quasar | ee41742c3d3e4591fc4e6940d09f1b4ddc5f4d49d0b0cbf30d3e60ac390c12db

Analysis

max time kernel
59s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260715-eavy7sdy7w
SHA256 ee41742c3d3e4591fc4e6940d09f1b4ddc5f4d49d0b0cbf30d3e60ac390c12db
MD5 77d4d63f5b4d3caebc4ea09db1ead8c3
SHA1 278be5a46fe6cf43383d631f2bf2d29d0045fe86
SHA512 1e7e94525a2bda6bfd417253ee35796d5bfbdc026a183a46827cf25a0e87149d28c570f42a54532489a599a9ca29d8ddd36962139b6b077a0d39300a639004f2
SSDEEP 49152:9yhJJHPNCC7J98vBgJh99oG4znXb+xUuxGSTHHB72eh2NT:9yhrHPh7J98vGJh99tFx
TLSH
T1B7E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

socoliveko.cc
malware.socoliveko.cc

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2684-0-0x00000000007A0000-0x0000000000ACC000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 38 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	messenger_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	messenger_update.exe
Token: SeDebugPrivilege	2416	messenger_update.exe
Token: SeDebugPrivilege	4324	messenger_update.exe
Token: SeDebugPrivilege	1712	messenger_update.exe
Token: SeDebugPrivilege	2884	messenger_update.exe
Token: SeDebugPrivilege	3544	messenger_update.exe
Token: SeDebugPrivilege	4152	messenger_update.exe
Token: SeDebugPrivilege	2572	messenger_update.exe
Token: SeDebugPrivilege	4320	messenger_update.exe
Token: SeDebugPrivilege	4068	messenger_update.exe
Token: SeDebugPrivilege	3860	messenger_update.exe
Token: SeDebugPrivilege	944	messenger_update.exe
Token: SeDebugPrivilege	4264	messenger_update.exe
Token: SeDebugPrivilege	4192	messenger_update.exe
Token: SeDebugPrivilege	1972	messenger_update.exe
Token: SeDebugPrivilege	2136	messenger_update.exe
Token: SeDebugPrivilege	4428	messenger_update.exe
Token: SeDebugPrivilege	3572	messenger_update.exe
Token: SeDebugPrivilege	1676	messenger_update.exe
Token: SeDebugPrivilege	5084	messenger_update.exe
Token: SeDebugPrivilege	4700	messenger_update.exe
Token: SeDebugPrivilege	2272	messenger_update.exe
Token: SeDebugPrivilege	872	messenger_update.exe
Token: SeDebugPrivilege	4472	messenger_update.exe
Token: SeDebugPrivilege	732	messenger_update.exe
Token: SeDebugPrivilege	1640	messenger_update.exe
Token: SeDebugPrivilege	3476	messenger_update.exe
Token: SeDebugPrivilege	4840	messenger_update.exe
Token: SeDebugPrivilege	936	messenger_update.exe
Token: SeDebugPrivilege	2012	messenger_update.exe
Token: SeDebugPrivilege	4520	messenger_update.exe
Token: SeDebugPrivilege	3984	messenger_update.exe
Token: SeDebugPrivilege	5008	messenger_update.exe
Token: SeDebugPrivilege	1660	messenger_update.exe
Token: SeDebugPrivilege	2052	messenger_update.exe
Token: SeDebugPrivilege	3952	messenger_update.exe
Token: SeDebugPrivilege	4528	messenger_update.exe
Token: SeDebugPrivilege	4896	messenger_update.exe
Token: SeDebugPrivilege	2420	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 4656	2684	messenger_update.exe	87
PID 4656 wrote to memory of 3404	4656	cmd.exe	89
PID 4656 wrote to memory of 2416	4656	cmd.exe	90
PID 2416 wrote to memory of 4496	2416	messenger_update.exe	91
PID 4496 wrote to memory of 2952	4496	cmd.exe	93
PID 4496 wrote to memory of 4324	4496	cmd.exe	94
PID 4324 wrote to memory of 1592	4324	messenger_update.exe	95
PID 1592 wrote to memory of 1848	1592	cmd.exe	97
PID 1592 wrote to memory of 1712	1592	cmd.exe	98
PID 1712 wrote to memory of 3820	1712	messenger_update.exe	99
PID 3820 wrote to memory of 1964	3820	cmd.exe	101
PID 3820 wrote to memory of 2884	3820	cmd.exe	102
PID 2884 wrote to memory of 1520	2884	messenger_update.exe	103
PID 1520 wrote to memory of 3716	1520	cmd.exe	105
PID 1520 wrote to memory of 3544	1520	cmd.exe	106
PID 3544 wrote to memory of 3812	3544	messenger_update.exe	107
PID 3812 wrote to memory of 1668	3812	cmd.exe	109
PID 3812 wrote to memory of 4152	3812	cmd.exe	110
PID 4152 wrote to memory of 2356	4152	messenger_update.exe	111
PID 2356 wrote to memory of 756	2356	cmd.exe	113
PID 2356 wrote to memory of 2572	2356	cmd.exe	114
PID 2572 wrote to memory of 3616	2572	messenger_update.exe	115
PID 3616 wrote to memory of 724	3616	cmd.exe	117
PID 3616 wrote to memory of 4320	3616	cmd.exe	118
PID 4320 wrote to memory of 4104	4320	messenger_update.exe	119
PID 4104 wrote to memory of 1864	4104	cmd.exe	121
PID 4104 wrote to memory of 4068	4104	cmd.exe	122
PID 4068 wrote to memory of 3752	4068	messenger_update.exe	123
PID 3752 wrote to memory of 4260	3752	cmd.exe	125
PID 3752 wrote to memory of 3860	3752	cmd.exe	126
PID 3860 wrote to memory of 3028	3860	messenger_update.exe	127
PID 3028 wrote to memory of 1692	3028	cmd.exe	129
PID 3028 wrote to memory of 944	3028	cmd.exe	130
PID 944 wrote to memory of 5004	944	messenger_update.exe	131
PID 5004 wrote to memory of 3992	5004	cmd.exe	133
PID 5004 wrote to memory of 4264	5004	cmd.exe	134
PID 4264 wrote to memory of 2756	4264	messenger_update.exe	135
PID 2756 wrote to memory of 636	2756	cmd.exe	137
PID 2756 wrote to memory of 4192	2756	cmd.exe	138
PID 4192 wrote to memory of 2552	4192	messenger_update.exe	139
PID 2552 wrote to memory of 2676	2552	cmd.exe	141
PID 2552 wrote to memory of 1972	2552	cmd.exe	142
PID 1972 wrote to memory of 3696	1972	messenger_update.exe	143
PID 3696 wrote to memory of 3788	3696	cmd.exe	145
PID 3696 wrote to memory of 2136	3696	cmd.exe	146
PID 2136 wrote to memory of 2440	2136	messenger_update.exe	147
PID 2440 wrote to memory of 4032	2440	cmd.exe	149
PID 2440 wrote to memory of 4428	2440	cmd.exe	150
PID 4428 wrote to memory of 212	4428	messenger_update.exe	151
PID 212 wrote to memory of 4044	212	cmd.exe	153
PID 212 wrote to memory of 3572	212	cmd.exe	154
PID 3572 wrote to memory of 4900	3572	messenger_update.exe	155
PID 4900 wrote to memory of 2904	4900	cmd.exe	157
PID 4900 wrote to memory of 1676	4900	cmd.exe	158
PID 1676 wrote to memory of 3816	1676	messenger_update.exe	161
PID 3816 wrote to memory of 4832	3816	cmd.exe	163
PID 3816 wrote to memory of 5084	3816	cmd.exe	164
PID 5084 wrote to memory of 1788	5084	messenger_update.exe	165
PID 1788 wrote to memory of 1472	1788	cmd.exe	167
PID 1788 wrote to memory of 4700	1788	cmd.exe	168
PID 4700 wrote to memory of 3604	4700	messenger_update.exe	169
PID 3604 wrote to memory of 4260	3604	cmd.exe	171
PID 3604 wrote to memory of 2272	3604	cmd.exe	172
PID 2272 wrote to memory of 1056	2272	messenger_update.exe	173

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fXYUpz0KxLgi.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PLTm7tVkeuLP.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4496
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4324
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TUB1PxSGdYpH.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lKpBYHeHYTsC.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8qwwcyceQXL8.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bWYZfyGKKPID.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6JUXwUsvenBv.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6iFmxmCJkE8V.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:724
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QPDhELrMjjnk.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B96NInhi3fkY.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kIwJdOwByHuf.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:1692
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qu2Pm7zHUxMy.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vTCOVxDFPT6w.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EhJlicKOHrud.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\U02qFh4Wv90U.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2136
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y1egbJrDxui0.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qTX4ACDCSL0y.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hOaxZ4ghEDjE.bat" "
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fZL0NZ1CAyb6.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:3816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Lpc40q2JxhSB.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0AbzaNOyzU7S.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nS8AjMxKgvyz.bat" "
        44⤵
        
        PID:1056
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Y8kxiiPhtOzp.bat" "
        46⤵
        
        PID:4532
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QKHcG1SolgxV.bat" "
        48⤵
        
        PID:3660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g7nHLmoNTUQZ.bat" "
        50⤵
        
        PID:4648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SKuwbJOCOkFA.bat" "
        52⤵
        
        PID:2208
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xsyxNVFocjxh.bat" "
        54⤵
        
        PID:1160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\11WacbnQwfSN.bat" "
        56⤵
        
        PID:3488
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PTlJgHAyMzcJ.bat" "
        58⤵
        
        PID:2476
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JBX9I5L7dSL1.bat" "
        60⤵
        
        PID:4856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HiWVL113y2Xy.bat" "
        62⤵
        
        PID:4616
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5gHG0qCKNPPl.bat" "
        64⤵
        
        PID:4848
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uF6UZoWHO2mT.bat" "
        66⤵
        
        PID:4248
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\COXr7TVFqN8X.bat" "
        68⤵
        
        PID:1260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dsommj3MdkwV.bat" "
        70⤵
        
        PID:4204
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VE0UZeBWVLyi.bat" "
        72⤵
        
        PID:3548
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VDL80sRzOxJy.bat" "
        74⤵
        
        PID:1952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        75⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\47gTqzNWCHkd.bat" "
        76⤵
        
        PID:4280
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        77⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

0AbzaNOyzU7S.bat

Path C:\Users\Admin\AppData\Local\Temp\0AbzaNOyzU7S.bat
Size 185B
SHA256 2f8b7cfc8067dd71f0509822077d43609c0204fcf97bc5812523c939fdd38e9d
MD5 667b95c8185def00973f4d7555b76de8
SHA1 341d3e62bfc72a43a42c1c210df8433a9c2962bb
SHA512 601c821bdb86b1082cd9ea1d795c8f4485eafe7b92f2542beff2592a44e3f3442aeb4d201b7c6b2d34fcb2c846549160e2b67f55a714f7bc401875993ac09990
TLSH
T198C0120181828A6E49055C1A5DAA66CCF1D5089D294ABFA04551C89D93D2C5DB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

11WacbnQwfSN.bat

Path C:\Users\Admin\AppData\Local\Temp\11WacbnQwfSN.bat
Size 185B
SHA256 e9e51859831016486c42e7ddd83019d156d9114ca130712a09df128cc41b106a
MD5 debc0734e8b6caae7af1ddf8e99262fc
SHA1 a56879ecb43351257f297d0514cddb3dcbab05dc
SHA512 f40b7f82d43d47338a250b9eb51dbf4fed9ca4a6c27e3e7ca3b62b6b6d8d1b1440a259d07550aee90a6c287430af363dec04a2b44cea830b2dcb0f07b7dd90ad
TLSH
T1C2C0120152818B5E45045C0A19A9668CF095089969497FA54A018C5C13E6C6CF5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

47gTqzNWCHkd.bat

Path C:\Users\Admin\AppData\Local\Temp\47gTqzNWCHkd.bat
Size 185B
SHA256 b0de87bc91a22ee7ee9150de6299b0433e8a3df60619767e20dee21ab9de98fa
MD5 1f94fbb6c46a3b28ada482608545c951
SHA1 60053339f489777eccb5b6c153ff44a6682d3fd1
SHA512 02fabf4a82a856acc453d289cb9401f7400323f7d8424072aed0a10b7330a7fad416ae5871716257ebf8b5733d4c9089c28ab67a5a67da1c235ee9498e5d54da
TLSH
T1C9C0120142818A5E45145C0B59EA66CCF096089E6D497FA045118C5C63D3C5DB5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

5gHG0qCKNPPl.bat

Path C:\Users\Admin\AppData\Local\Temp\5gHG0qCKNPPl.bat
Size 185B
SHA256 ea4c6bf6b97965271a8e6e358bc1de06f433837d11d18c92c46538499f113033
MD5 06efeb84fc1bcbbab13ef2c0c225f753
SHA1 278474b7cee520fc85edbcd62731ce4dcbb61a61
SHA512 616cc38d9d1f560df9772cfbc3051c4587b3b1df4a42e02c94ba6bcb272779b7a67114236c674e2b03fffb964c57e15fcb3041c3b2468ac9ddb077b8750cac3f
TLSH
T129C0120195C28B5E95045C0B19EA768CF1D6089969497FA145018C9D13D2C58B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

6JUXwUsvenBv.bat

Path C:\Users\Admin\AppData\Local\Temp\6JUXwUsvenBv.bat
Size 185B
SHA256 ec89dbad8aff6786b29e03bba5c3b5c744b4408447cbeb082a7667ad91278830
MD5 bc5533945d229dc2d8046381aadd26f8
SHA1 cead6622828538b01accff03ae48a6b11a91e26f
SHA512 50bcf63bb4f271229100d47f7a24af9e8756f0bfb7283e17aaf7261b76f5347fc7932342b5b69711d94d54743d18c1684fdaf2f8256eb64ba2cc75596b6c47f7
TLSH
T1F3C012019581CA5E59045C0A19AA668CF095089D2949FFA44901CC9C27D2C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

6iFmxmCJkE8V.bat

Path C:\Users\Admin\AppData\Local\Temp\6iFmxmCJkE8V.bat
Size 185B
SHA256 bbb22f03cea68689cf4657f9783ef8c65808c6a7f293027b053b0dc7d0928432
MD5 d9e0dc023ad0ab20c78a67b0d8b93ef5
SHA1 fd821ac8a0668d2ba88671a4e21a8401f2e19ac9
SHA512 bc9280c8af673802d82deec32a51d2fd2c4b877de945779fc3a4ce7d823635fb455d195b0c28f93b7240a7cfd360436e89cc4bcbc78971ec02cbb8f0e7655461
TLSH
T12FC012015185CA6E49045C1B19A9668CF0D5089D29497FA14601885E57D2CA8B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

8qwwcyceQXL8.bat

Path C:\Users\Admin\AppData\Local\Temp\8qwwcyceQXL8.bat
Size 185B
SHA256 58fd8b9f13d5fe1c4ee754d2def9502cccb0dc1c7bfbe68d9656ea9cfc438dba
MD5 085b1ec5b3fe34a5ff0a01c94d6c1014
SHA1 7ea2a544c2c03ca856801e635b4129e8e0a39d68
SHA512 624c5ca6f9774cd997ce38a47279ee682aa5130e2dfe95e46943ee65c0a8a4f0c90ea8d11a7312e1b378cfd76d45e34bb8369f0b88c5cbda78bd96c926831dd1
TLSH
T154C0220042818A1E09001C0A18E9628CF0A5089C6D097FA04600884D13C2C6CB5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

B96NInhi3fkY.bat

Path C:\Users\Admin\AppData\Local\Temp\B96NInhi3fkY.bat
Size 185B
SHA256 b440ff81790867e766c22f584fbf96529917f17c8bec277b52dbb3c9ee7c9e24
MD5 0fb690bb9cc627fe878d48f8b5da7f55
SHA1 f68974c0cf732b5ffbdbb77ac254240565f09d06
SHA512 bceda1f9c27e277749fa537ab6f62cf730664229175fe638e1ec24a4c31a9bf195056741b387366237686c20cc221d12402979caa8b638cfc40a6e5e0cab013f
TLSH
T1D6C0120181828E5E49045C0A19AA778CF09508D969497FA04541886D13E7CA9B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

COXr7TVFqN8X.bat

Path C:\Users\Admin\AppData\Local\Temp\COXr7TVFqN8X.bat
Size 185B
SHA256 188082e0cef6f228244187ba533d5882d40b6556c17b3c7689d12117e61316a5
MD5 d4f26d41563de44d00c574aa514b7184
SHA1 fc02c7201f09983977d014c191ee1c5a1afb62f5
SHA512 c011e050e85d0e76a303a47d188b2311840953bbb418bf02422ee438c0fc7669dea7aef3c4e07ed4b765f1b8543dcd393565a54727da5ab0978c2eb50c996625
TLSH
T152C012014191CA5E4614AC0A19E9A68CF0D6089D29497FA04501C89C53D2C59B9CB783
MD5 SHA1 SHA512 TLSH

Submit Download

EhJlicKOHrud.bat

Path C:\Users\Admin\AppData\Local\Temp\EhJlicKOHrud.bat
Size 185B
SHA256 27fde34b33dec6517af4735be67914bbf222aa3985b20bc9e6de4d74b14077ea
MD5 d52638181c84857c7e9e84c7f6b29890
SHA1 29aa9fe4371dbaf37efab2e025b3e04180bbe9b0
SHA512 4041b96106d7d517824e93c898fa0ae56abb1c0993a92fb58081a305791c40764d6f46392e676f84b3d1667152a0f0dad25efdee0ef30e792156f91486d1cdd9
TLSH
T1C8C0120181828A6E45045C1A19A9768CF19A09A92A497FA045418C9D63D2C58B6CB782
MD5 SHA1 SHA512 TLSH

Submit Download

HiWVL113y2Xy.bat

Path C:\Users\Admin\AppData\Local\Temp\HiWVL113y2Xy.bat
Size 185B
SHA256 e3724ae95b7df459fbb5c086f80f51120ad1478902db48d93de60069fd24cd04
MD5 79ab109c9796a989bc78cec4552557bb
SHA1 a0e2e061ca7be88026c399dad6bd2959439f0f27
SHA512 b7118ca5096f5830ff7e4ba75e69eb2c8e881422ed271da27700504c9b0f1ecd0136ff059ef94f90efe7a7c0aa4d3d3e25527b9d91abbe8c360e9e3ccb7d92ab
TLSH
T1D5C012015182CA5E45046C1A19A9668CF09508A929497FA44501CC9D67D6C68B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

JBX9I5L7dSL1.bat

Path C:\Users\Admin\AppData\Local\Temp\JBX9I5L7dSL1.bat
Size 185B
SHA256 4105d18d621249b036396662bf9c3d75ffeff6f6b338a6047317277333c9ee22
MD5 367c5bd162a81292ab76bf7d3db762b2
SHA1 d3678520a19002ec642370d48130068bdd2c00c2
SHA512 9cc49bae453ce54dc3a9abdff2d85b02452541844665437ed45af9338fe8b8fc54243a2ac228e2f29b028168e71d284939a362ed01dad6d729199604cc5361e6
TLSH
T106C012015186CA5E55145C0A19E966CCF0D909AD29497FA045018C5C63D3C59B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

Lpc40q2JxhSB.bat

Path C:\Users\Admin\AppData\Local\Temp\Lpc40q2JxhSB.bat
Size 185B
SHA256 92426391e5644b4e210b53b41ffc36f3009984461c1a2adef56be97ea59f4930
MD5 8bda800716192efc08d6bee0656c4924
SHA1 f098628eb67e59c4685961695d6d44703881a013
SHA512 1c326eb9fc91ef942563f53bdaa12ef8955f35a305176dfab0e9f2107d7b1456102e3d6d99ac8a2b2c0b9cc0fcea0bd5c390ef8cadf36b9114df14b251a6cdc5
TLSH
T114C0120141818A6E49145C0B19E966CCF0D908992D49BFA14A01885C23D6CACB6CB7C3
MD5 SHA1 SHA512 TLSH

Submit Download

PLTm7tVkeuLP.bat

Path C:\Users\Admin\AppData\Local\Temp\PLTm7tVkeuLP.bat
Size 185B
SHA256 e4afdfa6079eaff8ef0d8c8433eac0ed6c73f64c4683721e08e856b4f6c0d1be
MD5 fd0b3fcf9d0c0a27e0ce03c8991e50ed
SHA1 d46a37621dc22059dda3e2023680e8030c1674ef
SHA512 7085dce33f65fc029f058a07e9e42c8ba4c2970c282e03569c6ed6dffd9bfdca9aa2f0e411f6356431e9b2a5e1272686fd1ecf6fee5c22866e87b5b5f6e726e2
TLSH
T17CC0120181C18A5E49045C0AA9A9678CF0A508992949BFA44901885D63D6C58B5DB796
MD5 SHA1 SHA512 TLSH

Submit Download

PTlJgHAyMzcJ.bat

Path C:\Users\Admin\AppData\Local\Temp\PTlJgHAyMzcJ.bat
Size 185B
SHA256 4e6442e6db0ec4b0e58da58e3bd80af7029fadc36897f9f2ab32b5fb021e8fed
MD5 433326f9a21c4e08b31736681f81730c
SHA1 0ccc5a4038468b6749f673c3570a719f0ea13f9a
SHA512 ca883ca43389d1fd42c6d4c88686fa2515b440c34176e2e7f4f9140e49ca3490c8c02e43e0405b247dad992d13a6eacbe669e7d611bc141ca26c61417450e004
TLSH
T147C0120156828A5E49045C0A29A9668CF0D508993949BFA185018C5C13D2C58B5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

QKHcG1SolgxV.bat

Path C:\Users\Admin\AppData\Local\Temp\QKHcG1SolgxV.bat
Size 185B
SHA256 adaac6b8809b510d4d7c7d280c5d274fdc8aa8e54d8629f0b33fa282059a8160
MD5 5c1194b051136864700f05b6d5e7aa79
SHA1 4ba039024694086fd8a2f43064d6b18dc1272b53
SHA512 ae5b8c8fa426184533f3eeeab403b4d60af18046a479b3322ca63b2b4a30030e2a53f7a9a2d4d682c859df764b6303db230cf14c215badd5842838b1b84dfa27
TLSH
T15EC0220041818A2E4A084C0E49AE638CF095099829087FA00640C85D17C2C6CB4CB3C2
MD5 SHA1 SHA512 TLSH

Submit Download

QPDhELrMjjnk.bat

Path C:\Users\Admin\AppData\Local\Temp\QPDhELrMjjnk.bat
Size 185B
SHA256 f1eb2765ae4dfdd4445ce804b05c53a91e045ed73b9c87ac5282885d2120a16a
MD5 73a02161e014c718277feb4218b13fb5
SHA1 d6d792275bc4e906ae7b4a89c25de5c9efa1d43d
SHA512 581b9a60e6ad2d0f8a899919e28b7bf422691983cc2f88554e6219bff36a5d7ff5140938b5bec23e8a99cd9f705e8b9cbf95dc712180966e03f7595140687557
TLSH
T14AC0124152C1CA5E4A045C0A19A97A8CF0A5089D29497FA045018C5C13D7C58B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

SKuwbJOCOkFA.bat

Path C:\Users\Admin\AppData\Local\Temp\SKuwbJOCOkFA.bat
Size 185B
SHA256 8eb377d0245a8aed667ccf3caa01d0b7060aca052762a283fba0c259a50caca4
MD5 ab7034eba7065dc67d01ecd70122c9d3
SHA1 734e703b25f6f38f11939db65879b1085a510b93
SHA512 5512bf18584e7af11443e00965bef5ad3a017ddf275f4566c20078a8d11b9f13a9966cfc2ba827e2788a1f75acf0cdefd849f395d28123f08b64151c1ad257ee
TLSH
T159C022004591CA1E06005C0A09E9638CF0A5089C29087FA00521884C27D2C58B8CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

TUB1PxSGdYpH.bat

Path C:\Users\Admin\AppData\Local\Temp\TUB1PxSGdYpH.bat
Size 185B
SHA256 ad0c7bdc2cb62f94c612b13eca4abf40ba564198d7316af40aca17c727fa78ad
MD5 0a80f691800e8c2ef486e6525389c528
SHA1 99634892ee0bcb447f94ec50d21414010a909984
SHA512 37c542de1a8d34e846c7ff4bf725d338013cdafdbe5d025a705c9ba6821c3ba85341bc010142d48016e8c5415c96f5fd773e404522a4aa9a092ef55478f0af33
TLSH
T15AC0120146928A6E45045C0A19EA668CF1DA089D2E497FA44901885C23D2C58B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

U02qFh4Wv90U.bat

Path C:\Users\Admin\AppData\Local\Temp\U02qFh4Wv90U.bat
Size 185B
SHA256 fdc55b9a68a0e177e35e30105269f01a9c490d108ef6beaab2219158dcccef03
MD5 c72becde891feb7fddf72cb4f4c73e53
SHA1 a0fee0737afd403841000e1053e493258df92315
SHA512 dde15e08091f7eaed4d118b430d183edc900985c63b83e4499c42e86e411ae1341182ac090a2d18ac61cf9296f093d275f1150ce33bb909e6e89d7ccb01d0be8
TLSH
T1CAC0120141858A6E59045C0E19A977CCF0A509996A497FA04505885D23D3C99B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

VDL80sRzOxJy.bat

Path C:\Users\Admin\AppData\Local\Temp\VDL80sRzOxJy.bat
Size 185B
SHA256 25196931cfece14a64b80f8863ba6129ed1e9da2d73808db93947e0a0e4d699d
MD5 fc6ebda6b99fd3ce766fe5e8824c9de5
SHA1 35a4c09888572811371759ad3dafcc2aa95a1872
SHA512 9289035606e9e5e96163994eb49a57382c939e6534f31d9e066c954d9744ecba4c0c405c2bfb0a702524ad08e3977722a17a826780033dd24d33a20a09194f0b
TLSH
T1B5C0220042818A1E05001C0A19E9A38CF09908AC2D887FA005008C4C23C6C68B4CB3C2
MD5 SHA1 SHA512 TLSH

Submit Download

VE0UZeBWVLyi.bat

Path C:\Users\Admin\AppData\Local\Temp\VE0UZeBWVLyi.bat
Size 185B
SHA256 195928b10949444f21a6e107eefecc330936f501e8dc3765c6d8354544b2fae2
MD5 bf0d1e461fd5e33c6b442c6f74ab6cec
SHA1 a0bcc1bfbe15584941f27716a9e6dc06e2723cfe
SHA512 5761c049fc4c3b9358083ed51f523140c9ddbf0af8f757beac0b950632bbf870d576595779a23aad16bfb314f8e7ed5491e9b110debe669a15d02dc00a49c76d
TLSH
T133C0120142818A6E45046C1B19AEA68CF1A908A92949BFA04651889C63D7D98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

Y1egbJrDxui0.bat

Path C:\Users\Admin\AppData\Local\Temp\Y1egbJrDxui0.bat
Size 185B
SHA256 2e0e4a2d16b239e7245176f6eb953d04828b4ddbc374fd3b1b9b1753aaf15428
MD5 90409f850778ef0c09e6bff8f6fe4d51
SHA1 ffdbfdbf199c043f69e59fcb0b218cfe8812da39
SHA512 cc70ecdf32c7c7e6da515515dd640b0b215b11f483b129c2df6ddb4d202bfa0dee96b6c08a1ef17c8aad872ad9c7f432e2a16d71e955cd4a92382f0ff29904c1
TLSH
T150C012015291CA5E49045C0A59A967CCF1A609A92E497FB046018C9D13D3C58B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

Y8kxiiPhtOzp.bat

Path C:\Users\Admin\AppData\Local\Temp\Y8kxiiPhtOzp.bat
Size 185B
SHA256 9b4f05577606d80e8c835c909dbaa0077eef3d68a933dbd7354d18765471ac8e
MD5 fa5409e3cda77d6df1b14b1f4d85af8c
SHA1 560cb35d9d33e1a83ab75c14acd8114f21178737
SHA512 93ffa54afe39ba2772c14f99353614482fe04656d31c68b249fe01e79b9f152822c26d37422c4e7fc72f333f35afa866b3ebb1ac763ec60f6da149f9705380d4
TLSH
T1BFC0120251818E5E4A045C0A59AA668CF0D609992D497FA14601C86C53D3C68B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

bWYZfyGKKPID.bat

Path C:\Users\Admin\AppData\Local\Temp\bWYZfyGKKPID.bat
Size 185B
SHA256 3be2d4cf36921f70195a638af2f92af7aef13a843584dc8c63080aed4254314a
MD5 6fdbfa2bd978d646e55c7e5c66a45e89
SHA1 7a17b5ea599b8c48960569ebb9272572eb19f9d6
SHA512 04d5b62c445555be14d28e5dc427d04ed7ef59d21bcadef799cd0cd3b26e994e8adadd7e09b412c7bf2f50804500770308646de29e4dc4bfa557434412dd6d84
TLSH
T1E4C0120141C28A5E55045C0B59EA678CF09509992A49BFA04E01885C17D2C5DB5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

dsommj3MdkwV.bat

Path C:\Users\Admin\AppData\Local\Temp\dsommj3MdkwV.bat
Size 185B
SHA256 f2a50e6579b0f1ceafe2a6420b1ffaf4bb576880495e063ace39bdefb7b6c30e
MD5 52049a26da484339f20753eaacffc1da
SHA1 4df2b5ad3c1c569fa77026f14254c4f7dfcea82d
SHA512 48eb56d484a63a1d154a8db26bcd6ed47ebb9cf33a9209a2e19b6cfbb1b2c9cb0db480eb9eeb83719859c270f0a184a83818ef4fcdef2126360c640f4d54c5aa
TLSH
T1A4C012018286CA5E49445C0B19AA6A8CF0D9099929497FA04511886D53D6CA8B5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

fXYUpz0KxLgi.bat

Path C:\Users\Admin\AppData\Local\Temp\fXYUpz0KxLgi.bat
Size 185B
SHA256 a7f7f3280bc1db3d8e1ade535ae3289f54dde1067906b46f2b66eee55acff010
MD5 f4ea05a7c2cec99b69ac32c9b25059de
SHA1 aed31843a5ef1e8ca38305d89885ba5bbd8f22da
SHA512 d09b8ce31868f58a9c61a690e1d3a4df0a8abaf9ddc48611c6e440f1a1951dc567b7071a144847ff42ff81670b9fbd9b5dc132c58356ebb52b92d152d8e93969
TLSH
T1C9C0120181818A5E45085C0B59A9678CF09908AD2989BFA046018C5D23D7C59B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

fZL0NZ1CAyb6.bat

Path C:\Users\Admin\AppData\Local\Temp\fZL0NZ1CAyb6.bat
Size 185B
SHA256 59ed1f6eb24e9fadf91787b40bb1b9b5829c9aa2e4acbd31623205ecf27eee8f
MD5 e1be2d6c07e679f90b569ee0f05813f6
SHA1 7d382c16e6369fd70de4da11f213531b4260ed3b
SHA512 72b9f5f176771cf7d082da328cb9e2ef04b27bf0676db6d44e9a1039b36aab72be3d6db9f6562e3cc83a4cedb1896bd1e241547a2cf19f412d4ea66460b2feee
TLSH
T1C9C012014585CA6E86155C0A19A97A8CF0A5089929497FA14651C89C13D2D6CB9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

g7nHLmoNTUQZ.bat

Path C:\Users\Admin\AppData\Local\Temp\g7nHLmoNTUQZ.bat
Size 185B
SHA256 61f998dd0e900b2aeddd2b5abbcbfdd8c4dac442a2bdb6a72ed883fc3c4a2f7c
MD5 bb54d5f754d1d004b28306964a2a5865
SHA1 9c3c893035ff8c0e547ecd262c9c5bc205b9eff4
SHA512 de797a6f9ecef6cefb99f3d1758cfa21419ae292a368bfa87c0608da81f9b2e29a015cac7dc96c6f22ead5a8b254c6a03b9c4b770b6df7d665227e0045f3b02b
TLSH
T125C0120181868A6E46045C0B19EA678CF1DA09992A897FB44611889C27D2D58B5CB796
MD5 SHA1 SHA512 TLSH

Submit Download

hOaxZ4ghEDjE.bat

Path C:\Users\Admin\AppData\Local\Temp\hOaxZ4ghEDjE.bat
Size 185B
SHA256 8a18a93a679e5e031c2b332189674e2c4e13fed053ac2a0344498f55afe24ecc
MD5 a6f3ba2fd72a66d2c1fbb259a9aedfb0
SHA1 df6b81033dfdbaa248385081d4b98b95a5ec930c
SHA512 6da1200e1ff63df707955d1bd1271e09e6ffc0d7afbd133361a8d556b6fc2bfda7520cfe44193273aae6fae0e95eecd764d597bb539c2d55d438683db3a3a037
TLSH
T17BC012014281CA9E56045C0A19A9668CF1A9089969497FB04A41885D17D3C98B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

kIwJdOwByHuf.bat

Path C:\Users\Admin\AppData\Local\Temp\kIwJdOwByHuf.bat
Size 185B
SHA256 490e6b206c22fc6bf8bbb62a8f12097189f41898c699ec124ecd201b6de731ad
MD5 0b7ba5fc045a556c8c494bc6c6fd7cce
SHA1 d886bf6aee081b55e7ba6b9954263c7294fb4bbc
SHA512 01d5517ea8648fbe41dd989b50d487a4076d4f0af6a2352e9a88e8e295dbaadb364261e5666735052d15c08d7b2c87724a2ffe07343e9a99a9612e89f38d3e17
TLSH
T183C0120151828E5E4A149C0A1DA9B68CF0D5099969497FE04905885C17D7C58B9CF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

lKpBYHeHYTsC.bat

Path C:\Users\Admin\AppData\Local\Temp\lKpBYHeHYTsC.bat
Size 185B
SHA256 851e907b7e3849f59c7b1a95d908db789d7d1cfecb31b9dd9cecbe81139abfaf
MD5 10add4f3281d4dfe02123b045def2869
SHA1 b883d366c67a13c57ae726afcca765f3ce726248
SHA512 200604ba620f9a7fa576b954e2ed76671f529732eb77cde06681a2ea201d91a8431d1665e5167b0612177a79d9ac5f04af14797a0a7cda2aa516c6e032d2ff1c
TLSH
T16FC022008681CA2E46004C0A08A9738CF09508992909BFA44600888D13C2C9CB4CF792
MD5 SHA1 SHA512 TLSH

Submit Download

nS8AjMxKgvyz.bat

Path C:\Users\Admin\AppData\Local\Temp\nS8AjMxKgvyz.bat
Size 185B
SHA256 0596fb4be82226ece8d5385f1086f2b21f0d4f9faf5c2e1862649446fc8b2624
MD5 227851f4d5a75fa5876ce9e14fb09d0f
SHA1 9407e2792952957f56ed9f01462fcbd9f85dc545
SHA512 b713e9a8d115b559352385e753a0a878c9eb6791932ed6e4b7a26f259668d9cb9e4b3d0fce63050342a3fadf28b805f91856563c980b5924c44a71ad51d747ef
TLSH
T1CAC0120145C6CA5F59045C1A99AA668CF0A508992D49BFA44502885C53D3C5CB5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

qTX4ACDCSL0y.bat

Path C:\Users\Admin\AppData\Local\Temp\qTX4ACDCSL0y.bat
Size 185B
SHA256 e442531c50718d38f227d4f4fc9f5e5d3d20ed9ae06c80fcc9d259e34873b211
MD5 afec56d08f2d6214770e2040802b0915
SHA1 94e255fe11601e36e164f5f74e22cfa4a0f8b053
SHA512 d99fb8f8d6a0f4552a61ce2380db8bfadce271d11cc5fc5e5333bfd550978ad40445bb17ce3fab7a760be38253fd8f311a3fc58e1cafe83b8c03170d9d13c13a
TLSH
T110C0120145818B6E49045C1B19A9678CF09508AD2E497FA04605885D63D6C5CB9CFB92
MD5 SHA1 SHA512 TLSH

Submit Download

qu2Pm7zHUxMy.bat

Path C:\Users\Admin\AppData\Local\Temp\qu2Pm7zHUxMy.bat
Size 185B
SHA256 0165ff30c377876a21f30090f322b9e9b635fe41fd75230770c7ad22da939da9
MD5 d4c7bbe9926127743cee38b3331a039a
SHA1 112308f7cc84de454f1510f8978438646ad933c5
SHA512 59b78a82d6f94c8065030f6ba21bafb7052e0c028d44e5087848f0b781fdaa7f0a98ef1c1540012dd89acaacb567d02dba27185de3f5417a23a821d988eb9ca0
TLSH
T122C0120141818A5E49145C0B19A9668CF09508A92A497FA44511C85C13D6C59B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

uF6UZoWHO2mT.bat

Path C:\Users\Admin\AppData\Local\Temp\uF6UZoWHO2mT.bat
Size 185B
SHA256 8e52e54a34f8abae4063fd74b59ea8f515246958e8cef78f65c9a3eab2cc81ae
MD5 f91e37dbc66b0196a5416636d16744fb
SHA1 a5440d214db7e8cbfb8b1eadecdb749d50e722f9
SHA512 6af50ceb7e6fceefb4604ddf4a7b59e15c1211cc045201b0315ea17b948ab4220c27b5cb899faff29d01078536b1cd613e568f8cd6a296e17f9a5b157e64e8a1
TLSH
T1DFC012015285CA5E45045C2A19A9668CF195089E2949BFB04641885D17D6C59B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

vTCOVxDFPT6w.bat

Path C:\Users\Admin\AppData\Local\Temp\vTCOVxDFPT6w.bat
Size 185B
SHA256 2e8494b13f3e950427c24ad9616d00c4ceec936ae296144f1b656a80ac55470d
MD5 3d810862d5bf1d85f99b1e284905091e
SHA1 3e6a75f4d53ac671b5130329dc2e04b5a3f87a88
SHA512 c4aef3c030c57e36c53cc0dc7c0c25e6437fde23c9789d44703b90c3c656d23fff9b574d32cc0200c16052979a1e8a030caafee6b32488d69318c07a9e51766c
TLSH
T1E7C0120142828A5E46045C0A19EAA68CF1A50D9D2E497FA14651C85C53D2C58F5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

xsyxNVFocjxh.bat

Path C:\Users\Admin\AppData\Local\Temp\xsyxNVFocjxh.bat
Size 185B
SHA256 8fa2a8ea96eef4ef50f42a7be0278db03859aeb4114e8c38265b2fcaa96bd22a
MD5 7275d02c4807d93e30c2b22b1e98ca1a
SHA1 3cea46451f28ab841dc75cc616d8e65ccc26a0bb
SHA512 3d5448651939f42dcca6074730edd9eeb7f1b46b83c935e98e5f45471cb8d4735d1bc0f6d1951da3f560c39905b9495b08ffe1520aaada6acf6312d0a1bdbd5a
TLSH
T1D8C0120191858A5E49085C0A2DAA668CF0D6089969497FA145518C5C23D3C68B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2416-8-0x000000001BED0000-0x000000001BEE0000-memory.dmp

Download

memory/2684-0-0x00000000007A0000-0x0000000000ACC000-memory.dmp

Download

memory/2684-1-0x000000001B9C0000-0x000000001B9D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads