quasar | 5305f6df22af8f9a498e2bce46f6081a483c0489a2d57c2bcdfae1eea5f766e3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dwdw.exe
Size 3.1MB
Sample260702-rysj7sf14t
SHA256 5305f6df22af8f9a498e2bce46f6081a483c0489a2d57c2bcdfae1eea5f766e3
MD5 c87ad4ac91815c8326eed7486f02acea
SHA1 85278c28fb2e3147d9d171dd022fd148acf8ee6a
SHA512 a56bb01c0d2cf0c45deaa78657d065939c84ed7781c7a457c4b7165d4a4b60498174636dfb1ac65dc03c19d7f554ebc158f557433f85f3f74d44906fa27ebbb3
SSDEEP 49152:PvEgo2QSaNpzyPllgamb0CZof/JqAi2xkWoGdt+THHB72eh2NT:Pvlo2QSaNpzyPllgamYCZof/Jli2xZ
TLSH
T1A6E56B0437F85E32E16BD6B3E5B0511263F1F82AF363EB0B5181A77E5C93B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

https://uu888.jp.net/discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

https://uu888.jp.net/

https://uu888.jp.net/:80
https://uu888.jp.net/:8080
https://uu888.jp.net/:443
https://uu888.jp.net/:8443

Mutex

dc84e7d7-1880-44d7-b9b1-977a69077998

Attributes

encryption_key
576D1496F563366ADEBFC3046D6584BB4AD91241
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
10
startup_key
https://uu888.jp.net/
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/5532-1-0x0000000000780000-0x0000000000AA4000-memory.dmp	family_quasar
behavioral2/files/0x000d00000001c5da-15.dat	family_quasar

Executes dropped EXE 4 IoCs

pid	Process
2784	Client.exe
1916	Client.exe
2708	Client.exe
2992	Client.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	dwdw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Windows\CurrentVersion\Run\https://uu888.jp.net/ = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 24 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1284	PING.EXE
3516	PING.EXE
5064	PING.EXE
6756	PING.EXE
5552	PING.EXE
5756	PING.EXE
2312	PING.EXE
236	PING.EXE
6820	PING.EXE
5460	PING.EXE
5976	PING.EXE
3204	PING.EXE
2492	PING.EXE
3844	PING.EXE
6200	PING.EXE
6016	PING.EXE
1136	PING.EXE
5792	PING.EXE
2764	PING.EXE
1492	PING.EXE
3132	PING.EXE
4516	PING.EXE
5840	PING.EXE
4288	PING.EXE

Runs ping.exe 1 TTPs 24 IoCs

Remote System Discovery

T1018

pid	Process
3204	PING.EXE
2312	PING.EXE
5064	PING.EXE
6820	PING.EXE
6200	PING.EXE
6016	PING.EXE
5552	PING.EXE
4288	PING.EXE
3844	PING.EXE
1136	PING.EXE
5460	PING.EXE
5756	PING.EXE
5840	PING.EXE
1492	PING.EXE
236	PING.EXE
6756	PING.EXE
2764	PING.EXE
3132	PING.EXE
2492	PING.EXE
5792	PING.EXE
4516	PING.EXE
1284	PING.EXE
3516	PING.EXE
5976	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5528	schtasks.exe
2480	schtasks.exe
1256	schtasks.exe
1504	schtasks.exe
1332	schtasks.exe
4300	schtasks.exe
4548	schtasks.exe
5048	schtasks.exe
6112	schtasks.exe
1564	schtasks.exe
6384	schtasks.exe
6324	schtasks.exe
6636	schtasks.exe
4568	schtasks.exe
2696	schtasks.exe
3836	schtasks.exe
6084	schtasks.exe
1980	schtasks.exe
940	schtasks.exe
5920	schtasks.exe
1224	schtasks.exe
3464	schtasks.exe
692	schtasks.exe
6496	schtasks.exe
3124	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5532	dwdw.exe
Token: SeDebugPrivilege	2784	Client.exe
Token: SeDebugPrivilege	1916	Client.exe
Token: SeDebugPrivilege	2708	Client.exe
Token: SeDebugPrivilege	2992	Client.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2784	Client.exe
1916	Client.exe
2708	Client.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2784	Client.exe
1916	Client.exe
2708	Client.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 5920	5532	dwdw.exe	89
PID 5532 wrote to memory of 2784	5532	dwdw.exe	91
PID 2784 wrote to memory of 5528	2784	Client.exe	94
PID 2784 wrote to memory of 6696	2784	Client.exe	96
PID 6696 wrote to memory of 1236	6696	cmd.exe	98
PID 6696 wrote to memory of 5064	6696	cmd.exe	99
PID 1916 wrote to memory of 1224	1916	Client.exe	100
PID 1916 wrote to memory of 5108	1916	Client.exe	102
PID 5108 wrote to memory of 3412	5108	cmd.exe	104
PID 5108 wrote to memory of 6820	5108	cmd.exe	105
PID 6696 wrote to memory of 2708	6696	cmd.exe	106
PID 2708 wrote to memory of 5048	2708	Client.exe	107
PID 2708 wrote to memory of 6212	2708	Client.exe	109
PID 6212 wrote to memory of 6912	6212	cmd.exe	111
PID 6212 wrote to memory of 6200	6212	cmd.exe	112
PID 5108 wrote to memory of 2992	5108	cmd.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dwdw.exe
"C:\Users\Admin\AppData\Local\Temp\dwdw.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5920
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\J4Pzljv0GtF8.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6696
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1236
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5064
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5048
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ADHaFH8QXol5.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6212
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:6912
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6200
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        
        PID:4920
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G2fJ3OBQMVNb.bat" "
        7⤵
        
        PID:5268
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4232
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1136
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        
        PID:6156
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2480
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Sl9JMRgi1BFH.bat" "
        9⤵
        
        PID:2272
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2916
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5792
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        
        PID:2748
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5IHZNd2o0XD6.bat" "
        11⤵
        
        PID:368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4520
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4516
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        
        PID:6252
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nsADaEYwEoAi.bat" "
        13⤵
        
        PID:5000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1276
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1284
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        
        PID:3948
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FYTzdbrdNbAw.bat" "
        15⤵
        
        PID:6988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3920
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5460
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        
        PID:3744
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4eWOHc5JGSmY.bat" "
        17⤵
        
        PID:4888
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2036
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3204
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        
        PID:2752
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iDZnXfLhvuhQ.bat" "
        19⤵
        
        PID:2516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:708
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5840
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        
        PID:6848
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HShGVUz0xL0g.bat" "
        21⤵
        
        PID:6408
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:5080
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4288
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        
        PID:1032
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eVgHCfWqlQBF.bat" "
        23⤵
        
        PID:2768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3132
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        
        PID:620
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DVittdGJxbm7.bat" "
        25⤵
        
        PID:3296
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:6772
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2492
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        
        PID:6336
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rOiQ3aLk5mrV.bat" "
        27⤵
        
        PID:2848
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:404
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:236
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        
        PID:52
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\70yYfr3Vio0h.bat" "
        29⤵
        
        PID:6480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3844

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\System32\schtasks.exe
  "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NPqx3yC7gusA.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\System32\chcp.com
    chcp 65001
    3⤵
    PID:3412
- - C:\Windows\System32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6820
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
  - - C:\Windows\System32\schtasks.exe
      "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4568
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cskSY1tLYKR8.bat" "
      4⤵
      PID:6876
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1640
    - - C:\Windows\System32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6016
    - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        5⤵
        
        PID:4528
      - C:\Windows\System32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3836
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oiBXwUnv3bmL.bat" "
        6⤵
        
        PID:3116
        
        C:\Windows\System32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4660
        
        C:\Windows\System32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6756
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        7⤵
        
        PID:1968
        
        C:\Windows\System32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7at5KjzwFfsk.bat" "
        8⤵
        
        PID:6868
        
        C:\Windows\System32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2832
        
        C:\Windows\System32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5552
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        9⤵
        
        PID:6664
        
        C:\Windows\System32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FBcD3bGkwlfu.bat" "
        10⤵
        
        PID:6168
        
        C:\Windows\System32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:848
        
        C:\Windows\System32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2764
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        11⤵
        
        PID:1792
        
        C:\Windows\System32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NavxfjVCAYEQ.bat" "
        12⤵
        
        PID:4808
        
        C:\Windows\System32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:4820
        
        C:\Windows\System32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3516
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        13⤵
        
        PID:6412
        
        C:\Windows\System32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QTgjUzKgeqwh.bat" "
        14⤵
        
        PID:5920
        
        C:\Windows\System32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:5884
        
        C:\Windows\System32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5976
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        15⤵
        
        PID:1500
        
        C:\Windows\System32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6384
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jGuCUoQo4RoG.bat" "
        16⤵
        
        PID:1548
        
        C:\Windows\System32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:6540
        
        C:\Windows\System32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5756
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        17⤵
        
        PID:2676
        
        C:\Windows\System32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3124
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XL4ng2WEicvR.bat" "
        18⤵
        
        PID:5236
        
        C:\Windows\System32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:5848
        
        C:\Windows\System32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2312
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        19⤵
        
        PID:1132
        
        C:\Windows\System32\schtasks.exe
        
        "schtasks" /create /tn "https://uu888.jp.net/" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sVkTLJKHjOMZ.bat" "
        20⤵
        
        PID:2280
        
        C:\Windows\System32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4352
        
        C:\Windows\System32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1492
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        21⤵
        
        PID:1336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4eWOHc5JGSmY.bat

Path C:\Users\Admin\AppData\Local\Temp\4eWOHc5JGSmY.bat
Size 207B
SHA256 a0f89c34ec43bdafa6a72e8673c8d4e19f6cd90b2c78518dd6e12f62cf3c6303
MD5 4f1f14e8eb40649893175632918aa9cf
SHA1 b1fca6691f4c75b1b4c541dbd210cbe0d087923a
SHA512 6349df4cb559683ae2ff9569339bb6503cb08a4edc1ab9e6ebd363ba71180a77c3c7ad3eb71f0335fd180732c8e9cd929f79efc20de994ed82e3c071512de70d
TLSH
T104D023112340CF5D450028475D65628CB0AB04F72F48BDA2461148DC43C6D4CB55B141
MD5 SHA1 SHA512 TLSH

Submit Download

5IHZNd2o0XD6.bat

Path C:\Users\Admin\AppData\Local\Temp\5IHZNd2o0XD6.bat
Size 207B
SHA256 a3f0f8c6a5f90561a9326b780724afdccebcb1d7b1112c76e37bf6ce5ef18243
MD5 16f8b6e0f74ebe72ffb4a885c5357de4
SHA1 5d4286d935995845a52dbf068252fa5e8b873654
SHA512 9195486329989f888a360ef3c31c03835a6ba3cf9dda35f4198c0f455964f1d0077bae1f77bdb85b4bb967a512508334e04ee2ef2081dc73e33cca712da3eb86
TLSH
T101D023112780CD5D450018471D65A2C8B0EA04AB1F497DA14501889C03C6C5CB59B241
MD5 SHA1 SHA512 TLSH

Submit Download

70yYfr3Vio0h.bat

Path C:\Users\Admin\AppData\Local\Temp\70yYfr3Vio0h.bat
Size 207B
SHA256 e15354dcf0d780c17bd5174839507af26fd6d8b3721a19fe5b84beba61cf7ef8
MD5 0a556d6f04d0015a4d6b0a2f918c9ea7
SHA1 37f9f3de71d3d815333428f64718b10f5c936526
SHA512 379db04a47f6aa32b8b2290497b5c12e4b75e803ef1fc1c879f28522c5522373605e85f5739da88e8faef664d95d9b9732ed2171bcad271ea509f0a8596a5f12
TLSH
T187D022013384CE9F49001C471EB6A3CCB0EA04BA2F08BDA2860288DC03C6C8CB9DB182
MD5 SHA1 SHA512 TLSH

Submit Download

7at5KjzwFfsk.bat

Path C:\Users\Admin\AppData\Local\Temp\7at5KjzwFfsk.bat
Size 207B
SHA256 622ca4d5920fc0f1d0c1bc37fe3bc3481375b65952269408d6c3590080b52e6d
MD5 ec5f64b4ceb2a2d1c16b94c5394f1d02
SHA1 26540f92e4a2308c888831ff9099d47b32dd9d8e
SHA512 114e3d192388a3b34a05fda414d99dd85944e52e61b5ab578be784dbadd7bf41c4f690dcc9ed087d31b222aaf0b26f3a112192de750e420f2ccd6cb9cc4085c0
TLSH
T1FBD022012381CE9E4A111C4B5EA5A388B0BE04AB2F4CBDB2861588DC03CACCCB59B182
MD5 SHA1 SHA512 TLSH

Submit Download

ADHaFH8QXol5.bat

Path C:\Users\Admin\AppData\Local\Temp\ADHaFH8QXol5.bat
Size 207B
SHA256 02004812c3567e9805917fb8269f9d2eb1c343fa67e7faff2a5287cfc41da528
MD5 dfe8e3df3a7e8f6aa11376fc02f62f94
SHA1 8a0c069ea5d058b879182748131fd551a96e8222
SHA512 33a33c9143fb70ffdd7e967e017aaa3ce8eb2eb3820a23ef6120350d5025190771162a85583ad2262309fa1d69d3e029f6004e1f126eed9a8d4669c199508bd2
TLSH
T102D023012340CD9E85015C471DA563C8B09A04BA1F087D624502489C1386C8C759F181
MD5 SHA1 SHA512 TLSH

Submit Download

DVittdGJxbm7.bat

Path C:\Users\Admin\AppData\Local\Temp\DVittdGJxbm7.bat
Size 207B
SHA256 967b0e643024815ad9e45b0e971e05235be9ac409bb02c04904e60fc17be5215
MD5 7e2f967c7b8e784086f0139a9c8db95c
SHA1 c2b300839e76b135e925d9be88f564f4eb8a2bfa
SHA512 309b3e29de59c4722d8e54fa36afd4e6429fa37c588f303e71a9536fc322385b59dc6cb0a93f084e5f83f73b2551b539ab09c109f4d40c33e640c252b3631381
TLSH
T1EFD023012341CE9D55001C475E75A38CB09E0CA61F097DA145014C9C4387C4C75DF181
MD5 SHA1 SHA512 TLSH

Submit Download

FBcD3bGkwlfu.bat

Path C:\Users\Admin\AppData\Local\Temp\FBcD3bGkwlfu.bat
Size 207B
SHA256 ff8d408a5910329ddbf886207bd4e60a1088511b292dc3b6c4e81df6fb12d155
MD5 5dfc1ebcf31baecba61b85e4e56330c7
SHA1 8357bed6adde1bb88fdf7f19dea9651a825c0794
SHA512 f2a22f73b18d3da8ad341e67ecabc1959e6d2b7a24287e15942e7cc2d826939f3f530b66cffdc55fe726986354f408f38eec234b4202f070493b2de92d254b58
TLSH
T147D023422741CD5D560118871D65628CF0BA04EA1F4C7D6146018C9C1386C5CB5DB541
MD5 SHA1 SHA512 TLSH

Submit Download

FYTzdbrdNbAw.bat

Path C:\Users\Admin\AppData\Local\Temp\FYTzdbrdNbAw.bat
Size 207B
SHA256 49f6c66a97ad591b1e826480c0678debc9e87c6d46dbc64b8bcdb52b6ecf3dfe
MD5 4a672efa5ad827658bc944ea7f1edacc
SHA1 0751e2acf7777e7da3450947f7896fe6ac84a596
SHA512 e78f55569c0fd408f7a09de342a11ac7212297971bab5babdd3bd5cc30061c363cc5a318846746257816a49e18721891623af99eb3489f4aaa56be064da85317
TLSH
T125D0221123C0CEAE5A0058471EA5A3C8B0AB04AB2F08BDA28601CCDC03C688EB59B182
MD5 SHA1 SHA512 TLSH

Submit Download

G2fJ3OBQMVNb.bat

Path C:\Users\Admin\AppData\Local\Temp\G2fJ3OBQMVNb.bat
Size 207B
SHA256 557e783b0a0d7994215fb540354d1cf0b9cfdf46e2311fbae1d00762910bcdd5
MD5 37e083644c725940df8df956f30690b9
SHA1 5b5e8f87587495e2e671c76ec955e69f7f7f3191
SHA512 80ec1c3e578348fe923f98e15ed30049c591035eca187bd0486c9a948aa3b654030c1d3f575f2a6daf038f6aa2eb61ef5ee6f7ca6fa0feea0cdb4520b0f9eed2
TLSH
T15CD023412341CD5D590018471D75B288B09E08A61F097D62860148DC038684C795B141
MD5 SHA1 SHA512 TLSH

Submit Download

HShGVUz0xL0g.bat

Path C:\Users\Admin\AppData\Local\Temp\HShGVUz0xL0g.bat
Size 207B
SHA256 72ac9afe44632b0fce193aacef6af5abffd6a71f24dabc4b5a90b8bcdcdea3a5
MD5 00d12cc80f30add7fcbe8b425325fb18
SHA1 d727f3e740cbcd1e3a852d4875d00baba1f8d363
SHA512 2b7535d0a5691dae1817ab7646240599d07b9fef80fab4e0c4b29ec3e8c8d99c2ea986ff714dbedb4528802dba72716ebef0b7085c3ef63ed827ed512ef0794a
TLSH
T1C7D023112341CD5D450058475D6563C8B0AA04E61F0C7D614615489C138688C759B181
MD5 SHA1 SHA512 TLSH

Submit Download

J4Pzljv0GtF8.bat

Path C:\Users\Admin\AppData\Local\Temp\J4Pzljv0GtF8.bat
Size 207B
SHA256 6cc1eacbcdb98d9933ca72951f73e0d52ab0cdacf9be845ced96645b1367ca78
MD5 c4d4a4390b4445dc97a1ddda80776211
SHA1 1962342c9d7aae2b6adb9b9c60a604ed86e7f378
SHA512 520dab26ad6c8036e19f3033e0e9a49f04c1dbb6143ab1dd742a545d0e37931dc94528552dace14c0967e65be4c4cbf38821599faa311b3d94bb8ebf70debd0a
TLSH
T185D023413344CD9F450018471EA563C8B09B04E61F487D6145014CEC03C694CB55F641
MD5 SHA1 SHA512 TLSH

Submit Download

NPqx3yC7gusA.bat

Path C:\Users\Admin\AppData\Local\Temp\NPqx3yC7gusA.bat
Size 207B
SHA256 18bf40558778f83c25b8e9f7f519ccd5e91d982cf60ce6d87a49240cb7eef13c
MD5 596fa71619f532a9e4fb3a0a82db1ad7
SHA1 0dea8aa244b908cb837b8f9555a12cdea2c26c11
SHA512 6b60a0ae63eb5aaecbbfe44d0133d6d9255cf911310918b8a3111ab19d15cf0e43b861c890a0cae07a73068a88f03f484e4e3a6d1e71de1db6dbe9a9d74d2bd5
TLSH
T10CD023012740CDDD460058475DB5A288B09A04A62F0CBD71850148DC038785D755B181
MD5 SHA1 SHA512 TLSH

Submit Download

NavxfjVCAYEQ.bat

Path C:\Users\Admin\AppData\Local\Temp\NavxfjVCAYEQ.bat
Size 207B
SHA256 5e715c3047a91f82989db78cfead25d59819fd60104ee855b0c114516cb88625
MD5 b9a664fd2f496fcde65eb0b919b39816
SHA1 d78095534e8c6aaecefde6e90aea698df2b3568e
SHA512 4be216f084077e79b9c05c26a962df5472c6ab213f3c22f5a95ae8118a4ec02d072191f8fc1234dc88dff80085aad2ac35641cdba8fd6a3357a89a2519d0c474
TLSH
T147D023522340CD9D45001C4B5D65A388B09A04AA1F49BD714511489C0387C9C755F141
MD5 SHA1 SHA512 TLSH

Submit Download

QTgjUzKgeqwh.bat

Path C:\Users\Admin\AppData\Local\Temp\QTgjUzKgeqwh.bat
Size 207B
SHA256 f03eb2b6375ea9e198d1a3596b87f4962092b7a8201592c11212e9914798837f
MD5 969e4b07cd234deaaffb91ef15a4c316
SHA1 874f9557742a109eeb47767d8be5f5cd30aea202
SHA512 06dca5c547c49c020421d53ad6d37931b38c06640f6131d63ef927dff05e0f0942cfdb83a5684e67e2e59a4ccab403e97af7ae9d13e803e57fef6985af7327b7
TLSH
T175D023112381CD5E49005C475E65668CB0EA04B61F487D6145014C9C0386D5C759F541
MD5 SHA1 SHA512 TLSH

Submit Download

Sl9JMRgi1BFH.bat

Path C:\Users\Admin\AppData\Local\Temp\Sl9JMRgi1BFH.bat
Size 207B
SHA256 96dd00458285b2cc6eb970fa682b4cabf066094ed62152d059fd570a58822b87
MD5 5821631e253461a5bbd799021bb9068e
SHA1 bc15583635a10c4c732f21defe88bc4557ff14bd
SHA512 4a5d6cd8a820510c527be3249d1170d7a49782d2e478ae61faff0ffec8a18526f4e7259788c9875e933ea8853ef9c487259523b4b073fc976da6560eb1a3fcb9
TLSH
T159D022013380CEAE450018471EA9A388F0BB08AA2F4ABDA68605889C0386C9CB5AB182
MD5 SHA1 SHA512 TLSH

Submit Download

XL4ng2WEicvR.bat

Path C:\Users\Admin\AppData\Local\Temp\XL4ng2WEicvR.bat
Size 207B
SHA256 a57c95c95312acbaaa42ffa4621a66d99eff4905e5cd9d4182411a4dbed19da0
MD5 f145d38fabd0bbe6e5635d0243e92a03
SHA1 b5a16e575088eb78f14b2c5fd48f8231a8a700eb
SHA512 1cf6499ca57c40435c37ad8da3f5c773d97b7805c2cc20d89766f7a79a240b097bb7e6800f1a8aeaeb0b03210bbd21e00265e6164ac523a58f7ae17a4d1c3ecd
TLSH
T163D023013380CD5D450058475D65628CF09E04AA1F087E7145068C9C038794C755B241
MD5 SHA1 SHA512 TLSH

Submit Download

cskSY1tLYKR8.bat

Path C:\Users\Admin\AppData\Local\Temp\cskSY1tLYKR8.bat
Size 207B
SHA256 c80d7a7424f3acd6fe50419e2a92710aed579364636cc475f79e89e839a9e866
MD5 db70a0a0fc403528a882935f309d67cd
SHA1 67baafb7a15d0c99190ff4a8d04ec1539e134e7c
SHA512 b33f208943ae5623992bbbb4608bb9e20acc5d046d5beeebd69632231f94788df0d790454496ec0bd788776b70cefdc6638e3d122f03035e2e6a2566b128d1a9
TLSH
T13AD023012780CE5E450058571D6563CCB0EA04B62F487DA24505489C038784C755F141
MD5 SHA1 SHA512 TLSH

Submit Download

eVgHCfWqlQBF.bat

Path C:\Users\Admin\AppData\Local\Temp\eVgHCfWqlQBF.bat
Size 207B
SHA256 b787c5bc987d100f2a47d813c5d2a78030619ea6376cb12df62cf3e04dbf5a9e
MD5 d8f6c0d6b0a24f2ffbd14e96080a0c50
SHA1 cb2e3b06533a21952c64446881ea40c1a7caf7d0
SHA512 ec52b67b60a889330c1d98887cf7fb80d5a7eefd6629153d483d52efc090740c980423665912de348d84dbb009806f905c41a4204ada6c3db8e29346a87a1d60
TLSH
T126D023012340CD9D550018471E66A3CCB0DE44A61F097D724501489C0386C4C75BF581
MD5 SHA1 SHA512 TLSH

Submit Download

iDZnXfLhvuhQ.bat

Path C:\Users\Admin\AppData\Local\Temp\iDZnXfLhvuhQ.bat
Size 207B
SHA256 ea25c23c68265aefcd59580a296e935d56f3aacef7272c9280ed6c3d8ae7b26f
MD5 89c408d93fbb036c0b419968b11ad118
SHA1 d39ce68d5402d9ced87fc40c68852ed985834841
SHA512 84d4eecfc2297c2afa8941b97e15ececd955399bac85652e9d1b4e8432ef4bc0fb21e84447a4b40141972c34aa6f4e8a09b3e5ef530b28519b868d1eb4d5a7a1
TLSH
T136D022122382CE9F650118871EA5A388B0AA04BA2F09FDA28601889D138689CB59B182
MD5 SHA1 SHA512 TLSH

Submit Download

jGuCUoQo4RoG.bat

Path C:\Users\Admin\AppData\Local\Temp\jGuCUoQo4RoG.bat
Size 207B
SHA256 b08a7ef01973252a231c15779221352fffe7ce9d560cd17d2ded2489e5e31664
MD5 5ac0630f0c9ae81ef76654cf21d363d3
SHA1 a1e641bb78e9bfd9ab187691f0aa9fc5c79e204f
SHA512 120d0f7495d890539c165802aa0e7cc03538764458de84949987f29f3b2fa27d4616c60b17303244eb55721f01ab27549202de5c4693762ad70045df2e6ebd9e
TLSH
T113D023413740CD5D450018471D6567C8B0AA04B62F08BD61850148DC0386C4C759F141
MD5 SHA1 SHA512 TLSH

Submit Download

nsADaEYwEoAi.bat

Path C:\Users\Admin\AppData\Local\Temp\nsADaEYwEoAi.bat
Size 207B
SHA256 1d39307bb68cf2fb0d453c1113e65ecfd668b0300ebc754da30635559637f498
MD5 4339c0eead7f8ba5186d9ee0b4ed33bd
SHA1 7143c50432255251f613a007d3b54e921a2fc0cc
SHA512 80b4af3c9b1e4d7bd5477d877f7f5f4f5095f78992291222e25c29a25eb7eb1b75f84841d7efcd98868ca02a9859d77be897fba0d28cd6b29c7d60a39548dfa7
TLSH
T1ACD023113785CE5E450128475E6562CCF0DF04B61F48FDA14601889C038E85D755B141
MD5 SHA1 SHA512 TLSH

Submit Download

oiBXwUnv3bmL.bat

Path C:\Users\Admin\AppData\Local\Temp\oiBXwUnv3bmL.bat
Size 207B
SHA256 a70489627d009227c39ab49f6f55fea2a0134cffe5d7a01f4d0b4cd46bd0c1bd
MD5 15f312ffe549598a81e17a8ec0fc5ee5
SHA1 828938649f11f43817bc537be023fea5b93c722c
SHA512 47fd07beed61609f5303f130ad514c81ccc958bd702ddfb19bc2f5f046e93a0d18eb1cd0aad4131b2ea54d66cf3168295db3547ae5d2d6e3780a0e2962e6951b
TLSH
T172D023012340CD5E46011C471DB5E388F09A04A71F0C7DE1850148DC03C6C4C755B541
MD5 SHA1 SHA512 TLSH

Submit Download

rOiQ3aLk5mrV.bat

Path C:\Users\Admin\AppData\Local\Temp\rOiQ3aLk5mrV.bat
Size 207B
SHA256 b44b85dd9c4ba23cd0306399eae4d0285432668bf17e90a520e5cdb6d3b1f1b4
MD5 5d972d6bee519b69a5f0b84c3173a763
SHA1 5913d4aa2f9e0ed37bf4ef77dbb29865881a0d31
SHA512 c0c01262a4579c9edf15f4b19d2ee7ad7d871c24110f2ab04745058c7d8f2c1550f3726447824626a7b292276e2b48b5951128f806464b55d69907daac53d8ad
TLSH
T1A2D023012340CD5D55001C471DA5B688B0AA04AA1F0AFDB24501489C438789CB55B541
MD5 SHA1 SHA512 TLSH

Submit Download

sVkTLJKHjOMZ.bat

Path C:\Users\Admin\AppData\Local\Temp\sVkTLJKHjOMZ.bat
Size 207B
SHA256 914d037fcbb09fcaf6788b7fcc50b7acfbbe997dae681b187654a72adc5790ca
MD5 e38f98b6a6337d0cb100f88fd51ac88c
SHA1 b793ee077a324c05904c13ea6774c24f3b25bbe8
SHA512 faefbf1473785f956faeaa2e4ebddfa93333defb379b056c4f5211346f697a1864a10dd495a55cc984b354cb0382e7b494e0c79c21ce2991b918e473324039f2
TLSH
T199D023012380CD5D450118471D65678CB09A04B72F09BD61860148DC038795CB5DB181
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 5305f6df22af8f9a498e2bce46f6081a483c0489a2d57c2bcdfae1eea5f766e3
MD5 c87ad4ac91815c8326eed7486f02acea
SHA1 85278c28fb2e3147d9d171dd022fd148acf8ee6a
SHA512 a56bb01c0d2cf0c45deaa78657d065939c84ed7781c7a457c4b7165d4a4b60498174636dfb1ac65dc03c19d7f554ebc158f557433f85f3f74d44906fa27ebbb3
SSDEEP 49152:PvEgo2QSaNpzyPllgamb0CZof/JqAi2xkWoGdt+THHB72eh2NT:Pvlo2QSaNpzyPllgamYCZof/Jli2xZ
TLSH
T1A6E56B0437F85E32E16BD6B3E5B0511263F1F82AF363EB0B5181A77E5C93B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2784-28-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-40-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-27-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-16-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-29-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-30-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-32-0x000000001D3B0000-0x000000001D400000-memory.dmp

Download

memory/2784-33-0x000000001D4C0000-0x000000001D572000-memory.dmp

Download

memory/2784-25-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-26-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-24-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-23-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-22-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-21-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-20-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-18-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/2784-19-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-17-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-0-0x00007FFF4476F000-0x00007FFF44770000-memory.dmp

Download

memory/5532-14-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-13-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-12-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-11-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-10-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-9-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-8-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-7-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-6-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-5-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-4-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-3-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-2-0x00007FFF445E0000-0x00007FFF44F84000-memory.dmp

Download

memory/5532-1-0x0000000000780000-0x0000000000AA4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads