quasar | bcfe883efe407aeaedd8323573918466f0218bbd9249e0dee65f8c42f7afdd47

Analysis

max time kernel
59s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260715-vdkkmsg14m
SHA256 bcfe883efe407aeaedd8323573918466f0218bbd9249e0dee65f8c42f7afdd47
MD5 38078b835e8497c6e8dae163c2b230a8
SHA1 dec8fb978f0bec134e4d3f25f2c14e709be29a4d
SHA512 87b1c681a4e197f04fd4126e50988a6d2c6e1a363af3f8c99ff0faa0a130f6349aab1b929d58ca5e9e35a06265615b47866af4c3c94d7566d30b9d65d86e8a8b
SSDEEP 49152:RycHGrTlKehOqJgBHA6F9oG4znXawxUuxGJTHHB72eh2NT:RycmrTJhOqJgVA6F9tkx
TLSH
T177E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

up-00.com
malware.up-00.com

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/3788-0-0x0000000000160000-0x000000000048C000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 37 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	3788	messenger_update.exe
Token: SeDebugPrivilege	2752	messenger_update.exe
Token: SeDebugPrivilege	1736	messenger_update.exe
Token: SeDebugPrivilege	3168	messenger_update.exe
Token: SeDebugPrivilege	3324	messenger_update.exe
Token: SeDebugPrivilege	1764	messenger_update.exe
Token: SeDebugPrivilege	3032	messenger_update.exe
Token: SeDebugPrivilege	3028	messenger_update.exe
Token: SeDebugPrivilege	4152	messenger_update.exe
Token: SeDebugPrivilege	4296	messenger_update.exe
Token: SeDebugPrivilege	4704	messenger_update.exe
Token: SeDebugPrivilege	3836	messenger_update.exe
Token: SeDebugPrivilege	2008	messenger_update.exe
Token: SeDebugPrivilege	1828	messenger_update.exe
Token: SeDebugPrivilege	4528	messenger_update.exe
Token: SeDebugPrivilege	4288	messenger_update.exe
Token: SeDebugPrivilege	5116	messenger_update.exe
Token: SeDebugPrivilege	4632	messenger_update.exe
Token: SeDebugPrivilege	3780	messenger_update.exe
Token: SeDebugPrivilege	1772	messenger_update.exe
Token: SeDebugPrivilege	4724	messenger_update.exe
Token: SeDebugPrivilege	1712	messenger_update.exe
Token: SeDebugPrivilege	2520	messenger_update.exe
Token: SeDebugPrivilege	3900	messenger_update.exe
Token: SeDebugPrivilege	2296	messenger_update.exe
Token: SeDebugPrivilege	4876	messenger_update.exe
Token: SeDebugPrivilege	4768	messenger_update.exe
Token: SeDebugPrivilege	3160	messenger_update.exe
Token: SeDebugPrivilege	1696	messenger_update.exe
Token: SeDebugPrivilege	3472	messenger_update.exe
Token: SeDebugPrivilege	3304	messenger_update.exe
Token: SeDebugPrivilege	3364	messenger_update.exe
Token: SeDebugPrivilege	4652	messenger_update.exe
Token: SeDebugPrivilege	4424	messenger_update.exe
Token: SeDebugPrivilege	4800	messenger_update.exe
Token: SeDebugPrivilege	2600	messenger_update.exe
Token: SeDebugPrivilege	2260	messenger_update.exe
Token: SeDebugPrivilege	628	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 2004	3788	messenger_update.exe	88
PID 2004 wrote to memory of 1336	2004	cmd.exe	90
PID 2004 wrote to memory of 2752	2004	cmd.exe	91
PID 2752 wrote to memory of 3040	2752	messenger_update.exe	92
PID 3040 wrote to memory of 4592	3040	cmd.exe	94
PID 3040 wrote to memory of 1736	3040	cmd.exe	95
PID 1736 wrote to memory of 2640	1736	messenger_update.exe	98
PID 2640 wrote to memory of 4724	2640	cmd.exe	100
PID 2640 wrote to memory of 3168	2640	cmd.exe	101
PID 3168 wrote to memory of 1220	3168	messenger_update.exe	104
PID 1220 wrote to memory of 1632	1220	cmd.exe	106
PID 1220 wrote to memory of 3324	1220	cmd.exe	107
PID 3324 wrote to memory of 1428	3324	messenger_update.exe	108
PID 1428 wrote to memory of 2940	1428	cmd.exe	110
PID 1428 wrote to memory of 1764	1428	cmd.exe	111
PID 1764 wrote to memory of 3508	1764	messenger_update.exe	113
PID 3508 wrote to memory of 964	3508	cmd.exe	115
PID 3508 wrote to memory of 3032	3508	cmd.exe	116
PID 3032 wrote to memory of 2124	3032	messenger_update.exe	117
PID 2124 wrote to memory of 1956	2124	cmd.exe	119
PID 2124 wrote to memory of 3028	2124	cmd.exe	120
PID 3028 wrote to memory of 2240	3028	messenger_update.exe	123
PID 2240 wrote to memory of 4108	2240	cmd.exe	125
PID 2240 wrote to memory of 4152	2240	cmd.exe	126
PID 4152 wrote to memory of 3768	4152	messenger_update.exe	127
PID 3768 wrote to memory of 3468	3768	cmd.exe	129
PID 3768 wrote to memory of 4296	3768	cmd.exe	130
PID 4296 wrote to memory of 3796	4296	messenger_update.exe	131
PID 3796 wrote to memory of 2372	3796	cmd.exe	133
PID 3796 wrote to memory of 4704	3796	cmd.exe	134
PID 4704 wrote to memory of 4448	4704	messenger_update.exe	135
PID 4448 wrote to memory of 3248	4448	cmd.exe	137
PID 4448 wrote to memory of 3836	4448	cmd.exe	138
PID 3836 wrote to memory of 4916	3836	messenger_update.exe	139
PID 4916 wrote to memory of 1740	4916	cmd.exe	141
PID 4916 wrote to memory of 2008	4916	cmd.exe	142
PID 2008 wrote to memory of 3188	2008	messenger_update.exe	143
PID 3188 wrote to memory of 3100	3188	cmd.exe	145
PID 3188 wrote to memory of 1828	3188	cmd.exe	146
PID 1828 wrote to memory of 2940	1828	messenger_update.exe	147
PID 2940 wrote to memory of 2520	2940	cmd.exe	149
PID 2940 wrote to memory of 4528	2940	cmd.exe	150
PID 4528 wrote to memory of 3956	4528	messenger_update.exe	151
PID 3956 wrote to memory of 1628	3956	cmd.exe	153
PID 3956 wrote to memory of 4288	3956	cmd.exe	154
PID 4288 wrote to memory of 1416	4288	messenger_update.exe	155
PID 1416 wrote to memory of 2032	1416	cmd.exe	157
PID 1416 wrote to memory of 5116	1416	cmd.exe	158
PID 5116 wrote to memory of 4816	5116	messenger_update.exe	159
PID 4816 wrote to memory of 1800	4816	cmd.exe	161
PID 4816 wrote to memory of 4632	4816	cmd.exe	162
PID 4632 wrote to memory of 3136	4632	messenger_update.exe	163
PID 3136 wrote to memory of 4884	3136	cmd.exe	165
PID 3136 wrote to memory of 3780	3136	cmd.exe	166
PID 3780 wrote to memory of 4460	3780	messenger_update.exe	168
PID 4460 wrote to memory of 896	4460	cmd.exe	170
PID 4460 wrote to memory of 1772	4460	cmd.exe	171
PID 1772 wrote to memory of 4564	1772	messenger_update.exe	172
PID 4564 wrote to memory of 396	4564	cmd.exe	174
PID 4564 wrote to memory of 4724	4564	cmd.exe	175
PID 4724 wrote to memory of 2232	4724	messenger_update.exe	176
PID 2232 wrote to memory of 1632	2232	cmd.exe	178
PID 2232 wrote to memory of 1712	2232	cmd.exe	179
PID 1712 wrote to memory of 2652	1712	messenger_update.exe	181

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P7V6PIUXSDqR.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1336
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1QOvOWd8RPt9.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1736
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CMpd4fMKCmYX.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VofXxmUNFNKQ.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ECVRE9qGBa7V.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Kq1VV8H0JeiT.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\62HoJUroVRcj.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a8eU4JjfSVjG.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yj21UmZ5pThC.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9aFieQoy0Cd9.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:2372
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h2gN8e4PHFQA.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fl6DI78qdz9z.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VO62oDVnR0Es.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sn1NtpvrMTtS.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:2940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rpbreE2RfZTc.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9rPO0NzA4VG1.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IEoe9NE9l7RU.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FLXidbGWAzBI.bat" "
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gWDLOr04d2bB.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uLq1dNYSY7Wy.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SZeh2NMuJlct.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iisO00wwbhsC.bat" "
        44⤵
        
        PID:2652
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\87jSasaPnTqD.bat" "
        46⤵
        
        PID:2308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Qnl9G4EBpbIF.bat" "
        48⤵
        
        PID:2180
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kDE605u9QdE9.bat" "
        50⤵
        
        PID:3636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MObAmSpw62X7.bat" "
        52⤵
        
        PID:816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z1KepYr84mdD.bat" "
        54⤵
        
        PID:2316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QpEVAiu4DsAe.bat" "
        56⤵
        
        PID:2852
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FqAZCXmgBfAL.bat" "
        58⤵
        
        PID:3944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3472
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nbwkc4cFfoNb.bat" "
        60⤵
        
        PID:964
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u3Kn1tmRMiUo.bat" "
        62⤵
        
        PID:1016
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\n07Hp3mEKmSw.bat" "
        64⤵
        
        PID:4744
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qgUUYJ8jEHtl.bat" "
        66⤵
        
        PID:4536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Sub21PtBgvSR.bat" "
        68⤵
        
        PID:4032
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EujmGTgMhxPS.bat" "
        70⤵
        
        PID:5040
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yoMwmmVOl2KA.bat" "
        72⤵
        
        PID:5084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:1348
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WmevxcsP5iYF.bat" "
        74⤵
        
        PID:3096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

1QOvOWd8RPt9.bat

Path C:\Users\Admin\AppData\Local\Temp\1QOvOWd8RPt9.bat
Size 185B
SHA256 2ab50d98c77600ef08d9e8814c1950200d1a7f972349b231ae7b929990e3c323
MD5 1a6a5e2e008a25e33855b5c2f59815b0
SHA1 6f4fb52007afb9d84660d1b5134b513982f19a90
SHA512 6ea2fab84d740dbd52a7f4e54e1f2926d07bd90cf389648f7b8c22a06c94a3a10ad2e843043d22d4dbbecd0cae6415244bbe206a5a7b4fb44cd697b8b9922a14
TLSH
T144C0121145918A5E45046C0A19A9678CF0950CA92D4D7FA04511CC9C53D2C58B9CBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

62HoJUroVRcj.bat

Path C:\Users\Admin\AppData\Local\Temp\62HoJUroVRcj.bat
Size 185B
SHA256 27d19944759be475fce4df83ced07178c838fae2cf712b89ddf17ebac48c843e
MD5 a39c6b1165511b570b2c809caa94d31a
SHA1 bf0d6f9f38447ec3c1dbf39cd16bb1ca94d30916
SHA512 0d329d6d3b13e43cf43d1ae03e01923f207a969e2740b39bb9a5dcfe348b35c67c4a32b3952f03046f048a28b948175d3b2ae6a491c59dc84720231906097277
TLSH
T159C0120151958A6F45045C0B19AA668CF0A509A92A497FA54641C85D13D3C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

87jSasaPnTqD.bat

Path C:\Users\Admin\AppData\Local\Temp\87jSasaPnTqD.bat
Size 185B
SHA256 fbc29a5349458d51cf7375540e5fed3dc6f671ddd7bb7fd0fdc1f864d80b1a78
MD5 2614aa2ecaf1d7730849bdac3a31b5c5
SHA1 9a82c817556745ecd90c1f68e22ff20953eeca64
SHA512 784f4168ed342f4a685686f7243ff4d5b557b7a95b272628b4063b3abff893e462b0def1e5174da16a34f6f88260bac176d8491186bbf5892f92904d88a0a1fc
TLSH
T102C0120192828A6E49145C0B19E9768CF1A608996949BFA44601C89C13D2C98F9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

9aFieQoy0Cd9.bat

Path C:\Users\Admin\AppData\Local\Temp\9aFieQoy0Cd9.bat
Size 185B
SHA256 0941175c5de5f4fe91588a895b6a1d114cfe526f77f355db54cac3a7df4f8107
MD5 8b2e82507734ff986f91421b3dd5e321
SHA1 93ac74e1d418b429a6780d4df021311be88ba5b8
SHA512 20b1e753fd59112aa03fa40fab300dc5df457c9d0fbfe84f0ce4e51016d36b63d05ad0c73109f12ebd409c05db5d3790f94c34a80f2d7051f0b3458a70d96b4b
TLSH
T1D1C0120145C28A5E45045C0B59E9668CF0DA0CA969897FA04501885C27D6C6CB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

9rPO0NzA4VG1.bat

Path C:\Users\Admin\AppData\Local\Temp\9rPO0NzA4VG1.bat
Size 185B
SHA256 d64ecac4240c52d07d9fa9ed80d3abd0736388e07d9086d1dc497fffbc37546c
MD5 7d9bfaedc0fe6fa1ff40e05fca100a23
SHA1 c834579ca60a00ed7a829a9e2fa37ef3f9f2d09e
SHA512 b6f276b085fc54e24837779b322c9d839b0171b4fe5fe9189ffa1e4fcd5cd3c55ab4e84547b958ac6182c225c80d48e3dc20901787f8b0948544e36ad10f4a72
TLSH
T1ACC012014281CE5E49085C0B19A9B68DF0E50C992949BFA04641885D63D2C99B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

CMpd4fMKCmYX.bat

Path C:\Users\Admin\AppData\Local\Temp\CMpd4fMKCmYX.bat
Size 185B
SHA256 2bd713ed1be986c6ca14cf1fbcfeaa349ed0dcbf40069bea8e5ea1918018bb02
MD5 bd74c6c97d8487f50ff847c045d4c8cd
SHA1 9462ec748b32feb3a7b15a6fa11950e57079d984
SHA512 b91bc745af4860bde0b72cd42095599b89da685bf4c8150afd61178e4197ff15ed420dc87a91b128352a71900650d888a05742e388e372abfd226b4a96c26afb
TLSH
T126C0120185818A5E46145C1A19A9A68CF0D509992A497FA08501885C13D3C99B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

ECVRE9qGBa7V.bat

Path C:\Users\Admin\AppData\Local\Temp\ECVRE9qGBa7V.bat
Size 185B
SHA256 37997a03b5026547fe768de02da9bc6b1edd8738a6939ddab4fccfba41b03c6c
MD5 3a52bd2c5f45047cc769c0f34d013337
SHA1 321f8ccb2d7bed8bf8222303caf70d4ae4e312b6
SHA512 a1d72eb7a0aa9e007ff739032857ba27efb167c26f773b5e17f11e4ff9d5f04870db8075bd1e62f2fdf6683c8f7e3601019e7786a9ade58c834ede0b636a3b5f
TLSH
T18EC01205C1A5CA6E46045C1A59E9668CF19508992D497FA04901886D63D6C68B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

EujmGTgMhxPS.bat

Path C:\Users\Admin\AppData\Local\Temp\EujmGTgMhxPS.bat
Size 185B
SHA256 ed8a7af221b9c6534dddd9284f8c7230fd0d2e9a586a2ff8279b1f9b8c8ac023
MD5 fdb640924dcba1187f0a63e0e85f8514
SHA1 9f48d71fbad940466f845acd6b09ac7bda159990
SHA512 4b5d9fd2f53cbc97eb3db8ebc25c982eadede5204f26817f884e50f2d8f2b7ecb67cacc3d5a242fcbdbc062f98c4eadacf5c81a6583ebc84793da05917988670
TLSH
T1AEC012015185CA5E45045C0B59E9668CF0D9089D6949BFA44906C89D53D2C5DF5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

FLXidbGWAzBI.bat

Path C:\Users\Admin\AppData\Local\Temp\FLXidbGWAzBI.bat
Size 185B
SHA256 31cde83ea798f1151c489fe293edf0748e767b753eb4e00d5f8ba604afabbbc4
MD5 d8c5770e3365df5bd7ad31ee7336bb6e
SHA1 3029147fd77dc0f726a2cd880c073577367ce1ae
SHA512 f44cf9f1500a022500b1193112360780b171f390013b9d913c8292859157c131e6bb956a6185dce3be8ab2c7bd2cb22dbbca71769596d236d4d3379f6e444742
TLSH
T11CC012015181CA5E46085C0A59AA77CCF19508992D4ABFA14941885D17E3C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

Fl6DI78qdz9z.bat

Path C:\Users\Admin\AppData\Local\Temp\Fl6DI78qdz9z.bat
Size 185B
SHA256 6b8215ddb08535c5f1e64e242cba176b319a1fa924000ba3b42478cfea1a42ed
MD5 28ca7740d0dccce4c4f01ae483b550d1
SHA1 427518633dbc6b644412ae4fa9d490eaa7806472
SHA512 d6fc2dd6585a5da6f019a806bec3bc8e72c04b80963813ddcda94957142b456e73ea252c176f336f7652db43c09140860dc4ea1ae5281e6dceafa76950a0ee05
TLSH
T15BC0120186868A5E46045C1B19A9778CF0E508D939497FA04901885C57D2C68B5DB796
MD5 SHA1 SHA512 TLSH

Submit Download

FqAZCXmgBfAL.bat

Path C:\Users\Admin\AppData\Local\Temp\FqAZCXmgBfAL.bat
Size 185B
SHA256 444a80e68987f5bca54f60b63fac62d567e5cd3e9e298efc6fbe05616c013037
MD5 ca71a80d689be57919056ee44dc47e80
SHA1 657f1e574976d0ec11eed99f177e2e6bc7b099a0
SHA512 69bdeee0cdb25514cdef44b751c78d392b7758c9056507e54136245a6a93e2b251689791e6ae84be83e9853de9f0252f152f9c4cba91784c994d32ac530c00e6
TLSH
T178C012014685CA6E46045C0A19A9A6CCF099089929497FA54621885D67D2D59B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

IEoe9NE9l7RU.bat

Path C:\Users\Admin\AppData\Local\Temp\IEoe9NE9l7RU.bat
Size 185B
SHA256 ec1a25a83a015f8f32b01fc23eb04688608904cb93f8e74462291330cd20791a
MD5 3ab974e129880d6fa32932a22f7d9c7a
SHA1 f5b9bec964ff37c0e57e9f595235ea7a01e651f8
SHA512 892f6e41172b148caca44a066ed72e31b24fcdbd9a35d5faef99e83ea0a69dea0a99ffea772de4ec54e13f2bee26a68ec431151e480f487492ce63ac94605940
TLSH
T1C3C0120151828A5E89445C1B19A966CCF09908A96D497FA049058C9C23D6C9DB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

Kq1VV8H0JeiT.bat

Path C:\Users\Admin\AppData\Local\Temp\Kq1VV8H0JeiT.bat
Size 185B
SHA256 fde51b88f12dd4e31aec558c5bb1663064d0b0a09361b7f6f8b881226b763e16
MD5 2bf9f120628979a90f1466a20c7ae2f6
SHA1 20c6e0937abaeffc27856fa9892484631030e6cf
SHA512 6492740220da17cb004962c5ce415fab0243eb16060bd799a42f8e83c4567c0fefc723d84f279ff4d82abb6cbe769ba5138fabe8851a638972a1e7c8b0bfdcd4
TLSH
T11AC0220141818A1E4A000C0B19A9728CF0AA08A82908BFA00510884C17C3C5AB5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

MObAmSpw62X7.bat

Path C:\Users\Admin\AppData\Local\Temp\MObAmSpw62X7.bat
Size 185B
SHA256 e133edb4d268057190a77c903c44b2f55d1700eb95a1be12593207d2cfde5b7b
MD5 49ddb7060ddf684f14193fafd34cd250
SHA1 55a7282f52051e4fdfe291cfb17fca4ef6993853
SHA512 a3c068a5da1af200d4f96fb46cfe5690ae9654410c05b9749b823323210067c6cf9c08a73b722a874cefce38823ac35179e9fa130f85ae36950361dfd3baeec9
TLSH
T1AEC0120142818A5E45045C0A19ED778CF19509992A497FA04541885C63D7CACB5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

P7V6PIUXSDqR.bat

Path C:\Users\Admin\AppData\Local\Temp\P7V6PIUXSDqR.bat
Size 185B
SHA256 eed9d24a29ee346b557c3eef42dc95794e2fb201b0179c4d13bf2f10a66ae17f
MD5 518777c46361c24e2479a9b8a93e2fdd
SHA1 22cd52a6b7efdb52b3c23e70abfdf1d5a45c854b
SHA512 42063f24e2fbdcb8c940cb98ee76c6c7b0086cffe4530f0eca9a59186c41a72a2e9a583940893f4fb48c70ef070b43927b6abfcc01228226e0b1f8e5b87802a7
TLSH
T131C0121146918A6E59045C0B59A9778CF09509AD2D49BFA44901C85C13D2C58B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

Qnl9G4EBpbIF.bat

Path C:\Users\Admin\AppData\Local\Temp\Qnl9G4EBpbIF.bat
Size 185B
SHA256 c3ef83e991cb93471fb24445aa0b3eb1fe844fd6c93b5e9f614b3ee7c271febe
MD5 a99ef27bcadb2715d65b3be183e892d1
SHA1 73e473d95ef288f78490c1276d9e905efd46d4e1
SHA512 c92827fcea573422f379c1e9f6fcec46f54b266628f21309d2381bad8787abd72e4e54f5952b9f0496259194072a57b7932d74a9e2b246ca7e3ddd697cf941f1
TLSH
T13DC0120141818A5E4A045D1B19A967CCF0A909A92949BFA44A018C5C27D2C9CB5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

QpEVAiu4DsAe.bat

Path C:\Users\Admin\AppData\Local\Temp\QpEVAiu4DsAe.bat
Size 185B
SHA256 ca3a0efb34dfabbad3d6bc6c109bce0d8a8005507e4f7ce419e307eeaef77648
MD5 475ad231e6d14307aa1372671b42e7f1
SHA1 ad15c3b56fbb4d294825e925d93d3aeccb16c43a
SHA512 fb5cf79561014fda997636884d7b31080b73a5c82a1988a02db58facddaf50a69477876774f747055b0abbab6a7d857462576f053668b38d3ac5646a624220c2
TLSH
T1D8C0120191918B5E4A145C0A19A977CCF099089929497FA04502885E53D2C5DB6CF792
MD5 SHA1 SHA512 TLSH

Submit Download

SZeh2NMuJlct.bat

Path C:\Users\Admin\AppData\Local\Temp\SZeh2NMuJlct.bat
Size 185B
SHA256 e41379b26653b089c53ca4d31f7b9029e4e08cf1dfc006fcf997586d632a0089
MD5 d36c67b3856ae256126c23a860dfcf5a
SHA1 acafabe533534f875eb5974d2ffa3ece57b0ca84
SHA512 fb066d78c40941951fb7251dacece385c1ef5312b7ae5c2e936269ad0a51459dd7cf3ff305b475984e4b778702ea97d0687f8f8cc812b50112127d9287c4b67f
TLSH
T172C0120185818A6E56045C0A59AA76CCF19509A929497FA14A01CC9C23D6C5CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

Sub21PtBgvSR.bat

Path C:\Users\Admin\AppData\Local\Temp\Sub21PtBgvSR.bat
Size 185B
SHA256 da2f957908f74ca487932983252f08743b979d5f2fcc4e79af624178df94150d
MD5 6143e90594734fce4112af33f62059e7
SHA1 e1e3731dc68c160d525e92ee45b2f200f903e4a7
SHA512 50f5fb759412a1cd925c1f972fd0aa87810719619840787071362097ecee4556bc4e8159c668faaaa5e60e98d9cf64efcf935bec970e62d757bf1a00036e91a4
TLSH
T1EAC012019192CA5E49145C0B59A9678CF0D508992A497FA54501C85C63D2C5CF5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

VO62oDVnR0Es.bat

Path C:\Users\Admin\AppData\Local\Temp\VO62oDVnR0Es.bat
Size 185B
SHA256 b46e35dab26f87bc5c45d6d9e368849bd4a4f59da3f6ebf3a636a8554f4b0ecc
MD5 df30bc969bbdb7fc4ab0e07c341d316b
SHA1 1c81638897006571ec7cf80618c54c69135cd1d8
SHA512 b166be3fd017d26d9b7b4582e307158c4d66fb7de185b98c3213d502b4d2f6a97ea197dc272a3a38c1db4593dc001a01cb8f77de8d106692c2878b22c48ff537
TLSH
T1ECC0220141818A1E09004C0A18FA62CCF0D9089929087FA009008C4C23E2C58B6CF782
MD5 SHA1 SHA512 TLSH

Submit Download

VofXxmUNFNKQ.bat

Path C:\Users\Admin\AppData\Local\Temp\VofXxmUNFNKQ.bat
Size 185B
SHA256 57cad7be86ee6877b8e60fa98a6c9029bfcdbcf919045e1370844230246191f2
MD5 32809119ca472d47d568b15f0c9d4d0b
SHA1 a19497efea3fa24646b2dce6fad7c3e6c1442be3
SHA512 02a08f8c4c28de7be7cec02419b6ce087b2b1598e6eb91eb346773c2ccad14580ac904a40a72d6305079b98ff8651bb705025b32132796fb3bb95b4aa6f0628d
TLSH
T14EC0220041C18A1E05040C0A08A9A2CCF095089C2908BFA00501C84C23C2C58B9CB382
MD5 SHA1 SHA512 TLSH

Submit Download

WmevxcsP5iYF.bat

Path C:\Users\Admin\AppData\Local\Temp\WmevxcsP5iYF.bat
Size 185B
SHA256 fb6601194fe3470a2d2a300e3ff26fa9c662e16a0a75a6ae33832add80fb19cc
MD5 bb4cc3227abd72c4c5abfacdf52d8d4b
SHA1 48dfd9c227cfd18399c3ad26690df7329e64e15d
SHA512 2e2e0be062da9743a2733c785a8dfe19a41f200666853f7ba2221840832acdf02a6a5c1875a35155743441fd2fd185630edd6fc573cceaba83e787c67f81e12f
TLSH
T118C0120156858A5E86045C1A19AA66CCF0A9089929497FA14601885C53D6CA8B5DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

a8eU4JjfSVjG.bat

Path C:\Users\Admin\AppData\Local\Temp\a8eU4JjfSVjG.bat
Size 185B
SHA256 b88747e7432974ab16ae2cce5b2ad0d74e5e86721028404ce7960efc5914371c
MD5 7c6e9b67e4e2bb5269861089779ab9a3
SHA1 1313e4a08d5c358dc297c61c2aaf2f058fe65f20
SHA512 059a84531f47565eaadad36dcf9a74f28b5f96a2b6ae52f8e46eca422458509a4a421ef8c2b790406a0380e7c9b40bcf1f4198ec567dcab47ff29df83b20b296
TLSH
T1AFC012019186CA5E45145C0A19AA768CF0D5089929497FA54901889E13D3C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

gWDLOr04d2bB.bat

Path C:\Users\Admin\AppData\Local\Temp\gWDLOr04d2bB.bat
Size 185B
SHA256 291551d3d33b10a6ff1c8282183e6c035bf9ada6f0beaecc85f8592d842b3805
MD5 0a84780598814918b9fd146f4abd6fd0
SHA1 8d5a335d917e08d1e3ddb35995aec3755528da76
SHA512 3ad5e126e37b0eb5dc6c9de9f49845a205164e19ac4d1fc61ccd348bb44ea930df86a86762468062862b425705fbc5fea5f0b115e538d0766e588b37ccf8482b
TLSH
T153C012014181CA5E45445C0B19E9768CF0AA08996E497FA045018C5C23D2D68B5DF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

h2gN8e4PHFQA.bat

Path C:\Users\Admin\AppData\Local\Temp\h2gN8e4PHFQA.bat
Size 185B
SHA256 5b29b3158aef245c1ce9e5c00ce95974e0e6dbdc762d458865d20c17e364e644
MD5 82ed27dce3869444dcd3d0078d7daf81
SHA1 94a0fcc2de3da36dbc233a16ca9d65433a24f512
SHA512 a93153c4bd3646e9b52d9f1e84f326aab23a0d24836033a721611049793293ce3fae378b92ecd45fda8d3e0b962e0001be623c45d882c636e2aa512361001fe6
TLSH
T1AAC0220045818A1E05000C0A18AA628CF0E508982E087FA005008C8D17D2C58B8CBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

iisO00wwbhsC.bat

Path C:\Users\Admin\AppData\Local\Temp\iisO00wwbhsC.bat
Size 185B
SHA256 269ce01031a03bebef629d5f49c63efae7bebdb1d96da0f78cfe7b83f32b4967
MD5 df07cfa8005c0b322eb198e78ff71600
SHA1 748408e0fbf240362082f8101f4f2dff633f5bc5
SHA512 89785545811e03b62613e7636734b9f57d1d12f863d99176b7b1131be8ba1f53de3c7ed3417d0f1665c70e4f8f02891bb4e1e20aad5434101d4f1e3000e048fe
TLSH
T17EC012015191CA5E46145C0B19A967CCF0B508992D49BFA04511889C13D3C6DB9DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

kDE605u9QdE9.bat

Path C:\Users\Admin\AppData\Local\Temp\kDE605u9QdE9.bat
Size 185B
SHA256 fe36b1836a65b93e74429f2d99a70f10c5ea563b4e99c8dddec284481e356083
MD5 93292422efa0461d5a364bdd09015b14
SHA1 5a1331cdb9451428deb93d82a08f530cdfb3a53b
SHA512 2946e67044255b6e366ffd08302a4bc30f211e4169799d9af3c235d4c5bf0ca473982d07113d9c4ec5faee4362b4dcee527903d105eb5d5a7b397a9aa54cd4f7
TLSH
T1D0C0120141858A5E46145C0B19E9A6CCF19909992D497FA04581885C13D2C9CB5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

n07Hp3mEKmSw.bat

Path C:\Users\Admin\AppData\Local\Temp\n07Hp3mEKmSw.bat
Size 185B
SHA256 291152fed8311de7271112a0540685a96537517e4a98fa453eb37e1793d3d1b4
MD5 877db10b71b4b4a8441e96e39415dcff
SHA1 2a1c4d8420578476f5a1e3936cc44b428d81abef
SHA512 4936d39a6d62eb454c95bc3e1f18f52d95a06fb2e0c15770723ebf1a7158df6677ddcc600984652b43903ec4a58433859a4a4cb42f87e2e3916422e4d13e5def
TLSH
T155C012014182CA5E45545C5A1DAA668CF195099D3D497FA145018C5D53D3C5CB5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

nbwkc4cFfoNb.bat

Path C:\Users\Admin\AppData\Local\Temp\nbwkc4cFfoNb.bat
Size 185B
SHA256 f6a242ed491cb5999906b40eb00da9152f8b20187893aef3b6f06e6e78d3cb91
MD5 b292f463f45c2b606d7942fa2ed64009
SHA1 b7a0581bbf05a9ee12e25c93e893f09698c29c90
SHA512 aecd0620fa56d346679bb13ba1dcb871b8436f2de6ec4711b0b5c6870b7619931e9cacf63b59610c642b381abc749a43c91284176cd07846c92005ece2fc4c73
TLSH
T1C2C0120181828A5E46146C0B59AA668CF0D508A92D497FA44651885C17D2C69F9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

qgUUYJ8jEHtl.bat

Path C:\Users\Admin\AppData\Local\Temp\qgUUYJ8jEHtl.bat
Size 185B
SHA256 6c306a67c9d89624c37afb8e7ff97bdedc0a82afc58d8a98a6af67748abc3abf
MD5 d04d024e028559fbe504f5ffb46db59f
SHA1 801ceff0b4d3602b6c6ccc71ee4b1b99d5445ba5
SHA512 0b1483fcb852cde09615e9ca55ab0be081c5e01d377306a83af6e240ab4ec4d3c31d072115545a62435b3a1ed174d8ef8765c4f69fda9336ac68d2aa3df533b4
TLSH
T165C0121241828A6E4A045C0A19E9A68DF0A90C9929497FE045028C5C13D6CA8B9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

rpbreE2RfZTc.bat

Path C:\Users\Admin\AppData\Local\Temp\rpbreE2RfZTc.bat
Size 185B
SHA256 2cfb00cf8cf9a74090c6ca1b02baa6f5e0dba8f1a96c7772731c0c9c0668a866
MD5 337887f584d33fb290ad1d50d0400190
SHA1 423b4860830ddb1050f20872ec2815ef2100dadc
SHA512 1fe275c744d97ccef74c17e66089cf4b2ce9b91d09a0e481b32bf514024a2d113e3cba634dc456d6b251ff8e6617c242e1e93630fffa2a096ba5c73855943709
TLSH
T1AFC012118282CA5E49445C1A19AA668CF095099929497FB14505885C67D3C59F5CB786
MD5 SHA1 SHA512 TLSH

Submit Download

sn1NtpvrMTtS.bat

Path C:\Users\Admin\AppData\Local\Temp\sn1NtpvrMTtS.bat
Size 185B
SHA256 e887d04a9dd887ecab9eef1d7ba7ad8ac0dd665e608686f5ff5e08aee66b54b4
MD5 c7c7ff12112129292dd4a0307f16f7c6
SHA1 f6650f45ad4aca17e0bffbbef48bbe3b8defd273
SHA512 fe43dde6bc181d244ac5b3ad2d21375dba1ae5bd7d9c6f91b008ed3ca8f8ccd861ee671cacf7f8e937107996ca771758847e64b296d7cb9e0c9982d866f4fab8
TLSH
T10DC0120151858A5E4D145C1A19A9768CF29609A92949BFA045018C5D23D3C5CB9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

u3Kn1tmRMiUo.bat

Path C:\Users\Admin\AppData\Local\Temp\u3Kn1tmRMiUo.bat
Size 185B
SHA256 128de5f4f64bcc39958161fcfedf7b8a1e60b7e02dae99a23237acba9933ca24
MD5 befd32805a3202f4f30337733c1c24ff
SHA1 390a8c5409c33a46798a99fa795b57902411b796
SHA512 2c0d49a054b9dad21ad29178588aca92afc74b2309b3c251b1dbbcda6732aa77e97845ce05dd65cf1e0590c2502ff5dbac5561d33ed36d5d64bc790a1d2c8c8d
TLSH
T181C0220081C28A1E09004C0B0CEAA28CF09908982A087FA00910884C53D3C58B4CF782
MD5 SHA1 SHA512 TLSH

Submit Download

uLq1dNYSY7Wy.bat

Path C:\Users\Admin\AppData\Local\Temp\uLq1dNYSY7Wy.bat
Size 185B
SHA256 2844610db7ea55d5038babad44a4b4a7f09d96039c17db26f09714fe1c2545ed
MD5 2c941406ca9b908589fdcf821d0ac75d
SHA1 a1d9ea1f0ba0d64d808c30c5f1f6c949d081b28c
SHA512 68aa28805ad6a7c027064a03345b51bc849a2e5a1cc44d0aaffdbab8d69c88d92740d5071a0dfb4f15be2ca66f82f9d9075049466620f7d4e9a5b1612d907ea1
TLSH
T166C0220141818B5F46105C0A08A962CCF09608982D087FA00710C88C13C2C5CB4CF3C2
MD5 SHA1 SHA512 TLSH

Submit Download

yj21UmZ5pThC.bat

Path C:\Users\Admin\AppData\Local\Temp\yj21UmZ5pThC.bat
Size 185B
SHA256 6f5b90f73a8c2941d3d1c9991151a37b1b696d4f36946be8c70128b7e732a4fe
MD5 d82f62e72188b77fbd43051fd2906de1
SHA1 2a956ba0ca5b11bba83e6295f3d4e24e621265b9
SHA512 f22556d6ce4b0c87ceae4cac534701136a790e59442e7dfc47a8f79e8aa422f5687eb433376520633a7db4aeeb70ddb32581aa0ad80b7105b9118b2f48612fd1
TLSH
T1BAC0120155818A5E45045C0B19A9768CF09508996949BFA44601885C13D2C58B9FF792
MD5 SHA1 SHA512 TLSH

Submit Download

yoMwmmVOl2KA.bat

Path C:\Users\Admin\AppData\Local\Temp\yoMwmmVOl2KA.bat
Size 185B
SHA256 192770b5bd1f4d5d7e77fdd746119471ad42aa063225175d1e4a785a52da278b
MD5 17c06f6a8c856aecf3a1343a2a5dcdc7
SHA1 cafffd597abfe228c07e5f5a0f9eded0e92b68ce
SHA512 e73d9d8bfb3e5e89c54ede98a4fa1a9f6f6c1185ea41f833926c92277a5b306db90d24bcbaa901225c4cdaaa59a43fb710cec2cdfe9a209319d47da6efbe09c1
TLSH
T133C0120141958A5E46046C0B19E9A68CF1960CA92949BFA045418C9D13D2CA8B9CF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

z1KepYr84mdD.bat

Path C:\Users\Admin\AppData\Local\Temp\z1KepYr84mdD.bat
Size 185B
SHA256 2e118accc28c3d46f1c968914afa3eca90ae154c4f321f9dc1d1cc5dd30149cb
MD5 6107642de0759a3cd5470c4fd7ee112c
SHA1 3c7f7688c6415fb9b9be028699e8402ecbd99b2f
SHA512 fe146aa878e2f9e0b6005ff037e97e84b417a937c4abe6e088e3ea06c8c5b62731dd0242c8b814046afe88c037ecc4d727837f49a4ffe1c6f93e802c9132daf8
TLSH
T1A1C012019582CA5E45045C1A19AAE68CF0D509996D49BFA045118C9C13E3C58B9DF782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2752-8-0x000000001BB30000-0x000000001BB40000-memory.dmp

Download

memory/3788-1-0x000000001B0B0000-0x000000001B0C0000-memory.dmp

Download

memory/3788-0-0x0000000000160000-0x000000000048C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads