quasar | 5305f6df22af8f9a498e2bce46f6081a483c0489a2d57c2bcdfae1eea5f766e3

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dwdw.exe
Size 3.1MB
Sample260702-rysj7sf14t
SHA256 5305f6df22af8f9a498e2bce46f6081a483c0489a2d57c2bcdfae1eea5f766e3
MD5 c87ad4ac91815c8326eed7486f02acea
SHA1 85278c28fb2e3147d9d171dd022fd148acf8ee6a
SHA512 a56bb01c0d2cf0c45deaa78657d065939c84ed7781c7a457c4b7165d4a4b60498174636dfb1ac65dc03c19d7f554ebc158f557433f85f3f74d44906fa27ebbb3
SSDEEP 49152:PvEgo2QSaNpzyPllgamb0CZof/JqAi2xkWoGdt+THHB72eh2NT:Pvlo2QSaNpzyPllgamYCZof/Jli2xZ
TLSH
T1A6E56B0437F85E32E16BD6B3E5B0511263F1F82AF363EB0B5181A77E5C93B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

https://uu888.jp.net/discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

https://uu888.jp.net/

https://uu888.jp.net/:80
https://uu888.jp.net/:8080
https://uu888.jp.net/:443
https://uu888.jp.net/:8443

Mutex

dc84e7d7-1880-44d7-b9b1-977a69077998

Attributes

encryption_key
576D1496F563366ADEBFC3046D6584BB4AD91241
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
10
startup_key
https://uu888.jp.net/
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/6004-0-0x0000000000130000-0x0000000000454000-memory.dmp	family_quasar
behavioral1/files/0x000800000002460c-4.dat	family_quasar

Checks computer location settings 2 TTPs 16 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 17 IoCs

pid	Process
3844	Client.exe
5356	Client.exe
3696	Client.exe
4352	Client.exe
3404	Client.exe
472	Client.exe
4140	Client.exe
1484	Client.exe
5960	Client.exe
1724	Client.exe
5284	Client.exe
1212	Client.exe
5724	Client.exe
3504	Client.exe
4076	Client.exe
4212	Client.exe
4776	Client.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	dwdw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3752	PING.EXE
2200	PING.EXE
5232	PING.EXE
2868	PING.EXE
5584	PING.EXE
5920	PING.EXE
5172	PING.EXE
2028	PING.EXE
724	PING.EXE
5364	PING.EXE
4320	PING.EXE
5132	PING.EXE
4684	PING.EXE
2200	PING.EXE
5576	PING.EXE
2364	PING.EXE

Runs ping.exe 1 TTPs 16 IoCs

Remote System Discovery

T1018

pid	Process
724	PING.EXE
2028	PING.EXE
2200	PING.EXE
5364	PING.EXE
5576	PING.EXE
5172	PING.EXE
3752	PING.EXE
4684	PING.EXE
5232	PING.EXE
5132	PING.EXE
5584	PING.EXE
5920	PING.EXE
2364	PING.EXE
2200	PING.EXE
4320	PING.EXE
2868	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5640	schtasks.exe
4692	schtasks.exe
1456	schtasks.exe
5840	schtasks.exe
4144	schtasks.exe
8	schtasks.exe
5444	schtasks.exe
4772	schtasks.exe
2936	schtasks.exe
1696	schtasks.exe
4468	schtasks.exe
2964	schtasks.exe
5640	schtasks.exe
4460	schtasks.exe
3568	schtasks.exe
3284	schtasks.exe
1244	schtasks.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	6004	dwdw.exe
Token: SeDebugPrivilege	3844	Client.exe
Token: SeDebugPrivilege	5356	Client.exe
Token: SeDebugPrivilege	3696	Client.exe
Token: SeDebugPrivilege	4352	Client.exe
Token: SeDebugPrivilege	3404	Client.exe
Token: SeDebugPrivilege	472	Client.exe
Token: SeDebugPrivilege	4140	Client.exe
Token: SeDebugPrivilege	1484	Client.exe
Token: SeDebugPrivilege	5960	Client.exe
Token: SeDebugPrivilege	1724	Client.exe
Token: SeDebugPrivilege	5284	Client.exe
Token: SeDebugPrivilege	1212	Client.exe
Token: SeDebugPrivilege	5724	Client.exe
Token: SeDebugPrivilege	3504	Client.exe
Token: SeDebugPrivilege	4076	Client.exe
Token: SeDebugPrivilege	4212	Client.exe
Token: SeDebugPrivilege	4776	Client.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
3844	Client.exe
5356	Client.exe
3696	Client.exe
3404	Client.exe
472	Client.exe
4140	Client.exe
1484	Client.exe
5960	Client.exe
1724	Client.exe
5284	Client.exe
1212	Client.exe
5724	Client.exe
3504	Client.exe
4076	Client.exe
4212	Client.exe
4776	Client.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3844	Client.exe
5356	Client.exe
3696	Client.exe
3404	Client.exe
472	Client.exe
4140	Client.exe
1484	Client.exe
5960	Client.exe
1724	Client.exe
5284	Client.exe
1212	Client.exe
5724	Client.exe
3504	Client.exe
4076	Client.exe
4212	Client.exe
4776	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 5444	6004	dwdw.exe	86
PID 6004 wrote to memory of 3844	6004	dwdw.exe	88
PID 3844 wrote to memory of 2964	3844	Client.exe	89
PID 3844 wrote to memory of 6052	3844	Client.exe	93
PID 6052 wrote to memory of 2220	6052	cmd.exe	95
PID 6052 wrote to memory of 724	6052	cmd.exe	96
PID 5356 wrote to memory of 3284	5356	Client.exe	97
PID 5356 wrote to memory of 1536	5356	Client.exe	99
PID 1536 wrote to memory of 1432	1536	cmd.exe	101
PID 1536 wrote to memory of 5364	1536	cmd.exe	102
PID 6052 wrote to memory of 3696	6052	cmd.exe	106
PID 1536 wrote to memory of 4352	1536	cmd.exe	107
PID 3696 wrote to memory of 1244	3696	Client.exe	108
PID 3696 wrote to memory of 5200	3696	Client.exe	111
PID 5200 wrote to memory of 5632	5200	cmd.exe	114
PID 5200 wrote to memory of 5576	5200	cmd.exe	116
PID 5200 wrote to memory of 3404	5200	cmd.exe	124
PID 3404 wrote to memory of 4772	3404	Client.exe	125
PID 3404 wrote to memory of 2612	3404	Client.exe	127
PID 2612 wrote to memory of 5516	2612	cmd.exe	130
PID 2612 wrote to memory of 2364	2612	cmd.exe	131
PID 2612 wrote to memory of 472	2612	cmd.exe	135
PID 472 wrote to memory of 5640	472	Client.exe	136
PID 472 wrote to memory of 3312	472	Client.exe	139
PID 3312 wrote to memory of 5208	3312	cmd.exe	141
PID 3312 wrote to memory of 5172	3312	cmd.exe	142
PID 3312 wrote to memory of 4140	3312	cmd.exe	144
PID 4140 wrote to memory of 2936	4140	Client.exe	145
PID 4140 wrote to memory of 4876	4140	Client.exe	148
PID 4876 wrote to memory of 4128	4876	cmd.exe	150
PID 4876 wrote to memory of 3752	4876	cmd.exe	151
PID 4876 wrote to memory of 1484	4876	cmd.exe	152
PID 1484 wrote to memory of 4460	1484	Client.exe	153
PID 1484 wrote to memory of 4364	1484	Client.exe	156
PID 4364 wrote to memory of 1344	4364	cmd.exe	158
PID 4364 wrote to memory of 2028	4364	cmd.exe	159
PID 4364 wrote to memory of 5960	4364	cmd.exe	161
PID 5960 wrote to memory of 3568	5960	Client.exe	162
PID 5960 wrote to memory of 4668	5960	Client.exe	165
PID 4668 wrote to memory of 2108	4668	cmd.exe	167
PID 4668 wrote to memory of 2200	4668	cmd.exe	168
PID 4668 wrote to memory of 1724	4668	cmd.exe	170
PID 1724 wrote to memory of 4692	1724	Client.exe	171
PID 1724 wrote to memory of 1996	1724	Client.exe	174
PID 1996 wrote to memory of 4708	1996	cmd.exe	176
PID 1996 wrote to memory of 4320	1996	cmd.exe	177
PID 1996 wrote to memory of 5284	1996	cmd.exe	180
PID 5284 wrote to memory of 1696	5284	Client.exe	181
PID 5284 wrote to memory of 5252	5284	Client.exe	183
PID 5252 wrote to memory of 5776	5252	cmd.exe	186
PID 5252 wrote to memory of 5232	5252	cmd.exe	187
PID 5252 wrote to memory of 1212	5252	cmd.exe	188
PID 1212 wrote to memory of 1456	1212	Client.exe	189
PID 1212 wrote to memory of 5504	1212	Client.exe	192
PID 5504 wrote to memory of 1168	5504	cmd.exe	194
PID 5504 wrote to memory of 2868	5504	cmd.exe	195
PID 5504 wrote to memory of 5724	5504	cmd.exe	198
PID 5724 wrote to memory of 5840	5724	Client.exe	199
PID 5724 wrote to memory of 828	5724	Client.exe	202
PID 828 wrote to memory of 228	828	cmd.exe	204
PID 828 wrote to memory of 5132	828	cmd.exe	205
PID 828 wrote to memory of 3504	828	cmd.exe	206
PID 3504 wrote to memory of 5640	3504	Client.exe	207
PID 3504 wrote to memory of 2644	3504	Client.exe	210

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dwdw.exe
"C:\Users\Admin\AppData\Local\Temp\dwdw.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5444
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\L8490j7gEnES.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2220
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:724
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3696
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1244
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N90AaZ1netHx.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5200
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5632
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5576
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4bqRStYWmtMJ.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:5516
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2364
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:472
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sjxu2pumh4JL.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:5208
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5172
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JbmiMJjrSPJq.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4128
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3752
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1484
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E98LGETWjnI7.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1344
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2028
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5960
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yZyU5Z9SCxXC.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2200
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ACAoyGGifd27.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:1996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4708
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4320
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5284
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UMNUUhlkJhvo.bat" "
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:5252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:5776
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5232
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e29g2L2Y2BNM.bat" "
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:5504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1168
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2868
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5724
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zqtIQH5PeT65.bat" "
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:828
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:228
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5132
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Rt5YLdA8RbOt.bat" "
        25⤵
        
        PID:2644
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5584
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4076
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g4156KFvO4kR.bat" "
        27⤵
        
        PID:4160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2580
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5920
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ps6dKnuBSsS0.bat" "
        29⤵
        
        PID:1344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:3980
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4684
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4776
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\k2iKnucrHMhb.bat" "
        31⤵
        
        PID:5752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:6056
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2200

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5356
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mis7AYk5Lkqz.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1432
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5364
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
TLSH
T1EA41E27122B6B1D94D063F461C5D2AC003BF47287664AE0CBA99231EED2741B9F221F7
MD5 SHA1 SHA512 TLSH

Submit Download

4bqRStYWmtMJ.bat

Path C:\Users\Admin\AppData\Local\Temp\4bqRStYWmtMJ.bat
Size 207B
SHA256 372a99142f18dcc59f4cfa13386c857c88890d3d4d8e789fd7093e155ba1fbf7
MD5 f75d7fdf8760012c37c8176692e6d4da
SHA1 cd21ad18f836e7dbb98e5ef0a8b22bf9d790b404
SHA512 0a2d116a92b2be5838a84e1b1ad756b83926b22ad3f273cc54ab4abb5fd251bdf9a7a4ff47b31970956d376278b05e153b70e104aeae9d99398b682aa3733d6c
TLSH
T1FAD0235133C0CD5D45001C475DA56688B09A04A73F0CBDA2450188EC4386D8C755B141
MD5 SHA1 SHA512 TLSH

Submit Download

ACAoyGGifd27.bat

Path C:\Users\Admin\AppData\Local\Temp\ACAoyGGifd27.bat
Size 207B
SHA256 3da07a06860efa291383878416bb58c1419b5f1bd563126d0c3332ee9ce9db13
MD5 04677dc64b02e5d0d8319d7e5feb0f7f
SHA1 6de2d9c25a6e39af1f644de7e92d9da7b853abbd
SHA512 eaa56d6845bd85ab121685e0bbcc16e09ef3368d993658f923e2b3359c02531cd4b8dea5fb198cdbbaf84acee7cb635de5ce61bb523f2e0ef20ab65438656035
TLSH
T1EAD023412740CD6E450018471E65B3CCF0DA04F61F087D71460148DC038789CB55B181
MD5 SHA1 SHA512 TLSH

Submit Download

E98LGETWjnI7.bat

Path C:\Users\Admin\AppData\Local\Temp\E98LGETWjnI7.bat
Size 207B
SHA256 1d96697fd85c867613aabe25c3790a1382a7d5441670a36398f310b196f2f513
MD5 c5674d6285661ca0992e313b5d8bf75a
SHA1 8117b3d71f148e88b54e7260dae12d86a5ff9c18
SHA512 4c6df6dcd5bffae3f811d9165392b60e0655f5709101c25e240b7c4b3d223edfd523af5d4660012ec5f6b3b21f6870c148258006d77b89902ce162d8517e0a69
TLSH
T1B3D023012341CD5D45051C471DA57288B0DB04A61F4CBDF14605489C538784C795B182
MD5 SHA1 SHA512 TLSH

Submit Download

JbmiMJjrSPJq.bat

Path C:\Users\Admin\AppData\Local\Temp\JbmiMJjrSPJq.bat
Size 207B
SHA256 88ef2c7703d3ae76c731309d8851b66547dbdaddbf47213ed1bd4e3e0c9a903f
MD5 d0654f046dd14d1009905e67ddf4b76b
SHA1 98b8c26b2b20747cf8d81ff0adac019260845134
SHA512 6f6159ca9a77b9521f46b0e831208444284a7cf57b03be80d6b5d94091f23350dc7ad2dde67af7b471b5ec485c4e8dfaa7a583c945bff10ed8d3dddca72e7776
TLSH
T1A6D023016340CD9D450058471EA56388F0AA44F71F097D614505489C038795C755B542
MD5 SHA1 SHA512 TLSH

Submit Download

L8490j7gEnES.bat

Path C:\Users\Admin\AppData\Local\Temp\L8490j7gEnES.bat
Size 207B
SHA256 2f8029b870a9b5ab78e43795ea9deff952ae85a4f0ad94bf8cf454b1db7baa6b
MD5 c50eb14a2c8ec5be5d03b298319d7696
SHA1 72a064cc81314e2f1e6a41848b8b4035213fcfd0
SHA512 7ea8c0ebd8831935f958893c7ca4011b79aabe91e410e6239ba9d2f775d7b3d967941035f5f239664dd612af25c11cc1cbe92a769555183e52461fa971ad00ca
TLSH
T1FAD023112380CEDE45011C475DA5B289B09A04E61F08BD6147018C9C038794C755F141
MD5 SHA1 SHA512 TLSH

Submit Download

Mis7AYk5Lkqz.bat

Path C:\Users\Admin\AppData\Local\Temp\Mis7AYk5Lkqz.bat
Size 207B
SHA256 2144431bfed9aaf0dd0ebb495910469e016454f440e36554fd8e999b85f64b96
MD5 ebe2abfcf9741594a789e560a0b6a3c3
SHA1 07e21a4845867c26f9f578bf6cdb071d36474237
SHA512 34c455f9ed041d1a3fed4f16c7e491e7796841f9515ef79c319d90b29e96533c2feaa4bd83ca3d6b602786ff25ed84253fecf3bae6ca248e37c9f604ed2e96cb
TLSH
T1BDD023412340CD5E450038475D657388B09F04AB1F0C7DA58611C89C438A84C799F641
MD5 SHA1 SHA512 TLSH

Submit Download

N90AaZ1netHx.bat

Path C:\Users\Admin\AppData\Local\Temp\N90AaZ1netHx.bat
Size 207B
SHA256 f75f5393753c3f68398767133c71738e2f031d8e25f870d43a46dd404ff01686
MD5 d526f87f3210085cb5fea5c67840ca8f
SHA1 6c8dc8196551723eb46620b65ad15fc99c1e40ee
SHA512 7c8e181d6dc6c2bf5047b3c5def83ce090820af8e2968d0bc8c4bb37746e6792bc3367806ce2fcf6f254140ee9b49976c249638a66394319cb270595b3891448
TLSH
T195D023412340CD5D450028471DA5A288F09E04A61F0D7DB245014C9C13C684C755F5C1
MD5 SHA1 SHA512 TLSH

Submit Download

Rt5YLdA8RbOt.bat

Path C:\Users\Admin\AppData\Local\Temp\Rt5YLdA8RbOt.bat
Size 207B
SHA256 ee30146ccdedd055a11695386da90366dca49b0858f5dd8b3fc4588af334d663
MD5 5dd4c7db46329c51cdb03734b1cf0946
SHA1 e542c54218a9a9cfb88508a4d76ade4259b1a147
SHA512 6e4ff25ae6538c9edb6b62c97f3ef42a54e8c25b2e65a714e19564fae067378f5b17726561b9435579f96956e997a2b893259035242891da694c8a7073dbea5d
TLSH
T1E6D022112780CEAE450018472EA5A788B0EB08EA2F08BEA28611CC9C038688CF59B682
MD5 SHA1 SHA512 TLSH

Submit Download

UMNUUhlkJhvo.bat

Path C:\Users\Admin\AppData\Local\Temp\UMNUUhlkJhvo.bat
Size 207B
SHA256 6803664fd6c9eafcfbcea1667ed8cef61fd2906d857255d040735069777cf6f5
MD5 2213d59af11c0e4233871def1f2076b5
SHA1 ce77a4db79ee9d3eb2f1972c272a9542f17796ba
SHA512 2133350b5639ffdc438977e46bacc4b2472d512993e2f17e67c9ee02410e7db9c85f2fbe27104809b591898a9fa364ec9461d0d7904549e511332c002a5c26a7
TLSH
T198D023012340CE6D550018475D65A388F09A04F61F0C7DA1450148DC03C6D8CF55B141
MD5 SHA1 SHA512 TLSH

Submit Download

e29g2L2Y2BNM.bat

Path C:\Users\Admin\AppData\Local\Temp\e29g2L2Y2BNM.bat
Size 207B
SHA256 83a4c97a1b04e88c0faacaf3bdcce8f832f48dc10b83a26ce3e9643aa2ddee8f
MD5 cdedff4d868f8bc22d9382368c6422d7
SHA1 140af6026ba0b384dbead34ab91cd92f942bf2d1
SHA512 eeace56eac3d7b35288ba03173a9ef44f59f5aac4e0669082a264037bc7833398a09fdb112bf0186a65cc110042a821fd4f32f4a5967a6eceb67a49a266618de
TLSH
T154D023113740CD5E550018471EF5B288F0AA04E62F097DA1460148DC038794C795B181
MD5 SHA1 SHA512 TLSH

Submit Download

g4156KFvO4kR.bat

Path C:\Users\Admin\AppData\Local\Temp\g4156KFvO4kR.bat
Size 207B
SHA256 687f33a11c5eee5fdcab41e99f9827a434eb5793e19e8ceb1ec4f28116780f74
MD5 ad09d7e5366e213c07dcfcec54eb4c6e
SHA1 beb6aa179f35e0f1b476bb7f1024b053937e96e7
SHA512 347c4e3bda86a78d17c1a4df4dc9efc3f9b0557416d2ce7c64118f64c07f79245fc459dc5f21473742398ebb3a0867558431ead2e6476365cb0c2631e3ec21d1
TLSH
T123D023013341CD5E450018471E65AA8CF0EA04A71F0C7D618506C8DC038798C755B181
MD5 SHA1 SHA512 TLSH

Submit Download

k2iKnucrHMhb.bat

Path C:\Users\Admin\AppData\Local\Temp\k2iKnucrHMhb.bat
Size 207B
SHA256 d9edd1c919fd64e55668417c412f95ce7d541fbca386f02e87b873b1274db97f
MD5 180298308f51b67a6dfda7de5a195bae
SHA1 c4a14014c0e7ea3387450877cfc3e2ac5afb74d4
SHA512 d60ea04ef64b39de546e67495686a2330fb1f1c9d8e60cb4835af76c6771cbc19efb53a3857ee9d8fbac316cbd85fe0db36652bea2a6ccb23e4d1cb3a2593257
TLSH
T124D023112341CD9D45001C471D656288B19A04A71F49BD7146054C9C53C684C759F181
MD5 SHA1 SHA512 TLSH

Submit Download

ps6dKnuBSsS0.bat

Path C:\Users\Admin\AppData\Local\Temp\ps6dKnuBSsS0.bat
Size 207B
SHA256 1bb8b983a1db21ad52581af8a3a7159ca76b6461c972492cd924a1850a5eedc7
MD5 61e9d75907e20055cacc1e6027568b7c
SHA1 505f65f7fa47cea0c19a1b95fdcf18db2be4d557
SHA512 6cd1e3d2ab6d90f8772b58439dc33cff0c9d0137bfe289121454d35d65a01b85c049a7f429d96a5f58669698f2147ecc82221ddbef257b11cbb56de9ba605626
TLSH
T130D023413341CD5E550018471D6562CCB0DA04BB2F497D624601889C038694C755F143
MD5 SHA1 SHA512 TLSH

Submit Download

sjxu2pumh4JL.bat

Path C:\Users\Admin\AppData\Local\Temp\sjxu2pumh4JL.bat
Size 207B
SHA256 af59b825c90be626b4206ca11e304bba85f5509e8e4cfdef8389d30a6041aff1
MD5 2b22d79c556732adf74eccc15f303df4
SHA1 ce099e62d00753ee05a6cde925f2b79f37619151
SHA512 13a2ca175fec195b3ede46eadb37c25460fdb32ac37eeebf09ba62b3aef34efc00744a4bfc1cb2e200a8ab232c16a3f5e3e1a307343dc9c8272b8d6cdd6b1f11
TLSH
T15CD023412340CD6E550018471D656388B09A44A61F097DE146058C9C038784CB55B141
MD5 SHA1 SHA512 TLSH

Submit Download

yZyU5Z9SCxXC.bat

Path C:\Users\Admin\AppData\Local\Temp\yZyU5Z9SCxXC.bat
Size 207B
SHA256 7db089a3776a21cf29cc8af24d8567159a262a310e71a59891f0c511c619219d
MD5 e622eacb34ed097c8af37f578e5da538
SHA1 eaa60537491df1c443854fdb56fcc221cefc80a3
SHA512 0634fa201fc4140a8547693074d8e31c517f5111f4a75ee32cfbead3d6c69b7f50757d46dd48b0ace8f721c95842d57349889120a2700566f27caba8bf3cec97
TLSH
T1E9D023412381CE6D450058475EE57688F09A04A61F0CBEA14601489C53C684CB55F5C1
MD5 SHA1 SHA512 TLSH

Submit Download

zqtIQH5PeT65.bat

Path C:\Users\Admin\AppData\Local\Temp\zqtIQH5PeT65.bat
Size 207B
SHA256 bb14b7725eaf611a51b62015d6b63c37dc734ecbc2fe640a4db9465c898a50a4
MD5 e0858592aade169870bf396044e646da
SHA1 b76c08d8325114f49c3f3a597f0b035351bcaa18
SHA512 715959bc75ed35a109fe3fbc8a6e782a1561da4c9a81caebc0b03e844d786fdab96bb2a7e5b92941b6212e27b6f449926e02f435e91e21e79a59aa33b419fd88
TLSH
T1D8D023112741CD5D450158475DA56288B09E04EE1F0C7D61461948DD538684CF55F181
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 5305f6df22af8f9a498e2bce46f6081a483c0489a2d57c2bcdfae1eea5f766e3
MD5 c87ad4ac91815c8326eed7486f02acea
SHA1 85278c28fb2e3147d9d171dd022fd148acf8ee6a
SHA512 a56bb01c0d2cf0c45deaa78657d065939c84ed7781c7a457c4b7165d4a4b60498174636dfb1ac65dc03c19d7f554ebc158f557433f85f3f74d44906fa27ebbb3
SSDEEP 49152:PvEgo2QSaNpzyPllgamb0CZof/JqAi2xkWoGdt+THHB72eh2NT:Pvlo2QSaNpzyPllgamYCZof/Jli2xZ
TLSH
T1A6E56B0437F85E32E16BD6B3E5B0511263F1F82AF363EB0B5181A77E5C93B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3844-8-0x000000001C920000-0x000000001C970000-memory.dmp

Download

memory/3844-9-0x000000001CA30000-0x000000001CAE2000-memory.dmp

Download

memory/3844-7-0x0000000000E50000-0x0000000000E60000-memory.dmp

Download

memory/6004-0-0x0000000000130000-0x0000000000454000-memory.dmp

Download

memory/6004-1-0x000000001B120000-0x000000001B130000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads