quasar | 11d1beff4e8cdf50f73298ba1e8cc5127994d2b6bd396196e1f4231aebb66e6c

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 05:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
backup.exe
Size 3.1MB
Sample260503-gkp7tab151
SHA256 11d1beff4e8cdf50f73298ba1e8cc5127994d2b6bd396196e1f4231aebb66e6c
MD5 1df13e8b6ae9577d292ffb2adb0119bc
SHA1 ebfbb4fb70f4fe2c0ba22ccc32f5a833f80714fb
SHA512 bac0d198bd7a91ceb78b6131660e75b3828918d96b7f3b1b6e5c50007dc4add85e4739166b69dab0658745f0debbdd4393868dbe32cfdbec1b7803161eceadc7
SSDEEP 49152:LvivE2H5aweBHPbl6T/yGaqA6/y5T72lpoGdhTHHB72eh2NT:LvoE2H5aweBHPbl6T/DaqA6/y5T7u
TLSH
T186E56A143BF85E32E16AD6B3D5B0505263F0F82AF363EB0B5181777A2D53B40A9426B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xoilac discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

xoilac

aidas.us:443
backup.aidas.us:443
trojan.aidas.us:443
ransom.aidas.us:443
phisher.aidas.us:443
malicious.aidas.us:443

Mutex

b074bb76-509d-4f22-9881-b2e406eacc36

Attributes

encryption_key
B7E4985BC6F561AFD5FC99CACB2E00523B40A73D
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3912-0-0x0000000000F60000-0x0000000001284000-memory.dmp	family_quasar
behavioral2/files/0x002100000002b16e-5.dat	family_quasar

Executes dropped EXE 9 IoCs

pid	Process
4324	molliza.exe
3012	molliza.exe
4832	molliza.exe
4744	molliza.exe
2848	molliza.exe
3712	molliza.exe
4020	molliza.exe
4496	molliza.exe
4600	molliza.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 8 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2156	PING.EXE
3268	PING.EXE
2440	PING.EXE
956	PING.EXE
4120	PING.EXE
464	PING.EXE
2512	PING.EXE
4936	PING.EXE

Runs ping.exe 1 TTPs 8 IoCs

Remote System Discovery

T1018

pid	Process
3268	PING.EXE
2440	PING.EXE
956	PING.EXE
4120	PING.EXE
464	PING.EXE
2512	PING.EXE
4936	PING.EXE
2156	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2784	schtasks.exe
2224	schtasks.exe
2912	schtasks.exe
3404	schtasks.exe
3676	schtasks.exe
436	schtasks.exe
4344	schtasks.exe
3204	schtasks.exe
988	schtasks.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	backup.exe
Token: SeDebugPrivilege	4324	molliza.exe
Token: SeDebugPrivilege	3012	molliza.exe
Token: SeDebugPrivilege	4832	molliza.exe
Token: SeDebugPrivilege	4744	molliza.exe
Token: SeDebugPrivilege	2848	molliza.exe
Token: SeDebugPrivilege	3712	molliza.exe
Token: SeDebugPrivilege	4020	molliza.exe
Token: SeDebugPrivilege	4496	molliza.exe
Token: SeDebugPrivilege	4600	molliza.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 988	3912	backup.exe	79
PID 3912 wrote to memory of 4324	3912	backup.exe	81
PID 4324 wrote to memory of 3676	4324	molliza.exe	84
PID 4324 wrote to memory of 2976	4324	molliza.exe	86
PID 2976 wrote to memory of 1620	2976	cmd.exe	88
PID 2976 wrote to memory of 464	2976	cmd.exe	89
PID 2976 wrote to memory of 4832	2976	cmd.exe	90
PID 4832 wrote to memory of 2784	4832	molliza.exe	91
PID 4832 wrote to memory of 4484	4832	molliza.exe	93
PID 4484 wrote to memory of 780	4484	cmd.exe	95
PID 4484 wrote to memory of 2512	4484	cmd.exe	96
PID 4484 wrote to memory of 4744	4484	cmd.exe	97
PID 4744 wrote to memory of 436	4744	molliza.exe	98
PID 4744 wrote to memory of 3968	4744	molliza.exe	100
PID 3968 wrote to memory of 2460	3968	cmd.exe	102
PID 3968 wrote to memory of 4936	3968	cmd.exe	103
PID 3968 wrote to memory of 2848	3968	cmd.exe	104
PID 2848 wrote to memory of 2224	2848	molliza.exe	105
PID 2848 wrote to memory of 4540	2848	molliza.exe	107
PID 4540 wrote to memory of 3076	4540	cmd.exe	109
PID 4540 wrote to memory of 2156	4540	cmd.exe	110
PID 4540 wrote to memory of 3712	4540	cmd.exe	111
PID 3712 wrote to memory of 2912	3712	molliza.exe	112
PID 3712 wrote to memory of 4012	3712	molliza.exe	114
PID 4012 wrote to memory of 1072	4012	cmd.exe	116
PID 4012 wrote to memory of 3268	4012	cmd.exe	117
PID 4012 wrote to memory of 4020	4012	cmd.exe	118
PID 4020 wrote to memory of 4344	4020	molliza.exe	119
PID 4020 wrote to memory of 3528	4020	molliza.exe	121
PID 3528 wrote to memory of 4908	3528	cmd.exe	123
PID 3528 wrote to memory of 2440	3528	cmd.exe	124
PID 3528 wrote to memory of 4496	3528	cmd.exe	125
PID 4496 wrote to memory of 3404	4496	molliza.exe	126
PID 4496 wrote to memory of 3692	4496	molliza.exe	128
PID 3692 wrote to memory of 3776	3692	cmd.exe	130
PID 3692 wrote to memory of 956	3692	cmd.exe	131
PID 3692 wrote to memory of 4600	3692	cmd.exe	132
PID 4600 wrote to memory of 3204	4600	molliza.exe	133
PID 4600 wrote to memory of 4276	4600	molliza.exe	135
PID 4276 wrote to memory of 3856	4276	cmd.exe	137
PID 4276 wrote to memory of 4120	4276	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\backup.exe
"C:\Users\Admin\AppData\Local\Temp\backup.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:988
- C:\Users\Admin\AppData\Roaming\malware\molliza.exe
  "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kolBXg4Ni31F.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1620
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:464
  - - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
      "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4832
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zicCNsTrbHuZ.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4484
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:780
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2512
      - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZeJi5GBqnyAw.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2460
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4936
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Dvmk8Ux5927g.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3076
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2156
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2912
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FHEDvjCo4UXw.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1072
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3268
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\voIFRnD0C4ef.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4908
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2440
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3404
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hzQoAKk7WJuV.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:956
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G0lg5rb5U8xH.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3856
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4120

C:\Users\Admin\AppData\Roaming\malware\molliza.exe
C:\Users\Admin\AppData\Roaming\malware\molliza.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

molliza.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\molliza.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

Dvmk8Ux5927g.bat

Path C:\Users\Admin\AppData\Local\Temp\Dvmk8Ux5927g.bat
Size 209B
SHA256 382f3dbee8f855b706178de3eceab156fff7c1c51a409da10608b201ee0227e1
MD5 f537908d920a5e5244388494386d474c
SHA1 c43f5bf1376933c8aeac8976464069f8cf9b41df
SHA512 f470e84b82aa2d04e96daf1e258fdbb98d272fb548127f88b31360ea818c03e400a4fe9e151f35f0d4374819dd3a26596c9d4b174ccabaa04b0c46b22796261b
TLSH
T12AD023035790C79D45008C4B5F61738CB05608E72F4C7DD145008C9C438688CB5AB5C1
MD5 SHA1 SHA512 TLSH

Submit Download

FHEDvjCo4UXw.bat

Path C:\Users\Admin\AppData\Local\Temp\FHEDvjCo4UXw.bat
Size 209B
SHA256 4e6d624bb4c0efaa460e4af73181222043e186b83bbcda819bdcecaf655b1ee1
MD5 3a744e8087e2902d8aa14101bfb03ad6
SHA1 edfd297fed306b70b4126161fe7da56d47b4ff98
SHA512 eb8ad32baf38a034e926526ae717b47a36787fd7c821410047f7b3ee9cef04ff8ead6046e83735948cfe2954e00424262b4cf51fce077c363ec34b111892da98
TLSH
T156D023411790C75D460188471EA572CCB09504EA2F4C7D914D044C9C438689CF557582
MD5 SHA1 SHA512 TLSH

Submit Download

G0lg5rb5U8xH.bat

Path C:\Users\Admin\AppData\Local\Temp\G0lg5rb5U8xH.bat
Size 209B
SHA256 da2ad347473402038e84807d58ba492fbdb1c5e1b3f439573e044487bb2e093a
MD5 d3cda2d9352c9f5b85b418405a04656d
SHA1 a948cb2aade9d1695c4abc83deb3e91d2423341c
SHA512 d9daaaecbbccf7d1bf73526e4add9be264bd3d43d459035b7043cb2de840010669cc737a845e1acb23d577f76a65cdca0391db13f969668079d0e0abdc8fd2a5
TLSH
T1DFD023111790C75D590448471E61728CB05904FA1F4CBDE189008C9D03C689CB597581
MD5 SHA1 SHA512 TLSH

Submit Download

ZeJi5GBqnyAw.bat

Path C:\Users\Admin\AppData\Local\Temp\ZeJi5GBqnyAw.bat
Size 209B
SHA256 68ddb37c59c6eb7a5279dda8f376f18416102285ed128ce1baad5d7c6472881b
MD5 9f086837e085652c462d44ee6c56fe74
SHA1 ed13aefc21aabe407e9f16a9a391e42719bb467a
SHA512 b4acd5067037f83bc4afc4d6ac69aad0fef27610f1f9170a53dcbc2a7de6534eacc8a606061e742c02fb24c2a7b1c67af240cf42fd1df305103507412e7dc6fe
TLSH
T19AD023111791C75D650048471FB172CCB05604FA2F4C7D9185004CDC1386C9CF65B581
MD5 SHA1 SHA512 TLSH

Submit Download

hzQoAKk7WJuV.bat

Path C:\Users\Admin\AppData\Local\Temp\hzQoAKk7WJuV.bat
Size 209B
SHA256 db0b673c80eddda4e2d119a2597488cef13975bd1dbca292fcbcceda94b10334
MD5 9cdce80c0b25f907f3f95308a25f096e
SHA1 f4486b6cac72cbaaf263b4d0e2c6c2f8881f0523
SHA512 8dd2987214f5be832616c056447fe5009cc74ad72b5b5e420459db4b33622833a160934130cfd61d5f5078b05b911fd01d958490d3714798c2a8503d75fc92fb
TLSH
T11BD0230317D0C75D45004C471EB1728CB05504EE1F487DD245014C9D07C689CB5D75C1
MD5 SHA1 SHA512 TLSH

Submit Download

kolBXg4Ni31F.bat

Path C:\Users\Admin\AppData\Local\Temp\kolBXg4Ni31F.bat
Size 209B
SHA256 1b34ac0a5c3c4a5b83bbfbc83d5f7f56658e63c1ae50ee9a35563573b1a65f4e
MD5 65632684eaddee3039c97d605c4543dd
SHA1 040593f304f933dbe8977b069250f46a4f81e838
SHA512 0526b26c3c3bcf05bcc9d9bf97b482367f0491d579379fe3545e531b4eee0153669da6f8b62238c57eff37a409e7fde1c806d955f220ce502bafd6d63abe9d78
TLSH
T162D023415790C75D4501484B1E6172CCB09A04E71FC87DD746054C9D138789CB56B581
MD5 SHA1 SHA512 TLSH

Submit Download

voIFRnD0C4ef.bat

Path C:\Users\Admin\AppData\Local\Temp\voIFRnD0C4ef.bat
Size 209B
SHA256 32b293a55dae112c23cf6064a84b7c8bf7c15198e78b5cd49119b686d4187516
MD5 97a411b59c4e72aca27332ecc872d823
SHA1 4164de3c7a8e06b8d6bae948d0abb05fe79f4ecb
SHA512 84c6908a46b7e7898a8ed540e521f544ed87ea5a42ac5748344305e716c500be9dc5906860b7d3b8089c34e139c13ad45183489e894ec6fa44ed8d4a5da1c13b
TLSH
T197D023025790C79E45004C475E7176CCF09704EA1F48BDD145004C9C038688CB567583
MD5 SHA1 SHA512 TLSH

Submit Download

zicCNsTrbHuZ.bat

Path C:\Users\Admin\AppData\Local\Temp\zicCNsTrbHuZ.bat
Size 209B
SHA256 9e3f0eeb97cbde842e26b8c41384c3efb0bf12ba99cd5349a5f7f489a2045572
MD5 57586e372b8ac0f6cba977f7b5dd659e
SHA1 3cde00b4b78309eaf26b4d50555e1efdb4c226cb
SHA512 56e9c501f878d640e578c17b30421af9abf9e9d5ceb0d63c1da820b5c7f46915d62dcf3b868a3ed72cdf47effd4f267f93feda671902545b8fde1feac3ff83ea
TLSH
T1B2D023415791C79D5500484B1E6572CCB05514F61F497DD1CA014C9C0386C8CF5575C2
MD5 SHA1 SHA512 TLSH

Submit Download

molliza.exe

Path C:\Users\Admin\AppData\Roaming\malware\molliza.exe
Size 3.1MB
SHA256 11d1beff4e8cdf50f73298ba1e8cc5127994d2b6bd396196e1f4231aebb66e6c
MD5 1df13e8b6ae9577d292ffb2adb0119bc
SHA1 ebfbb4fb70f4fe2c0ba22ccc32f5a833f80714fb
SHA512 bac0d198bd7a91ceb78b6131660e75b3828918d96b7f3b1b6e5c50007dc4add85e4739166b69dab0658745f0debbdd4393868dbe32cfdbec1b7803161eceadc7
SSDEEP 49152:LvivE2H5aweBHPbl6T/yGaqA6/y5T72lpoGdhTHHB72eh2NT:LvoE2H5aweBHPbl6T/DaqA6/y5T7u
TLSH
T186E56A143BF85E32E16AD6B3D5B0505263F0F82AF363EB0B5181777A2D53B40A9426B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2848-45-0x0000000000F10000-0x0000000000F1C000-memory.dmp

Download

memory/2848-47-0x00000000028B0000-0x00000000028B9000-memory.dmp

Download

memory/2848-46-0x0000000002880000-0x0000000002892000-memory.dmp

Download

memory/3012-14-0x0000000002930000-0x0000000002942000-memory.dmp

Download

memory/3012-13-0x0000000001110000-0x000000000111C000-memory.dmp

Download

memory/3712-55-0x000000001C3C0000-0x000000001C3C9000-memory.dmp

Download

memory/3712-54-0x000000001B870000-0x000000001B882000-memory.dmp

Download

memory/3712-53-0x0000000001510000-0x000000000151C000-memory.dmp

Download

memory/3912-9-0x00000000033F0000-0x0000000003402000-memory.dmp

Download

memory/3912-0-0x0000000000F60000-0x0000000001284000-memory.dmp

Download

memory/3912-8-0x0000000003360000-0x000000000336C000-memory.dmp

Download

memory/3912-1-0x000000001BFA0000-0x000000001BFB0000-memory.dmp

Download

memory/4020-60-0x000000001BCA0000-0x000000001BCA9000-memory.dmp

Download

memory/4020-58-0x000000001BA90000-0x000000001BA9C000-memory.dmp

Download

memory/4020-67-0x000000001BA90000-0x000000001BA9C000-memory.dmp

Download

memory/4020-69-0x000000001BCA0000-0x000000001BCA9000-memory.dmp

Download

memory/4020-59-0x000000001BC50000-0x000000001BC62000-memory.dmp

Download

memory/4324-22-0x000000001B7E0000-0x000000001B7F2000-memory.dmp

Download

memory/4324-15-0x000000001C2B0000-0x000000001C300000-memory.dmp

Download

memory/4324-10-0x000000001B800000-0x000000001B810000-memory.dmp

Download

memory/4324-21-0x00000000013A0000-0x00000000013AC000-memory.dmp

Download

memory/4324-16-0x000000001C3C0000-0x000000001C472000-memory.dmp

Download

memory/4324-23-0x000000001B840000-0x000000001B849000-memory.dmp

Download

memory/4496-75-0x0000000002570000-0x000000000257C000-memory.dmp

Download

memory/4496-77-0x000000001B060000-0x000000001B069000-memory.dmp

Download

memory/4496-76-0x0000000002740000-0x0000000002752000-memory.dmp

Download

memory/4600-82-0x0000000001BC0000-0x0000000001BC9000-memory.dmp

Download

memory/4600-80-0x0000000001990000-0x000000000199C000-memory.dmp

Download

memory/4600-81-0x0000000001B10000-0x0000000001B22000-memory.dmp

Download

memory/4600-91-0x0000000001BC0000-0x0000000001BC9000-memory.dmp

Download

memory/4600-89-0x0000000001990000-0x000000000199C000-memory.dmp

Download

memory/4744-38-0x0000000001820000-0x0000000001832000-memory.dmp

Download

memory/4744-39-0x0000000003150000-0x0000000003159000-memory.dmp

Download

memory/4744-37-0x0000000001790000-0x000000000179C000-memory.dmp

Download

memory/4832-31-0x000000001B7D0000-0x000000001B7D9000-memory.dmp

Download

memory/4832-29-0x0000000002D10000-0x0000000002D1C000-memory.dmp

Download

memory/4832-30-0x000000001BEE0000-0x000000001BEF2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads