quasar | 51e1149d6ebe110c4cf015bdc582a57016073ea11b9fad9972de0e395d710eee

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dwwdw.exe
Size 3.1MB
Sample260702-rwlc4sds2p
SHA256 51e1149d6ebe110c4cf015bdc582a57016073ea11b9fad9972de0e395d710eee
MD5 0aa7745dd95ea6d7894801af6df1f4a6
SHA1 493e70f0eaa89665f6f57b89577334626c5a1a74
SHA512 6832e3fa71f29f5f47103f3feaa805b4c9d3c8791515db4b6f664060f027fbadc13b6ea2c8a9e09dbadd362223128d802d72baf26e3b47dd7fa6ee6858e923e3
SSDEEP 49152:9vESW274aBMaePxlZfurjCd1nytv2C1JjloGdA4THHB72eh2NT:9vvW274aBMaePxlZfuPCd1nytv2g
TLSH
T145E54A1437F85F23E1BBE273D5B0041267F1E82AB363FB5B6191677A1C93B505801AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

https://xn--c-ifu2a9exa9bye4c.net/vi-vn/discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

https://xn--c-ifu2a9exa9bye4c.net/vi-vn/

https://xn--c-ifu2a9exa9bye4c.net/vi-vn/:80
https://xn--c-ifu2a9exa9bye4c.net/vi-vn/:8080
https://xn--c-ifu2a9exa9bye4c.net/vi-vn/:443
https://xn--c-ifu2a9exa9bye4c.net/vi-vn/:8443

Mutex

dc84e7d7-1880-44d7-b9b1-977a69077998

Attributes

encryption_key
576D1496F563366ADEBFC3046D6584BB4AD91241
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
10
startup_key
https://xn--c-ifu2a9exa9bye4c.net/vi-vn/
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2332-1-0x0000000000600000-0x0000000000924000-memory.dmp	family_quasar
behavioral2/files/0x000d00000001c5a6-15.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
3936	Client.exe
5000	Client.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Windows\CurrentVersion\Run\ https://xn--c-ifu2a9exa9bye4c.net/vi-vn/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	dwwdw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1797646245-3139070211-3019596475-1000\Software\Microsoft\Windows\CurrentVersion\Run\ https://xn--c-ifu2a9exa9bye4c.net/vi-vn/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5360	PING.EXE
1292	PING.EXE
5812	PING.EXE
3400	PING.EXE
4572	PING.EXE
4552	PING.EXE
4956	PING.EXE
3436	PING.EXE
2144	PING.EXE
3684	PING.EXE
4896	PING.EXE
4592	PING.EXE
1216	PING.EXE

Runs ping.exe 1 TTPs 13 IoCs

Remote System Discovery

T1018

pid	Process
1216	PING.EXE
4552	PING.EXE
4956	PING.EXE
1292	PING.EXE
5812	PING.EXE
3400	PING.EXE
4572	PING.EXE
2144	PING.EXE
5360	PING.EXE
3436	PING.EXE
3684	PING.EXE
4896	PING.EXE
4592	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 14 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3284	schtasks.exe
6008	schtasks.exe
3084	schtasks.exe
1048	schtasks.exe
3892	schtasks.exe
4304	schtasks.exe
844	schtasks.exe
2956	schtasks.exe
4896	schtasks.exe
1600	schtasks.exe
3156	schtasks.exe
2424	schtasks.exe
5152	schtasks.exe
1996	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	dwwdw.exe
Token: SeDebugPrivilege	3936	Client.exe
Token: SeDebugPrivilege	5000	Client.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3936	Client.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3936	Client.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4896	2332	dwwdw.exe	88
PID 2332 wrote to memory of 3936	2332	dwwdw.exe	90
PID 3936 wrote to memory of 3284	3936	Client.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dwwdw.exe
"C:\Users\Admin\AppData\Local\Temp\dwwdw.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4896
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CEORntQlo0pA.bat" "
    3⤵
    PID:5800
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4420
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1216
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      PID:4156
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6008
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NWHZ6Kx5Fx9Q.bat" "
        5⤵
        
        PID:2852
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4392
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4552
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        
        PID:4616
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\x5Bt58YL8HvQ.bat" "
        7⤵
        
        PID:1792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2144
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4956
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        
        PID:2748
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rSzr4FK4AreU.bat" "
        9⤵
        
        PID:2280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5360
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        
        PID:4980
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uftNfF4Srgny.bat" "
        11⤵
        
        PID:2988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:5028
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1292
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        
        PID:2680
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3156
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\k5ZPwrzfGXpS.bat" "
        13⤵
        
        PID:4820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5812
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        
        PID:5944
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s6WNoNFby1ab.bat" "
        15⤵
        
        PID:4192
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:1120
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3400
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        
        PID:5288
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aLzbK6qzhQdo.bat" "
        17⤵
        
        PID:4712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4888
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3436
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        
        PID:2560
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\k5r57iKjvv8n.bat" "
        19⤵
        
        PID:4416
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:356
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4572
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        
        PID:4828
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iI7W5yI8rLwR.bat" "
        21⤵
        
        PID:4428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1744
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2144
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        
        PID:692
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N7Ho7oiV2FXa.bat" "
        23⤵
        
        PID:4532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:5936
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3684
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        
        PID:4684
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wcvTr0Wl1ZiQ.bat" "
        25⤵
        
        PID:5904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:5544
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4896
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        
        PID:5340
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn " https://xn--c-ifu2a9exa9bye4c.net/vi-vn/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sQtdENxBbyHH.bat" "
        27⤵
        
        PID:700
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4220
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4592

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:4768
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:4516

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:3904

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

CEORntQlo0pA.bat

Path C:\Users\Admin\AppData\Local\Temp\CEORntQlo0pA.bat
Size 207B
SHA256 46b6b528ecb8c127b6323bcd33a5018a94a9bf7b8787e54b680810b4bf84c09f
MD5 b252192e045ecd6ecefbd03282168e78
SHA1 8260f7d73d7e001d215b1370d4ed15efb64ff520
SHA512 cdaa9ff3ec087b42ce09fceecc0f28d21d9873b4e34dc1b0f36865cb2437e112ed9d11049d5ec15e6e6e7a7e0f39063826765cd548be189754d77ab2301c70db
TLSH
T1B4D023016350CD5D560018476D757288B0EE04AB1F087D6185054C9C038784C755F1C2
MD5 SHA1 SHA512 TLSH

Submit Download

N7Ho7oiV2FXa.bat

Path C:\Users\Admin\AppData\Local\Temp\N7Ho7oiV2FXa.bat
Size 207B
SHA256 47808bdae100a97383d2bc12942bfbc37297d908e3fda046893f324b04790d77
MD5 b158e517521f0a5ceb896aa9bdc6fb34
SHA1 5d97f19351646451e30d650dffb072b7ff694da8
SHA512 5fddb73fc4e8105b193493322783e57058c767574aeb1b7888afd74202fa9f9d6ab1df455d63b35d87ae6b2912be1d80b6f7cde2a1f1e35fda0b37d8216a9958
TLSH
T14FD022023780CE9F46015C471EA5AB88B0AE04BB2F48BDA287118C9C938788CB5EB182
MD5 SHA1 SHA512 TLSH

Submit Download

NWHZ6Kx5Fx9Q.bat

Path C:\Users\Admin\AppData\Local\Temp\NWHZ6Kx5Fx9Q.bat
Size 207B
SHA256 27a5d433ce5bc572be341c2efa0dad507b370760df5ad1254cccae7bbbad360c
MD5 3029bd45a7ab916f36eb6033fd9470c4
SHA1 6f933729ae866ce2cdcb2b01c451c67fde6f39b2
SHA512 3acca1526b2803c7cd0760fa7c6dc46c0ef3886c35a7d237fe7c6466bc3e37ca60a1a94c12df9f94d4f8895f3299b419a2123142c56e272986ce61da3611b740
TLSH
T1CCD022122381CE9F550018472EB6B6C8B0AA04AA2F08BDA28601889C438698CB59F182
MD5 SHA1 SHA512 TLSH

Submit Download

aLzbK6qzhQdo.bat

Path C:\Users\Admin\AppData\Local\Temp\aLzbK6qzhQdo.bat
Size 207B
SHA256 0020d59c92e09c26ea7ad36848e49d3768f3f80ad3a79921002f20c721a5e139
MD5 51dc78427a362c1c951f5dd1de9509dd
SHA1 adc2aff1a4c34df092e4bb576b2417ab10579e7b
SHA512 4f682ce062bf5deb032e104ece414ee79bec49d34a385d1dde4649ef3b2f39c23d0345c8fffd63e405dca0838a26bb190594a67a20ea14e5cc9b24e9e777a4ac
TLSH
T193D022413380CE9E85001C475EA5F288F0EB04BA2F0CBDA2860188EC03C6CACB69B183
MD5 SHA1 SHA512 TLSH

Submit Download

iI7W5yI8rLwR.bat

Path C:\Users\Admin\AppData\Local\Temp\iI7W5yI8rLwR.bat
Size 207B
SHA256 32d4fcf84fa772ca4b678864fe35d98c4265ce2c3618681655459c23cb1eb12e
MD5 672f873c40f9bc98eea93343aef0fa04
SHA1 5560c3b2bfafc1fe129728a7f1f47170b40bf0ae
SHA512 113245e3f8f73b15435f775f1a2346a55eb815d2c334982d66138610e85d318d261a3e5620e40cde96eb579c3421ab30005d85fc3ca0d5120e6993411da95e81
TLSH
T129D023522340CD5D5501184B1D656688F0DF04E61F087D6145018C9C438785C755B142
MD5 SHA1 SHA512 TLSH

Submit Download

k5ZPwrzfGXpS.bat

Path C:\Users\Admin\AppData\Local\Temp\k5ZPwrzfGXpS.bat
Size 207B
SHA256 ce3005ffa93bf69e6bbdf983fd93a195bf1c919b923d099e6ce376835fbe74c4
MD5 c4c3cf0f185f0f2ae91e4306677ccfd7
SHA1 7fa3e63d151496295f8d0eaf1f0fb166506d21ba
SHA512 77ac547e60db217e2d55cd699c8143ee6f56143ca99d2dfc01b4d9ac25768d5253cfbc1cd862ac9729e80221b23d0daf1132cdac183f3f011cb03b21a34a3100
TLSH
T142D022012380CEAE46005A471EA6B689F0AB04EA2F0CFDB28A0588DC038688CB59B5C2
MD5 SHA1 SHA512 TLSH

Submit Download

k5r57iKjvv8n.bat

Path C:\Users\Admin\AppData\Local\Temp\k5r57iKjvv8n.bat
Size 207B
SHA256 6684751ba3faceb10ec776c45e7f4c0769b8e470b22e2c64e2d2a1759939b6b8
MD5 9b4239a003fc9f6d1f32c87e2a58f9f6
SHA1 ab7510f47d75db8682496570b35bdbce2ebd3e45
SHA512 8bdb3c040f2784059e7771c769e918c3d9bb58916ab31def29246b85e0efa91762feecbf4547d527a2155189fd4ede11bfed0b3d757220a8cd935a96cff961ec
TLSH
T103D023112781CE5D46011C471D657288B0BA04B71F087D614506489C03C698CB56B141
MD5 SHA1 SHA512 TLSH

Submit Download

rSzr4FK4AreU.bat

Path C:\Users\Admin\AppData\Local\Temp\rSzr4FK4AreU.bat
Size 207B
SHA256 7c1ffc8320ad4294169c662081b565f35f69b901fa5dbbee170604c8b4c583d1
MD5 4e9f2d5bae0ba5007207c03867fc0bc8
SHA1 0f7e743ea971c44da7de7a13e2b40e81affad5b5
SHA512 09fbf49e44effb471b8d731f867145bbc46455c3e177ed3563b412e2e574b29ac7691f4c474db5fda19bf0cdb0b837506631895535e0af7122851133629868f6
TLSH
T17FD023012340CD5D45005C471D7562C8B0DA04B71F4C7D618501489C538688C755F142
MD5 SHA1 SHA512 TLSH

Submit Download

s6WNoNFby1ab.bat

Path C:\Users\Admin\AppData\Local\Temp\s6WNoNFby1ab.bat
Size 207B
SHA256 d2b5ce433f841ac8c77062de842560450dabf9a0a8d958647d8e08e1e5833e5a
MD5 5ff665111cb37e8a985925128f4c651d
SHA1 392df17609d6574ba232f1aa7522bb9f10092ad5
SHA512 34298aa44f90678a0b9f9c8e24aa726a11a9834497348ac35cf1f1b9b25748589eeedf39d55eca346f940a1856a7d187f647882854bcf2f873868eafc62b5ae1
TLSH
T14DD023113341CE5D550018571D7566C8B09A04AB1F0D7D61C701889C078688CB55B582
MD5 SHA1 SHA512 TLSH

Submit Download

sQtdENxBbyHH.bat

Path C:\Users\Admin\AppData\Local\Temp\sQtdENxBbyHH.bat
Size 207B
SHA256 8f8538025e9f6721ad47cba9e46c51f8d3917545195849bd9e4648bdd029fac5
MD5 f598ed6a910902dcdf8891db748af7c4
SHA1 380d8c4979b2a51c62aaa5c040865270ee8101c3
SHA512 7895ab4f3c10ec141c8b823f1e58703d1674067b06871c682f38c01e10c865768a5adca5d936864311a5d832749a08e42f4a918808886d3bb9d4db03ca65f6ad
TLSH
T173D023522340CD5D55001C471D656388B0DE04AA1F097DA186054CDC038784CF59B981
MD5 SHA1 SHA512 TLSH

Submit Download

uftNfF4Srgny.bat

Path C:\Users\Admin\AppData\Local\Temp\uftNfF4Srgny.bat
Size 207B
SHA256 7e962b657bb79bbd79c956968bcbe683137e5c2ae8daae63f2ef836f800831cd
MD5 0a19efd713555d59a1e52b91fceb2a2b
SHA1 690e1c997ddb7880b267d24dbfbe0f39df6afd0c
SHA512 62927fcb3e28d2f639de53cbf4172802adc37298fdacd2c1520ce0a2ebf2ff99c17605b292db6ffbba47f3ade1db8f3fc68d36d9d5b1618b491f46cf91fc7582
TLSH
T1AAD023412390CD5E560018471D657388B0FA04A61F487D61850D48DC038685D755F141
MD5 SHA1 SHA512 TLSH

Submit Download

wcvTr0Wl1ZiQ.bat

Path C:\Users\Admin\AppData\Local\Temp\wcvTr0Wl1ZiQ.bat
Size 207B
SHA256 928e94356b70065b744d3e2dfe792bc91f22bd8b17a223af450a9377073439c9
MD5 65f90e4700b4c1bf30f3858a72de6772
SHA1 161e7c95a1d36af1ec8fc4a273bf7208d3afab12
SHA512 f93a48083e6e2543e2c317bdb16c6fb0a2c5384c91569db5849a2cf556b4f80536f363b57ba693c08261caaec4220aec970600248a8ee0fc7b488de3b5d4a80e
TLSH
T1EED023452340CD9D590118471EF56288B09E04AA2F48BD6146154C9C57C684D755B141
MD5 SHA1 SHA512 TLSH

Submit Download

x5Bt58YL8HvQ.bat

Path C:\Users\Admin\AppData\Local\Temp\x5Bt58YL8HvQ.bat
Size 207B
SHA256 7e59c17c949b07942853c078df211254cbbdbab93737df09e34410dfe6d0be0d
MD5 55a80f77cfd4eb2db5ab36298358bed5
SHA1 66219937d4aba1fbcdbacca6c06d23648d9a96f0
SHA512 960f0a8a43c2cdd8370933643aae27bc8542017c779aff4ad7d0197bde5b433f2b0728a6a5faaf231fd001cf7d08ef4aecc8cf2a322656c5304a46c22a68d58a
TLSH
T189D023012B50CE5D450018471D657788B09B04BA1F09FDA185014C9C478694CB55F142
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 51e1149d6ebe110c4cf015bdc582a57016073ea11b9fad9972de0e395d710eee
MD5 0aa7745dd95ea6d7894801af6df1f4a6
SHA1 493e70f0eaa89665f6f57b89577334626c5a1a74
SHA512 6832e3fa71f29f5f47103f3feaa805b4c9d3c8791515db4b6f664060f027fbadc13b6ea2c8a9e09dbadd362223128d802d72baf26e3b47dd7fa6ee6858e923e3
SSDEEP 49152:9vESW274aBMaePxlZfurjCd1nytv2C1JjloGdA4THHB72eh2NT:9vvW274aBMaePxlZfuPCd1nytv2g
TLSH
T145E54A1437F85F23E1BBE273D5B0041267F1E82AB363FB5B6191677A1C93B505801AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2332-8-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-7-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-11-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-10-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-9-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-21-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-12-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-0-0x00007FFFD942F000-0x00007FFFD9430000-memory.dmp

Download

memory/2332-6-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-5-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-14-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-4-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-13-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-3-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-2-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/2332-1-0x0000000000600000-0x0000000000924000-memory.dmp

Download

memory/3904-49-0x0000019F82D60000-0x0000019F82E60000-memory.dmp

Download

memory/3904-66-0x0000019F82B60000-0x0000019F82B80000-memory.dmp

Download

memory/3904-48-0x0000019F82920000-0x0000019F82940000-memory.dmp

Download

memory/3904-80-0x0000019F94600000-0x0000019F94620000-memory.dmp

Download

memory/3904-34-0x0000019F801E0000-0x0000019F802E0000-memory.dmp

Download

memory/3904-36-0x0000019F801E0000-0x0000019F802E0000-memory.dmp

Download

memory/3904-35-0x0000019F801E0000-0x0000019F802E0000-memory.dmp

Download

memory/3936-31-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/3936-24-0x000000001D430000-0x000000001D4E2000-memory.dmp

Download

memory/3936-23-0x000000001D320000-0x000000001D370000-memory.dmp

Download

memory/3936-20-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/3936-19-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/3936-18-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/3936-17-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

memory/3936-16-0x00007FFFD92A0000-0x00007FFFD9C44000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads