quasar | b8a46aa74b7e451ca9ae336258971d7d46334b37c487da00a6039c1d146f6d62

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Size

365KB
MD5

57e44c04fcf797cc96f11a5e539dcf45
SHA1

ccb1a5049980889cfe8d96ceba005c536d25e017
SHA256

b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc
SHA512

9caf54fb294cd085bbd0337d70a9bfc0b11351a9ea46b0a09fc6a5e869bd8b15a6ea514f758aed9169894c82f271611f1ecb10570f99a0b76a79e28b3b462c95
SSDEEP

6144:Yx6bPXhLApfpIcE/ckl2La1bz4uUYHD7XKj8lxfBA66Ec2KHv:4mhAp8Bl9N4lkmj8RA6pcL

Score

10^/10

quasar win_update_2023 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Win_Update_2023

butterflybourne.ddns.net:4782

Mutex

QSR_MUTEX_zD2aPCc6Z0MX6eOBsy

Attributes

encryption_key
JzQzojcImiy4nU59S0ns
install_name
custom.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Win_Update_2023
subdirectory
SubDir

Signatures

Quasar RAT 5 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

description	flow	ioc	Process
Key opened		\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
	2	ip-api.com	Process not Found
	9	api.ipify.org	Process not Found
	15	ip-api.com	Process not Found
	22	ip-api.com	Process not Found

Quasar family
quasar

Quasar payload 11 IoCs

resource	yara_rule
behavioral11/memory/2256-1-0x00000000003B0000-0x0000000000412000-memory.dmp	family_quasar
behavioral11/files/0x0038000000012275-5.dat	family_quasar
behavioral11/memory/2904-10-0x0000000000010000-0x0000000000072000-memory.dmp	family_quasar
behavioral11/memory/2068-31-0x0000000000CF0000-0x0000000000D52000-memory.dmp	family_quasar
behavioral11/memory/2196-49-0x0000000000CF0000-0x0000000000D52000-memory.dmp	family_quasar
behavioral11/memory/2812-84-0x00000000002E0000-0x0000000000342000-memory.dmp	family_quasar
behavioral11/memory/2712-102-0x00000000001A0000-0x0000000000202000-memory.dmp	family_quasar
behavioral11/memory/2124-120-0x0000000001290000-0x00000000012F2000-memory.dmp	family_quasar
behavioral11/memory/2336-138-0x0000000001290000-0x00000000012F2000-memory.dmp	family_quasar
behavioral11/memory/1676-154-0x0000000001290000-0x00000000012F2000-memory.dmp	family_quasar
behavioral11/memory/2904-176-0x00000000013B0000-0x0000000001412000-memory.dmp	family_quasar

Executes dropped EXE 12 IoCs

pid	Process
2904	custom.exe
2068	custom.exe
2196	custom.exe
1536	custom.exe
2812	custom.exe
2712	custom.exe
2124	custom.exe
2336	custom.exe
1676	custom.exe
2560	custom.exe
1740	custom.exe
2904	custom.exe

Loads dropped DLL 61 IoCs

pid	Process
2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
496	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2164	WerFault.exe
2072	WerFault.exe
2072	WerFault.exe
2072	WerFault.exe
2072	WerFault.exe
2072	WerFault.exe
1616	WerFault.exe
1616	WerFault.exe
1616	WerFault.exe
1616	WerFault.exe
1616	WerFault.exe
1588	WerFault.exe
1588	WerFault.exe
1588	WerFault.exe
1588	WerFault.exe
1588	WerFault.exe
1864	WerFault.exe
1864	WerFault.exe
1864	WerFault.exe
1864	WerFault.exe
1864	WerFault.exe
2052	WerFault.exe
2052	WerFault.exe
2052	WerFault.exe
2052	WerFault.exe
2052	WerFault.exe
2396	WerFault.exe
2396	WerFault.exe
2396	WerFault.exe
2396	WerFault.exe
2396	WerFault.exe
2672	WerFault.exe
2672	WerFault.exe
2672	WerFault.exe
2672	WerFault.exe
2672	WerFault.exe
536	WerFault.exe
536	WerFault.exe
536	WerFault.exe
536	WerFault.exe
536	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1768	WerFault.exe
1768	WerFault.exe
1768	WerFault.exe
1768	WerFault.exe
1768	WerFault.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
9	api.ipify.org
15	ip-api.com
22	ip-api.com

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File created	C:\Windows\SysWOW64\SubDir\custom.exe	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
496	2904	WerFault.exe	33
2164	2068	WerFault.exe	41
2072	2196	WerFault.exe	50
1616	1536	WerFault.exe	58
1588	2812	WerFault.exe	66
1864	2712	WerFault.exe	74
2052	2124	WerFault.exe	82
2396	2336	WerFault.exe	90
2672	1676	WerFault.exe	98
536	2560	WerFault.exe	106
1856	1740	WerFault.exe	114
1768	2904	WerFault.exe	122

System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 12 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
496	PING.EXE
2296	PING.EXE
2296	PING.EXE
1556	PING.EXE
2248	PING.EXE
2964	PING.EXE
1812	PING.EXE
2152	PING.EXE
1952	PING.EXE
2228	PING.EXE
2564	PING.EXE
1376	PING.EXE

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
2964	PING.EXE
1812	PING.EXE
2296	PING.EXE
1556	PING.EXE
1376	PING.EXE
496	PING.EXE
2152	PING.EXE
1952	PING.EXE
2296	PING.EXE
2228	PING.EXE
2248	PING.EXE
2564	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2344	schtasks.exe
3000	schtasks.exe
2392	schtasks.exe
1352	schtasks.exe
2824	schtasks.exe
1112	schtasks.exe
2596	schtasks.exe
756	schtasks.exe
1184	schtasks.exe
1992	schtasks.exe
2708	schtasks.exe
2752	schtasks.exe
2864	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Token: SeDebugPrivilege	2904	custom.exe
Token: SeDebugPrivilege	2068	custom.exe
Token: SeDebugPrivilege	2196	custom.exe
Token: SeDebugPrivilege	1536	custom.exe
Token: SeDebugPrivilege	2812	custom.exe
Token: SeDebugPrivilege	2712	custom.exe
Token: SeDebugPrivilege	2124	custom.exe
Token: SeDebugPrivilege	2336	custom.exe
Token: SeDebugPrivilege	1676	custom.exe
Token: SeDebugPrivilege	1740	custom.exe
Token: SeDebugPrivilege	2904	custom.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2904	custom.exe
2068	custom.exe
2196	custom.exe
1536	custom.exe
2812	custom.exe
2712	custom.exe
2124	custom.exe
2336	custom.exe
1676	custom.exe
1740	custom.exe
2904	custom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2752	2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	31
PID 2256 wrote to memory of 2752	2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	31
PID 2256 wrote to memory of 2752	2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	31
PID 2256 wrote to memory of 2752	2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	31
PID 2256 wrote to memory of 2904	2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	33
PID 2256 wrote to memory of 2904	2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	33
PID 2256 wrote to memory of 2904	2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	33
PID 2256 wrote to memory of 2904	2256	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	33
PID 2904 wrote to memory of 2864	2904	custom.exe	34
PID 2904 wrote to memory of 2864	2904	custom.exe	34
PID 2904 wrote to memory of 2864	2904	custom.exe	34
PID 2904 wrote to memory of 2864	2904	custom.exe	34
PID 2904 wrote to memory of 784	2904	custom.exe	36
PID 2904 wrote to memory of 784	2904	custom.exe	36
PID 2904 wrote to memory of 784	2904	custom.exe	36
PID 2904 wrote to memory of 784	2904	custom.exe	36
PID 2904 wrote to memory of 496	2904	custom.exe	38
PID 2904 wrote to memory of 496	2904	custom.exe	38
PID 2904 wrote to memory of 496	2904	custom.exe	38
PID 2904 wrote to memory of 496	2904	custom.exe	38
PID 784 wrote to memory of 1492	784	cmd.exe	39
PID 784 wrote to memory of 1492	784	cmd.exe	39
PID 784 wrote to memory of 1492	784	cmd.exe	39
PID 784 wrote to memory of 1492	784	cmd.exe	39
PID 784 wrote to memory of 1952	784	cmd.exe	40
PID 784 wrote to memory of 1952	784	cmd.exe	40
PID 784 wrote to memory of 1952	784	cmd.exe	40
PID 784 wrote to memory of 1952	784	cmd.exe	40
PID 784 wrote to memory of 2068	784	cmd.exe	41
PID 784 wrote to memory of 2068	784	cmd.exe	41
PID 784 wrote to memory of 2068	784	cmd.exe	41
PID 784 wrote to memory of 2068	784	cmd.exe	41
PID 2068 wrote to memory of 2824	2068	custom.exe	42
PID 2068 wrote to memory of 2824	2068	custom.exe	42
PID 2068 wrote to memory of 2824	2068	custom.exe	42
PID 2068 wrote to memory of 2824	2068	custom.exe	42
PID 2068 wrote to memory of 2372	2068	custom.exe	44
PID 2068 wrote to memory of 2372	2068	custom.exe	44
PID 2068 wrote to memory of 2372	2068	custom.exe	44
PID 2068 wrote to memory of 2372	2068	custom.exe	44
PID 2068 wrote to memory of 2164	2068	custom.exe	46
PID 2068 wrote to memory of 2164	2068	custom.exe	46
PID 2068 wrote to memory of 2164	2068	custom.exe	46
PID 2068 wrote to memory of 2164	2068	custom.exe	46
PID 2372 wrote to memory of 2320	2372	cmd.exe	47
PID 2372 wrote to memory of 2320	2372	cmd.exe	47
PID 2372 wrote to memory of 2320	2372	cmd.exe	47
PID 2372 wrote to memory of 2320	2372	cmd.exe	47
PID 2372 wrote to memory of 2296	2372	cmd.exe	48
PID 2372 wrote to memory of 2296	2372	cmd.exe	48
PID 2372 wrote to memory of 2296	2372	cmd.exe	48
PID 2372 wrote to memory of 2296	2372	cmd.exe	48
PID 2372 wrote to memory of 2196	2372	cmd.exe	50
PID 2372 wrote to memory of 2196	2372	cmd.exe	50
PID 2372 wrote to memory of 2196	2372	cmd.exe	50
PID 2372 wrote to memory of 2196	2372	cmd.exe	50
PID 2196 wrote to memory of 1112	2196	custom.exe	51
PID 2196 wrote to memory of 1112	2196	custom.exe	51
PID 2196 wrote to memory of 1112	2196	custom.exe	51
PID 2196 wrote to memory of 1112	2196	custom.exe	51
PID 2196 wrote to memory of 1976	2196	custom.exe	53
PID 2196 wrote to memory of 1976	2196	custom.exe	53
PID 2196 wrote to memory of 1976	2196	custom.exe	53
PID 2196 wrote to memory of 1976	2196	custom.exe	53

C:\Users\Admin\AppData\Local\Temp\b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
"C:\Users\Admin\AppData\Local\Temp\b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe"
1⤵
- Quasar RAT
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2752
- C:\Windows\SysWOW64\SubDir\custom.exe
  "C:\Windows\SysWOW64\SubDir\custom.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\f3GOrkDdDsBx.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1952
  - - C:\Windows\SysWOW64\SubDir\custom.exe
      "C:\Windows\SysWOW64\SubDir\custom.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2068
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2824
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\bHQ0wbfKXjkI.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2372
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2296
      - C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\zfjLD8clihBh.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1976
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1556
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2344
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\PKx8ySQMW3Ch.bat" "
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2004
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2228
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2812
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        11⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\1IBAmjkHrY0V.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2248
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2712
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        13⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\AzXjvsm1bVmQ.bat" "
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2564
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2124
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        15⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\w0grq2ejMYlr.bat" "
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:1668
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:2960
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2964
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2336
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        17⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\sbMnz5nuG4ha.bat" "
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1376
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1676
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        19⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\d6N7933YKAn6.bat" "
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:608
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:1688
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1812
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        21⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2708
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\YBO9HYeUPpvp.bat" "
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:1492
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:496
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1740
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        23⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2392
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\MiCCDG4RzjiF.bat" "
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:2924
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2152
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        25⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\UPYkMP6BjgUB.bat" "
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 1448
        25⤵
        Loads dropped DLL
        Program crash
        
        PID:1768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 1420
        23⤵
        Loads dropped DLL
        Program crash
        
        PID:1856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 1444
        21⤵
        Loads dropped DLL
        Program crash
        
        PID:536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 1420
        19⤵
        Loads dropped DLL
        Program crash
        
        PID:2672
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 1428
        17⤵
        Loads dropped DLL
        Program crash
        
        PID:2396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 1440
        15⤵
        Loads dropped DLL
        Program crash
        
        PID:2052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 1432
        13⤵
        Loads dropped DLL
        Program crash
        
        PID:1864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 1424
        11⤵
        Loads dropped DLL
        Program crash
        
        PID:1588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 1436
        9⤵
        Loads dropped DLL
        Program crash
        
        PID:1616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 1468
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2072
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1480
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:2164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2904 -s 1448
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1IBAmjkHrY0V.bat

Filesize
196B

MD5
a6dda7a9b4049b078d5a49b3778fb0ce

SHA1
17cbfce9f1a5cc356c16f853009a429f35846f9b

SHA256
835f9e40b65cd047208f9d89b601a269969642faf7980f1eacf990957e0bdb2d

SHA512
44b9f24b90bae2dd4870e35434727a37f1d5b1690db09f24c1b396089f9dfe2e66d0ddccc10340611a4f702f702fcba647dde85599ec187e363e2bf9fc504b66

Download Submit
C:\Users\Admin\AppData\Local\Temp\AzXjvsm1bVmQ.bat

Filesize
196B

MD5
28be895ae56ad88d27d1de722baa342f

SHA1
def46f2c0341268d40bdb98e37d3f6081b12a509

SHA256
8ae6777e9c0d9a006fb26651c10ae860944ba4a78608d7ddac369032b5bdc9a9

SHA512
5859580d656738a944e3543e60bd2f8d92408d0c77e1efd60cdefecd19610ef298e50d49277b65a1359a446d92cd2e6e00a654624e29c04d14993a5642e20b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\MiCCDG4RzjiF.bat

Filesize
196B

MD5
7653a36a1e4dcb31b47b305c15cfe3f1

SHA1
8b55e911b1ee4fc135f035465fffda4c78020b38

SHA256
c608a24bec324fb6deef8608e87366e10216fd99a9c2ac3b20ffc2bc1175352d

SHA512
623f711900c0ffdd68133e3e33ad7f92497dffc64cd74faf1746b69be82ec9dbddc9943462399b885862465ad3c08ee55d3b8fbde6d3504d98e6f3a57af39343

Download Submit
C:\Users\Admin\AppData\Local\Temp\PKx8ySQMW3Ch.bat

Filesize
196B

MD5
a84dd97f3ac14d29a107147ebb6875f7

SHA1
723fa211ddd0471a6a0ce2171949a1dc69eca4af

SHA256
5e6d17084252e47825aeeaa52888a0b20e0a9cb8e884073426d8bccb9f41361b

SHA512
c8ec0814f4f20e6f69fa4ac0fbf284b2b41efb2094d5dbe63be7101d6df996929ebb7a975470972586a2a4cdbe28d2c71e90bb9d7736efd865ff5b3e2cf846d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\UPYkMP6BjgUB.bat

Filesize
196B

MD5
ceba908355f0c2eda8ef9edeafc90bcd

SHA1
2e888049299386c856470839a24204b81383b0a0

SHA256
ff8752043282dc0cbebd1054b5ef72b938e0860ddf75042db7cf6ed3cc7753d1

SHA512
c34d3746170eb509cafb4e75e6b71350942cb0aa7cd06ec576e1a69fc5e109ecec70d13d884aa1cb93e679cd034ac73c30036b37b7143cd48eca75440537cf06

Download Submit
C:\Users\Admin\AppData\Local\Temp\bHQ0wbfKXjkI.bat

Filesize
196B

MD5
c5ba0d54bd36471f190dbc36db8ebb7e

SHA1
5fbd395a14dd7b36a03ec98fc8cc097770840cad

SHA256
f12339f6c7999ba45e9008ef57dc52938cce564fd594a1e3d62d5c9835bd4aae

SHA512
e77d3eea86c9dc179164d2380ccf8114e03229564a91360f6b3924c0c7066cd9e61d1bad6c1fccf469e1c99b969dcfdbd016aeda5badf4e95be79048720f0e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\d6N7933YKAn6.bat

Filesize
196B

MD5
e6f6a86adcaa8ccf20ba188c9e91fe9b

SHA1
a27230e07918f671f75ea01648f5d97441b8ee3c

SHA256
3e3775fd61b6ba8853228716ca10c355babadefc2190d4296b680c449c33b52c

SHA512
32aa598dda58b564022dfba4e640e00b920e572f3186ebdd09495fc71ba50f70b04c67fc18727bac323ab4576fc729f5f5d065d3b4062eb50c53ad758f051377

Download Submit
C:\Users\Admin\AppData\Local\Temp\f3GOrkDdDsBx.bat

Filesize
196B

MD5
4212815c9d67d3f73e820f80d065814e

SHA1
5f954df653974a7f783e8201e4c5109a448e51a0

SHA256
1c709bcc065f9ade567b43d324fb0799843902a11be935ce676b4995a62d89f2

SHA512
12f59225b47e680d263a578d4705d2cd120085b2be4656e9b03e6805a229a439b11cd57db08c7b209f2c2ebe8622d6338e6b9655cf7a0a9d3bcdd515651813e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\sbMnz5nuG4ha.bat

Filesize
196B

MD5
96343b775b37ac2d4fb42d5999122315

SHA1
a949848b51339365c14fa8eb6f503e076dc88f10

SHA256
55e6390d7aa026cc76fa5222dfea936bf0aa407338bf7f9fe0c5421646ae8768

SHA512
1bf69b89877c77e5fd238f74fc09ad1b90052818384ec38ba86f94d166e1ec5dfc1e04c87aef75d3679f9a73b72a5e8f7b149a367e2f5732265451c26d19da1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\w0grq2ejMYlr.bat

Filesize
196B

MD5
c9600d8ec4c21a4094d7cb62f1bc1d95

SHA1
7746e875cf7c33b7aa6bd0e04275f5ba54a44713

SHA256
6f79645d65558c4b3cbfa31deb84e36fbe96c440664f64baa5b08aeb485b718a

SHA512
2de9899b857bc014e5ed1ae83ed5795db3aab772e5c264e3dbf48f93ad6fc2cf44b21ecd6d6525d8b7715bf356473300ae8b8d83077d9735b68d5cc8720aca6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\zfjLD8clihBh.bat

Filesize
196B

MD5
bb40bc8d3351c77784213ff98ce43d0b

SHA1
c4aeb3969d619f1b920e85d486f5744eb3b296ce

SHA256
b28541dadb0add525d53ed3566c4b35ec2fb19c7f4a626a281d8b06a409ec648

SHA512
835e73ef53ecadd2c5df9277033f1de4a381e9b53fad856d24874b8564b366a3c8c9f76d4c1a57e1f78d6a25f51ef7573a5479939e73f4309a87809cc6741487

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
0f69a262d0c822cab5e96f548b77eaa2

SHA1
24480bf8712132a0560205079a8ae6d17a5d7677

SHA256
13a8a4acf2ce024c39ca5d0cbbaa1dc37596700152daecdb6a6e8b65a0f1445c

SHA512
ffa93833e8fb3f4d4864995ad7cfa11789f1d32e3217fb3f4416260b6174645b051f15c7f4f1d2bdb2699c0ab9fcde192a7d2fb281db914bbcc5de9120f601b8

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
0116522bb2306f589ed5031ca9529b91

SHA1
27122464946b2534abda52df0191ccf8a4b17707

SHA256
2cf6b92290e5d2cdb30507fe3a5c37d6b380bec2a04e0924d77fde2da1909c34

SHA512
5927b722839655a2f1fa4e10fb61e3103c6211774c141a8ac627cad54a79f064d1e60d410219aa745ef2cff82ae4bc27914243dd0dab4eaa840b2a6a20869cd7

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
29176575d2d7034e1d8be75d18c3c48f

SHA1
e43f79975d2bff01fc9e153679d4c0b2ffba91cb

SHA256
01cf1dfef19da1818c7e004d9952a99d7a0f04bf76ffd49a6ea1348ec1f2c6bc

SHA512
d212abdebf37e454a22f0507a067ae56edaccccf6892db8a147ece343f279c6cb5367fe1441af4a900386c2d1a2428af24f851f45ec0d3df57f34a8f332a300e

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
1eaf3b036c3d95434ee32b513338b5db

SHA1
cb82c4c18ec3a15144102a4c3911492adf852783

SHA256
1d61ea8c71329a0b15035d5ec1ef876cffbeb67b4f366abb7573fd196f921eb6

SHA512
d1070eccc97a04eb39816b8413649006640e1f59e7e49471919a9c38e2060a338d9f6be9d03648f777013e05fc1de451ef3049c57aca58d75dec76a04a30164a

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
02ede396c522d78871fcfef680649eb9

SHA1
f4435a13535589316ab04d6ba48ad8ceab512cc2

SHA256
24486e5ed2e3e2f5cad22a793cb882edb05077bfe48cb777d7d6bc74a10f5c94

SHA512
432581b624ad964eac91bfb1d93c8b13091b4976e3cd8b55e7a6d7ef822cef34e5838eec52c828cdf7fb302db4a14507af33b25258990b2551aa31a8b39484a1

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
dad845ee3d66d07d114d366b28da8b18

SHA1
57b92158c984f174272681ad52534029338f8676

SHA256
f491617b793e2d4d8f22dbc9642e3afc7412ebf72e80d0e9351d91dead4ccc93

SHA512
2b4ceeb7dee445d2982c514162876b9c788d91f339cf890f7990c4cca021ec505e4e05380c254c3be2bbffce79f0ddf4df52e099819c47ec30f4f6bb2fee170e

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
9e360b4bcbaf0ee8ba2704878b955c17

SHA1
321c86d1f7ecea32746f98306b76bc5f9ec3899d

SHA256
e3d3e8360f41eb1ffb551702a853b14c45ca1cb338d986a184c9da2d62593afc

SHA512
5ae8611b5baae7dba9c924a65fc5673bb1c234947981ad6ab03afcd0d08ec0eea0356a345508eeb35a49ac2114a51d4be2743e3d62014dfd88777d18eb6288f1

Download Submit
\Windows\SysWOW64\SubDir\custom.exe

Filesize
365KB

MD5
57e44c04fcf797cc96f11a5e539dcf45

SHA1
ccb1a5049980889cfe8d96ceba005c536d25e017

SHA256
b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc

SHA512
9caf54fb294cd085bbd0337d70a9bfc0b11351a9ea46b0a09fc6a5e869bd8b15a6ea514f758aed9169894c82f271611f1ecb10570f99a0b76a79e28b3b462c95

Download Submit
memory/1676-154-0x0000000001290000-0x00000000012F2000-memory.dmp

Filesize
392KB

Download
memory/2068-31-0x0000000000CF0000-0x0000000000D52000-memory.dmp

Filesize
392KB

Download
memory/2124-120-0x0000000001290000-0x00000000012F2000-memory.dmp

Filesize
392KB

Download
memory/2196-49-0x0000000000CF0000-0x0000000000D52000-memory.dmp

Filesize
392KB

Download
memory/2256-0-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/2256-13-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2256-2-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2256-1-0x00000000003B0000-0x0000000000412000-memory.dmp

Filesize
392KB

Download
memory/2336-138-0x0000000001290000-0x00000000012F2000-memory.dmp

Filesize
392KB

Download
memory/2560-166-0x0000000073110000-0x00000000737FE000-memory.dmp

Filesize
6.9MB

Download
memory/2712-102-0x00000000001A0000-0x0000000000202000-memory.dmp

Filesize
392KB

Download
memory/2812-84-0x00000000002E0000-0x0000000000342000-memory.dmp

Filesize
392KB

Download
memory/2904-29-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-10-0x0000000000010000-0x0000000000072000-memory.dmp

Filesize
392KB

Download
memory/2904-11-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download
memory/2904-176-0x00000000013B0000-0x0000000001412000-memory.dmp

Filesize
392KB

Download
memory/2904-12-0x0000000074410000-0x0000000074AFE000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads