quasar | 4052df4d6e7b8c82a36231ac7eaac8e6072c8da7ca989e831c226e17ae9a4517

Analysis

max time kernel
149s
max time network
61s
platform
windows11-21h2_x64
resource
win11-20250610-en
resource tags

arch:x64arch:x86image:win11-20250610-enlocale:en-usos:windows11-21h2-x64system
submitted
13/10/2025, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SETUP_1.exe
Size 9.0MB
Sample251013-tfleaagj4s
SHA256 4052df4d6e7b8c82a36231ac7eaac8e6072c8da7ca989e831c226e17ae9a4517
MD5 eb197985e4eee21ecce4248ff9458f7c
SHA1 ce320876abc5c63094ecfe39772b152c4abf47bb
SHA512 cb3d425ab83f0e702e6b00305c7195adb47e865fcc104ca5da3912f863664ad91dd601e3d0aed4cb6e24d1e685fddc9ed452344fe380bbba5de95ea8bcee08c3
SSDEEP 98304:4mnrjqXCX26feL7rR+rA7pmWv3vzNndrY9KMFz0Y6Yd1YA:4Ra2hr/AA3vrYv9h6KR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

setup discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.3.0.0

Botnet

setup

azharabdo109.ddns.net:61293

Mutex

QSR_MUTEX_eyJ2qGfzmq4bwaIxyh

Attributes

encryption_key
dbLHm7Cgu3oZDoyPUWrl
install_name
setup.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
setup

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 5 IoCs

resource	yara_rule
behavioral2/memory/72-18-0x00000000011A0000-0x00000000011FE000-memory.dmp	family_quasar
behavioral2/memory/5640-28-0x0000000000D10000-0x0000000000D6E000-memory.dmp	family_quasar
behavioral2/memory/4468-38-0x0000000000B30000-0x0000000000B8E000-memory.dmp	family_quasar
behavioral2/memory/2512-47-0x0000000000B60000-0x0000000000BBE000-memory.dmp	family_quasar
behavioral2/memory/5736-58-0x0000000001000000-0x000000000105E000-memory.dmp	family_quasar

Loads dropped DLL 2 IoCs

pid	Process
3516	SETUP_1.exe
3516	SETUP_1.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3516 set thread context of 72	3516	SETUP_1.exe	79
PID 3516 set thread context of 5640	3516	SETUP_1.exe	83
PID 3516 set thread context of 4468	3516	SETUP_1.exe	93
PID 3516 set thread context of 2512	3516	SETUP_1.exe	101
PID 3516 set thread context of 5736	3516	SETUP_1.exe	110

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4976	72	WerFault.exe	79
2344	4468	WerFault.exe	93
2664	2512	WerFault.exe	101
5792	5736	WerFault.exe	110

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
484	PING.EXE
5876	PING.EXE
3140	PING.EXE
3152	PING.EXE

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
3140	PING.EXE
3152	PING.EXE
484	PING.EXE
5876	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2352	schtasks.exe
4516	schtasks.exe
6136	schtasks.exe
704	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	72	AddInProcess32.exe
Token: SeDebugPrivilege	4468	AddInProcess32.exe
Token: SeDebugPrivilege	2512	AddInProcess32.exe
Token: SeDebugPrivilege	5736	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
72	AddInProcess32.exe
4468	AddInProcess32.exe
2512	AddInProcess32.exe
5736	AddInProcess32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 72	3516	SETUP_1.exe	79
PID 3516 wrote to memory of 72	3516	SETUP_1.exe	79
PID 3516 wrote to memory of 72	3516	SETUP_1.exe	79
PID 3516 wrote to memory of 72	3516	SETUP_1.exe	79
PID 3516 wrote to memory of 72	3516	SETUP_1.exe	79
PID 3516 wrote to memory of 72	3516	SETUP_1.exe	79
PID 72 wrote to memory of 6136	72	AddInProcess32.exe	81
PID 72 wrote to memory of 6136	72	AddInProcess32.exe	81
PID 72 wrote to memory of 6136	72	AddInProcess32.exe	81
PID 3516 wrote to memory of 5640	3516	SETUP_1.exe	83
PID 3516 wrote to memory of 5640	3516	SETUP_1.exe	83
PID 3516 wrote to memory of 5640	3516	SETUP_1.exe	83
PID 3516 wrote to memory of 5640	3516	SETUP_1.exe	83
PID 3516 wrote to memory of 5640	3516	SETUP_1.exe	83
PID 3516 wrote to memory of 5640	3516	SETUP_1.exe	83
PID 72 wrote to memory of 4920	72	AddInProcess32.exe	84
PID 72 wrote to memory of 4920	72	AddInProcess32.exe	84
PID 72 wrote to memory of 4920	72	AddInProcess32.exe	84
PID 4920 wrote to memory of 4556	4920	cmd.exe	91
PID 4920 wrote to memory of 4556	4920	cmd.exe	91
PID 4920 wrote to memory of 4556	4920	cmd.exe	91
PID 4920 wrote to memory of 3140	4920	cmd.exe	92
PID 4920 wrote to memory of 3140	4920	cmd.exe	92
PID 4920 wrote to memory of 3140	4920	cmd.exe	92
PID 3516 wrote to memory of 4468	3516	SETUP_1.exe	93
PID 3516 wrote to memory of 4468	3516	SETUP_1.exe	93
PID 3516 wrote to memory of 4468	3516	SETUP_1.exe	93
PID 3516 wrote to memory of 4468	3516	SETUP_1.exe	93
PID 3516 wrote to memory of 4468	3516	SETUP_1.exe	93
PID 3516 wrote to memory of 4468	3516	SETUP_1.exe	93
PID 4468 wrote to memory of 704	4468	AddInProcess32.exe	94
PID 4468 wrote to memory of 704	4468	AddInProcess32.exe	94
PID 4468 wrote to memory of 704	4468	AddInProcess32.exe	94
PID 4468 wrote to memory of 2336	4468	AddInProcess32.exe	96
PID 4468 wrote to memory of 2336	4468	AddInProcess32.exe	96
PID 4468 wrote to memory of 2336	4468	AddInProcess32.exe	96
PID 2336 wrote to memory of 3808	2336	cmd.exe	100
PID 2336 wrote to memory of 3808	2336	cmd.exe	100
PID 2336 wrote to memory of 3808	2336	cmd.exe	100
PID 3516 wrote to memory of 2512	3516	SETUP_1.exe	101
PID 3516 wrote to memory of 2512	3516	SETUP_1.exe	101
PID 3516 wrote to memory of 2512	3516	SETUP_1.exe	101
PID 3516 wrote to memory of 2512	3516	SETUP_1.exe	101
PID 3516 wrote to memory of 2512	3516	SETUP_1.exe	101
PID 3516 wrote to memory of 2512	3516	SETUP_1.exe	101
PID 2336 wrote to memory of 3152	2336	cmd.exe	102
PID 2336 wrote to memory of 3152	2336	cmd.exe	102
PID 2336 wrote to memory of 3152	2336	cmd.exe	102
PID 2512 wrote to memory of 2352	2512	AddInProcess32.exe	103
PID 2512 wrote to memory of 2352	2512	AddInProcess32.exe	103
PID 2512 wrote to memory of 2352	2512	AddInProcess32.exe	103
PID 2512 wrote to memory of 2208	2512	AddInProcess32.exe	105
PID 2512 wrote to memory of 2208	2512	AddInProcess32.exe	105
PID 2512 wrote to memory of 2208	2512	AddInProcess32.exe	105
PID 2208 wrote to memory of 1592	2208	cmd.exe	109
PID 2208 wrote to memory of 1592	2208	cmd.exe	109
PID 2208 wrote to memory of 1592	2208	cmd.exe	109
PID 3516 wrote to memory of 5736	3516	SETUP_1.exe	110
PID 3516 wrote to memory of 5736	3516	SETUP_1.exe	110
PID 3516 wrote to memory of 5736	3516	SETUP_1.exe	110
PID 3516 wrote to memory of 5736	3516	SETUP_1.exe	110
PID 3516 wrote to memory of 5736	3516	SETUP_1.exe	110
PID 3516 wrote to memory of 5736	3516	SETUP_1.exe	110
PID 2208 wrote to memory of 484	2208	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\SETUP_1.exe
"C:\Users\Admin\AppData\Local\Temp\SETUP_1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:72
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1AwPl1jiSECI.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3140
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 72 -s 1724
    3⤵
    - Program crash
    PID:4976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YhInc4tRaiJH.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:3808
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3152
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 2256
    3⤵
    - Program crash
    PID:2344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\chgoS9E8HYHU.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1592
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:484
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 2244
    3⤵
    - Program crash
    PID:2664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5736
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AONbrM8Jq0Vu.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:108
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:4944
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5876
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 2264
    3⤵
    - Program crash
    PID:5792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 72 -ip 72
1⤵
PID:2480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
1⤵
- System Location Discovery: System Language Discovery
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4468 -ip 4468
1⤵
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2512 -ip 2512
1⤵
PID:2884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5736 -ip 5736
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AddInProcess32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log
Size 411B
SHA256 4316a207e4de7425aa5d54fb2aba0f01b9d3fa3a4810c300da132be830bc63ad
MD5 6978c4cc994dfca124c4ba1dd57b67bb
SHA1 22599d27fc4860746b18d18ec3f5b52bcadc7f69
SHA512 d4393211aa7116431ea2527734a96ed7b2bba6348c3d5eac563dc8b0fb9176e58b3573e0168e136b7f8f28fb54ab8e464d2742171b47568760ce1fec0ccbe55e
MD5 SHA1 SHA512

Submit Download

1AwPl1jiSECI.bat

Path C:\Users\Admin\AppData\Local\Temp\1AwPl1jiSECI.bat
Size 223B
SHA256 835b8b269c88c9739a43d0154ed89ddefe8dc1571c1a1614539e176a639112ee
MD5 e08b1fbff0f5cacf8edc64c87c46a659
SHA1 3432a19a79852ac8073d00d7eae9f4ad43c3d4a2
SHA512 72796571702946fde3ea453d6f444f79126dca93c620a67a05321331023cf74e3aa1b41c9cfac03e5ebfa5aba99085f18bfd258239a704c005b3c478be251ac6
MD5 SHA1 SHA512

Submit Download

AONbrM8Jq0Vu.bat

Path C:\Users\Admin\AppData\Local\Temp\AONbrM8Jq0Vu.bat
Size 223B
SHA256 2254391c051835ab31aecf9c72770f489c059d00743d636d66b143649b23f14c
MD5 fdfc29a75eabac2ebebcebaf45750485
SHA1 a655c991b25cc154f523ff6b70c6af6c16b87e53
SHA512 bd8427025c5ebd1c6acc5f04b4a0ea2431d358536e23b40a774e20e9019de07c48dad7ea5ef63c1e31777c17b57ebe834cd82ce0d32dece049c71d93c037457e
MD5 SHA1 SHA512

Submit Download

YhInc4tRaiJH.bat

Path C:\Users\Admin\AppData\Local\Temp\YhInc4tRaiJH.bat
Size 223B
SHA256 3119d02293fdc9b4b30fc8fdfd1054434a1370906a17908957ae9076ef63dc34
MD5 0b526a9ed4e5eacc5cfd50b98f3d4f73
SHA1 61ed1ae1e135c7a77358bdca0d5762fc4aa4ba7f
SHA512 f5e1e27162b662266bda002c24bba3f0a3128446aafdcb0ccc5bbd2bb1a3516939dc9295bbe878374fbee70e75d78604e7a79e1980b1ebd14bf8fee14f3ed7f8
MD5 SHA1 SHA512

Submit Download

chgoS9E8HYHU.bat

Path C:\Users\Admin\AppData\Local\Temp\chgoS9E8HYHU.bat
Size 223B
SHA256 9715a3a86b47456ea18263e7f410c8fc8a71c15bde47c4023eeb68b2261bd120
MD5 ee9162ea7e4219a06b95c07cf4b73d27
SHA1 d6e6568f1614f17110d1ad9ee96f6c90bfdd85c3
SHA512 d30aa75819102b733f69d97a73c341d39d092c75ffee4450b0368e7f9112e0e4a1381627f648fcb9bd62260e1b1e6d42247852f9b332e9ad2578a20b034dca5e
MD5 SHA1 SHA512

Submit Download

evb599A.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb599A.tmp
Size 1KB
SHA256 37f1525dd9ab5989b6e46d5c394776e1042f0b4d7ca2fda300f09bddfc8cd90a
MD5 a301076fb0caa7c2b0620e9e027ec188
SHA1 f46fa3b7fb689c70ab99cd4bd39c3fbc5c6ef693
SHA512 5ee251435b830ea358c955afb5323ad239d879f0d784c2bac0314d08b036e59158627c91774a7953c124cbd80d250c175254f0b78d8480468420c2b638fae939
MD5 SHA1 SHA512

Submit Download

evb5A18.tmp

Path C:\Users\Admin\AppData\Local\Temp\evb5A18.tmp
Size 1KB
SHA256 ca1bd35c85a5c589fd50f0b6b67b09e78e71653ce18fdb8240b2f3455144cff0
MD5 9a766ae2a3da26cc4a30c7f47203c5d3
SHA1 9c8c1743aef4de2eebfa621468473e6752e2451b
SHA512 2f1341cfbef71500d85486cb77e1bc5330847ab1adbedaf92869a9b0118908d8d2a138a538a010b2e80d21ac649c9243437f12b94798911c5f12802c6efd0a87
MD5 SHA1 SHA512

Submit Download

10-13-2025

Path C:\Users\Admin\AppData\Roaming\Logs\10-13-2025
Size 224B
SHA256 7ed292abc12d06b9213cfc22aea7c6057ebd61b8b9a29f184d51fe901ec5e81a
MD5 3f2401280318758bf0f6c97fa5742b5a
SHA1 ecf015aecf513445e59c9e6df0e518ff296c4fbe
SHA512 65a9117306268cd7ae9ca8896bc8c85f948ef618440327c62a51cd934dde30898c9da828b3e7173019d4b097cd8084d9ec75f63a97518060eb8e9b3081316b28
MD5 SHA1 SHA512

Submit Download

10-13-2025

Path C:\Users\Admin\AppData\Roaming\Logs\10-13-2025
Size 224B
SHA256 45e95255b8aae3012e70b5d39297f20fd4ebbe786cd1bb988861607ff7e4fb0a
MD5 029036bf4a118dd97283c37ed48657fc
SHA1 15a2edb8653f48a8403f979ce09f454cee01034d
SHA512 862849f134739b3060adf43775ff41a1783c7686e1464f3a1e48bf68bfcc2fcae3abf4ed5cdcc3f6858574ff5ffd6ace211c81a570eee7eef99d75dc25f6498b
MD5 SHA1 SHA512

Submit Download

10-13-2025

Path C:\Users\Admin\AppData\Roaming\Logs\10-13-2025
Size 224B
SHA256 96d3018ddd258478f7eda696465ec5a64cb595d4cde61ab777c03be4beb47754
MD5 4b46ad725e83a52068c555fd33681470
SHA1 9e9a2252d41684b46d20993b70dadb69da5298ee
SHA512 9d9ffc2ceea529f40f1f091348371bd76dd2caf9790a69eb50bd3892c643deba07a3056dbfaa5505ccd738c247397444d50f4a92bca35b85196e64bdb53d6e0c
MD5 SHA1 SHA512

Submit Download

memory/72-37-0x00007FFE90C00000-0x00007FFE90E09000-memory.dmp

Download

memory/72-18-0x00000000011A0000-0x00000000011FE000-memory.dmp

Download

memory/72-19-0x0000000005CE0000-0x0000000006286000-memory.dmp

Download

memory/72-20-0x0000000005820000-0x00000000058B2000-memory.dmp

Download

memory/72-21-0x00007FFE90C00000-0x00007FFE90E09000-memory.dmp

Download

memory/72-22-0x00000000058C0000-0x0000000005926000-memory.dmp

Download

memory/72-23-0x00000000065D0000-0x00000000065E2000-memory.dmp

Download

memory/72-24-0x0000000006A20000-0x0000000006A5C000-memory.dmp

Download

memory/72-26-0x0000000006D90000-0x0000000006D9A000-memory.dmp

Download

memory/728-32-0x0000000002500000-0x000000000252A000-memory.dmp

Download

memory/728-31-0x00000000001C0000-0x00000000001CC000-memory.dmp

Download

memory/728-33-0x0000000004B10000-0x0000000004B66000-memory.dmp

Download

memory/2512-47-0x0000000000B60000-0x0000000000BBE000-memory.dmp

Download

memory/3516-41-0x0000000140000000-0x00000001400C0000-memory.dmp

Download

memory/3516-14-0x00007FFE90C00000-0x00007FFE90E09000-memory.dmp

Download

memory/3516-17-0x0000000002440000-0x000000000245B000-memory.dmp

Download

memory/3516-16-0x0000000180000000-0x000000018095D000-memory.dmp

Download

memory/3516-2-0x00007FFE90CA4000-0x00007FFE90CA5000-memory.dmp

Download

memory/3516-10-0x0000000002440000-0x000000000245B000-memory.dmp

Download

memory/3516-42-0x00007FFE90C00000-0x00007FFE90E09000-memory.dmp

Download

memory/3516-0-0x0000000140000000-0x00000001400C0000-memory.dmp

Download

memory/3516-12-0x0000000002440000-0x000000000245B000-memory.dmp

Download

memory/3516-5-0x0000000180000000-0x000000018095D000-memory.dmp

Download

memory/3516-15-0x00007FFE90C00000-0x00007FFE90E09000-memory.dmp

Download

memory/3516-53-0x0000000180000000-0x000000018095D000-memory.dmp

Download

memory/3516-4-0x00007FFE90C00000-0x00007FFE90E09000-memory.dmp

Download

memory/3516-62-0x00007FFE90C00000-0x00007FFE90E09000-memory.dmp

Download

memory/3516-60-0x0000000180000000-0x000000018095D000-memory.dmp

Download

memory/4468-38-0x0000000000B30000-0x0000000000B8E000-memory.dmp

Download

memory/5640-28-0x0000000000D10000-0x0000000000D6E000-memory.dmp

Download

memory/5736-58-0x0000000001000000-0x000000000105E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads