quasar | b8a46aa74b7e451ca9ae336258971d7d46334b37c487da00a6039c1d146f6d62

Analysis

max time kernel
143s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Size

365KB
MD5

57e44c04fcf797cc96f11a5e539dcf45
SHA1

ccb1a5049980889cfe8d96ceba005c536d25e017
SHA256

b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc
SHA512

9caf54fb294cd085bbd0337d70a9bfc0b11351a9ea46b0a09fc6a5e869bd8b15a6ea514f758aed9169894c82f271611f1ecb10570f99a0b76a79e28b3b462c95
SSDEEP

6144:Yx6bPXhLApfpIcE/ckl2La1bz4uUYHD7XKj8lxfBA66Ec2KHv:4mhAp8Bl9N4lkmj8RA6pcL

Score

10^/10

quasar win_update_2023 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Win_Update_2023

butterflybourne.ddns.net:4782

Mutex

QSR_MUTEX_zD2aPCc6Z0MX6eOBsy

Attributes

encryption_key
JzQzojcImiy4nU59S0ns
install_name
custom.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Win_Update_2023
subdirectory
SubDir

Signatures

Quasar RAT 5 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

description	flow	ioc	Process
	11	ip-api.com	Process not Found
Key opened		\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
	36	api.ipify.org	Process not Found
	77	ip-api.com	Process not Found
	95	ip-api.com	Process not Found

Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral12/memory/4460-1-0x00000000000E0000-0x0000000000142000-memory.dmp	family_quasar
behavioral12/files/0x000b000000023c25-11.dat	family_quasar

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation	custom.exe

Executes dropped EXE 11 IoCs

pid	Process
2152	custom.exe
5076	custom.exe
2616	custom.exe
4960	custom.exe
1400	custom.exe
4832	custom.exe
3640	custom.exe
2228	custom.exe
1880	custom.exe
2448	custom.exe
4404	custom.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	ip-api.com
36	api.ipify.org
77	ip-api.com
95	ip-api.com

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File created	C:\Windows\SysWOW64\SubDir\custom.exe	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir\custom.exe	custom.exe
File opened for modification	C:\Windows\SysWOW64\SubDir	custom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 11 IoCs

pid	pid_target	Process	procid_target
1508	2152	WerFault.exe	91
1792	5076	WerFault.exe	107
5020	2616	WerFault.exe	119
2360	4960	WerFault.exe	134
2920	1400	WerFault.exe	144
4180	4832	WerFault.exe	153
1316	3640	WerFault.exe	162
3000	2228	WerFault.exe	171
1400	1880	WerFault.exe	180
3540	2448	WerFault.exe	189
1508	4404	WerFault.exe	198

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	custom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3020	PING.EXE
4428	PING.EXE
3784	PING.EXE
4360	PING.EXE
1128	PING.EXE
1516	PING.EXE
1388	PING.EXE
696	PING.EXE
1460	PING.EXE
2272	PING.EXE
1820	PING.EXE

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
4428	PING.EXE
1460	PING.EXE
2272	PING.EXE
1820	PING.EXE
696	PING.EXE
3784	PING.EXE
4360	PING.EXE
1128	PING.EXE
1516	PING.EXE
1388	PING.EXE
3020	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1432	schtasks.exe
1336	schtasks.exe
3840	schtasks.exe
4796	schtasks.exe
3660	schtasks.exe
1432	schtasks.exe
1996	schtasks.exe
4368	schtasks.exe
3560	schtasks.exe
3896	schtasks.exe
628	schtasks.exe
400	schtasks.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Token: SeDebugPrivilege	2152	custom.exe
Token: SeDebugPrivilege	5076	custom.exe
Token: SeDebugPrivilege	2616	custom.exe
Token: SeDebugPrivilege	4960	custom.exe
Token: SeDebugPrivilege	1400	custom.exe
Token: SeDebugPrivilege	4832	custom.exe
Token: SeDebugPrivilege	3640	custom.exe
Token: SeDebugPrivilege	2228	custom.exe
Token: SeDebugPrivilege	1880	custom.exe
Token: SeDebugPrivilege	2448	custom.exe
Token: SeDebugPrivilege	4404	custom.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
2152	custom.exe
5076	custom.exe
2616	custom.exe
4960	custom.exe
1400	custom.exe
4832	custom.exe
3640	custom.exe
2228	custom.exe
1880	custom.exe
2448	custom.exe
4404	custom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3896	4460	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	89
PID 4460 wrote to memory of 3896	4460	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	89
PID 4460 wrote to memory of 3896	4460	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	89
PID 4460 wrote to memory of 2152	4460	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	91
PID 4460 wrote to memory of 2152	4460	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	91
PID 4460 wrote to memory of 2152	4460	b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe	91
PID 2152 wrote to memory of 628	2152	custom.exe	95
PID 2152 wrote to memory of 628	2152	custom.exe	95
PID 2152 wrote to memory of 628	2152	custom.exe	95
PID 2152 wrote to memory of 408	2152	custom.exe	97
PID 2152 wrote to memory of 408	2152	custom.exe	97
PID 2152 wrote to memory of 408	2152	custom.exe	97
PID 408 wrote to memory of 4644	408	cmd.exe	101
PID 408 wrote to memory of 4644	408	cmd.exe	101
PID 408 wrote to memory of 4644	408	cmd.exe	101
PID 408 wrote to memory of 3020	408	cmd.exe	102
PID 408 wrote to memory of 3020	408	cmd.exe	102
PID 408 wrote to memory of 3020	408	cmd.exe	102
PID 408 wrote to memory of 5076	408	cmd.exe	107
PID 408 wrote to memory of 5076	408	cmd.exe	107
PID 408 wrote to memory of 5076	408	cmd.exe	107
PID 5076 wrote to memory of 3840	5076	custom.exe	108
PID 5076 wrote to memory of 3840	5076	custom.exe	108
PID 5076 wrote to memory of 3840	5076	custom.exe	108
PID 5076 wrote to memory of 1140	5076	custom.exe	110
PID 5076 wrote to memory of 1140	5076	custom.exe	110
PID 5076 wrote to memory of 1140	5076	custom.exe	110
PID 1140 wrote to memory of 4888	1140	cmd.exe	113
PID 1140 wrote to memory of 4888	1140	cmd.exe	113
PID 1140 wrote to memory of 4888	1140	cmd.exe	113
PID 1140 wrote to memory of 4428	1140	cmd.exe	115
PID 1140 wrote to memory of 4428	1140	cmd.exe	115
PID 1140 wrote to memory of 4428	1140	cmd.exe	115
PID 1140 wrote to memory of 2616	1140	cmd.exe	119
PID 1140 wrote to memory of 2616	1140	cmd.exe	119
PID 1140 wrote to memory of 2616	1140	cmd.exe	119
PID 2616 wrote to memory of 4796	2616	custom.exe	126
PID 2616 wrote to memory of 4796	2616	custom.exe	126
PID 2616 wrote to memory of 4796	2616	custom.exe	126
PID 2616 wrote to memory of 1976	2616	custom.exe	128
PID 2616 wrote to memory of 1976	2616	custom.exe	128
PID 2616 wrote to memory of 1976	2616	custom.exe	128
PID 1976 wrote to memory of 5096	1976	cmd.exe	132
PID 1976 wrote to memory of 5096	1976	cmd.exe	132
PID 1976 wrote to memory of 5096	1976	cmd.exe	132
PID 1976 wrote to memory of 1460	1976	cmd.exe	133
PID 1976 wrote to memory of 1460	1976	cmd.exe	133
PID 1976 wrote to memory of 1460	1976	cmd.exe	133
PID 1976 wrote to memory of 4960	1976	cmd.exe	134
PID 1976 wrote to memory of 4960	1976	cmd.exe	134
PID 1976 wrote to memory of 4960	1976	cmd.exe	134
PID 4960 wrote to memory of 400	4960	custom.exe	135
PID 4960 wrote to memory of 400	4960	custom.exe	135
PID 4960 wrote to memory of 400	4960	custom.exe	135
PID 4960 wrote to memory of 2860	4960	custom.exe	137
PID 4960 wrote to memory of 2860	4960	custom.exe	137
PID 4960 wrote to memory of 2860	4960	custom.exe	137
PID 2860 wrote to memory of 2732	2860	cmd.exe	140
PID 2860 wrote to memory of 2732	2860	cmd.exe	140
PID 2860 wrote to memory of 2732	2860	cmd.exe	140
PID 2860 wrote to memory of 3784	2860	cmd.exe	142
PID 2860 wrote to memory of 3784	2860	cmd.exe	142
PID 2860 wrote to memory of 3784	2860	cmd.exe	142
PID 2860 wrote to memory of 1400	2860	cmd.exe	144

C:\Users\Admin\AppData\Local\Temp\b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
"C:\Users\Admin\AppData\Local\Temp\b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe"
1⤵
- Quasar RAT
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe" /rl HIGHEST /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3896
- C:\Windows\SysWOW64\SubDir\custom.exe
  "C:\Windows\SysWOW64\SubDir\custom.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1q437nU6J0ep.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3020
  - - C:\Windows\SysWOW64\SubDir\custom.exe
      "C:\Windows\SysWOW64\SubDir\custom.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3840
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1GSCrFy5uXDt.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1140
      - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
      - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4428
      - C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4796
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uaTM80nf2Yia.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1460
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        9⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SciVFsrEYH1K.bat" "
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2732
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3784
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1400
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        11⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3660
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RGiELUXX3itv.bat" "
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:4632
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2272
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4832
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        13⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nP2tx5Hc0xBb.bat" "
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:4700
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4360
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3640
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        15⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ldkDKwbJHZN.bat" "
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:1644
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1820
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2228
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        17⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4368
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XiwguiijFFDY.bat" "
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:3452
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1128
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1880
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        19⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3560
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PPUAFgEoyw5c.bat" "
        19⤵
        System Location Discovery: System Language Discovery
        
        PID:3736
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:4520
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1516
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2448
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        21⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BXJb9Vcj3yiH.bat" "
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:4692
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1388
        
        C:\Windows\SysWOW64\SubDir\custom.exe
        
        "C:\Windows\SysWOW64\SubDir\custom.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4404
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Win_Update_2023" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\custom.exe" /rl HIGHEST /f
        23⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1336
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DpMsiMPIv8Xd.bat" "
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:1316
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 2212
        23⤵
        Program crash
        
        PID:1508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 2204
        21⤵
        Program crash
        
        PID:3540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 2184
        19⤵
        Program crash
        
        PID:1400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 2192
        17⤵
        Program crash
        
        PID:3000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 2224
        15⤵
        Program crash
        
        PID:1316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 2212
        13⤵
        Program crash
        
        PID:4180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 1192
        11⤵
        Program crash
        
        PID:2920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 2176
        9⤵
        Program crash
        
        PID:2360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 1988
        7⤵
        Program crash
        
        PID:5020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 2244
        5⤵
        Program crash
        
        PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 2140
    3⤵
    - Program crash
    PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2152 -ip 2152
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5076 -ip 5076
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2616 -ip 2616
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4960 -ip 4960
1⤵
PID:1700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1400 -ip 1400
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4832 -ip 4832
1⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3640 -ip 3640
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2228 -ip 2228
1⤵
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1880 -ip 1880
1⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2448 -ip 2448
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4404 -ip 4404
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1GSCrFy5uXDt.bat

Filesize
196B

MD5
8258ded2531c237988208697d86c2999

SHA1
016d735b4c6e073991640b8f78dd2ee69bfd8fa6

SHA256
0d18a4d5aa6ec1c4b0cad28c0297103e4488ad63466f3981a38460a73de70413

SHA512
8aefa6a70f13945116d104b42ddb8e882bc1d2cd248a2ba778cd16af67bb4ea65cbf7d1cd912ee011dce9b4ebb43f3bb413ffd694d1cdc8ff8f0791b5c2b1aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1q437nU6J0ep.bat

Filesize
196B

MD5
749885af89dc49dd4eac57900ba96206

SHA1
e87c644e364985b19f7daf0aab8f14286b40105d

SHA256
5b3264a4eff0cc5f2a464df37bf99ad977f7e593f9f53e2319a95b7af92dfa7b

SHA512
784c4dcf599b8c7b346210ad39ebac336e305020e061506efb312f8ab50895c0fbecdfe5e508990d7b04b5cde7142f99fa796bb8ad271c99e2bd8ab88f549817

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ldkDKwbJHZN.bat

Filesize
196B

MD5
1a15c99aae08a4990fc28123ac6082c1

SHA1
97c6c2cb48a340670bdef5bb070cad3a482de171

SHA256
1f2f773cfc28072810411c0b08caa024de31a79a0011d97d8d195ba20406b8a7

SHA512
68ebf74cbb889e71cb3ae91de6b552670e31c99433247e704e96e97fad54e759466031980b080fa4f4f3579c557b10d6deea74edf14d039c2d7a870dab427114

Download Submit
C:\Users\Admin\AppData\Local\Temp\BXJb9Vcj3yiH.bat

Filesize
196B

MD5
98f4cb1aaf8febc0b5205584421409d6

SHA1
6bd0dd688e377d51abc1534040e8b32bb47d92a6

SHA256
2d1e1a8f56517c70af67ea5c1f7ec6c2d68d73d9ec2841c0b6e68c415f6d0505

SHA512
9f60d1ad1cb37feda876d13dad05ad23b94f903fa38f3fd33bcc295734fef175b8125ec78ec115d9bab8245cad91417a4c525eee09bf87e57cf8c54b984f7c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\DpMsiMPIv8Xd.bat

Filesize
196B

MD5
377854a888f44ee31b2a13ace26611ba

SHA1
815211379a4bc36da554d83b3923241229c1899d

SHA256
12eaa373f70a58333b6ca86e976b345336beec081ee7dc499a645c937ee7ce2e

SHA512
291148c557a9e5499b40f0ef09a6b3b97bc688fbb51eea0b8832a1fc26791b00989c01afd7daa86a90c62633af63e07bfcdd9462dc2fd2c9b8abb768ea2e2fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\PPUAFgEoyw5c.bat

Filesize
196B

MD5
80b95a5a4325af258d1189471e925bc2

SHA1
b74ffb12bd0ca5df468335e02cd62561eb48be01

SHA256
454e0fdf47be07e227c7eac3793eaf7ecdcc823fdae66144194c540a061175f5

SHA512
c5ab2682ff291b1b935475b4ca5ba523b247a83b0f2e5e7f6f14477fd5e473e46d13df6c2347c4815f8927614526d1160bbeb9ebf343dbe65c92ddf1e667b8fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RGiELUXX3itv.bat

Filesize
196B

MD5
53dcc34aef44ccbc4b8a16cabd09e078

SHA1
3cc48f8c5a5e904f4f058174725a1a15e6cc1aad

SHA256
f2e79e7356538c4282db75eca62d1998df80bad53c143b181de5504e87a18c0f

SHA512
6d46c67a27e26198762edcfcaa2e99aa2e6f10c7c8d4bda575fef3409d89147d05e1bbf40499c36c28c71c98a9dd96576bf2a7c9b3ebccc66d2559bfcfe89d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\SciVFsrEYH1K.bat

Filesize
196B

MD5
851108b74556b656aab41176f1515915

SHA1
6176bca1d6fcb24c8a7fc8cef5da85871a35ab29

SHA256
03eefea58c2476c4b7097c3ce3b3b18bcc2198fbae9b7cc7410dd6b340ceff0a

SHA512
887264484445d155b5ec8ab1369c6731e6edb3c520079a647aa8d83fd6acc30caa73b13b9537424228c6fb094147bcf4fcee3072da24a72d6a1f68f4d9822821

Download Submit
C:\Users\Admin\AppData\Local\Temp\XiwguiijFFDY.bat

Filesize
196B

MD5
2b708dbae3d7bdc1afb778288c025bf1

SHA1
4348e32df52b32c00df2ef2d4167825c90e8acb5

SHA256
8e53e86ecf6306a318111796859c3959aca978b134584e932f0cf6453b36120d

SHA512
bd057dae50b4f199f3d5aa80008bf79a4cfaea619ff8cb0acfdc4be6876324b604f6d2809cef6fb81d17d05a7f18b30900367b475a6dfe9d3133b2d987ff890b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nP2tx5Hc0xBb.bat

Filesize
196B

MD5
ca3e3a6b235602773c48ac34b0ee1331

SHA1
f1c206fb93b1713c15dc63bd3a555baa55fdde27

SHA256
5193065fa996e4ace672a92d8706ef96dba575e2e2ff68b269e7e2fbee251c65

SHA512
a645444b4c378c7f25d0479e0be3e237e18cd6ce072097532eb6b7ee3b4c93d8386632e16ad7bd1e8d47883cee74052448ca1e084412e75da27efada3b1ac782

Download Submit
C:\Users\Admin\AppData\Local\Temp\uaTM80nf2Yia.bat

Filesize
196B

MD5
9178e7250bfa4df89d78bac5c79ac43b

SHA1
8085b72f13f16553da30d548068b9f487d1e7485

SHA256
a0984327664c752371de60031a22000158e46eadb08ec3b71cae61c0657d9bf0

SHA512
65283efbd643c660ef6c798cc0fd613b7b209da67be3fe6705cc8b13c44d64c2069f75ec69ffd2fd627d0f8477159bc4c412615a526a98ff0961c5209bf6f21a

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
bf7e3d185908e427882f49f9a7811235

SHA1
ba50eab25f4913e704a5b611e928c057d53494b6

SHA256
fda7fb9f83810ffbdf5f6ce9b5cd8dd6033c679b9aab42794f0e235215a56550

SHA512
31bd9b0c3d13cdbf930a5f68f054b3c3b9ce55acd6c6786cada2771631f72fbac65e732a9c8b77021ffb5f4515a338c396f308970f3952642314b2b11e53d7f1

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
120d6734bfa94fc3d79ac9f3225e2ead

SHA1
347fa6f0176a42c794f98e0f992d1b7186bbcc83

SHA256
71a39c2789089a454dc282c2dcb5fb645e67112b26f1f1fbb87cd0be061dfaf9

SHA512
cf6e4c7e03d4543a49df5a08ccd6d40522a1d0d9857fec267b13abe6d3dcc52436b42afb4a92fb5614ebed37e456999d2564e4fb190ea59b33aab010ba21514d

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
eba9c4c11d5df099aec69526f8a8dc49

SHA1
d57496a90cfee41a4d0b02c48a5ebf6f0211b342

SHA256
b8ede2f4574f3e364df966ebca87e87929983a2393c23b3f118616a9ca2b5d7f

SHA512
14c463f464e0fef25a049ee1415d39a641299603963a69cc09c51fa7e464d6f0edb3b0e3b6c2a53da154f70ac6551aba71eddffc5678c94862ee38552f5845e5

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
2ed4cadbf0f72d2e2d5d64b40af8d829

SHA1
9113d7da87e963b340fbb794d9a3a6fc8bfc502e

SHA256
0bf7a373b0de4c8102837552e88bcbb12ffb2e9a708a1e62a52ee71f01e1f95a

SHA512
979b54712cd3398013f534b00ea9e32d44f7c49df09b83d64a9c422f7cc80a12cdcc1311de9e4b532f3d582364eb156da3eff0ba39de5067a70ad5f1a95255b2

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
b0384f042df1aafc04433134603086a4

SHA1
545bdf43438ba10f550b1c13e6f6aa5321c4f4dd

SHA256
44f0ebfb5cf5a23f14e03dc5d1b2ed624942b44b56e8476180f41785aa25ed7e

SHA512
c3726ef083c99e0e5415ee3451c587e820ebae2ee8a148e59099c3e05d46b94855cf412058f502a6a2ccdf2a8fac05f05ed20096e611e410a71b02051b94c19c

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
fb6942c115cab0155696bb9eab4dc580

SHA1
479a80a71c4178f9fbbe16a900aefa2a6e2e3741

SHA256
5e5a8d2b850adf266df801d2eb2cc97a1c49e1b874659c089106df863cf9500f

SHA512
3773d28d453c9b8b3c1ae7bdcdea829ff1cbaa63d7f5def3a6920609b0285244d36e800999894379bf95970437b77b5ad9c322dd129ea28e8eadec3577421447

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
7fe45587f06fda30aef6479b32efbe79

SHA1
92cf3f9922fe3a60edbc55710821d9f86dff2e6b

SHA256
36d4db90ea7bd07e0ead367129f11fcdec67d0bbb720ff784eb259bac46b8f07

SHA512
c8c4dfdb6606b163f8c3ae3dfc935526900895d281bff8862ddcb0360e94a7995c33aacab1aa7e247ba63dfdcca23b1ebcd7fbab7d255397f04d0f8d43abeb54

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
743975e5066e3520d9fcdd6d6e4455e6

SHA1
51079509604275302f47357dccf8903fff42d855

SHA256
f696e8a6004ecc9660c4a3ee205ca2c05c81655ef8ed37edbd5b19eefd9b396e

SHA512
63a4deac886fd1d037ea0a22ed06d9c3278a4e30cd11046a8ebcbf86cdc23be1a4eae4ed8cc6d13b527fe218706419eeeac226287f98532b86350606d5680a30

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
8a65a1ed43cb443e0135dec8fa7f3fd6

SHA1
3674c7eea51a128dd8886f2f9dc3028907a3fa3b

SHA256
e3a01f817e979948fe09117981ce76906b5e404f076f0eb37836a8d175edc3bf

SHA512
b15c8bad28477916dd43eaba5540112007c260f169ba1c83632d2e9fc267ee6e0290bf8f416b5fdbd5349f070e39e3b4781df0141bd5f0f887506607c32316bc

Download Submit
C:\Users\Admin\AppData\Roaming\Logs\03-06-2025

Filesize
224B

MD5
482fb26e91be5b9618f9817efba12c45

SHA1
4255c9ef6b1d642b86830c001341c8b150a0db4c

SHA256
41373671c3e2c9f40522ee4256769089ec6a9e2e3abb7cfe046798ec577850f2

SHA512
e2ba3b7bdc2ad96144ddaa7d2f0334b4551f2d09b422cf2c922fd99598dfd43a200dd721a09d62cb2e0a7f94486de20c5448fa5539f8150a0af7a25e8d9b279a

Download Submit
C:\Windows\SysWOW64\SubDir\custom.exe

Filesize
365KB

MD5
57e44c04fcf797cc96f11a5e539dcf45

SHA1
ccb1a5049980889cfe8d96ceba005c536d25e017

SHA256
b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc

SHA512
9caf54fb294cd085bbd0337d70a9bfc0b11351a9ea46b0a09fc6a5e869bd8b15a6ea514f758aed9169894c82f271611f1ecb10570f99a0b76a79e28b3b462c95

Download Submit
memory/2152-23-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/2152-14-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/2152-18-0x0000000006350000-0x000000000635A000-memory.dmp

Filesize
40KB

Download
memory/2152-16-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4460-6-0x00000000051A0000-0x00000000051B2000-memory.dmp

Filesize
72KB

Download
memory/4460-5-0x0000000004CB0000-0x0000000004D16000-memory.dmp

Filesize
408KB

Download
memory/4460-4-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4460-0-0x000000007459E000-0x000000007459F000-memory.dmp

Filesize
4KB

Download
memory/4460-3-0x0000000004C10000-0x0000000004CA2000-memory.dmp

Filesize
584KB

Download
memory/4460-15-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4460-2-0x00000000051C0000-0x0000000005764000-memory.dmp

Filesize
5.6MB

Download
memory/4460-7-0x0000000005D90000-0x0000000005DCC000-memory.dmp

Filesize
240KB

Download
memory/4460-1-0x00000000000E0000-0x0000000000142000-memory.dmp

Filesize
392KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads