quasar | dba3c2707eb7a151daeb7af6762d1c2d5a335817c4654d0b9395b8af45377303

Analysis

max time kernel
60s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260710-edpxcsd13s
SHA256 dba3c2707eb7a151daeb7af6762d1c2d5a335817c4654d0b9395b8af45377303
MD5 0e175027ebac47e8bb0a55f2ef27747b
SHA1 e4eeb483a82bf7a6f55bc6212c6f711a9792780f
SHA512 7405d4a92726b402ede53d9a789f6dd811f799459d96bedcfc4466dfdfa7598bb2dd49c69cf2dbecc9beb8e0a472c94e01c4a06ce84dc4131389dd4036921edb
SSDEEP 49152:CyvKE/61tXMfeOc1IShN9oG4znXdwxUuxGCTHHB72eh2NT:Cyvr/61GfeOc19hN9txx
TLSH
T112E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

cakhialink-wc2026a.tv
malware.cakhialink-wc2026a.tv

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/4704-0-0x0000000000890000-0x0000000000BBC000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 38 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	messenger_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	messenger_update.exe
Token: SeDebugPrivilege	4540	messenger_update.exe
Token: SeDebugPrivilege	2692	messenger_update.exe
Token: SeDebugPrivilege	1312	messenger_update.exe
Token: SeDebugPrivilege	1188	messenger_update.exe
Token: SeDebugPrivilege	1656	messenger_update.exe
Token: SeDebugPrivilege	4332	messenger_update.exe
Token: SeDebugPrivilege	3232	messenger_update.exe
Token: SeDebugPrivilege	2176	messenger_update.exe
Token: SeDebugPrivilege	348	messenger_update.exe
Token: SeDebugPrivilege	1080	messenger_update.exe
Token: SeDebugPrivilege	3060	messenger_update.exe
Token: SeDebugPrivilege	4724	messenger_update.exe
Token: SeDebugPrivilege	4420	messenger_update.exe
Token: SeDebugPrivilege	3380	messenger_update.exe
Token: SeDebugPrivilege	3888	messenger_update.exe
Token: SeDebugPrivilege	4308	messenger_update.exe
Token: SeDebugPrivilege	5100	messenger_update.exe
Token: SeDebugPrivilege	1572	messenger_update.exe
Token: SeDebugPrivilege	4808	messenger_update.exe
Token: SeDebugPrivilege	4224	messenger_update.exe
Token: SeDebugPrivilege	3256	messenger_update.exe
Token: SeDebugPrivilege	4784	messenger_update.exe
Token: SeDebugPrivilege	3524	messenger_update.exe
Token: SeDebugPrivilege	892	messenger_update.exe
Token: SeDebugPrivilege	3012	messenger_update.exe
Token: SeDebugPrivilege	3928	messenger_update.exe
Token: SeDebugPrivilege	1784	messenger_update.exe
Token: SeDebugPrivilege	4312	messenger_update.exe
Token: SeDebugPrivilege	2468	messenger_update.exe
Token: SeDebugPrivilege	460	messenger_update.exe
Token: SeDebugPrivilege	1264	messenger_update.exe
Token: SeDebugPrivilege	2964	messenger_update.exe
Token: SeDebugPrivilege	688	messenger_update.exe
Token: SeDebugPrivilege	1244	messenger_update.exe
Token: SeDebugPrivilege	2752	messenger_update.exe
Token: SeDebugPrivilege	1456	messenger_update.exe
Token: SeDebugPrivilege	3564	messenger_update.exe
Token: SeDebugPrivilege	4352	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4636	4704	messenger_update.exe	85
PID 4636 wrote to memory of 1628	4636	cmd.exe	87
PID 4636 wrote to memory of 4540	4636	cmd.exe	88
PID 4540 wrote to memory of 1376	4540	messenger_update.exe	91
PID 1376 wrote to memory of 2752	1376	cmd.exe	94
PID 1376 wrote to memory of 2692	1376	cmd.exe	95
PID 2692 wrote to memory of 1064	2692	messenger_update.exe	99
PID 1064 wrote to memory of 2388	1064	cmd.exe	101
PID 1064 wrote to memory of 1312	1064	cmd.exe	102
PID 1312 wrote to memory of 212	1312	messenger_update.exe	104
PID 212 wrote to memory of 748	212	cmd.exe	106
PID 212 wrote to memory of 1188	212	cmd.exe	107
PID 1188 wrote to memory of 3724	1188	messenger_update.exe	113
PID 3724 wrote to memory of 4424	3724	cmd.exe	115
PID 3724 wrote to memory of 1656	3724	cmd.exe	116
PID 1656 wrote to memory of 4508	1656	messenger_update.exe	117
PID 4508 wrote to memory of 2392	4508	cmd.exe	119
PID 4508 wrote to memory of 4332	4508	cmd.exe	120
PID 4332 wrote to memory of 4184	4332	messenger_update.exe	123
PID 4184 wrote to memory of 4524	4184	cmd.exe	125
PID 4184 wrote to memory of 3232	4184	cmd.exe	126
PID 3232 wrote to memory of 4964	3232	messenger_update.exe	127
PID 4964 wrote to memory of 2924	4964	cmd.exe	129
PID 4964 wrote to memory of 2176	4964	cmd.exe	130
PID 2176 wrote to memory of 5104	2176	messenger_update.exe	132
PID 5104 wrote to memory of 996	5104	cmd.exe	135
PID 5104 wrote to memory of 348	5104	cmd.exe	136
PID 348 wrote to memory of 5108	348	messenger_update.exe	139
PID 5108 wrote to memory of 560	5108	cmd.exe	141
PID 5108 wrote to memory of 1080	5108	cmd.exe	142
PID 1080 wrote to memory of 3696	1080	messenger_update.exe	144
PID 3696 wrote to memory of 4908	3696	cmd.exe	146
PID 3696 wrote to memory of 3060	3696	cmd.exe	147
PID 3060 wrote to memory of 4440	3060	messenger_update.exe	152
PID 4440 wrote to memory of 4088	4440	cmd.exe	154
PID 4440 wrote to memory of 4724	4440	cmd.exe	155
PID 4724 wrote to memory of 3148	4724	messenger_update.exe	156
PID 3148 wrote to memory of 2008	3148	cmd.exe	158
PID 3148 wrote to memory of 4420	3148	cmd.exe	159
PID 4420 wrote to memory of 4112	4420	messenger_update.exe	161
PID 4112 wrote to memory of 3616	4112	cmd.exe	163
PID 4112 wrote to memory of 3380	4112	cmd.exe	164
PID 3380 wrote to memory of 1732	3380	messenger_update.exe	166
PID 1732 wrote to memory of 4132	1732	cmd.exe	168
PID 1732 wrote to memory of 3888	1732	cmd.exe	169
PID 3888 wrote to memory of 64	3888	messenger_update.exe	171
PID 64 wrote to memory of 4424	64	cmd.exe	173
PID 64 wrote to memory of 4308	64	cmd.exe	174
PID 4308 wrote to memory of 4584	4308	messenger_update.exe	176
PID 4584 wrote to memory of 224	4584	cmd.exe	178
PID 4584 wrote to memory of 5100	4584	cmd.exe	179
PID 5100 wrote to memory of 4348	5100	messenger_update.exe	181
PID 4348 wrote to memory of 956	4348	cmd.exe	183
PID 4348 wrote to memory of 1572	4348	cmd.exe	184
PID 1572 wrote to memory of 4612	1572	messenger_update.exe	188
PID 4612 wrote to memory of 4272	4612	cmd.exe	190
PID 4612 wrote to memory of 4808	4612	cmd.exe	191
PID 4808 wrote to memory of 2552	4808	messenger_update.exe	193
PID 2552 wrote to memory of 1044	2552	cmd.exe	195
PID 2552 wrote to memory of 4224	2552	cmd.exe	196
PID 4224 wrote to memory of 536	4224	messenger_update.exe	198
PID 536 wrote to memory of 5012	536	cmd.exe	200
PID 536 wrote to memory of 3256	536	cmd.exe	201
PID 3256 wrote to memory of 2968	3256	messenger_update.exe	203

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OhiKag4onrmQ.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QKJtf4N82ozL.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2692
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ofMoogROBd4l.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6tYPuG6Suazf.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ErDvbLnb0oD1.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cw1InZq50frD.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BT7fuJfc5rWW.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gPMriiYhXFeD.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WNYxvLjCpLaW.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6WCExudKCLdF.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YnW5oW21aCau.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FnaiRYcfaC5d.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pIq8X0cuQt77.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ogs2LBsywXCX.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JxGcphmOxYj1.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DSJIBTNn6x4f.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4ZUaRtqiYoPy.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C1jCxDhGA7hW.bat" "
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NFLjIZfuRJyZ.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\d5IoyvwKqTqx.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5Sw8fM147elu.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pVKv5kOJ3j0K.bat" "
        44⤵
        
        PID:2968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TAhHyclF3LMo.bat" "
        46⤵
        
        PID:3576
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3TqAM4T35KVI.bat" "
        48⤵
        
        PID:2884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QJ4mCYwwreyv.bat" "
        50⤵
        
        PID:668
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZVhNXFFhRK6R.bat" "
        52⤵
        
        PID:2376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:1172
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3928
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SLXg1qiGwLic.bat" "
        54⤵
        
        PID:2336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EheKCjFT8A2i.bat" "
        56⤵
        
        PID:988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VV6xwYPY01kN.bat" "
        58⤵
        
        PID:440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xGJSTUluy6TN.bat" "
        60⤵
        
        PID:1852
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iIOHuMpNmHMa.bat" "
        62⤵
        
        PID:1640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\68kXIqbCto4b.bat" "
        64⤵
        
        PID:2872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FDSBXhVBarMu.bat" "
        66⤵
        
        PID:4620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\R6AH6VC7YQvz.bat" "
        68⤵
        
        PID:4524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4tnYLbg8mR9E.bat" "
        70⤵
        
        PID:748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Is31pjjq30RO.bat" "
        72⤵
        
        PID:3712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mG81sJFyb5wA.bat" "
        74⤵
        
        PID:2760
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        75⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3564
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VsglpPRGOtJt.bat" "
        76⤵
        
        PID:612
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\njf3xOd1cxe8.bat" "
        78⤵
        
        PID:2348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

3TqAM4T35KVI.bat

Path C:\Users\Admin\AppData\Local\Temp\3TqAM4T35KVI.bat
Size 185B
SHA256 7d815246ed5378b379a4e4fe9941590367335b2b43e26eed86244af4c5e1dd17
MD5 f96bbfee421b5489b41a4d6cb788422d
SHA1 71c7bc134b7d3ff3006ae69af3b70942d72af555
SHA512 597becf78da953fe2e919f6ef14583bda925c8ececd3d87651894610425bf83c9a23783b2241befe59889916e4742cffb2cf6d6bceb39325b034b286c7ed739f
TLSH
T151C0120245868F6E4A045C0A19AA66CCF1D508AD29497FB04641885C13D6C98B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

4ZUaRtqiYoPy.bat

Path C:\Users\Admin\AppData\Local\Temp\4ZUaRtqiYoPy.bat
Size 185B
SHA256 8e9fee030419b7b276cda4ea6a2b90f1204f2a59ffc4d77990e73b08966594ea
MD5 8b751499f83846b2540071ada53284ae
SHA1 54e5ff39143320141376adbd90fd36f36b65e359
SHA512 c2cefaa0410eccefb55d8d024065bc8081769c315c9ae638e544e22b333fcc63a236293b4f1a13cbe958d2fa7b59b5506e4e7163618efee99eeba4e7c74ec3dc
TLSH
T1BDC0121145C2CA6E59046C0A19EAB6CCF096099D29497FA14905885C13D6C5CB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

4tnYLbg8mR9E.bat

Path C:\Users\Admin\AppData\Local\Temp\4tnYLbg8mR9E.bat
Size 185B
SHA256 7fadba8f4e2b4f9f5b3fe8873d3309125a46996bab03024b7b9691b8a4bc1e14
MD5 e2f77adbf4d383c4689eecd9cf3f8347
SHA1 373c5e99ad0e54d5bac98f376f1f39b98aa41e14
SHA512 bc39ba6ea22e76257ffea73308fb4e7f30d45f605f6d042a72475dcabee61604b64c391a06f493a6ba465493f64b2d4525bd6494dcc5fd8ded1f053945858fa2
TLSH
T11CC012014281CA5E45045C0A19EDA68CF0D909996E497FA04902889D13D6C58B6CF782
MD5 SHA1 SHA512 TLSH

Submit Download

5Sw8fM147elu.bat

Path C:\Users\Admin\AppData\Local\Temp\5Sw8fM147elu.bat
Size 185B
SHA256 1a246821c63d9621f0908b19d0bbc5d2555856ae43c57f5268e3f7a96abde4b6
MD5 ef7b38a5ef233b191ace753d60c188f0
SHA1 2f704246767235f2022d1ef4c7322f7e58a611f7
SHA512 7ba0c3cc352dadbfb698927860e1cb984007f2a13108e56c27b49fe0a42358db5f565fa194a182b41c9e94238751cd1944ff561864c4381cb8003cd6f9c7c3b1
TLSH
T181C0120145818B5E55045C0A59A9668CF09509AA298D7FA04641885C17D6C9EB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

68kXIqbCto4b.bat

Path C:\Users\Admin\AppData\Local\Temp\68kXIqbCto4b.bat
Size 185B
SHA256 92448154eb0ce7b4a86e43f5c76d39b55300c01e3f8f5c25008357a8fd065fbd
MD5 7d00039132dd919e1f655c2cc994a1fc
SHA1 9dbd5d9054b4a80c983f21de14cce30d3f7bf7f8
SHA512 dc60713d81278abdadaa8e63784061971be2fa33c3d6d5e3d407837266a3c011c6101978b0e4aed3bb215dc19d83a17b2215741bc9a4d06f8fd765c148c7e740
TLSH
T163C0121291868A6E45145C0B5DA9768DF0A6089D39497FA04602885C53D2C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

6WCExudKCLdF.bat

Path C:\Users\Admin\AppData\Local\Temp\6WCExudKCLdF.bat
Size 185B
SHA256 191de84ab8eb32de748f556e671da1ec25aeec534902e74d5c6a271a21d40992
MD5 570a8af91ace20df75866fe6768a4f7d
SHA1 ac0b774c373c810dc553d7e9f1f87263e3124d99
SHA512 afbe991c4c9b8e90e49a85909b5d5c4cf45130382e5f1a81ae8ba2cf80d87816c1edc047b7ccaa51b3e2c151778ddc1ee7eb655368cab81b15cfc8eeb3c4a2c2
TLSH
T199C0120152858E6E56045C0A19A9668CF0D608992A497FA04501885C63D2C58BDDF786
MD5 SHA1 SHA512 TLSH

Submit Download

6tYPuG6Suazf.bat

Path C:\Users\Admin\AppData\Local\Temp\6tYPuG6Suazf.bat
Size 185B
SHA256 11d25d3b0cae5163c74d4d04bd770bfe7b9aac102d0dd9d752ad52712b8f2470
MD5 d9766d472ff0940824db7cbc8a21a829
SHA1 58f160a8abff6e9485686063aff3194e743b2e33
SHA512 3c9db5ad330dee12423450a4bc6300a5c9f2eaa4b8f3e014802ab86f8dfd13f6cf104ab6998de011a26917448c49f6c19c77e056cdc5c5e575527e9c40f13eb0
TLSH
T19FC0120151818A5E49045C0A59A9768CF09508A92A497FA48641C85D53D7C68B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

BT7fuJfc5rWW.bat

Path C:\Users\Admin\AppData\Local\Temp\BT7fuJfc5rWW.bat
Size 185B
SHA256 67a20ac3ca3b074d419d68a89dd079b87aa7b809d1bd4c3f2893d758816ac62f
MD5 e6566ccd57b9da37c136dd7461efd133
SHA1 ecb0109cf095656c1539c8e915c7f77ab31e25c9
SHA512 58b4d7f667002cf416dd480815588c079c46ab731a53fb1657851143324d2c3de63ed267b51e86619c8d9fd63e87be32e2cb98c2647f1ed0c45d70c8d7962f94
TLSH
T1D5C0120152818A5F85145C0A19A966CCF0D508A96A497FA04952C85C13D6C9CB5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

C1jCxDhGA7hW.bat

Path C:\Users\Admin\AppData\Local\Temp\C1jCxDhGA7hW.bat
Size 185B
SHA256 75840f5488e3bc3f7c5705895dcabd2371728b7baa49c9bace04575bcfd79559
MD5 5f18bbc6e5a7b5dc109d0f304d73beca
SHA1 bcb37d747fb8cc0d33b30af219b40fc2a37c8ce8
SHA512 97aa7b3546c1c69d586374fc91014cd63ca24501cd3044bcbe7d35c6d9370ec356bccab8fac9a7450f9f6058c88b69aab02a2a320024a12b13fe433f4ba9eb54
TLSH
T1FEC0220041818A6E06000C0E19A9628CF0D6089C2D08BFB00900884C13D3C58B4CB782
MD5 SHA1 SHA512 TLSH

Submit Download

DSJIBTNn6x4f.bat

Path C:\Users\Admin\AppData\Local\Temp\DSJIBTNn6x4f.bat
Size 185B
SHA256 c202d92ec5460d1272cd88104b15ad0c800b0b625afdbc351e50ab11f4cbc38d
MD5 bf33d021d357ee976246403f8b57e69e
SHA1 bbd1ae4623cdcad84b06d6baa2b562df6700fe7b
SHA512 93235518f9bbfc15ac94c1a0f3e231cdd778d7e675a6525aad2693a1dcdbcc13d2f7a769951395099ac31228498ed1d92e3fd9a2cbd7191ee7fda8098c31dba6
TLSH
T1FCC0120145828A6E4A045C0A59AAA6CCF09508A93E497FA04601885C53D3C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

EheKCjFT8A2i.bat

Path C:\Users\Admin\AppData\Local\Temp\EheKCjFT8A2i.bat
Size 185B
SHA256 1852ecc46f5f157f29f3f55b46e6541ef6e14c0ca239eb02547a069387a2354f
MD5 fa0541c850709be06f4900ace0e3d27e
SHA1 1984348c638589abea6a7143384c71830769076f
SHA512 7b60272aa007e89508cdb6d5b72095d565c1c9c1ab4bef7abd459dc20f5e71713b21d31b5a487a77afbaead679604793e1a7086b1009b1de410e9abde35082c7
TLSH
T15DC012018285CA6E55145C1A69A9668CF0D908ED29497FA04A51885C53D6C68B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ErDvbLnb0oD1.bat

Path C:\Users\Admin\AppData\Local\Temp\ErDvbLnb0oD1.bat
Size 185B
SHA256 cbff3cf8c28c9a18edb80657b74de5afd5b9628a4b2169b9804f4fa7815fc5d8
MD5 0bd641a916d7618cb4e6a998bedccb0f
SHA1 6cd00fc26372d4192af0d8fd239afc4da45866ee
SHA512 59e76c123d09def0feffd2c6988e24d163965dbab1e28e06440b8308b20abbe3327a12ea7915702394b3e4a34b499fae91311d98de5b136eccf588bc92c8ee3e
TLSH
T1D6C012015295CA6E55045C0A19A9668CF09608992A497FA145418C5C63D2C6CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

FDSBXhVBarMu.bat

Path C:\Users\Admin\AppData\Local\Temp\FDSBXhVBarMu.bat
Size 185B
SHA256 16f949af0dd107c8b1b0cbbdd03668c9fc599b17bf7db8a94085d71e275028ca
MD5 110b0af0e31f7b17a78ed13f9ca12d81
SHA1 d03e56781a4d124b7f6f858b8f655441f215ca63
SHA512 301c15942d7d45a263d0134aabc3c36233e8a2e0cb91e96b74b72d50d929ffd6d9375f2670c4fc4708952efbe61fe1b5b2121ac47fbe923d594dd5c5ab62eeef
TLSH
T10DC012019181CA5E4B145C1B19A9778CF0E50899294D7FA44601885C23D6CADB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

FnaiRYcfaC5d.bat

Path C:\Users\Admin\AppData\Local\Temp\FnaiRYcfaC5d.bat
Size 185B
SHA256 71999ff802a4f7e6d730587760a5ff5ef06f23e40e0fb16fa52ed63e749c56ce
MD5 7b59e48b50c319073be0a976fcd893f4
SHA1 bf64cae30b9fe8503826a2afd3cfef4f5a2c529d
SHA512 9d51786d8eb618d8819427b4a8af27a42cec5c10bfe0a593431a41e4fff3af9fa8a0038a03f1dd415e3a28ce37df31dd263cb7f30efecfab905e27999dac7f44
TLSH
T116C0120141818A5E46085C0A59E9768CF199089A2A49BFA046118C5D63D6C59F5CBB82
MD5 SHA1 SHA512 TLSH

Submit Download

Is31pjjq30RO.bat

Path C:\Users\Admin\AppData\Local\Temp\Is31pjjq30RO.bat
Size 185B
SHA256 c191643a4b1f29348b53c5eba7925980a51aae957bba4dbb319cc649131a138d
MD5 cd95abbd33c3825a5e98d4f5bf7dab7b
SHA1 dee0557b8454a6ba76021225746e535005e1ab92
SHA512 6ba8c9a8b0bb0f3776403c375e1b92962804140689a01b764444f70d0bd4511c0d52af49a653c6a90bd898b3c1e039a4503c5c94a5da1d74935e9baf65b6c2c1
TLSH
T124C0120151868A6E45045C0A59AA678CF1DA08AD69497FA04505885C27D6D68B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

JxGcphmOxYj1.bat

Path C:\Users\Admin\AppData\Local\Temp\JxGcphmOxYj1.bat
Size 185B
SHA256 6439080da92e9ebfd886c3bd7df33d389bf00ae570ec5b46d3ed0590e1c28955
MD5 9fb4a8a616498a048c9c2af942777694
SHA1 f61fb60f6c2657d89a65d2ddfc8dde1510d675bd
SHA512 0da90b3645d523d0ad5168e3e857bae9b36c35b4c57890935676810b1e0360b28e466d16c907ebca7d663b736d5b3c18c4843162a807604777bb97a84d2d122d
TLSH
T191C022018281CE1E4A000C0B09A9A2CCF0A5089A29097FA04D01884D53C2C59B6CB382
MD5 SHA1 SHA512 TLSH

Submit Download

NFLjIZfuRJyZ.bat

Path C:\Users\Admin\AppData\Local\Temp\NFLjIZfuRJyZ.bat
Size 185B
SHA256 027edb4383b39e75a84fe02d46b122f2ab946e9502b09fd0998ab5806e516275
MD5 935a0c2e4f16a02bc3d4f63973cadcf8
SHA1 ba099f76909be5c48a35b1fdac293589406c8514
SHA512 992adf931d3362ce27f28a2018b77c9d56ff1b6415e7a1d899aeb408faf1a0cb2664c0f00a7d3fd7e229051c98531d86eea1eb7b494b7e9c8991c70519f7d105
TLSH
T1DBC080014281CA5E56155C1B19F977CCF0D50A9D2D497FA08901CC5D53D3D6CB5DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

OhiKag4onrmQ.bat

Path C:\Users\Admin\AppData\Local\Temp\OhiKag4onrmQ.bat
Size 185B
SHA256 d43784d4b256490d402a7f48b62681339eb465a16f245a4adebcf005898bc069
MD5 943c4293f4300e40b41309b00d5269a8
SHA1 e02ec86a647d212d5dd2d59ec928d4cdc733f8c3
SHA512 ffcda4f674b4aaf81f609644007abf77d602d1da528f3420bfadff89c94414d08ac28bcbf1ad714ac77456f9f394b95e1485580b349f453849232a7b32d38fab
TLSH
T136C0120141828AAE55045C0B19AA66CCF0A909AD6949BFA04501C89E17D2C99B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

QJ4mCYwwreyv.bat

Path C:\Users\Admin\AppData\Local\Temp\QJ4mCYwwreyv.bat
Size 185B
SHA256 9427753a70c616e2338905948bed57290c6aed00360d310550430cbda5c2211c
MD5 4d9eca1a218513b4aad77e600a362eab
SHA1 2403509a17a9f33019b9d4c3243d4dc161d63184
SHA512 4b113c6a7a243252bb86a32c859f5471a923da6dec6a4f452c3bf60c2da9ddf7bd6a684667671bc19ac138b56faf6008cec77ffcfd9923a7d92fe6149eb78034
TLSH
T19AC0120146818A5E4A145C1B19AD67CCF09509992D497FA14A018C5C63D2C59B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

QKJtf4N82ozL.bat

Path C:\Users\Admin\AppData\Local\Temp\QKJtf4N82ozL.bat
Size 185B
SHA256 5327dbb06c3b63a1a39b25261b06b4bdec8b211cbcae2ff25498fd4e47177c27
MD5 47cb3f8490783c8aca0ab7de3705b2b2
SHA1 0a0883aff51af02c5821b052fba86fd586470311
SHA512 4d1d72e1dc4a75c7e90b98105a0f02625478bf64f00e4c4ef0b46955a999bac65ecc9185d06a1a2c1163708111d5abad055b1c709745524d8ea0ac9d974b5426
TLSH
T1E5C012015281CA5E5A145C0B19E9768CF095099D6A49BFE44611885C13D6C59B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

R6AH6VC7YQvz.bat

Path C:\Users\Admin\AppData\Local\Temp\R6AH6VC7YQvz.bat
Size 185B
SHA256 3edfaf88328a1080880245a5385ce55f2d440ca6a296b5c56b34b1f6797135c0
MD5 03c68bc6516d5e8d778ccc92c301036a
SHA1 94a0608935aa963d532a19cc8e66294a18c819e8
SHA512 81b86c4446c23b221ae9a535ba442b16681cf7c7d9510e627ea4ddc34c08ba0386bbad6c9187bf56d032c1d26bb6b24b4880cd64731e7f75ff043f8f32b4a684
TLSH
T1A9C012014185CA7F56045C1A19A9A68CF0D609992A497FA04612885D17D2D9CB9CBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

SLXg1qiGwLic.bat

Path C:\Users\Admin\AppData\Local\Temp\SLXg1qiGwLic.bat
Size 185B
SHA256 9f37fa2dd6d91d0988cbd86157bd55a78bb986f590660a389ece85f00c4225a1
MD5 74c428934ed01d683a9962c6e5424ff2
SHA1 d1ebaa8be4152bbf6857fa9845f7778e912c2ec0
SHA512 944957eec04300389c7a214a40de4bc3d950a99c84202fc0037184bd47376e409e154855bd8953c4b168587d7a3609f3d5d88aabb4897ba1beba67aa58fc9b3a
TLSH
T17CC012014185CA5F45045C0B59BDA68CF195099969497FF04551886D53D2D58B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

TAhHyclF3LMo.bat

Path C:\Users\Admin\AppData\Local\Temp\TAhHyclF3LMo.bat
Size 185B
SHA256 a4b621ff7cb7929504ba52282cdd9ae889ddc0f7d43aa581ed557bdd30a957b8
MD5 9e7ca7f386e1316aa62d7bd4bbedc421
SHA1 be78a5611d98d9d87bf3f3adcfd60b2877997a70
SHA512 4e142f644ff1a7bcc352aee78525cb13b011ac95502ba920f5812c9427364752934e7f98227ce0cfced59f7cc85f585f0bc99be7b08fecdfd18ce1ac2de3a75e
TLSH
T143C0120141C18A5E45045C0B19AD678CF0D90DAD29497FA04A41885C57D3C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

VV6xwYPY01kN.bat

Path C:\Users\Admin\AppData\Local\Temp\VV6xwYPY01kN.bat
Size 185B
SHA256 7d24840e1b67dee095d4c8e7a318872325870660845f21ac36fc5d39197a2c53
MD5 7a4017c27933519e8478eddeaa8f118e
SHA1 7fc44352aefbf9636cce27daba867b4157fd9368
SHA512 f0335a5023d78f48c4284bdafc783afc37d331b209bada850215e243a14f802e4fc603eb61a65e754160c40cabd762b73cc711c0551e6d16420295017a9bb8e6
TLSH
T11DC012024285CA5E55055C0A19AA678DF1EA08A96D497FA04541885D23D3C99B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

VsglpPRGOtJt.bat

Path C:\Users\Admin\AppData\Local\Temp\VsglpPRGOtJt.bat
Size 185B
SHA256 44151bd3f6a04fb1b5c2f3b4491d5e9ab0a9b39f5825fb0dc35d6e39a7b1c4f4
MD5 6b1222bc4c17e5efa4f3e3da5679225f
SHA1 c0c9dd904cc4b5e71034af9265f444fd6ec47775
SHA512 51d4428169b3106b3c078e7059e545d14fb0705928cf27abb49e5ddf55e55e312e698b090a6939212c707c999158ca48c3766e4caafc56c4f28a3a6f93573d9c
TLSH
T198C012014282CA5E56045C0B19E967CCF1E909A929497FA04602CC5C27D6C98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

WNYxvLjCpLaW.bat

Path C:\Users\Admin\AppData\Local\Temp\WNYxvLjCpLaW.bat
Size 185B
SHA256 bcaf4dd26bffab15670e58a3b4825bcaa822444bfff47132082acb52007713a3
MD5 a903a7280d23d68a525665c627dc8303
SHA1 12d69bd0ca27bd4722de3addbf5d71fb8158a16b
SHA512 770b7fb9ec8c996d711702053f88d333e5a110e1c99928d76dbbae1cea46f35a58e3c9b7f00b44e897234fd8c85b18dfd9e335f1f8aa13982c1bf858b92a7d7c
TLSH
T1AAC012019282CA5E49045C0A19A9668CF1A908A92D4D7FA54901885D17D2C6CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

YnW5oW21aCau.bat

Path C:\Users\Admin\AppData\Local\Temp\YnW5oW21aCau.bat
Size 185B
SHA256 5c0caab6c05fa38c49aeb02710935e054f8096721ed2cd112b77892e5efea111
MD5 6a171cdbc884a176d5b6554497ea64c0
SHA1 dbf7d639abe2ead21329c3d0904383165427511c
SHA512 c94bd4afcf6259d7666555120cf21ddedbe60c6bea678b481cf778dd780bc687cd227267bc43a76851a155b207d001b4e35576db28f75cc8cb7961a781ffe13c
TLSH
T17AC0120141818A6E45145C0A59A9A7CCF09508993A49BFA04A41889C3BD7C9CB5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

ZVhNXFFhRK6R.bat

Path C:\Users\Admin\AppData\Local\Temp\ZVhNXFFhRK6R.bat
Size 185B
SHA256 24c15d504919d94528f4673a75db305bac6fe96d6baf450998eb4125615bcd1b
MD5 7293044b1de2715ffb4e293593f3c7fc
SHA1 5e2b5129017244b6d6fcad6c17d40414e5fe1a16
SHA512 1833c8e5d72463f40001381ae07f9b14f83a3c2d2f499f4df1ff3c5260c731ab2ca36117fe724e2dea520ccb5a5e0439f3b22ba35e09ffc11fbdf415d09f460d
TLSH
T1BEC0120182858A5E55045C0A19EAA78CF196089929497FA04615C89C13D2D9CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

cw1InZq50frD.bat

Path C:\Users\Admin\AppData\Local\Temp\cw1InZq50frD.bat
Size 185B
SHA256 b222001cc393c93dfc519adf736beef7992df0dcf5fa361c2cf8817b6ad3d099
MD5 486ea1b24e3a9625f5ce72dd9106db03
SHA1 14677144cf6d8b650a2139a025ee4f482261d0f1
SHA512 fc1bab5c2df022028fd4e4f2a385555ce35b496527e531915055e1d05decf38706aad1ff299e7c467cc33371148d22dff182e80a2d6fe4811b0d4639759857ad
TLSH
T103C0120141968A5E45045C0A19A9668CF096089D29497FA54901886C13D2C59B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

d5IoyvwKqTqx.bat

Path C:\Users\Admin\AppData\Local\Temp\d5IoyvwKqTqx.bat
Size 185B
SHA256 c8c3ae2e794f47769debe8bcbfb4a8ac05c737f069252453721cc23bac979230
MD5 70ff293927e2e1313e504d251548aa73
SHA1 1422916708249d6732a663e9773f062715481de2
SHA512 c9c710af11007520bacdf2fcd2ec4c18c63dac1c93b47aebd7110f5213ef665d15e7696357a2ec79ff1e1fe5cc2b2141ed0de5a83ccb191b2ccaf8747a65106a
TLSH
T1ACC0120185C28A6E46045C0B29E9B7CCF0D509A96D49BFB44501889C17D2C98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

gPMriiYhXFeD.bat

Path C:\Users\Admin\AppData\Local\Temp\gPMriiYhXFeD.bat
Size 185B
SHA256 7f05d8dfb14cb6b63cf9bfa75cbd162d6f92e10b982cde268c36bb3bb6bde7d7
MD5 516f1fe906952eb152d6c8b019712709
SHA1 663595a103de2ecacc735acdf9ff1db2e05f94ae
SHA512 fb0cf4c4d6eea8eb16c2730925feba7d5f9eee00d19f5ddfd1b4acfaeea47a5ff227fd12a5812fbe348f0131135669a2c6bab5943f901d950524b6e483457725
TLSH
T16CC0120185828A6E45045C0B19A9668CF1A909A969497FA44901885C13D3C98F5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

iIOHuMpNmHMa.bat

Path C:\Users\Admin\AppData\Local\Temp\iIOHuMpNmHMa.bat
Size 185B
SHA256 9124987b29ce56801dd82d2d4cd16072eb8ba1ae7ef17d564b1adc4483bbebb7
MD5 8f6ea764d49677c470172317cabf8600
SHA1 ee824d20113ba3c5240849411a50a5bef663df75
SHA512 3a435317f4064b29dbee1427872ecc3f2f95be3853fca267f3cfa390c7907f24440c200901a17fb2c0949961a84d205cb479f1b469f814dcd70720fdf4f836c3
TLSH
T167C0120181958A5E45045C0A19A9A6CCF0A509D929497FA049018C9C53D6C69B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

mG81sJFyb5wA.bat

Path C:\Users\Admin\AppData\Local\Temp\mG81sJFyb5wA.bat
Size 185B
SHA256 13089e6bd0b5de84a49d2ccfb183d6fc4d153172eb9c53e87cac32a90b879f3a
MD5 d9e13924d31a509ddde65e1a5a5fd2fc
SHA1 5e1232a605419f2fe56b597087b3f966a7242589
SHA512 0544a2f263af2a2d63331358b6289ad79ec03a47325522c569d53ef3034eaf61cdd49ff4afbc28a7358c6c55d0e21afdb3850a642d4533b9815b8e3669eaccc4
TLSH
T170C0120182928A5E49145C1A19EAA7CCF0A508996A497FA44551885D13D2C58B5DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

ofMoogROBd4l.bat

Path C:\Users\Admin\AppData\Local\Temp\ofMoogROBd4l.bat
Size 185B
SHA256 e48507e5f775bde13127a31ad1a80e923d8f0461be513baec1c3a0cb430bad25
MD5 527aa15f5f686162e2c679a47e09313d
SHA1 8ecbc8e2df98e99c0c61dc6446ce6fe437dff745
SHA512 483e244b86f9372f8f9960fcdca7347c8bca230aed2e7a7613b2b463f0ce77baf20f0e41b1a62bdf4bafa3cd2bc1cb1eb27fafec4553f87a754a07ea2e0ffbad
TLSH
T194C0121141858A5E46045C1B19AA678CF09508992D49BFA04501C85C23D3CA8B5DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

ogs2LBsywXCX.bat

Path C:\Users\Admin\AppData\Local\Temp\ogs2LBsywXCX.bat
Size 185B
SHA256 95fa26a191c77b89a0b134338bd482b1126231f2b26c6d023f84957eb69eb927
MD5 f0a15b10ba469402037d3c899b6775fa
SHA1 7c2586e7eba67fe7a5bef7c213ae8e8f20cd86f8
SHA512 34fb024f06e5e401286774a51723554dec066d01598c92aad812c475e5d297ba38cba56a75bf9b22c72acac00be181d5f942841cf55a3a454f33105b494a819e
TLSH
T115C0120145928A6E45045C0B59EA668CF1D508996A49BFA04911C85D23D2C58B5CB793
MD5 SHA1 SHA512 TLSH

Submit Download

pIq8X0cuQt77.bat

Path C:\Users\Admin\AppData\Local\Temp\pIq8X0cuQt77.bat
Size 185B
SHA256 99ea22df323e0b8b0fa8f7cce726e16ae35e18d1691ee17ae773f2b309fbdda0
MD5 fe9d1aa2e81d026779003f0dea70400e
SHA1 9efa0389efac0c7c303c40c0fd9a5ed25378c0a7
SHA512 e6a870bbb5a39c4bc1b9eaf10929641fb7a773fd69a39dd171b58dc3013ef8c0967b17065d5aaf11c30c39a6b38274920fc74c0609e085a90e61f27e5d69da15
TLSH
T123C012018581CA5E4A045C1B59E966CCF1D608A92D497FA185018C5C23D2C98B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

pVKv5kOJ3j0K.bat

Path C:\Users\Admin\AppData\Local\Temp\pVKv5kOJ3j0K.bat
Size 185B
SHA256 ae02e091c8343a4ea7e29b881e7bb68ceb14265d36150678a6e28f0be9b72c20
MD5 8a5f79f7769385a650fdaabc6e9abbf1
SHA1 a1c691dce327479a67ff3cf35179e26e4aab9783
SHA512 09c850805c61aaefcd13f0681f0f306fb0785359f6101fd54772abcd4d305780fa3c1a602d9023a1b3013072c6ace3fafe039ab5a0ae7de7e7f017ad4e33ebf4
TLSH
T183C0120146A18A6E59055C0A19EA778CF09908A96A497FA055018C5C63D6D58B9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

xGJSTUluy6TN.bat

Path C:\Users\Admin\AppData\Local\Temp\xGJSTUluy6TN.bat
Size 185B
SHA256 f4d569581174054da4257a7485c01a66500073a8d2660b976f8b752a796d4a41
MD5 e08f28d9cc2f1184baeaaa3586f54dd1
SHA1 39bfb91ac70d6d365b7900d8fbd6d103131eea1f
SHA512 c97a0f9d205ef1372a9b32ac1a9aa6b09b768b4dc4c5ce77a7f9c158d257a6c3fc042ef46fa3da11580af44a20e0efa162a27ae423b6d3560cb59ddfcc525e7a
TLSH
T187C0120142828E5E45045C0B19E9678CF0A5089969497FE04A518C5C27D3C58B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4540-8-0x0000000002330000-0x0000000002340000-memory.dmp

Download

memory/4704-1-0x000000001B890000-0x000000001B8A0000-memory.dmp

Download

memory/4704-0-0x0000000000890000-0x0000000000BBC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads