quasar | d7b9f48a28374c6d2b15193dc077a13c1660eddbf94ec5767c41fd6dadc51db0

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/03/2026, 05:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
chrome.exe
Size 3.1MB
Sample260322-gcfneaay2k
SHA256 d7b9f48a28374c6d2b15193dc077a13c1660eddbf94ec5767c41fd6dadc51db0
MD5 87542c80df4b34e7d4b30ed25d06fcdc
SHA1 80a41bf4242cacdc5d66be6ca6151fc57e4e96ac
SHA512 3c32acb6a684fcc647a84022656653e38ecb219c128bde25f836c864995b7d54e82b3f129d886ae9d4eb52706b0340c6f8e304718f94d981b0e660097d56558d
SSDEEP 98304:XGLSw2wgea2corPelMLISdRdeZ/jysFzx:WTPeFDhx
TLSH
T1C1E55C063BF85E23E56FE6B2E5B1400657F0F81AA3A3FB0B6581B3781C57B504D416AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

xoilac86xb.tv

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4368-0-0x00000000004F0000-0x000000000081C000-memory.dmp	family_quasar
behavioral2/files/0x001a00000002b3c2-5.dat	family_quasar

Executes dropped EXE 16 IoCs

pid	Process
3160	molliza.exe
4748	molliza.exe
4560	molliza.exe
1984	molliza.exe
4828	molliza.exe
2872	molliza.exe
4832	molliza.exe
2804	molliza.exe
2128	molliza.exe
2036	molliza.exe
4156	molliza.exe
2476	molliza.exe
948	molliza.exe
1608	molliza.exe
5040	molliza.exe
1068	molliza.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2140	PING.EXE
4432	PING.EXE
3064	PING.EXE
1576	PING.EXE
3088	PING.EXE
4932	PING.EXE
3936	PING.EXE
3268	PING.EXE
1000	PING.EXE
5012	PING.EXE
1400	PING.EXE
1104	PING.EXE
936	PING.EXE
3396	PING.EXE
2752	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
1576	PING.EXE
5012	PING.EXE
3936	PING.EXE
1104	PING.EXE
3064	PING.EXE
4432	PING.EXE
3396	PING.EXE
1000	PING.EXE
2752	PING.EXE
1400	PING.EXE
3268	PING.EXE
2140	PING.EXE
3088	PING.EXE
936	PING.EXE
4932	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3128	schtasks.exe
1628	schtasks.exe
4960	schtasks.exe
3572	schtasks.exe
1888	schtasks.exe
2240	schtasks.exe
3544	schtasks.exe
3304	schtasks.exe
3196	schtasks.exe
2340	schtasks.exe
1172	schtasks.exe
432	schtasks.exe
920	schtasks.exe
2024	schtasks.exe
4884	schtasks.exe
4624	schtasks.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	chrome.exe
Token: SeDebugPrivilege	3160	molliza.exe
Token: SeDebugPrivilege	4748	molliza.exe
Token: SeDebugPrivilege	4560	molliza.exe
Token: SeDebugPrivilege	1984	molliza.exe
Token: SeDebugPrivilege	4828	molliza.exe
Token: SeDebugPrivilege	2872	molliza.exe
Token: SeDebugPrivilege	4832	molliza.exe
Token: SeDebugPrivilege	2804	molliza.exe
Token: SeDebugPrivilege	2128	molliza.exe
Token: SeDebugPrivilege	2036	molliza.exe
Token: SeDebugPrivilege	4156	molliza.exe
Token: SeDebugPrivilege	2476	molliza.exe
Token: SeDebugPrivilege	948	molliza.exe
Token: SeDebugPrivilege	1608	molliza.exe
Token: SeDebugPrivilege	5040	molliza.exe
Token: SeDebugPrivilege	1068	molliza.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2340	4368	chrome.exe	80
PID 4368 wrote to memory of 3160	4368	chrome.exe	82
PID 3160 wrote to memory of 1172	3160	molliza.exe	85
PID 3160 wrote to memory of 3380	3160	molliza.exe	87
PID 3380 wrote to memory of 4252	3380	cmd.exe	89
PID 3380 wrote to memory of 3064	3380	cmd.exe	90
PID 3380 wrote to memory of 4560	3380	cmd.exe	91
PID 4560 wrote to memory of 4884	4560	molliza.exe	92
PID 4560 wrote to memory of 4472	4560	molliza.exe	94
PID 4472 wrote to memory of 1716	4472	cmd.exe	96
PID 4472 wrote to memory of 3268	4472	cmd.exe	97
PID 4472 wrote to memory of 1984	4472	cmd.exe	98
PID 1984 wrote to memory of 3572	1984	molliza.exe	99
PID 1984 wrote to memory of 1720	1984	molliza.exe	101
PID 1720 wrote to memory of 3060	1720	cmd.exe	103
PID 1720 wrote to memory of 2140	1720	cmd.exe	104
PID 1720 wrote to memory of 4828	1720	cmd.exe	105
PID 4828 wrote to memory of 1888	4828	molliza.exe	106
PID 4828 wrote to memory of 1428	4828	molliza.exe	108
PID 1428 wrote to memory of 2020	1428	cmd.exe	110
PID 1428 wrote to memory of 1576	1428	cmd.exe	111
PID 1428 wrote to memory of 2872	1428	cmd.exe	112
PID 2872 wrote to memory of 432	2872	molliza.exe	113
PID 2872 wrote to memory of 8	2872	molliza.exe	115
PID 8 wrote to memory of 4932	8	cmd.exe	117
PID 8 wrote to memory of 4432	8	cmd.exe	118
PID 8 wrote to memory of 4832	8	cmd.exe	119
PID 4832 wrote to memory of 3128	4832	molliza.exe	120
PID 4832 wrote to memory of 3408	4832	molliza.exe	122
PID 3408 wrote to memory of 4720	3408	cmd.exe	124
PID 3408 wrote to memory of 3088	3408	cmd.exe	125
PID 3408 wrote to memory of 2804	3408	cmd.exe	126
PID 2804 wrote to memory of 1628	2804	molliza.exe	127
PID 2804 wrote to memory of 3992	2804	molliza.exe	129
PID 3992 wrote to memory of 4444	3992	cmd.exe	131
PID 3992 wrote to memory of 936	3992	cmd.exe	132
PID 3992 wrote to memory of 2128	3992	cmd.exe	133
PID 2128 wrote to memory of 920	2128	molliza.exe	134
PID 2128 wrote to memory of 1328	2128	molliza.exe	136
PID 1328 wrote to memory of 1848	1328	cmd.exe	138
PID 1328 wrote to memory of 3396	1328	cmd.exe	139
PID 1328 wrote to memory of 2036	1328	cmd.exe	140
PID 2036 wrote to memory of 2024	2036	molliza.exe	141
PID 2036 wrote to memory of 3036	2036	molliza.exe	143
PID 3036 wrote to memory of 1528	3036	cmd.exe	145
PID 3036 wrote to memory of 1000	3036	cmd.exe	146
PID 3036 wrote to memory of 4156	3036	cmd.exe	147
PID 4156 wrote to memory of 2240	4156	molliza.exe	148
PID 4156 wrote to memory of 1468	4156	molliza.exe	150
PID 1468 wrote to memory of 2100	1468	cmd.exe	152
PID 1468 wrote to memory of 2752	1468	cmd.exe	153
PID 1468 wrote to memory of 2476	1468	cmd.exe	154
PID 2476 wrote to memory of 4624	2476	molliza.exe	155
PID 2476 wrote to memory of 1100	2476	molliza.exe	157
PID 1100 wrote to memory of 2788	1100	cmd.exe	159
PID 1100 wrote to memory of 5012	1100	cmd.exe	160
PID 1100 wrote to memory of 948	1100	cmd.exe	161
PID 948 wrote to memory of 3544	948	molliza.exe	162
PID 948 wrote to memory of 3324	948	molliza.exe	164
PID 3324 wrote to memory of 4088	3324	cmd.exe	166
PID 3324 wrote to memory of 4932	3324	cmd.exe	167
PID 3324 wrote to memory of 1608	3324	cmd.exe	168
PID 1608 wrote to memory of 3304	1608	molliza.exe	169
PID 1608 wrote to memory of 3844	1608	molliza.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\chrome.exe
"C:\Users\Admin\AppData\Local\Temp\chrome.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2340
- C:\Users\Admin\AppData\Roaming\malware\molliza.exe
  "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g21ooFjD1Fo7.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4252
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3064
  - - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
      "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4884
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mW9OZV0zAytW.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4472
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1716
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3268
      - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DZY8WWGIdOsL.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3060
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2140
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F7Ary5aPCYnG.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2020
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1576
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SyA84aPtwu0V.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4932
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4432
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3128
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UZbxdsmb6NVN.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4720
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3088
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2804
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FlPVIOK6043Y.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4444
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:936
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1OVdvogWsjlr.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1848
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3396
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vTzNOgttWAO8.bat" "
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1528
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1000
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2240
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5BipidgcHU0e.bat" "
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2100
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2752
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nsERh87pWM6A.bat" "
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:1100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2788
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5012
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2g4P7sGX5y3t.bat" "
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4088
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4932
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gWf24MZRtTlS.bat" "
        27⤵
        
        PID:3844
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3936
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5040
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4960
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iEuqQl9XIPiQ.bat" "
        29⤵
        
        PID:3940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1548
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1104
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1068
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3196
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PQRwHhYr48ho.bat" "
        31⤵
        
        PID:2340
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:3464
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1400

C:\Users\Admin\AppData\Roaming\malware\molliza.exe
C:\Users\Admin\AppData\Roaming\malware\molliza.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

molliza.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\molliza.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

1OVdvogWsjlr.bat

Path C:\Users\Admin\AppData\Local\Temp\1OVdvogWsjlr.bat
Size 209B
SHA256 1a60be869b9dcef09c322eeff6b2c1c15668713261eb770fa1f4957664640f84
MD5 2bb6b04854e4e79372d418b4722da0b1
SHA1 933868db8d8c1de104caf41d7125651b90616e2d
SHA512 ebf198271efb8035217a180e75b03e351c4c1cdc3361e1fbe1b3c9dc12ba5908a74f57c0f25859dc41d38a41de6be2fde2df3ed15f9f90e60af3dc5938be2970
TLSH
T128D023521791C75D850148871E6172CCB05904EB2F48FD914A004C9C0386C8CB557581
MD5 SHA1 SHA512 TLSH

Submit Download

2g4P7sGX5y3t.bat

Path C:\Users\Admin\AppData\Local\Temp\2g4P7sGX5y3t.bat
Size 209B
SHA256 4cdcc010b6452277b4df7a149fa49c05b21c5f9d2fd41238af445de45e8822ac
MD5 e926169122f54ef2ce461db00f860b04
SHA1 5309d104ca745d033d5487445dd3c88906db4a94
SHA512 c68a90cbb7a5c4d9835c6b83ca2f89485d4ecd3f26c6252730c2d8d307f9e676ef5b41dc3938d671a03bb2af3638a361e4637ef2dc49bb409ca256f25cbb2e46
TLSH
T122D0234117C1C75D451048471EA5778CB05504E61F487D914501CCAD43C68DCB557581
MD5 SHA1 SHA512 TLSH

Submit Download

5BipidgcHU0e.bat

Path C:\Users\Admin\AppData\Local\Temp\5BipidgcHU0e.bat
Size 209B
SHA256 be85d71f279da5f0d9e68029afb629ca117ec6ceacf0535edf7926d645bdd43c
MD5 4a9ce8e17261d4596ac706ad35f29c76
SHA1 e897d43a39263ec2e187fed799ccddc97adcec6d
SHA512 d87ce26c1aba70f2911fc5ccca9fef72d06fffb7357e8dd952b3def5673640cef4f994777847e48dbc7acb7796d10481288a851028655ed31dbfd496a5fad424
TLSH
T104D023411780C75D491048475FB572CCB05504EB1F887D9345004C9C038789CB557581
MD5 SHA1 SHA512 TLSH

Submit Download

DZY8WWGIdOsL.bat

Path C:\Users\Admin\AppData\Local\Temp\DZY8WWGIdOsL.bat
Size 209B
SHA256 651fe94e550f6ad9023411017044bfabe963d9981d0d31e4af0a401d793b1ca3
MD5 235aa0614ec1cd151fc1c015647e6872
SHA1 267b7064ccf1649542e558b14bd16864f1e36455
SHA512 aa345a221268868fc22f63cf01da0df322c31fb294283a419f2515556a63c1fc21f3d7850d7be1d0686031c9af868a0942bd65d3fe0a3cbc5a52070cd7c580fe
TLSH
T1DCD0230217C0C75D45004C47DF65778CB05D18E61F487DD145014CDD038788CB5B7581
MD5 SHA1 SHA512 TLSH

Submit Download

F7Ary5aPCYnG.bat

Path C:\Users\Admin\AppData\Local\Temp\F7Ary5aPCYnG.bat
Size 209B
SHA256 3c772961e128ce56ef7acb6e494a2b80f21cc603b01419336d73bad24db65914
MD5 aa37ab01f521e1daa0adaeb5ee1a428b
SHA1 5434e3e8d7e10116c2faa86c1913f68297256598
SHA512 54c71e6a8f96163643e77dad7809b113f4187492581d16c2989bbe6cbc11f173fb7865551c4ba89df070d68e9fb8ca6cc6661e4e7a6616c2e19d3e8010b2d442
TLSH
T13CD023031780C75D4701484F5E61728CB06604E61F4CBD924D104C9C13C68CCF597581
MD5 SHA1 SHA512 TLSH

Submit Download

FlPVIOK6043Y.bat

Path C:\Users\Admin\AppData\Local\Temp\FlPVIOK6043Y.bat
Size 209B
SHA256 7f3b12357e9a705bcdf4fb1ad2ec07a2234292f75f142f57a71e349c6f1c5141
MD5 6848169f6265d2c5bb4a8ea15bca3b4b
SHA1 6ce2a6ba0ab5499eacaaea909ac0402dd974fb30
SHA512 1234bb9d483c3f1a6ef36abea214f34ba8bced7ffaac0edbc09ba4ba2458ecebc21b6687905a6cbf89c7dd9752e0cb159b7221111684e154b958e39204874bbd
TLSH
T142D023415781CF9D49044C4F1F75728CB0A504EA1F487E9245004C9C038788CF557581
MD5 SHA1 SHA512 TLSH

Submit Download

PQRwHhYr48ho.bat

Path C:\Users\Admin\AppData\Local\Temp\PQRwHhYr48ho.bat
Size 209B
SHA256 25f1d202bd1222e2459c811826176136a084983c8a4fcd01a1161356893b56d4
MD5 7afffbab208deb2ef8e4a6b2cbd58f11
SHA1 a7e0795de21ff6007d17543b930c4301fc69390b
SHA512 71803b98d5a62153cd84362dcbe2406cf55d0b62a83c08fc65e7d0bab9b0309f26d0ca4cac0707acf92b3e63ab904b77875db05376a2132c1060c741f3cbc982
TLSH
T1A2D023515781C75D4501484B1E65728CB05904FA2F48FDD145004CDD07C6C9CF5579C1
MD5 SHA1 SHA512 TLSH

Submit Download

SyA84aPtwu0V.bat

Path C:\Users\Admin\AppData\Local\Temp\SyA84aPtwu0V.bat
Size 209B
SHA256 0cf0890648bc0b7d3a3b43c8d45a491efd0524cf74c301cb89259a57b448a3d7
MD5 7e4e5978db3ec5c5c9f84501c78d3c7c
SHA1 ebc0fcbd6c0546eb147dcd9516dbeec03fe15922
SHA512 cd21fac1b298af5506905777d51b907a0958f8be1d1c180f8b29a668bb1bff339655f57a528d33b77ca201bdcf72a4d6f49c4445db24768f2eb7e2b311f90b71
TLSH
T136D023115780C75D494048475E65768CF05604E61F487DD245004CED038689CB557581
MD5 SHA1 SHA512 TLSH

Submit Download

UZbxdsmb6NVN.bat

Path C:\Users\Admin\AppData\Local\Temp\UZbxdsmb6NVN.bat
Size 209B
SHA256 3be0587dad4056e99db38535e72a5aa16ff9a62d7dfc3510634b1f7bf60b6a73
MD5 59ff2f7b830ee0725132c48c4b8fffec
SHA1 69974ee8d2a79508440ec4d94f742973c348b31b
SHA512 ff0f3dde1403e361f94adf90390296726310d3502152ddaf9b8ef4f93ae3e7262c4b6524b0cb770d418a8de3ce2303803f85f6ab2aa887debb5e6bc32e7b62d1
TLSH
T178D023021790CB5D550148471E6177CDB05504F61F4C7DD24B004C9C0386C8CF55F5C1
MD5 SHA1 SHA512 TLSH

Submit Download

g21ooFjD1Fo7.bat

Path C:\Users\Admin\AppData\Local\Temp\g21ooFjD1Fo7.bat
Size 209B
SHA256 84548cf6e5aef7ed7f1f54cd1e56dd681fc3602f9b4aeba58ce4098fafd852fa
MD5 83e179a18ebc5782c2f93aad4a606679
SHA1 789059103e6c2d6c14b728db11deb0a101cda858
SHA512 d019dfc3d4e2b1230488286d284efff392a50f57e527064eb124b8fe08ca0024fa4c5b3a8826c5dad5fd9f870af3ea187e670b980f03da83af5afc36c7805940
TLSH
T14ED023011781CB5D550148471E61728CF05904E61F487DD145054C9D13C68CCB5575C1
MD5 SHA1 SHA512 TLSH

Submit Download

gWf24MZRtTlS.bat

Path C:\Users\Admin\AppData\Local\Temp\gWf24MZRtTlS.bat
Size 209B
SHA256 25064f2fc1fd6517067a9b97b7efde50c0ca5e134be1db261c6d7194460ad278
MD5 5ac92ee9c5f9fdd2aac3cf4b3f5dbf93
SHA1 c632df3dc88182143e77dbb6a2645238737b4b41
SHA512 a2b5f86444bdba9e56c4aa35b22489248bd3bedb7a26ede57f86e5e4a92ba227978d7d615a29a637a977a98f45ee0bac1580c03cf6762def21956bfe459d34b7
TLSH
T1B7D023115790C75D450148475E6576CCB05608E72F48BD9145004C9D03CB98CB5975C2
MD5 SHA1 SHA512 TLSH

Submit Download

iEuqQl9XIPiQ.bat

Path C:\Users\Admin\AppData\Local\Temp\iEuqQl9XIPiQ.bat
Size 209B
SHA256 5a340c2c196ada811aae3771450602706f05d4230424e6fbf64e429b52d63ec1
MD5 751759486b686370c58409348bf82306
SHA1 5abf060e0d76ddd5fa8f84fa31adbae01a8f1d4f
SHA512 557c667078ce992878ef65634e9473f804bac101b7af01c1b51e5772fe8de5f50119e09e0ba754ebda9a030241ab7d3797c9cd44c078f80692d6a3be2e5c62ee
TLSH
T168D023025781C75D4900C8475FB572CCF09604EA1F48BD9249044C9D038689CB5675C2
MD5 SHA1 SHA512 TLSH

Submit Download

mW9OZV0zAytW.bat

Path C:\Users\Admin\AppData\Local\Temp\mW9OZV0zAytW.bat
Size 209B
SHA256 e5b59d51d80f31692769e2998093a4f9936048b742d3cff5367dda4e394d77c1
MD5 3b56c593aca3c5a33d14f6cf51e73fce
SHA1 86fa64a7f11bbbc505ae74dd703b92ccc8f7d29a
SHA512 05bae221a469e96072fa19c13d6eb387041794cada2ddf0010c615f3fe2eb282153c2a83d23ee8a8a9e4d06cc989fad6edf1866efc4c00ea69d1edb8a18e77ec
TLSH
T17BD023415B80C75D49008C4F5FA5728DB05504E61F4C7DD14A004C9C0386DDCB56B581
MD5 SHA1 SHA512 TLSH

Submit Download

nsERh87pWM6A.bat

Path C:\Users\Admin\AppData\Local\Temp\nsERh87pWM6A.bat
Size 209B
SHA256 b962be9c0dd095a968b00e55af24c176577fd13dfce19a701522faa6497ba55c
MD5 30cd7f96649072360aff4306cc6b69ac
SHA1 0df644c024dfc1b14cc35f894445f005c8c791d0
SHA512 c0e24d58b6c5b96153d37b930584cf3081a46a43a394169aab6d498840759c4648bd55d0987eba50682d4cf0c6f25d86d076782f3c9c688d223c718e4d005d62
TLSH
T176D0230117D1C75D450148875EA2728CB09904E61F4CBD9145044CDD13C6CDCF5575C1
MD5 SHA1 SHA512 TLSH

Submit Download

vTzNOgttWAO8.bat

Path C:\Users\Admin\AppData\Local\Temp\vTzNOgttWAO8.bat
Size 209B
SHA256 9185581503c5253d1753397956953ac19d1893ca88c0d4b42f5069c8b0616a0a
MD5 b8d7000d2ea9ffe56429181351cfea8c
SHA1 f355c0754367f7dd18c6ec445da143287fd2476d
SHA512 e9dd835dbee613a259d079b0751afad87cdf596ea480e0ea87975cfe9340d75921ee37d0f28d351e302de16380f0fd8683478533181b95123792735e9a9ad176
TLSH
T166D023125780C79E550148471E71728CF05604E61F487D9246114C9C0386C9CB56B583
MD5 SHA1 SHA512 TLSH

Submit Download

molliza.exe

Path C:\Users\Admin\AppData\Roaming\malware\molliza.exe
Size 3.1MB
SHA256 d7b9f48a28374c6d2b15193dc077a13c1660eddbf94ec5767c41fd6dadc51db0
MD5 87542c80df4b34e7d4b30ed25d06fcdc
SHA1 80a41bf4242cacdc5d66be6ca6151fc57e4e96ac
SHA512 3c32acb6a684fcc647a84022656653e38ecb219c128bde25f836c864995b7d54e82b3f129d886ae9d4eb52706b0340c6f8e304718f94d981b0e660097d56558d
SSDEEP 98304:XGLSw2wgea2corPelMLISdRdeZ/jysFzx:WTPeFDhx
TLSH
T1C1E55C063BF85E23E56FE6B2E5B1400657F0F81AA3A3FB0B6581B3781C57B504D416AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-113-0x0000000002490000-0x00000000024A2000-memory.dmp

Download

memory/948-112-0x000000001B140000-0x000000001B25E000-memory.dmp

Download

memory/948-111-0x0000000000C20000-0x0000000000C2C000-memory.dmp

Download

memory/1068-137-0x0000000002E60000-0x0000000002E72000-memory.dmp

Download

memory/1068-136-0x000000001B820000-0x000000001B93E000-memory.dmp

Download

memory/1068-135-0x00000000013E0000-0x00000000013EC000-memory.dmp

Download

memory/1608-121-0x0000000002E00000-0x0000000002E12000-memory.dmp

Download

memory/1608-119-0x00000000013A0000-0x00000000013AC000-memory.dmp

Download

memory/1608-120-0x000000001B950000-0x000000001BA6E000-memory.dmp

Download

memory/1984-39-0x00000000032B0000-0x00000000032BC000-memory.dmp

Download

memory/1984-41-0x000000001BD60000-0x000000001BD72000-memory.dmp

Download

memory/1984-40-0x000000001BE30000-0x000000001BF4E000-memory.dmp

Download

memory/2036-87-0x0000000001430000-0x000000000143C000-memory.dmp

Download

memory/2036-88-0x000000001B9E0000-0x000000001BAFE000-memory.dmp

Download

memory/2036-89-0x000000001B9B0000-0x000000001B9C2000-memory.dmp

Download

memory/2128-81-0x00000000031E0000-0x00000000031F2000-memory.dmp

Download

memory/2128-80-0x000000001BD50000-0x000000001BE6E000-memory.dmp

Download

memory/2128-79-0x0000000001980000-0x000000000198C000-memory.dmp

Download

memory/2476-104-0x000000001C070000-0x000000001C18E000-memory.dmp

Download

memory/2476-103-0x0000000003180000-0x000000000318C000-memory.dmp

Download

memory/2476-105-0x0000000003230000-0x0000000003242000-memory.dmp

Download

memory/2804-73-0x0000000002610000-0x0000000002622000-memory.dmp

Download

memory/2804-72-0x000000001B140000-0x000000001B25E000-memory.dmp

Download

memory/2804-71-0x0000000000AA0000-0x0000000000AAC000-memory.dmp

Download

memory/2872-55-0x0000000002530000-0x000000000253C000-memory.dmp

Download

memory/2872-56-0x000000001B070000-0x000000001B18E000-memory.dmp

Download

memory/2872-57-0x000000001B7E0000-0x000000001B7F2000-memory.dmp

Download

memory/3160-25-0x000000001BD10000-0x000000001BD22000-memory.dmp

Download

memory/3160-23-0x0000000002F70000-0x0000000002F7C000-memory.dmp

Download

memory/3160-24-0x000000001B8A0000-0x000000001B9BE000-memory.dmp

Download

memory/3160-18-0x000000001C2A0000-0x000000001C352000-memory.dmp

Download

memory/3160-17-0x000000001C190000-0x000000001C1E0000-memory.dmp

Download

memory/3160-11-0x0000000002F80000-0x0000000002F90000-memory.dmp

Download

memory/4156-95-0x00000000011B0000-0x00000000011BC000-memory.dmp

Download

memory/4156-96-0x000000001B720000-0x000000001B83E000-memory.dmp

Download

memory/4156-97-0x0000000002BE0000-0x0000000002BF2000-memory.dmp

Download

memory/4368-8-0x000000001B5B0000-0x000000001B6CE000-memory.dmp

Download

memory/4368-10-0x00000000029A0000-0x00000000029B2000-memory.dmp

Download

memory/4368-7-0x0000000001040000-0x000000000104C000-memory.dmp

Download

memory/4368-1-0x000000001B550000-0x000000001B560000-memory.dmp

Download

memory/4368-0-0x00000000004F0000-0x000000000081C000-memory.dmp

Download

memory/4560-33-0x000000001B0A0000-0x000000001B0B2000-memory.dmp

Download

memory/4560-31-0x0000000000B50000-0x0000000000B5C000-memory.dmp

Download

memory/4560-32-0x000000001B110000-0x000000001B22E000-memory.dmp

Download

memory/4748-16-0x0000000002960000-0x0000000002972000-memory.dmp

Download

memory/4748-14-0x00000000028A0000-0x00000000028AC000-memory.dmp

Download

memory/4748-15-0x000000001B620000-0x000000001B73E000-memory.dmp

Download

memory/4828-47-0x0000000001B80000-0x0000000001B8C000-memory.dmp

Download

memory/4828-49-0x00000000033F0000-0x0000000003402000-memory.dmp

Download

memory/4828-48-0x000000001C050000-0x000000001C16E000-memory.dmp

Download

memory/4832-65-0x000000001B840000-0x000000001B852000-memory.dmp

Download

memory/4832-64-0x000000001BA30000-0x000000001BB4E000-memory.dmp

Download

memory/4832-63-0x0000000002C90000-0x0000000002C9C000-memory.dmp

Download

memory/5040-128-0x000000001B4B0000-0x000000001B5CE000-memory.dmp

Download

memory/5040-129-0x00000000028E0000-0x00000000028F2000-memory.dmp

Download

memory/5040-127-0x0000000002820000-0x000000000282C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads