quasar | 0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216.exe
Size 3.1MB
Sample260528-dcffvsfz3w
SHA256 0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216
MD5 3e79a671ca9a73063f21d0fbabd20baa
SHA1 6e2d116a23d966da68a94675005a9029d92c0535
SHA512 eb7ee7b8462bd697fd6aeb434bf824d74e57c3c3ef99125d3dd7523d90581abc04bfcf5a711ca7cf6d6eb47ae2017722d9fd61d01881e4756890485e0faeb354
SSDEEP 49152:XvOe821/aQWl8P0lSk3aKA3Z+nFFj3tarGLoGdF1rTHHB72eh2NT:XvN821/aQWl8P0lSk3DA3Z+nz3d
TLSH
T1DEE54A1437F85E23E1ABE373D5B0041367F1F82AB3A3EB0B6191677A5C53B5049826A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xoilac discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

xoilac

cel-robox.com:443
trojan.cel-robox.com :443
spyware.cel-robox.com :443
worm.cel-robox.com :443

Mutex

2b437ab2-4092-4be7-b826-8506c5ec38ac

Attributes

encryption_key
B7E4985BC6F561AFD5FC99CACB2E00523B40A73D
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/3732-0-0x0000000000970000-0x0000000000C94000-memory.dmp	family_quasar
behavioral2/files/0x001a00000002b54d-5.dat	family_quasar

Executes dropped EXE 16 IoCs

pid	Process
3416	molliza.exe
5752	molliza.exe
4116	molliza.exe
1948	molliza.exe
2060	molliza.exe
2732	molliza.exe
4812	molliza.exe
2692	molliza.exe
1892	molliza.exe
5564	molliza.exe
1888	molliza.exe
2976	molliza.exe
4704	molliza.exe
5752	molliza.exe
5884	molliza.exe
3912	molliza.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4052	PING.EXE
5924	PING.EXE
5016	PING.EXE
2932	PING.EXE
1496	PING.EXE
840	PING.EXE
1204	PING.EXE
4632	PING.EXE
5976	PING.EXE
4332	PING.EXE
5176	PING.EXE
3776	PING.EXE
5596	PING.EXE
5876	PING.EXE
1904	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
5596	PING.EXE
4632	PING.EXE
5176	PING.EXE
5016	PING.EXE
2932	PING.EXE
5976	PING.EXE
1904	PING.EXE
3776	PING.EXE
4052	PING.EXE
5924	PING.EXE
4332	PING.EXE
840	PING.EXE
5876	PING.EXE
1204	PING.EXE
1496	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3952	schtasks.exe
436	schtasks.exe
1752	schtasks.exe
4108	schtasks.exe
3556	schtasks.exe
3384	schtasks.exe
5700	schtasks.exe
5236	schtasks.exe
3464	schtasks.exe
2104	schtasks.exe
4752	schtasks.exe
3516	schtasks.exe
5220	schtasks.exe
3472	schtasks.exe
1788	schtasks.exe
3896	schtasks.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	_0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216.exe
Token: SeDebugPrivilege	3416	molliza.exe
Token: SeDebugPrivilege	5752	molliza.exe
Token: SeDebugPrivilege	4116	molliza.exe
Token: SeDebugPrivilege	1948	molliza.exe
Token: SeDebugPrivilege	2060	molliza.exe
Token: SeDebugPrivilege	2732	molliza.exe
Token: SeDebugPrivilege	4812	molliza.exe
Token: SeDebugPrivilege	2692	molliza.exe
Token: SeDebugPrivilege	1892	molliza.exe
Token: SeDebugPrivilege	5564	molliza.exe
Token: SeDebugPrivilege	1888	molliza.exe
Token: SeDebugPrivilege	2976	molliza.exe
Token: SeDebugPrivilege	4704	molliza.exe
Token: SeDebugPrivilege	5752	molliza.exe
Token: SeDebugPrivilege	5884	molliza.exe
Token: SeDebugPrivilege	3912	molliza.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 5220	3732	_0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216.exe	80
PID 3732 wrote to memory of 3416	3732	_0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216.exe	82
PID 3416 wrote to memory of 3384	3416	molliza.exe	85
PID 3416 wrote to memory of 6088	3416	molliza.exe	87
PID 6088 wrote to memory of 4744	6088	cmd.exe	89
PID 6088 wrote to memory of 4052	6088	cmd.exe	90
PID 6088 wrote to memory of 4116	6088	cmd.exe	91
PID 4116 wrote to memory of 3472	4116	molliza.exe	92
PID 4116 wrote to memory of 6136	4116	molliza.exe	94
PID 6136 wrote to memory of 3460	6136	cmd.exe	96
PID 6136 wrote to memory of 5596	6136	cmd.exe	97
PID 6136 wrote to memory of 1948	6136	cmd.exe	98
PID 1948 wrote to memory of 5700	1948	molliza.exe	99
PID 1948 wrote to memory of 3372	1948	molliza.exe	101
PID 3372 wrote to memory of 5412	3372	cmd.exe	103
PID 3372 wrote to memory of 5876	3372	cmd.exe	104
PID 3372 wrote to memory of 2060	3372	cmd.exe	105
PID 2060 wrote to memory of 3952	2060	molliza.exe	106
PID 2060 wrote to memory of 1540	2060	molliza.exe	108
PID 1540 wrote to memory of 3148	1540	cmd.exe	110
PID 1540 wrote to memory of 4632	1540	cmd.exe	111
PID 1540 wrote to memory of 2732	1540	cmd.exe	112
PID 2732 wrote to memory of 5236	2732	molliza.exe	113
PID 2732 wrote to memory of 2776	2732	molliza.exe	115
PID 2776 wrote to memory of 5620	2776	cmd.exe	117
PID 2776 wrote to memory of 5924	2776	cmd.exe	118
PID 2776 wrote to memory of 4812	2776	cmd.exe	119
PID 4812 wrote to memory of 3464	4812	molliza.exe	120
PID 4812 wrote to memory of 5140	4812	molliza.exe	122
PID 5140 wrote to memory of 3484	5140	cmd.exe	124
PID 5140 wrote to memory of 1204	5140	cmd.exe	125
PID 5140 wrote to memory of 2692	5140	cmd.exe	126
PID 2692 wrote to memory of 2104	2692	molliza.exe	127
PID 2692 wrote to memory of 4172	2692	molliza.exe	129
PID 4172 wrote to memory of 5764	4172	cmd.exe	131
PID 4172 wrote to memory of 5976	4172	cmd.exe	132
PID 4172 wrote to memory of 1892	4172	cmd.exe	133
PID 1892 wrote to memory of 4752	1892	molliza.exe	134
PID 1892 wrote to memory of 4380	1892	molliza.exe	136
PID 4380 wrote to memory of 4776	4380	cmd.exe	138
PID 4380 wrote to memory of 4332	4380	cmd.exe	139
PID 4380 wrote to memory of 5564	4380	cmd.exe	140
PID 5564 wrote to memory of 1752	5564	molliza.exe	141
PID 5564 wrote to memory of 220	5564	molliza.exe	143
PID 220 wrote to memory of 5628	220	cmd.exe	145
PID 220 wrote to memory of 5176	220	cmd.exe	146
PID 220 wrote to memory of 1888	220	cmd.exe	147
PID 1888 wrote to memory of 436	1888	molliza.exe	148
PID 1888 wrote to memory of 5328	1888	molliza.exe	150
PID 5328 wrote to memory of 1484	5328	cmd.exe	152
PID 5328 wrote to memory of 1904	5328	cmd.exe	153
PID 5328 wrote to memory of 2976	5328	cmd.exe	154
PID 2976 wrote to memory of 3516	2976	molliza.exe	155
PID 2976 wrote to memory of 4836	2976	molliza.exe	157
PID 4836 wrote to memory of 4964	4836	cmd.exe	159
PID 4836 wrote to memory of 5016	4836	cmd.exe	160
PID 4836 wrote to memory of 4704	4836	cmd.exe	161
PID 4704 wrote to memory of 4108	4704	molliza.exe	162
PID 4704 wrote to memory of 4840	4704	molliza.exe	164
PID 4840 wrote to memory of 2596	4840	cmd.exe	166
PID 4840 wrote to memory of 2932	4840	cmd.exe	167
PID 4840 wrote to memory of 5752	4840	cmd.exe	168
PID 5752 wrote to memory of 3556	5752	molliza.exe	169
PID 5752 wrote to memory of 1748	5752	molliza.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\_0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216.exe
"C:\Users\Admin\AppData\Local\Temp\_0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5220
- C:\Users\Admin\AppData\Roaming\malware\molliza.exe
  "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZlnawrhTzA1B.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6088
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4744
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4052
  - - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
      "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4116
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3472
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4a6aiCLGxzYJ.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6136
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3460
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5596
      - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ni2c9sQrCqoc.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:5412
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5876
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2060
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PdZ1Ly7Vr7Zp.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3148
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4632
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cIETqrneRixv.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:5620
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5924
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PKLg2jQAhYIV.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:5140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3484
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1204
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2104
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BznOFXwbr2ry.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4172
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:5764
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5976
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\94VRcDpjaMdl.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4380
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4332
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5564
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AkfrnJ1u6lYn.bat" "
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:5628
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5176
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OcacsHqJxAyr.bat" "
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:5328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1484
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1904
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3516
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bxRMKzgxlUtV.bat" "
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:4836
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5016
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\554nAq8ORTXa.bat" "
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2596
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2932
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5752
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j14SNnimAGnh.bat" "
        27⤵
        
        PID:1748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1496
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5884
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hC2SAXSAc5lv.bat" "
        29⤵
        
        PID:3920
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3776
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3912
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FIWeFx2uglVC.bat" "
        31⤵
        
        PID:5700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:5616
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:840

C:\Users\Admin\AppData\Roaming\malware\molliza.exe
C:\Users\Admin\AppData\Roaming\malware\molliza.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

molliza.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\molliza.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

4a6aiCLGxzYJ.bat

Path C:\Users\Admin\AppData\Local\Temp\4a6aiCLGxzYJ.bat
Size 209B
SHA256 44b16f0c2c0c2a5f03cdcdda58589821d3591284661268e7886227d3b1682788
MD5 32e4e0718628aa8ec2e4c7eae91ca6ef
SHA1 cf5782380b73736a8a4501419f46957c02e2a640
SHA512 535720abaea8f7cff3bb4c8a789bb5ce7cacedc3bb99afdc067edc243deef2f360d87d3c7b177af1b85229f7360f5d505193d76e158b1dace5d2689c5ad29055
TLSH
T1CFD023111780CF5D590148471F61728CB05604FB2F4C7D9145004C9C0387C8CB55B581
MD5 SHA1 SHA512 TLSH

Submit Download

554nAq8ORTXa.bat

Path C:\Users\Admin\AppData\Local\Temp\554nAq8ORTXa.bat
Size 209B
SHA256 dd62e8c74d4fc1f639f408192b360f768c9f0e3aab1380f78a8d30404d3050ab
MD5 3f6e4aaaf6b7a3e067babc5845fd135b
SHA1 2e9f9993fce16ba199e391c5cd4c558acca1aba8
SHA512 a26d4500d9a182863162cd27dd2034ef38678aa6eab58f5e75e7e1454802dc2a9b2ac033cc47559d28ce43dad4f1b9f19672b0a6a93fa09bf47a59a8a0f41f91
TLSH
T19ED023011780C75D560088471E61728CB09504E71F487D9147014CDC438788CF597583
MD5 SHA1 SHA512 TLSH

Submit Download

94VRcDpjaMdl.bat

Path C:\Users\Admin\AppData\Local\Temp\94VRcDpjaMdl.bat
Size 209B
SHA256 c49d89a654e13cb4babb0eeca6f84885fcdf2503a768b129e2f6f1cb08ae07ba
MD5 5dee0998ab26bd911183bc27275cf90f
SHA1 f7c38d5539588f29a5c96575e8c35111fefea169
SHA512 71f91ec4d4786f457109d5bd1c7c762413ccdadbd4e855d8b75a6a7f653c95851f249f93d98bb47fe08febae234e504bdc1c4bf630cc4f89718ce492fcf9cbf7
TLSH
T193D023112780C75D45004C471E7172CCF09944E62F4C7DD145004CDC038788CB55B581
MD5 SHA1 SHA512 TLSH

Submit Download

AkfrnJ1u6lYn.bat

Path C:\Users\Admin\AppData\Local\Temp\AkfrnJ1u6lYn.bat
Size 209B
SHA256 9f2bba0c4cb5eef5b6db4ece73b56be560b40f0aa7a91dfcf14661c116e86bea
MD5 7e1c48b7d4ce09e060cab37040e7df9d
SHA1 2fc1f835d2de07b18a1358d6e785537b98b841dd
SHA512 1a07759d4f77a81e82b8bdb7cb1bbe2700c09484e62072d99eb181cc5670ddbb7aecfc5ea4ddfb70dbc31c299231c0dde73751955a81b55fb44c09f665d1abda
TLSH
T14FD023511790CB5D550148475E6177CCB09504E61F487D91C5014C9D038A8CCB55B581
MD5 SHA1 SHA512 TLSH

Submit Download

BznOFXwbr2ry.bat

Path C:\Users\Admin\AppData\Local\Temp\BznOFXwbr2ry.bat
Size 209B
SHA256 af5d5fe71b79c7db9615a050d612bbff09b9191358a3fcb9c083ca3ae34bbd16
MD5 dbf44b02609234d21a46dc4499a24971
SHA1 45daf29fe6b6661d89c416baf7032fdc8d497414
SHA512 58ab403709bd84fb2160f491d5033174ee4fc93db5ff2b770e49d92a10cc673805f95614a2ed18f88a659a1d6a477b40d74314ddf4acfa0c7c139a7c30dad4cf
TLSH
T16DD023011784CB5D59404C471E61728CF05904E61F487D9189448CDC038688CF797581
MD5 SHA1 SHA512 TLSH

Submit Download

FIWeFx2uglVC.bat

Path C:\Users\Admin\AppData\Local\Temp\FIWeFx2uglVC.bat
Size 209B
SHA256 8042dee8ef2864ec194e8322c87d5843fa5738cf3a1132551a29a585db521c82
MD5 7bc8540472704b24214849fb11b341c6
SHA1 6a3d0587c1ff7923c110002ffa893cded9453057
SHA512 f5aacdf77d3c8faf75547b18e8f6641f11b1f9ca78470fc669468373c30c2ebd5a7069a3f15dd0a3f38fe0378bc34e408c08c837405a639ff021c428f6308f79
TLSH
T1B3D0234157C0C75D4D014C471E65728CB09504E71F48BD9145004C9D03C688CF967581
MD5 SHA1 SHA512 TLSH

Submit Download

OcacsHqJxAyr.bat

Path C:\Users\Admin\AppData\Local\Temp\OcacsHqJxAyr.bat
Size 209B
SHA256 ee4fe0c184c1fc1c603031f8e8fb39f3068a09d1cb9b4f0848b70433a190520a
MD5 6f9991f22a38d262eff163d38c8a1ee6
SHA1 9da9847fe8a9847f06f16ec4839a04833df44e28
SHA512 672a7221ca5a6ae7ab52fe0ad7e2d73eec45795911224f998c965ae0e815352c7f907bd0f85a32c7f58b70368cd4b6d3c6d3edbb17d82aea6cb6af0b3a82e484
TLSH
T161D0235217C0C79D4641C8C71E75738CB05604E61F487E9186014C9D438689CB597581
MD5 SHA1 SHA512 TLSH

Submit Download

PKLg2jQAhYIV.bat

Path C:\Users\Admin\AppData\Local\Temp\PKLg2jQAhYIV.bat
Size 209B
SHA256 9ecd8ecc987e5bdc824ac42956df78a24a049694a7b1de4c4f269270500a6330
MD5 0f6bd314d1d3cff7d7ec6030749dfc0e
SHA1 1f4f3fc01640cec56106439137621e8c0df197ee
SHA512 dcc8416ade930f863d321803cc08da1e98d92cbfea7548c26fb0218608966b5f65f5d92b1ffa6be5e02972c62c37f5481a7028414cddd5ce3108ad54828a83b5
TLSH
T1BBD0230157C0C75D490148471E61728CB05504FB1F4CBD9686014C9D1786CDCB557582
MD5 SHA1 SHA512 TLSH

Submit Download

PdZ1Ly7Vr7Zp.bat

Path C:\Users\Admin\AppData\Local\Temp\PdZ1Ly7Vr7Zp.bat
Size 209B
SHA256 a2d584e843807f3c0a0d8870fb32bd287eb5647c24453ffd3d959775610f8162
MD5 a0e19f1866f28206346c01cd06276430
SHA1 ad23a66535aa5148112d57a185ccf2c54f9801b8
SHA512 01cfb390162f9298b760678c8641ce1a15a6adf6c9b929b78eef5ae7e41deda6a8cba64f3a869d07c67d1451250e437248b624dd192991768b35efebc19d17ea
TLSH
T195D0234317C1CB9D5500CC471EA1728CB05504E61F4CBDE18A004CDC038A89CF597981
MD5 SHA1 SHA512 TLSH

Submit Download

ZlnawrhTzA1B.bat

Path C:\Users\Admin\AppData\Local\Temp\ZlnawrhTzA1B.bat
Size 209B
SHA256 e9b47e31cc9ab21c5234e0c592b47e7beb714f0e9996a3cb726e4d465de0652b
MD5 175902f308f1c048f5bc8dfe8586313e
SHA1 38ba3f616f4c75ec322deba7dbffbefe457a314d
SHA512 88131c65c79fb1527211b891afde0108a11135b45871bbaf9bffcac83382c59042f9bc586008da8cf6830668c60ee122e3112d7c15a1ee1df314d217c54be4a2
TLSH
T183D023011B90C79D450088471FB5768CB05504EA2F4C7D9146014C9C47C7C8CB557581
MD5 SHA1 SHA512 TLSH

Submit Download

bxRMKzgxlUtV.bat

Path C:\Users\Admin\AppData\Local\Temp\bxRMKzgxlUtV.bat
Size 209B
SHA256 b452bf17214765c29935e0e3b73d9cee70166fdc85c2d95e338d7496d616ffed
MD5 cf9a7ff2e5bd71abb50eba523b250359
SHA1 ae7cc23c8ef1dc2734bd24922ef53cc53127ed2d
SHA512 f046098c2eeba949189a4eb63a0f5f9aeb2075368d00491b05fc0cb33bbc32fefc5ab1962201dcbb9a5da09fa82ae3dcdec0ed9b3851334b1087a55f113dd813
TLSH
T15FD023425780C75D550048475FA1778CF0D504E61F487DD18D004CDD0387C9CB55B5C1
MD5 SHA1 SHA512 TLSH

Submit Download

cIETqrneRixv.bat

Path C:\Users\Admin\AppData\Local\Temp\cIETqrneRixv.bat
Size 209B
SHA256 91732ee32c1289133c669763ce46251d82f92caff37ed177627f125396afc76c
MD5 8bee9900ab2b8f87e4dcf9268ea75f9d
SHA1 c7a1f707d9b7cd2e073aa8ce0af43b8d8262dc23
SHA512 b59601181397fbf5ce0157ce2164fd8537292fe3cc775a6560c1e189b35f1dcce85adda8cd9d781b3450ce3a67faa341618cece70bff9b12775e3db70835c7e6
TLSH
T10FD023011780CB5D49058C471FE5728CB05704E61F487D9189014C9C138789CF5A7581
MD5 SHA1 SHA512 TLSH

Submit Download

hC2SAXSAc5lv.bat

Path C:\Users\Admin\AppData\Local\Temp\hC2SAXSAc5lv.bat
Size 209B
SHA256 4a127b49287bcf47a677a13a385d75d56b869304b41c86edcffd0a1f22f7cd7e
MD5 ab64728a107b976e0e3a3c7c3e04c270
SHA1 95460478268f13e093d32c4f7703f46f11858f58
SHA512 b8f274e20519d9748e893a5aecce7655105162901821726bd9da8f0c14a80ec1aed1bdddea4f889a9574b8771917d0f822f2516001700c85d8b38c45b847ba75
TLSH
T149D023011791C7AD55004C471E61728CB05504E61F487D9249004CDC13878CCB5A7682
MD5 SHA1 SHA512 TLSH

Submit Download

j14SNnimAGnh.bat

Path C:\Users\Admin\AppData\Local\Temp\j14SNnimAGnh.bat
Size 209B
SHA256 4551cb2b7e90447f6f854566ba294b052b786f592ce2e24b19eefb532ab04243
MD5 27c25d6f5840d9273090b2a00b62632d
SHA1 415c7c95a32c8e44885b26ef0bfdc71903b264ae
SHA512 2104a9119d99d0030a738845e75b42c9ef2e264d61e098a21740b5eb936eb9b0856db68e268ac7db27d3b8bfcb39d8a12a86201fae1a1c9f2f528cfea8b1ec43
TLSH
T1F1D0231227C0C79D5500484B5E65738CF05614E72F487D9145004CDC0387C8CF5A75C1
MD5 SHA1 SHA512 TLSH

Submit Download

ni2c9sQrCqoc.bat

Path C:\Users\Admin\AppData\Local\Temp\ni2c9sQrCqoc.bat
Size 209B
SHA256 c93387e54142da87d8d5585b24dda8d516b304ec3038f17329e379d8abcac747
MD5 15ab435e8bcb8c1a57a1abc3b42af820
SHA1 a028c6b31b2598d3010595bd7342498cb15ccebd
SHA512 f9e5bcbd1c664569d666fec18333abb6f9eb1a7c5fa80bc083c2bc4a65e9a7460371eded5686979ed3f5d02a47a1cda48b1de982a227a401807189591546d5ab
TLSH
T19CD0230117C1C79D5900884B1F61778CB05504FE1F49BDA185054CDC138788CB567581
MD5 SHA1 SHA512 TLSH

Submit Download

molliza.exe

Path C:\Users\Admin\AppData\Roaming\malware\molliza.exe
Size 3.1MB
SHA256 0464caa1c45cb753db25a95a30ce0b6814650b6f839a07cf8c2afdc143de7216
MD5 3e79a671ca9a73063f21d0fbabd20baa
SHA1 6e2d116a23d966da68a94675005a9029d92c0535
SHA512 eb7ee7b8462bd697fd6aeb434bf824d74e57c3c3ef99125d3dd7523d90581abc04bfcf5a711ca7cf6d6eb47ae2017722d9fd61d01881e4756890485e0faeb354
SSDEEP 49152:XvOe821/aQWl8P0lSk3aKA3Z+nFFj3tarGLoGdF1rTHHB72eh2NT:XvN821/aQWl8P0lSk3DA3Z+nz3d
TLSH
T1DEE54A1437F85E23E1ABE373D5B0041367F1F82AB3A3EB0B6191677A5C53B5049826A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3416-12-0x000000001D5B0000-0x000000001D662000-memory.dmp

Download

memory/3416-11-0x000000001D4A0000-0x000000001D4F0000-memory.dmp

Download

memory/3416-8-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

Download

memory/3732-0-0x0000000000970000-0x0000000000C94000-memory.dmp

Download

memory/3732-1-0x000000001CF20000-0x000000001CF30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads