee983b09f53a1243d61a

SHA256
136041daf826f4f6c918921a6c504d82a617b57d69d59b5084d3dd7a79db314c

SHA512
49a7087e962d1aa0f803adf55deafc9f7c752adc10ee7fb39ecbdcbbcc0f98791fff8d873867eb6d659e96f3bf8af421f275905edd53c9192843844478baf509

Download Submit
C:\Users\Admin\AppData\Local\Temp\SKJ68JFu78EQ.bat

Filesize
196B

MD5
16ea5971bda45e43b9275a06bbbde121

SHA1
8aa5fe7d061992fa9e551168b79b1672808c4419

SHA256
00b256a2925d79adca54ea2a8f4f071e0851592a1ad5db9aacdd69cc12ed3e03

SHA512
5233c26c96f8df9fea7159339d95c20fcfcf242c59c15dca425731354d01ea3e19369f9349d54b5a79c54efaea4e9503d28e3c75d00b84f37c1ffeba8fde906a

Download Submit
C:\Users\Admin\AppData\Local\Temp\T0eOAtxUxum0.bat

Filesize
196B

MD5
0f5f222082276443413ce0c82fc6fd95

SHA1
cf466cb6a10d54e15c49dd50bce15ad89af64a2c

SHA256
01326a85ee26b05119ef6a8c5d9214e73773dbf862e5f5b31deb9c4cabb4eebf

SHA512
ced6e537d7ff40a35687dcd2804de49edd7a635892562e4d7fdee29ae2e14479d869e2f691bd391acce5a47a5ba87bf1096d50ce7d6fa5b3a6b23a0d1ff05720

Download Submit
C:\Users\Admin\AppData\Local\Temp\YqkTKkvwCRME.bat

Filesize
196B

MD5
b3bfad6f0b0bc62a89692f95658cea8c

SHA1
c98821e1c7f3992641abaeeb84d684d5be0d6505

SHA256
472df42005cc9d941f4243ced14d78e887b9e562a46851ceb5ff49808975c6e2

SHA512
b2b9b9a4ba22bc285107702f3a6a6502840ddd542235cbae8738380ee7ce26ea25f18875da6b5d68e46fadaa8da25b714e7d555bd0ba4c4636c1664b27b0c1c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\lJkfqbFP5hzL.bat

Filesize
196B

MD5
a62991ae3bcea7a85199123f9877c870

SHA1
3e60e9e458da0d81cbfa668e5969060262e34f8d

SHA256
e7c018b750928df2ee91bf6c8f3dadf86f4f085582c1c5118218800c2bb3396f

SHA512
13cd5f27167ad60d76f8153ebfe1fb7ed2dc3f72dbd55be79329ad65e0e48e7d8f34bfc5316585819246faa1538b18319e05cc10616f08864660dee87c953345

Download Submit
C:\Users\Admin\AppData\Local\Temp\mVSnogrAPdOO.bat

Filesize
196B

MD5
2b49afeeb6aed2103b65a41e60a71d5d

SHA1
8f85318cbfbb373e775b446c3a9fb52c345ce68b

SHA256
a4e865410fcaedc1a5a296a0ff2dfdbb45df1aa1daf124a3089c920f468f9016

SHA512
2425ff4ccf240a3ee827c3c50f6fcdaab48ed6ff425aa6347babf5432bd5ffa459f33877ddb7890814e2b9fb055b2cea1b3583437b916753aae4ed2f8f0d424f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zDThu8yNOTDk.bat

Filesize
196B

MD5
bf6be94db08fd52cede1185615593c1f

SHA1
a5a6c0cbff3073557aceda93a122b7208c832988

SHA256
e945e28d682b03e80ae8caf32e31a1a0e07116c72288c04226da1e3f5b0acbe2

SHA512
7d17b130c8ab259ad0e44f8879a73498c47ca8283e2b325a788ff598bc30ece5e7cff9bbf58b813443e269af7a8ca9c67df7a4f74e1e640f8a44a0d20bc57f28

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
90d18eb1561f6a9c44bb62d63ed2a72c

SHA1
ed486a383972cfd30507d65b7ea15f19f50b8c89

SHA256
b59a8fbf35e985435db075354b30befd6b1f48868e2d7d88c43f1f2640ef698c

SHA512
fb633f153140bb7f35251833b2ea99a244ef186e0a1c9582c2089fd35c3a89f16d8119572b989915aeac4a84e14fcd956e53414eda6e601192cd67a86d569ec9

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
f33c1cdf18eea28b86fce197f49c58c4

SHA1
dcb00200c33430fb46e12ecf24bd82b5ebf7d3d4

SHA256
62bc33522f6e1603b4f8e3c78777a1ea054209ccfa42e6416f842cb4c6a9bf46

SHA512
21226a53e4f36cc628005f29be7745e65eeb6e3d7f010b38624a4bc96483a09e614519b684cf2d15cfe9a65d14f469f29fd5b5f0e6e557ff2469472adf17f22d

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
f0449b56ec21d68705921f7c055772ed

SHA1
066e398d223261c9217989fe81ff0cb3a7d0ab48

SHA256
857c117f21320464558d70c8e113664f0b4bbf9d821f5e76b9fc509b7401609b

SHA512
9267f6b445ba5c62be40f3362ce99f6252f8968f3ef34a299bfee6965a40fcd04d021c1e4f110731d98eb3a34b751f438862bdead5c72ab2602d7b8ffcd88622

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
b98635eb07a4795a75ffca2aec2e9d51

SHA1
36d1326f1d0a0d87cc440da42695fb5b7f3d21ba

SHA256
e72a8a8c8da8c6a1a474de8239d7adea7a622c34d4fabce2332a656b932de786

SHA512
310bdd6b18a6fdecaef38c80de94f3a8396532351eea8cc7af8718cb870323a1adc889520978263ee6887d17d2878e05f6b72890a8c282fee590e0dcdc57d598

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
f791f28f31122ccb1806b1e989e93c12

SHA1
e29b2b124a44dc997cdc2a4a9054f57feaddb75b

SHA256
bdb04b2572200f27ec9a03c851937313b3ac1299cf02fecce0351f97279a42fd

SHA512
c57fb3b01a471c607549818bdb3ef013b17e66435b456dad7185a927a0e6d5927e94e09fb44b208fcfcda0485aa6610b7661b0392b798318cc3874f6aea41310

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
231488517c2e508ea3a81df0017d4caa

SHA1
d78309316ed7b616d0b68fda40dfae1cf6719d04

SHA256
3cd43f324ee79848dce7bc02618ac52ba722f13aa9ad036fd162692b7d0e65a9

SHA512
adaebd8eafda8d882a8b947d460d959a895eaf78261a471bd6f48136813e1ea9e6405374ac3e1d6dd9aa5d8f9d31d69bd5c683ce5be2b4bdd7f2e5327bef0d86

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
1fc919f78439fa79443f9233de48353f

SHA1
88e8686612ede5177227554303bd74322bdf2fa5

SHA256
c663c1acb6d66c497fc935c4fa67ea0531f79ccc89eb2eb44eb06ec5b1f3ea3a

SHA512
d96c50e1201094e9c82ce9d4ce03bf78df2e4514b682b81fd86b5d4e53e4e0f8aafd7f1a3e6302e65f585acb894435f40776e20bffaefa3503a6d8ef5a7b11ff

Download Submit
\Windows\SysWOW64\SubDir\custom.exe

Filesize
365KB

MD5
57e44c04fcf797cc96f11a5e539dcf45

SHA1
ccb1a5049980889cfe8d96ceba005c536d25e017

SHA256
b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc

SHA512
9caf54fb294cd085bbd0337d70a9bfc0b11351a9ea46b0a09fc6a5e869bd8b15a6ea514f758aed9169894c82f271611f1ecb10570f99a0b76a79e28b3b462c95

Download Submit
memory/1028-138-0x0000000001390000-0x00000000013F2000-memory.dmp

Filesize
392KB

Download
memory/1184-34-0x0000000001390000-0x00000000013F2000-memory.dmp

Filesize
392KB

Download
memory/2376-120-0x0000000001390000-0x00000000013F2000-memory.dmp

Filesize
392KB

Download
memory/2380-0-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/2380-15-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2380-12-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2380-3-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/2380-2-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2380-1-0x0000000000CD0000-0x0000000000D32000-memory.dmp

Filesize
392KB

Download
memory/2728-32-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2728-16-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2728-11-0x0000000001390000-0x00000000013F2000-memory.dmp

Filesize
392KB

Download
memory/2728-14-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2728-13-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads