quasar | 85b03313465a137a440676d938b9c4829f592a54e3cfc1dbf178430bb942caa2

Analysis

max time kernel
59s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 00:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260710-ajnt2act7y
SHA256 85b03313465a137a440676d938b9c4829f592a54e3cfc1dbf178430bb942caa2
MD5 4e0cb9dbc6fc3e666410cb41e8774be1
SHA1 4de7c8cbee94a14548ba61800e8974d7b663cd93
SHA512 75d3005e1b21817c5577201fd568c7f20381d01b310807652b29487a541d83fd1576cdd87886c7721c3de70e4017768a7f0b5f50af647dfe34e2e5bedc554c47
SSDEEP 49152:oyhJJHPNCC7J98vBgJh99oG4znXeWxUuxGRTHHB72eh2NT:oyhrHPh7J98vGJh99tCx
TLSH
T15DE56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

xoilaczzwwz.tv
malware.xoilaczzwwz.tv

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/436-0-0x00000000002E0000-0x000000000060C000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 36 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	messenger_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	messenger_update.exe
Token: SeDebugPrivilege	1812	messenger_update.exe
Token: SeDebugPrivilege	4480	messenger_update.exe
Token: SeDebugPrivilege	4552	messenger_update.exe
Token: SeDebugPrivilege	3508	messenger_update.exe
Token: SeDebugPrivilege	2292	messenger_update.exe
Token: SeDebugPrivilege	1720	messenger_update.exe
Token: SeDebugPrivilege	1260	messenger_update.exe
Token: SeDebugPrivilege	4948	messenger_update.exe
Token: SeDebugPrivilege	4952	messenger_update.exe
Token: SeDebugPrivilege	4612	messenger_update.exe
Token: SeDebugPrivilege	3740	messenger_update.exe
Token: SeDebugPrivilege	3988	messenger_update.exe
Token: SeDebugPrivilege	4632	messenger_update.exe
Token: SeDebugPrivilege	4012	messenger_update.exe
Token: SeDebugPrivilege	4568	messenger_update.exe
Token: SeDebugPrivilege	4992	messenger_update.exe
Token: SeDebugPrivilege	2120	messenger_update.exe
Token: SeDebugPrivilege	3844	messenger_update.exe
Token: SeDebugPrivilege	2700	messenger_update.exe
Token: SeDebugPrivilege	4176	messenger_update.exe
Token: SeDebugPrivilege	2256	messenger_update.exe
Token: SeDebugPrivilege	3396	messenger_update.exe
Token: SeDebugPrivilege	1376	messenger_update.exe
Token: SeDebugPrivilege	4396	messenger_update.exe
Token: SeDebugPrivilege	440	messenger_update.exe
Token: SeDebugPrivilege	468	messenger_update.exe
Token: SeDebugPrivilege	4724	messenger_update.exe
Token: SeDebugPrivilege	3940	messenger_update.exe
Token: SeDebugPrivilege	364	messenger_update.exe
Token: SeDebugPrivilege	4728	messenger_update.exe
Token: SeDebugPrivilege	1532	messenger_update.exe
Token: SeDebugPrivilege	5036	messenger_update.exe
Token: SeDebugPrivilege	1948	messenger_update.exe
Token: SeDebugPrivilege	3596	messenger_update.exe
Token: SeDebugPrivilege	712	messenger_update.exe
Token: SeDebugPrivilege	3356	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 1584	436	messenger_update.exe	86
PID 1584 wrote to memory of 4408	1584	cmd.exe	88
PID 1584 wrote to memory of 1812	1584	cmd.exe	89
PID 1812 wrote to memory of 4464	1812	messenger_update.exe	90
PID 4464 wrote to memory of 4688	4464	cmd.exe	92
PID 4464 wrote to memory of 4480	4464	cmd.exe	93
PID 4480 wrote to memory of 4404	4480	messenger_update.exe	94
PID 4404 wrote to memory of 3180	4404	cmd.exe	96
PID 4404 wrote to memory of 4552	4404	cmd.exe	97
PID 4552 wrote to memory of 232	4552	messenger_update.exe	98
PID 232 wrote to memory of 1736	232	cmd.exe	100
PID 232 wrote to memory of 3508	232	cmd.exe	101
PID 3508 wrote to memory of 2320	3508	messenger_update.exe	104
PID 2320 wrote to memory of 3060	2320	cmd.exe	106
PID 2320 wrote to memory of 2292	2320	cmd.exe	107
PID 2292 wrote to memory of 464	2292	messenger_update.exe	110
PID 464 wrote to memory of 3644	464	cmd.exe	112
PID 464 wrote to memory of 1720	464	cmd.exe	113
PID 1720 wrote to memory of 2284	1720	messenger_update.exe	115
PID 2284 wrote to memory of 656	2284	cmd.exe	117
PID 2284 wrote to memory of 1260	2284	cmd.exe	118
PID 1260 wrote to memory of 2400	1260	messenger_update.exe	119
PID 2400 wrote to memory of 1816	2400	cmd.exe	121
PID 2400 wrote to memory of 4948	2400	cmd.exe	122
PID 4948 wrote to memory of 4504	4948	messenger_update.exe	125
PID 4504 wrote to memory of 1380	4504	cmd.exe	127
PID 4504 wrote to memory of 4952	4504	cmd.exe	128
PID 4952 wrote to memory of 2316	4952	messenger_update.exe	129
PID 2316 wrote to memory of 4804	2316	cmd.exe	131
PID 2316 wrote to memory of 4612	2316	cmd.exe	132
PID 4612 wrote to memory of 5012	4612	messenger_update.exe	133
PID 5012 wrote to memory of 4372	5012	cmd.exe	135
PID 5012 wrote to memory of 3740	5012	cmd.exe	136
PID 3740 wrote to memory of 2324	3740	messenger_update.exe	137
PID 2324 wrote to memory of 1728	2324	cmd.exe	139
PID 2324 wrote to memory of 3988	2324	cmd.exe	140
PID 3988 wrote to memory of 4328	3988	messenger_update.exe	141
PID 4328 wrote to memory of 4728	4328	cmd.exe	143
PID 4328 wrote to memory of 4632	4328	cmd.exe	144
PID 4632 wrote to memory of 4904	4632	messenger_update.exe	145
PID 4904 wrote to memory of 1208	4904	cmd.exe	147
PID 4904 wrote to memory of 4012	4904	cmd.exe	148
PID 4012 wrote to memory of 1276	4012	messenger_update.exe	149
PID 1276 wrote to memory of 980	1276	cmd.exe	151
PID 1276 wrote to memory of 4568	1276	cmd.exe	152
PID 4568 wrote to memory of 3996	4568	messenger_update.exe	153
PID 3996 wrote to memory of 1576	3996	cmd.exe	155
PID 3996 wrote to memory of 4992	3996	cmd.exe	156
PID 4992 wrote to memory of 4324	4992	messenger_update.exe	158
PID 4324 wrote to memory of 4772	4324	cmd.exe	160
PID 4324 wrote to memory of 2120	4324	cmd.exe	161
PID 2120 wrote to memory of 2344	2120	messenger_update.exe	162
PID 2344 wrote to memory of 2696	2344	cmd.exe	164
PID 2344 wrote to memory of 3844	2344	cmd.exe	165
PID 3844 wrote to memory of 3168	3844	messenger_update.exe	166
PID 3168 wrote to memory of 3356	3168	cmd.exe	168
PID 3168 wrote to memory of 2700	3168	cmd.exe	169
PID 2700 wrote to memory of 1724	2700	messenger_update.exe	170
PID 1724 wrote to memory of 4696	1724	cmd.exe	173
PID 1724 wrote to memory of 4176	1724	cmd.exe	174
PID 4176 wrote to memory of 716	4176	messenger_update.exe	175
PID 716 wrote to memory of 2296	716	cmd.exe	177
PID 716 wrote to memory of 2256	716	cmd.exe	178
PID 2256 wrote to memory of 4040	2256	messenger_update.exe	179

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7tN8YpbTnt0g.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Hbug8awlMQpz.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4480
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qunjfVykChHh.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bw7EIOXXXSOL.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iNiiRtqJcCRp.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8TyeXuDFYSWX.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:464
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eVmoVxTJyAA0.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:656
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\53Il3fmu2svl.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NgvNCnNjgUoZ.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\InMo7yOjvHXR.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BYcU6Lb33vOe.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3740
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Eaeg33Kji1e4.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vlyrLSMfr30P.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8B2XzVonQE5m.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BIqLths19oq5.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:980
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JkON18Ix0O9F.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6DwSUdVmVnPz.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AA4ADjKr4ePN.bat" "
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3844
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F2a3yhHiQ6gn.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\diNh9OBgYpXO.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:1724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NK9lY0h4mgI1.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rZzylUB1QVLJ.bat" "
        44⤵
        
        PID:4040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VLghcW5cZcr8.bat" "
        46⤵
        
        PID:3276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1376
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8nz5ij48hbCs.bat" "
        48⤵
        
        PID:4380
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JMYqOnrQw4ph.bat" "
        50⤵
        
        PID:2040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5CfGgWkUcpK5.bat" "
        52⤵
        
        PID:920
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZYKQvnCQ1eK3.bat" "
        54⤵
        
        PID:3332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4MWYfVIq2FeI.bat" "
        56⤵
        
        PID:2744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\i7MgGnlIM5pI.bat" "
        58⤵
        
        PID:3804
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sB4hy0XCmCua.bat" "
        60⤵
        
        PID:1440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4728
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QuVkQPIlGfAw.bat" "
        62⤵
        
        PID:4280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\doCjZweZWE3G.bat" "
        64⤵
        
        PID:4144
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZNJCFNC01Aqb.bat" "
        66⤵
        
        PID:1396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F3BGMr9fWmiL.bat" "
        68⤵
        
        PID:1012
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\k6A1Ab3ndqUq.bat" "
        70⤵
        
        PID:1816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0O1r2X67nMBT.bat" "
        72⤵
        
        PID:940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

0O1r2X67nMBT.bat

Path C:\Users\Admin\AppData\Local\Temp\0O1r2X67nMBT.bat
Size 185B
SHA256 f4d056f3669b69dacbb2c5de84e057bbce8b024d0481904bbabc7aed9f1b911b
MD5 10ce393ce28e9d4d114aec18947b4199
SHA1 260540df7d95617fcac562078dd8bca4e38a0e8a
SHA512 7b268620022cd4096f0dc1a86b1403a15220481e0c36ebea4b7df8b09e08eba925cf23e14b7f9eda8695e8bea94e05d3c151c08572f1ecf5c7890744b1ca9173
TLSH
T1FBC0120141818A6E4A145C0B59A9778CF29909996949BFA04501CC5C53D2D98B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

4MWYfVIq2FeI.bat

Path C:\Users\Admin\AppData\Local\Temp\4MWYfVIq2FeI.bat
Size 185B
SHA256 c4b8516e9646e69a90fa44504b7f7a6c661988cdcd198caaf00642007729f03d
MD5 6309528451cb5100e25ac20c04556cbf
SHA1 1445cec7ca104060a00429f4cba764f1d45b2a3d
SHA512 7fc0f26ff34f250f5414c7d495b05eaad2c3d71fb302517e7f8069b1e048d155907e7e3ac0ea0df283ed1ca66543d85cbf218eaaf544ac90f5335f7eadace125
TLSH
T1B2C0120141928A6E45159C0A59F9A68CF1E609D929497FA04A51885C57D3CA8B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

53Il3fmu2svl.bat

Path C:\Users\Admin\AppData\Local\Temp\53Il3fmu2svl.bat
Size 185B
SHA256 ee9327b04dc7a0dd7b8744877dae001672914344abe0f037dc197790ee79c2b1
MD5 2f0cd76784bb75f5df50b3ef1fe1bcb3
SHA1 7a1ce070cc9d36738b57ff9c6a0f1e6ee8e13ac9
SHA512 b3c1fceba39915ff545b8257e344e40f0f0f87a46fa59cfcb9819a296c73260158f78937e9061b3d95169da0dd39b059db32a9adf75eb4175f7d7aff09222bb0
TLSH
T11DC0120141818E5E49155C0B19EA668CF09508992D4DBFA04511889C17D2D68B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

5CfGgWkUcpK5.bat

Path C:\Users\Admin\AppData\Local\Temp\5CfGgWkUcpK5.bat
Size 185B
SHA256 1fb7a2b4c54c16fab1903b44378a9f37ded7bd036cc3977ab911e52a4ff375fb
MD5 58ca869f27e2fc2ee115aa66ac17f588
SHA1 4cf77f29bf2e3adca29a91ded4910041e74a5c22
SHA512 bafc96091121983f0e96d69958d90288a6effc049706474900d4ba041f5566731162a1e09248d2af0d8b7a5fee0e0173477e7289d3c3f05a2031b1416ce389c5
TLSH
T1ADC0120281828A5E56145C0A19E9A68CF295089D29497FA04501885C23D2C58B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

6DwSUdVmVnPz.bat

Path C:\Users\Admin\AppData\Local\Temp\6DwSUdVmVnPz.bat
Size 185B
SHA256 a38c61db9a2611402ae16e6dfacb8b482fb3dff3f389a1d9bcf12622f9f7599e
MD5 d74eaa8a163404575dcc6b48f3d31afd
SHA1 dcd3c7a2964098212e7bb3acc25e57e83a15d705
SHA512 2e0016b2a345f52ef9011a9279b843020dd78a5d9090ab49b8a23804af391814ac16f9afba981116312eb575dd3d882cac0469c630486d9372a96c29fc120860
TLSH
T177C0120152858A5F55055C1A59EAA78CF0950A9D29497FA04901885C13D2C58B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

7tN8YpbTnt0g.bat

Path C:\Users\Admin\AppData\Local\Temp\7tN8YpbTnt0g.bat
Size 185B
SHA256 cc8200268f5cbb5516c8af710afdb241f71fb32a85d13944a199d45847bb6e27
MD5 a601b8d7dd19f40a94626837e18bfd1b
SHA1 02ae6d8473585dca8fedd09643645ae497157676
SHA512 9a9e267b71cf998e5b111021af17cde9a3d2dc4a78a6bc0f95327869e0971048e4d15da61023f869070c7461ffad3433f3280c1c9ed60020f41674a5e4a4293b
TLSH
T10DC0220281828A1E09004C0A18E9A38CF09608982E0C7FA005008C5C13C2C58B4CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

8B2XzVonQE5m.bat

Path C:\Users\Admin\AppData\Local\Temp\8B2XzVonQE5m.bat
Size 185B
SHA256 1232424c0f7bed25db78a8be266fa4682692c78afb0dc68944d99602e64aa8b5
MD5 0362bb9b798cce98132efbee5ebe1bc2
SHA1 a69242d6739c4332258709304e7af39758aa0915
SHA512 9053aac13cef3e09257127c8f5ef24da6c9638fc0402d4e4366f6309cf155f926c23d8ee624dd4fe21f1b239b4d59d9925d942975e1e2df29b9395f4c37627ed
TLSH
T14AC0220051818A1E05000C0A68E966CCF0E5089C290B7FA00500C88C13C3C68B5DB382
MD5 SHA1 SHA512 TLSH

Submit Download

8TyeXuDFYSWX.bat

Path C:\Users\Admin\AppData\Local\Temp\8TyeXuDFYSWX.bat
Size 185B
SHA256 46c7e0ee39989f463bca21f1f5db3cb694acf60277513625a4692e16de26f922
MD5 c4fd954d20c9b3595091a62621e433bb
SHA1 0bc1d73e569f4b14180517c2aa3a2bad671aa270
SHA512 b6906e91f4c7770978439fe3ead88816f95e6d6056977a9122ad051bf713ac0be9ac652cfedc9c69bb1638b3f37311e802fab428efbbd90167f555b0a5448b6b
TLSH
T1DBC0120141868A5E46145C5A19E966CCF1E5089969497FA045118C5D13D3C58B5DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

8nz5ij48hbCs.bat

Path C:\Users\Admin\AppData\Local\Temp\8nz5ij48hbCs.bat
Size 185B
SHA256 db3667bd95da9e3caa732941ed9f5788fae3c136b9d78386d21eb53e45602aa4
MD5 6d9c8f4e757194eec8357eba9259c3dd
SHA1 ae459f9a883c137876f4dd8781e391d15ddd415b
SHA512 d404fa04489f49612588dfa6358c8c836141c51fb5f1aac563da69ee874180c05fe32ba31545fbd8ccc7d3976910ce629eb4bd9764714ec5e28edc689e051c53
TLSH
T1AEC0120181818A5E45045C0B19F967CCF0A609996E497FA045118C9C67D2C58F5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

AA4ADjKr4ePN.bat

Path C:\Users\Admin\AppData\Local\Temp\AA4ADjKr4ePN.bat
Size 185B
SHA256 e0135dbc373aa888f361806163efe4f94a8fe3c5a5fc4e4e50f2f7a6feddb751
MD5 df9233c545e27e1666abaaa13bbf203d
SHA1 c19007a5c9d943f05f6122b66fa63dacd751c6d5
SHA512 74c1033b49c52667f1d788234eb5d5c3855d78df3b57fb971113344287da85dbc3a7fef6939290df2a8e694bc6125fcd925480bac281a1d91a255667aa7fa14a
TLSH
T116C012115285CA5E55045C1B19E9B7CCF096089969497FE046428C5C23D2C5DB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

BIqLths19oq5.bat

Path C:\Users\Admin\AppData\Local\Temp\BIqLths19oq5.bat
Size 185B
SHA256 1b9cafeae440c7cab1e45494d706f985948574efed36ed17a74fe74473970973
MD5 0c0ab9e76a72987a0fcfd13a0de52755
SHA1 0271f7f92956bfde8152e59e5a82f5d33b901319
SHA512 0d3cdeca6cb578d3db6d68ffb072ea52361327ecdbcf4dd9b360f790bcb341d708fa183e8938b7b242ef72bcf5abf0ffb66f7d22d399bd4feff407c29ad488f2
TLSH
T1BFC0220281828A6E05000C0A08A9668CF0A5089D2A097FA40540885C13C2C98B4CF3C2
MD5 SHA1 SHA512 TLSH

Submit Download

BYcU6Lb33vOe.bat

Path C:\Users\Admin\AppData\Local\Temp\BYcU6Lb33vOe.bat
Size 185B
SHA256 936a9019972260925947a7d4b089899fcdacebe4de58bf789723da7bc861fd39
MD5 e293bd08d2ee0fcd4b999ab9b1cdfcf9
SHA1 3e69f3171c7dd139ea45d4ba057511101e87b653
SHA512 778825deb956da3b79e0a481fa93b34084e5262b4ad368070cb2cb693ff53c733a8bb812e68b83be499593dbe7a36807136e46c9620c397c586456cf802fbb83
TLSH
T13EC0121186818A5E46045C0B19A9A6CCF0A908992949BFA045518C9C17D2C59B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

Eaeg33Kji1e4.bat

Path C:\Users\Admin\AppData\Local\Temp\Eaeg33Kji1e4.bat
Size 185B
SHA256 ed6ddb89f72f596996a96ed077db032b6ad68cd2b5c33c6427c30016e5722cd9
MD5 72cf79253107338c7ec44f4b9f864488
SHA1 66e71855aa2d2dee81c8cdb5511d923089851dd3
SHA512 98045733952e3f614b82732323f4ed6095a70def208a29db2679a147e62533f3e30ca504ab8af6cf6832e29bad9a1afc45cb026599bc1e0a30c0578a9d780a13
TLSH
T1B6C012014191CA5E56045C4B19A9A68CF195099A2A897FA04611885C63D2C9DB9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

F2a3yhHiQ6gn.bat

Path C:\Users\Admin\AppData\Local\Temp\F2a3yhHiQ6gn.bat
Size 185B
SHA256 f8efe8eeef4bf2eb4e7c878b0477905d04cae7f45e92f8ec377ab4999a7888b2
MD5 c373a5e3dc31bbb37c6cd0b39eb0b3c7
SHA1 8a5561599bc588c02bfcaa202ea62dbd3dbbba68
SHA512 a4f8730b6f658b1de060f29fe4aa9a220dbfe62fa1c9263b01c84a46dbc5e3fee23ef5cef031126374767109ea98c6a1b8613a3f049d70bf1acbaac51606e8f6
TLSH
T1F1C0120142828A5E46055C0A29A967CCF09608992A497FA04501885D13E7C58F5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

F3BGMr9fWmiL.bat

Path C:\Users\Admin\AppData\Local\Temp\F3BGMr9fWmiL.bat
Size 185B
SHA256 31e956204a97a205c444f61102cdcb0bda83d2a116bf6ef79cd3a21b8e118498
MD5 7bc4d91943bebdc36a34a72953d94870
SHA1 e1b671edc0eebb5aed7a33c65f92acf7002df4b2
SHA512 11a58ed7b8088e3e9d790941c58bbd864c3a9a0fe3c070c1cd97cd7d025ace92ae2622b41ffff01ae03b725f949862e5fdb317150967bebb1c4ed2c82e14bf7e
TLSH
T186C0120142958A6E46145D0A19B9668CF1D509992D897FA04611889D13D2C58B5CBB82
MD5 SHA1 SHA512 TLSH

Submit Download

Hbug8awlMQpz.bat

Path C:\Users\Admin\AppData\Local\Temp\Hbug8awlMQpz.bat
Size 185B
SHA256 2137b31e4a1249720d59552aac529e910c718e362d8d8103724572fb42aa55cf
MD5 c3af150c6783c925e106117b1f1c8505
SHA1 6c5fe7723c5c48dd2c03b94f76b1398fa987fbdd
SHA512 1a232f8726e1de8391035d51ec777a3b7b59d54a73c30c76e0bb22c62ea1651270c0740c499f3999f0ffafa99e127a65cffbd576021f91c98feb71da401868ec
TLSH
T10CC012014196CA5F4B085C1A19A9668CF1A509996949BFA445018C5C53D2C5CB5CB796
MD5 SHA1 SHA512 TLSH

Submit Download

InMo7yOjvHXR.bat

Path C:\Users\Admin\AppData\Local\Temp\InMo7yOjvHXR.bat
Size 185B
SHA256 0bbd9b01b4237922e14ab65d425188a6f4bab3515f2d4fc1aa15e21d290addf1
MD5 936ae765e311b7d21491259476ff6a3e
SHA1 2067cc2002ba4066af91746a76db743f17488d82
SHA512 9dfc40419db1c6722c81faecfc8af3b693e58c98b65e6f637bf3d3567d124bcca5feb12fb7cf0060e18e84c39296c335a490c6a372960fe98008727d370af03f
TLSH
T11CC0120141858A5E46145C0B19F966CCF196099D29497FA04501C85C67D2C98B9CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

JMYqOnrQw4ph.bat

Path C:\Users\Admin\AppData\Local\Temp\JMYqOnrQw4ph.bat
Size 185B
SHA256 b97b23a357d750a6060e2b19af8c69fe8b55ac963a3fbda912d125658635c39b
MD5 44cc0126100e85a7aa787704865cc7db
SHA1 3bca848e9fe6d6c930f881c972152185aaa76713
SHA512 caf1d6633c5dfd21d64d578d27343be14cf8c750a93a5f44afe896b2622929a0971b02e5c211de0d8c76181cf89c4b6e695b72867abe4ff9223f2aa32da8b85c
TLSH
T129C0120181818A5E45145C0A59A9668CF0A5089969497FA04901886C13D2C98B5CB7C3
MD5 SHA1 SHA512 TLSH

Submit Download

JkON18Ix0O9F.bat

Path C:\Users\Admin\AppData\Local\Temp\JkON18Ix0O9F.bat
Size 185B
SHA256 71b40ef550b681fb557b5bc5192084958afba21a32bb046c36ae66d1ffcfef35
MD5 0c2a78a7805d43dd014ac5bcdf34f081
SHA1 b5734892ce2f31375941edd64dea55d469006e5b
SHA512 c6e19e10d08f8b261bfa44a91d141ec3e8c3763234198d8af2b0e6842fd4ba440a981cbee9768512f1ae3e4559359ecd5987b28ddffbc17567cb248a064d2311
TLSH
T1C5C012014591CA5E55145C0A59A9768CF0A508992D497FA045418C9C93D3C5DBADF782
MD5 SHA1 SHA512 TLSH

Submit Download

NK9lY0h4mgI1.bat

Path C:\Users\Admin\AppData\Local\Temp\NK9lY0h4mgI1.bat
Size 185B
SHA256 5deaaea7f268d450d9d8b761ae682d2dc06e7d16c6371b70240416b0b265485a
MD5 0c9097f1f6eacf07a737cc32e5876ce7
SHA1 3d0c22c757bfd987e8a2a06308b7b2aee5fd3c3e
SHA512 4743a4b25b4212f243de1d30f56b96787da1c03b8d62aa1bc74b6c66bbe3547d5dbc4cd63d46ce67e0c7fa777549491ccf09676e0758e2a61983969b74e085d4
TLSH
T18BC012014192CA5E46045C1B19E9668CF09509996949BFA04601C85C53D2C68B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

NgvNCnNjgUoZ.bat

Path C:\Users\Admin\AppData\Local\Temp\NgvNCnNjgUoZ.bat
Size 185B
SHA256 79c3416e07e1e22e2b79a252b53fb480abd9b5aa5ea41a6a06164c4f2deed0ae
MD5 4e9074bc6094cbdfd0ba926af720b8c8
SHA1 fdfc0c41b8727833e0d8ec41065df31949dde1d8
SHA512 c8317fb0177e29117d721513199bfdde30c9743808bf08a6b135a40a4e72a3094d2e194f85089cbb1d2f97bdc57bac4e1cfa44d9929645c5aa06ae7b21d521a2
TLSH
T1A5C0120242828A7E55145C0A19E966CCF196089929497FA14611885D13D6C58B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

QuVkQPIlGfAw.bat

Path C:\Users\Admin\AppData\Local\Temp\QuVkQPIlGfAw.bat
Size 185B
SHA256 87426abd9506c5e8d5d85fca40f96eadc4eceb749d2480f9055f9992787ac878
MD5 382700f3495bbeff7e7e89776f6a39c1
SHA1 2104a8a9c338ca9835582f5d6b10708170265189
SHA512 b2dc27b68fd0bfb03d047c752d9ddfddad95216e6c472937bd4d02f270cc6122cd3629196e95ef13983b990878b108232f902ac70c5022d9722332ecaeaeaccb
TLSH
T17FC0120152918AAE5A046C1A19AD66CCF0A508AD6A49BFA44A01C89C13D2C69B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

VLghcW5cZcr8.bat

Path C:\Users\Admin\AppData\Local\Temp\VLghcW5cZcr8.bat
Size 185B
SHA256 e0bd9119063c81efbc2738c2d14132fdf9cb4ce69cb8fcd1f19cf2cea5e06a9c
MD5 3c0f32e26ce54cf902e1b6a7b8b62d85
SHA1 499ad6c4fe30ea339a4e3c67fea949bff44bbe5a
SHA512 30644bb6b20d113ebd435c329359e7db4f87961e7b27fd045baad140cdc495006cf5386241a7f4fe5bfcbc8356ffe30c0c161665dc1d325d2cceb53d389d6f3e
TLSH
T1BBC0120142818A5F56085C1A59E9768CF1950C9979497FA046018C9D27D2CA8B5CBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

ZNJCFNC01Aqb.bat

Path C:\Users\Admin\AppData\Local\Temp\ZNJCFNC01Aqb.bat
Size 185B
SHA256 7612ce8c578ce82887af5ff67a083b2240cd01f189f2a23c465205042c9e0da7
MD5 a15175c1f6a2be6587df5f8b877096a1
SHA1 43fb19177c0d1b616b84d315607f45a6b1dbf00b
SHA512 6c633c303f469455f7e016a549745e6ede9132a026b5976fcbd6dd31d63ad3b0700e2b5efa961a28eee9f88b6aadaf778fbfb55c425adb07329d8b961c0eb6f5
TLSH
T1ADC012014292CA6E45145C0A19EAA6CCF09508AD394D7FA546418C9D23D2C68B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ZYKQvnCQ1eK3.bat

Path C:\Users\Admin\AppData\Local\Temp\ZYKQvnCQ1eK3.bat
Size 185B
SHA256 21f0ce0ef5b80a0323d4e08d0d6c518a3ad8e330a44bd272f64374083a1a7ead
MD5 b1e8fc6637b4f3745353eef119940e6f
SHA1 0f4f6a045abc72ab27d114b01406162be8e9a6c6
SHA512 8bfe80d702c907c0456a5c8af1fcfb0ec2807582e827d19aefa6053d85f6101ce398fb5033baa0eb456d78cd8a2d1fe3874e68cbe838c2323347661aa786d418
TLSH
T1F5C012014196CA5E49045C0A5AE9A68CF095089A69497FA149018C9C23D6C6AB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

bw7EIOXXXSOL.bat

Path C:\Users\Admin\AppData\Local\Temp\bw7EIOXXXSOL.bat
Size 185B
SHA256 7c3ada4f056c46b38a99b2add84ca142c3a74b3fe418cd060361223bff366071
MD5 6ccdb938cfd3ec8987837a74887a6692
SHA1 8038b568d7195e7a1ca3ba133c1f478e4abe5160
SHA512 ebee35500d3d89604dbcd74f8d4a83a9ad20cc39cb5c781a750ff03460485eff97c211ddc26a5bf790a46d4f30b0e5bb9d0c2760dff9b0aa7d157ab0cc883722
TLSH
T114C012014296CA5E56145C0B19A9668DF0950C9929497FA149118C9C57D2C6DB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

diNh9OBgYpXO.bat

Path C:\Users\Admin\AppData\Local\Temp\diNh9OBgYpXO.bat
Size 185B
SHA256 fb5912c771e6c249fe2859b39ca816f8adab9272b4287df36df63a5ca63b6794
MD5 eea3291963dabb4e9233b45e8244db34
SHA1 3de67477c9af46077ff119b924ddea4ab54b5049
SHA512 d7cd661042e03f7cb425dbbaf70ba1fa6dfe236b5bcc01c4c3a47eec7a7a6fac60a98ea8131944f3177bc1bcd901a949bf3b95537da2e80528948346db2179df
TLSH
T1E6C0220095818A1E0A005C0A0AE9AA8CF0D908D82D487FA045008C4C13D2C98B4CB382
MD5 SHA1 SHA512 TLSH

Submit Download

doCjZweZWE3G.bat

Path C:\Users\Admin\AppData\Local\Temp\doCjZweZWE3G.bat
Size 185B
SHA256 0cc6f41d76db7de78c86fbf8f5c2f333af08e075a8c5255c61b9ef5f012198c5
MD5 b860c32d2ff2f93d1f649a093de7b2e4
SHA1 0b0a9af804458b4ff4c8c9200c742479a7c28597
SHA512 b102bf467a7378613feb4b6562538d5076e3ee7f090e615ae2f24488c9c64db8017228a6363af8e3ed3b587b7e37d0e545896ffd54e1fd3c3f3e043a0d48d48b
TLSH
T134C0120181828A5E55045C0A59A9AA8CF09509A939497FA049018C5D57D6C9CB9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

eVmoVxTJyAA0.bat

Path C:\Users\Admin\AppData\Local\Temp\eVmoVxTJyAA0.bat
Size 185B
SHA256 7b3587d2cb72bac94e934a25cb6a93e4e83f995b0d20578846e71f8f7c4cb3cd
MD5 2b111e553eee37bbfc55f609b89d08b6
SHA1 cd4ab38bcb59c5951d7ae488a0420c66dda244fc
SHA512 762b433f5e6cdb2f73a1b6ea430d100f196d77fdac8280e937383f2dc881df1504170ee393ef60204961770e2dd570f8bc929cb64640d1a7106400b5d93f440e
TLSH
T1F6C0120141918A5E55045C0A59AB668CF095089969497FA04501885C17D2C5EB5DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

i7MgGnlIM5pI.bat

Path C:\Users\Admin\AppData\Local\Temp\i7MgGnlIM5pI.bat
Size 185B
SHA256 1b1d52c3eb9e6318999884a1bc264f8d899382130fbdbc6a628ef4fe1c9a1146
MD5 277264d3ec9d5c393fab3370b1e29366
SHA1 50e0245aad00da5795501b7a753a35342b0b15fa
SHA512 6cb51d114492823f8fe0b15685cef18187ae30b6fd34214f2b1b3a4f6766805dae50ee92b5301a7219de701b4f5b4464d64307db249980326a4c92390fb7b480
TLSH
T1DDC0124155868E5E55045C0B19E9A78CF0E5099929497FA14511889C13D2C68F5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

iNiiRtqJcCRp.bat

Path C:\Users\Admin\AppData\Local\Temp\iNiiRtqJcCRp.bat
Size 185B
SHA256 986982a7340c2877c12d1138d1716cb2bc65ace04efd76952c9981afcccf1f4d
MD5 cc361a10dffe5ddb6413401acb9bd986
SHA1 676a0778ce7aa63d96417cff1e0976bd9ba145eb
SHA512 3aa9fc9738fe4eecf1990630bc971d911ec02f1353b1bca89da269dd63c1133841ab6f92cbb6738f4c9dd98ccdb3b9cd15d3a43588844bcd64da8dc8da6cac95
TLSH
T19BC012015185CA5E55145C0A19E9678CF0D508992949BFA046418C5C17D7C78B6DF782
MD5 SHA1 SHA512 TLSH

Submit Download

k6A1Ab3ndqUq.bat

Path C:\Users\Admin\AppData\Local\Temp\k6A1Ab3ndqUq.bat
Size 185B
SHA256 24ef96ad5345398eaf3cd303a8f16650ab98794ccf6c8c25f61b82d9b02475f4
MD5 5f2b8365cb95a223b2b29823fce4f131
SHA1 8ca216dedc1081a0993aa0ca7cbc84af752b5d0c
SHA512 c05376107247f93fb0c67dd54152be99d97e305ba340c274b1ba9760ec3b1004047b4ea68b7037940e4ed262bd147253a4632a3b477e011f8b030bf31dd1e2e2
TLSH
T135C012014581CA5E56145C0B1DAA668CF095089929497FA04551C85C57D2C58B9CF792
MD5 SHA1 SHA512 TLSH

Submit Download

qunjfVykChHh.bat

Path C:\Users\Admin\AppData\Local\Temp\qunjfVykChHh.bat
Size 185B
SHA256 a8d25d255b01045b969ec1c468ec2b78f8fd5e197b6904d567c4ded078a7e1e2
MD5 22bd556f21e0b748dabc713f55d175f8
SHA1 46216cca49f63c466dfe99c9413b688208a35dea
SHA512 615703c4512e174e04eb08c669836dcc7f43bf0e83503e0bcba7f6872c6fd7f953290312845ebeaca15ce5ec06bb71dbd6e00b7c2b6e8df5d1ab2af8db9f97da
TLSH
T10FC0120155968A9E55085C0A19AD768CF095089D6D497FA44511C85C13D2C68B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

rZzylUB1QVLJ.bat

Path C:\Users\Admin\AppData\Local\Temp\rZzylUB1QVLJ.bat
Size 185B
SHA256 b0b636deb1a5fe3873870702d6ba7246af1ea35dfb091ab1c60090ec62cc4c5d
MD5 52cdde4199a45a8be7fedf6ebffe43e8
SHA1 e26362a75d85fc2a8751f1a165f63474cb8feb6e
SHA512 622e5bae8bfd9fae92f3aeb931e6a5938e49b7aefb553d1a53644d73d570648064a333789e1cfc8556f1d0c03366c07470ac40079938cbc3f2a48bc327552cdf
TLSH
T1B0C0120152818A5E55445C1A59A9768CF099089D29497FA44601885C27D2C5CB5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

sB4hy0XCmCua.bat

Path C:\Users\Admin\AppData\Local\Temp\sB4hy0XCmCua.bat
Size 185B
SHA256 12b68f02bea8f274ecdaa5d9c5a386fb398e972e2bcab638b9433b264e7e4923
MD5 ba4d322f8e405120f5e951b6382bb8c3
SHA1 10e9e8a2a404f0079ca7d24ba272d8a9f2ea7023
SHA512 6dbc352e2103cc176b8c8ad2b9749fe9a3e9e665a656c089fe3561d5fb87015b8f6e59b8494b8a8f86d63ccc36dbf994d6400a2637c7b370a337057d8a57bc94
TLSH
T1AAC0120142818A6E45045C1A19A9A68CF0E608DD29497FA14901C85C57D2C99B5CF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

vlyrLSMfr30P.bat

Path C:\Users\Admin\AppData\Local\Temp\vlyrLSMfr30P.bat
Size 185B
SHA256 10e1d50a357a39f2896861ab694d3a4c08a38edfa7ce5756bb471660bf4a4a6c
MD5 f6760ee37e2a2566474f201d395d5ed6
SHA1 a620c86fc57707f5361beb30ac1ef444ed5bbd6d
SHA512 aa4c1cc4b463d472199f83519aca61298c55e728e11a77c3ec4bb752c446e656b467d5013eb29b0ebb8b8560922aac7a821a1579bda35b0fd0b2574d6ba56a36
TLSH
T18AC0120151818A6E59045C1A19AD778CF0A90C992F497FA04501885D23D3C5CB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/436-0-0x00000000002E0000-0x000000000060C000-memory.dmp

Download

memory/436-1-0x000000001B430000-0x000000001B440000-memory.dmp

Download

memory/1812-8-0x000000001B840000-0x000000001B850000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads