quasar | dc4c76e1051fda5ceb799aa7915f593e51a6aff4233744d1d8a53c0c92e36b92

Analysis

max time kernel
60s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260716-e29xfagv2z
SHA256 dc4c76e1051fda5ceb799aa7915f593e51a6aff4233744d1d8a53c0c92e36b92
MD5 2adeb3399914459b40422690b59b55a8
SHA1 1ad05867578df8e6e94dc2e44a977e173ff4d368
SHA512 1c41146dbedfd204dc7fc15c1bfcab79adae2850476698549c0453d9cbf66401ae12d62b66d6e5072e937c503e0efb788dd881d6a1abd39bbad8909621c28f0b
SSDEEP 49152:vyhJJHPNCC7J98vBgJh99oG4znXFpxUuxGBTHHB72eh2NT:vyhrHPh7J98vGJh99tcx
TLSH
T1E8E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

socolivekx.cc
malware.socolivekx.cc

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/4772-0-0x0000000000880000-0x0000000000BAC000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 37 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	messenger_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	messenger_update.exe
Token: SeDebugPrivilege	3212	messenger_update.exe
Token: SeDebugPrivilege	1712	messenger_update.exe
Token: SeDebugPrivilege	3060	messenger_update.exe
Token: SeDebugPrivilege	5232	messenger_update.exe
Token: SeDebugPrivilege	1720	messenger_update.exe
Token: SeDebugPrivilege	4932	messenger_update.exe
Token: SeDebugPrivilege	1148	messenger_update.exe
Token: SeDebugPrivilege	2624	messenger_update.exe
Token: SeDebugPrivilege	5640	messenger_update.exe
Token: SeDebugPrivilege	5832	messenger_update.exe
Token: SeDebugPrivilege	2608	messenger_update.exe
Token: SeDebugPrivilege	1748	messenger_update.exe
Token: SeDebugPrivilege	2324	messenger_update.exe
Token: SeDebugPrivilege	4788	messenger_update.exe
Token: SeDebugPrivilege	4460	messenger_update.exe
Token: SeDebugPrivilege	2696	messenger_update.exe
Token: SeDebugPrivilege	5668	messenger_update.exe
Token: SeDebugPrivilege	5132	messenger_update.exe
Token: SeDebugPrivilege	3356	messenger_update.exe
Token: SeDebugPrivilege	5092	messenger_update.exe
Token: SeDebugPrivilege	4688	messenger_update.exe
Token: SeDebugPrivilege	4888	messenger_update.exe
Token: SeDebugPrivilege	2236	messenger_update.exe
Token: SeDebugPrivilege	6012	messenger_update.exe
Token: SeDebugPrivilege	3448	messenger_update.exe
Token: SeDebugPrivilege	5152	messenger_update.exe
Token: SeDebugPrivilege	3748	messenger_update.exe
Token: SeDebugPrivilege	4696	messenger_update.exe
Token: SeDebugPrivilege	4620	messenger_update.exe
Token: SeDebugPrivilege	6024	messenger_update.exe
Token: SeDebugPrivilege	5044	messenger_update.exe
Token: SeDebugPrivilege	4232	messenger_update.exe
Token: SeDebugPrivilege	4452	messenger_update.exe
Token: SeDebugPrivilege	3216	messenger_update.exe
Token: SeDebugPrivilege	2468	messenger_update.exe
Token: SeDebugPrivilege	5244	messenger_update.exe
Token: SeDebugPrivilege	5004	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 5564	4772	messenger_update.exe	86
PID 5564 wrote to memory of 1864	5564	cmd.exe	88
PID 5564 wrote to memory of 3212	5564	cmd.exe	89
PID 3212 wrote to memory of 2648	3212	messenger_update.exe	90
PID 2648 wrote to memory of 1992	2648	cmd.exe	92
PID 2648 wrote to memory of 1712	2648	cmd.exe	93
PID 1712 wrote to memory of 1620	1712	messenger_update.exe	95
PID 1620 wrote to memory of 2588	1620	cmd.exe	97
PID 1620 wrote to memory of 3060	1620	cmd.exe	98
PID 3060 wrote to memory of 5808	3060	messenger_update.exe	100
PID 5808 wrote to memory of 3764	5808	cmd.exe	102
PID 5808 wrote to memory of 5232	5808	cmd.exe	103
PID 5232 wrote to memory of 5336	5232	messenger_update.exe	105
PID 5336 wrote to memory of 4668	5336	cmd.exe	107
PID 5336 wrote to memory of 1720	5336	cmd.exe	108
PID 1720 wrote to memory of 2092	1720	messenger_update.exe	110
PID 2092 wrote to memory of 3852	2092	cmd.exe	112
PID 2092 wrote to memory of 4932	2092	cmd.exe	113
PID 4932 wrote to memory of 5292	4932	messenger_update.exe	115
PID 5292 wrote to memory of 1236	5292	cmd.exe	117
PID 5292 wrote to memory of 1148	5292	cmd.exe	118
PID 1148 wrote to memory of 2480	1148	messenger_update.exe	122
PID 2480 wrote to memory of 3216	2480	cmd.exe	124
PID 2480 wrote to memory of 2624	2480	cmd.exe	125
PID 2624 wrote to memory of 1940	2624	messenger_update.exe	127
PID 1940 wrote to memory of 5300	1940	cmd.exe	129
PID 1940 wrote to memory of 5640	1940	cmd.exe	130
PID 5640 wrote to memory of 4980	5640	messenger_update.exe	132
PID 4980 wrote to memory of 5420	4980	cmd.exe	134
PID 4980 wrote to memory of 5832	4980	cmd.exe	135
PID 5832 wrote to memory of 976	5832	messenger_update.exe	137
PID 976 wrote to memory of 3984	976	cmd.exe	139
PID 976 wrote to memory of 2608	976	cmd.exe	140
PID 2608 wrote to memory of 2660	2608	messenger_update.exe	142
PID 2660 wrote to memory of 4164	2660	cmd.exe	144
PID 2660 wrote to memory of 1748	2660	cmd.exe	145
PID 1748 wrote to memory of 2908	1748	messenger_update.exe	147
PID 2908 wrote to memory of 4528	2908	cmd.exe	149
PID 2908 wrote to memory of 2324	2908	cmd.exe	150
PID 2324 wrote to memory of 3600	2324	messenger_update.exe	152
PID 3600 wrote to memory of 3336	3600	cmd.exe	154
PID 3600 wrote to memory of 4788	3600	cmd.exe	155
PID 4788 wrote to memory of 4372	4788	messenger_update.exe	157
PID 4372 wrote to memory of 2620	4372	cmd.exe	159
PID 4372 wrote to memory of 4460	4372	cmd.exe	160
PID 4460 wrote to memory of 5228	4460	messenger_update.exe	162
PID 5228 wrote to memory of 5892	5228	cmd.exe	164
PID 5228 wrote to memory of 2696	5228	cmd.exe	165
PID 2696 wrote to memory of 1812	2696	messenger_update.exe	167
PID 1812 wrote to memory of 1992	1812	cmd.exe	169
PID 1812 wrote to memory of 5668	1812	cmd.exe	170
PID 5668 wrote to memory of 1140	5668	messenger_update.exe	172
PID 1140 wrote to memory of 4524	1140	cmd.exe	174
PID 1140 wrote to memory of 5132	1140	cmd.exe	175
PID 5132 wrote to memory of 2932	5132	messenger_update.exe	177
PID 2932 wrote to memory of 1844	2932	cmd.exe	179
PID 2932 wrote to memory of 3356	2932	cmd.exe	180
PID 3356 wrote to memory of 5352	3356	messenger_update.exe	185
PID 5352 wrote to memory of 4580	5352	cmd.exe	187
PID 5352 wrote to memory of 5092	5352	cmd.exe	188
PID 5092 wrote to memory of 5324	5092	messenger_update.exe	190
PID 5324 wrote to memory of 696	5324	cmd.exe	192
PID 5324 wrote to memory of 4688	5324	cmd.exe	193
PID 4688 wrote to memory of 5096	4688	messenger_update.exe	195

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F67b1svJjTdm.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\exCzXzRrCByn.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1712
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbx0Bu36Pp6M.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g9UX300OLyBd.bat" "
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\98OBwIvIc1Oo.bat" "
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:5336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M0kCQ8f290Ho.bat" "
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hrjode6SCHQv.bat" "
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:5292
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\loKSVOkMIYTo.bat" "
        16⤵
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hY5JRjttVwUj.bat" "
        18⤵
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\22wIG7KdFOqO.bat" "
        20⤵
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5832
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sDOofsNwycwG.bat" "
        22⤵
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ExFuaVXKiBnT.bat" "
        24⤵
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sordL8Y4XdXD.bat" "
        26⤵
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7Mw5Nimly6mL.bat" "
        28⤵
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7a2adVp7HXQD.bat" "
        30⤵
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N3KObZeAYjbu.bat" "
        32⤵
        Suspicious use of WriteProcessMemory
        
        PID:5228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4uQjwb3LywoD.bat" "
        34⤵
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5668
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jgf1CTxGmBo9.bat" "
        36⤵
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nojGtlNfaGDW.bat" "
        38⤵
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Uozc1spc4euv.bat" "
        40⤵
        Suspicious use of WriteProcessMemory
        
        PID:5352
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iShUdSSiF0q0.bat" "
        42⤵
        Suspicious use of WriteProcessMemory
        
        PID:5324
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1dgzU4n9m2O2.bat" "
        44⤵
        
        PID:5096
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\N2l9l9UaohiI.bat" "
        46⤵
        
        PID:4884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oazKidmVD5WA.bat" "
        48⤵
        
        PID:3344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:6012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CFJxpktYroIM.bat" "
        50⤵
        
        PID:5732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TIRXrtZ8GAEo.bat" "
        52⤵
        
        PID:2044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GtJyN6xCm6r6.bat" "
        54⤵
        
        PID:4088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0EM0ozVmsOHW.bat" "
        56⤵
        
        PID:5792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wOaX8wpsEzLR.bat" "
        58⤵
        
        PID:4568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4620
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e4Nv9RNbNRRo.bat" "
        60⤵
        
        PID:784
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:6024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rckTUhjdKykU.bat" "
        62⤵
        
        PID:2832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5044
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Yl6kTCYFWhOF.bat" "
        64⤵
        
        PID:4724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lmSzADvg35oO.bat" "
        66⤵
        
        PID:5048
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JXgHvAFl9XC7.bat" "
        68⤵
        
        PID:1184
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3216
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5X6URcTv8q3T.bat" "
        70⤵
        
        PID:5776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZeI1OCU5AFF6.bat" "
        72⤵
        
        PID:388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5244
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\otNOPumVwztP.bat" "
        74⤵
        
        PID:4176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        75⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        75⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5004
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6xMFPWLdrWWC.bat" "
        76⤵
        
        PID:4028
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        77⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        77⤵
        
        PID:5272
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\l3Cp3KBS63bP.bat" "
        78⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        79⤵
        
        PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

0EM0ozVmsOHW.bat

Path C:\Users\Admin\AppData\Local\Temp\0EM0ozVmsOHW.bat
Size 185B
SHA256 0919554214fe7af75026cf20ef7caa60e4545b9d749ff41bb566f4c1451f2813
MD5 bdf5b35c5e3f5d95298d742c58489fb9
SHA1 1ce62172f7bc6996184b726aeb3a75384171f379
SHA512 286d6c5830f5e67de5f67cba239794ff69cd7460dca526a4bc0b7ebf2fa24421f3987342bb554cb03a64795094b65cc85d374bd1a8804b21f5cb379a66153940
TLSH
T103C012019191CA5E45045C1F19AE67CCF195089D2A497FA14951885C53D3C58B9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

1dgzU4n9m2O2.bat

Path C:\Users\Admin\AppData\Local\Temp\1dgzU4n9m2O2.bat
Size 185B
SHA256 022b000bcafca6db0ccc80838604c72f2df49b8007b83db4db6f9d71e2c95e7d
MD5 8b900394e2d9215e0b7d86b4794aa11c
SHA1 54d7fda77b9a7d1b8ff04f5d93b62848f1a43cd2
SHA512 424cd894badbf1557351055bd76104dbfa9d734a84dd13adcacf7ffc3661e7369b96806f2092df67bbb1aec120b41c3709bc26470597ae34908fb7c628bb9fb7
TLSH
T1FFC0120241828AAE46045C4A19EAA7CCF19509A929497FA145118C5C23D3C5CB5CFBC2
MD5 SHA1 SHA512 TLSH

Submit Download

22wIG7KdFOqO.bat

Path C:\Users\Admin\AppData\Local\Temp\22wIG7KdFOqO.bat
Size 185B
SHA256 20348455e590a3ad704533b9bc068af2a78b96d0e17951b3185250cc7cc0a87d
MD5 ef90b6812890c689aef0bdab20e6fab7
SHA1 eb7d9e2c2db28909de70feacebc6e2e910641e5a
SHA512 7e934034e81281428449c4efc3edb10828a5023a93de024511322393ef20beabbfc8c45caa1994999a916165e6599738457a6eddde37f7ed9ad4a617cef03a31
TLSH
T167C0120195C68A6E46045C0A19E9A68CF1D9089929497FA54501CC9C23E3C98B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

4uQjwb3LywoD.bat

Path C:\Users\Admin\AppData\Local\Temp\4uQjwb3LywoD.bat
Size 185B
SHA256 06d93b6c9ddf8be5c419a9052026573758a183655084e3c68b182db1186db240
MD5 21e8a64d1153ab2d8b8f40c636503347
SHA1 51cabe379d1d4c76215777ce2ed4745ae70daa50
SHA512 a1462530ed6d22352bc44cc15430cd2bdd3a0e31daea53941ea454f8f2a7f2de2525b95d6ab7ab001a4ec217f8c89e4e17e1cb8aaef4899e2a9c7811632e7e32
TLSH
T167C0121141928A6E46045C0A19A9A6CCF09508AA39497FA04501C85C13D7C98B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

5X6URcTv8q3T.bat

Path C:\Users\Admin\AppData\Local\Temp\5X6URcTv8q3T.bat
Size 185B
SHA256 c5594cbbc51ee5768e830e88a3959c86496c7717984b82291c8df29e5e953687
MD5 4bfaa9787abecc2c9ee69908ba479ac9
SHA1 a16279bed3ff37011f926862c529ee9293f6beb4
SHA512 251715c5a34fc0121990e026283d2de4618dadeee4f939497e69768161c4930a688178d4b16be2da46d15bf360e4f2edc27f13753d610b2f965145e1ef4c86d0
TLSH
T15BC0120151818A6E55045C4A19E9668CF0E5099B2949BFA04A01C85D13D2D5DB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

6xMFPWLdrWWC.bat

Path C:\Users\Admin\AppData\Local\Temp\6xMFPWLdrWWC.bat
Size 185B
SHA256 c0fa9b75bb4d5ea23a7bc36ab86634923c254c5890b825dca49a3538403445e8
MD5 2ce848b016737778ddf5db724fe2bd98
SHA1 be0ccdf3dbf32eeae27adc0ebaa61bf6e2fa3464
SHA512 807f42f0a29ea0ff6788c7ab4066bbe577fa17f348e7bf3d456be1f6d93c1f91a0ada79d660e7e93d1670b6b8243bb28f02ee72c1c97875ac04297725c99cad9
TLSH
T14BC080015585CA6E4A145C0B19EA77CCF1D5089D2E49BFA44551CC5C13D3C5CF9DF7D2
MD5 SHA1 SHA512 TLSH

Submit Download

7Mw5Nimly6mL.bat

Path C:\Users\Admin\AppData\Local\Temp\7Mw5Nimly6mL.bat
Size 185B
SHA256 957710e85cccea56187dde406a60dfa57b672fd5eab7d8e25cb79db3386e4f21
MD5 0233f0227b53cc2cb5f51eb8ac7cead7
SHA1 dc4f84245a3b6be1e8f94b873114f4c0c04995ec
SHA512 bc053ecad08b64378187000d2fc498e6af2400822d713a6ecabc9dd43873564d1115cd6a3d631508ee245de12d7bdde8f5a5a67f753a451faa098668c3d9a5b6
TLSH
T1F1C0120142818A6E45149C0B29A976CCF0D5089929497FE04501885C17E2CADB5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

7a2adVp7HXQD.bat

Path C:\Users\Admin\AppData\Local\Temp\7a2adVp7HXQD.bat
Size 185B
SHA256 5072aa286010b102ce5fa53345baa3583a1ad0761e1846c851c52d04d8f0e69b
MD5 33e529b830b24888d57b78c5d91059ca
SHA1 672e2ff92df0fbcd21082b08fdd33f60992a7066
SHA512 29c5571e72049cac7597f69fcee1b338330de96d772aa1525836ca92a88950eba91a928ee14fd9367ffc831a0db3a3decdfa6e2feebaa1d3621640c3f655ea1b
TLSH
T1DFC0220041828A1E0A040C0A09E9668CF09508A829887FA04500884C13C2C9CB4DB3D2
MD5 SHA1 SHA512 TLSH

Submit Download

98OBwIvIc1Oo.bat

Path C:\Users\Admin\AppData\Local\Temp\98OBwIvIc1Oo.bat
Size 185B
SHA256 8367d0477b5ce3475a260adb1975eb8f657df4c7afa64d72a43eff6edebc6d76
MD5 53dbd8611b368273af71712cab0e56f2
SHA1 b0018bf69f40c6ef6d9b4cb34951adca2752bcf6
SHA512 e90aab04042c23c248a3b6719b256f481cb070611bf4bf8a277abe67168596c1ff065484861277ae43fdd6be6b495833fc0c8dfeccaed1dfd9a4bb8a56c8d157
TLSH
T137C012015191CA5E45045C0F19A967CCF0D5089969497FA946518C5C53D3C5DB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

CFJxpktYroIM.bat

Path C:\Users\Admin\AppData\Local\Temp\CFJxpktYroIM.bat
Size 185B
SHA256 6f2283b75a7369315f3edfa7ae539891b3e6c69e026ad5eb8fa9bfd2f95a8a91
MD5 d9aeaf1eaa3735b34fa58947d9c7b62a
SHA1 4083eed11d785467c5c86e63fe88ec8274bb27eb
SHA512 375cd52f910bd1991cb5333751746d3e9d028bbd5104be34a9aa6131d08877924aef5a9b5b0bd499065969c096858f66b2a25dee5d3d8f609b74e525e803e360
TLSH
T12AC012018191CA5E46145C1A69AA668CF199099D2D497FA04611885D23D2C58B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

ExFuaVXKiBnT.bat

Path C:\Users\Admin\AppData\Local\Temp\ExFuaVXKiBnT.bat
Size 185B
SHA256 7f5cb0a42c61c16e4b1c9cf2a48956c67432c244c1750d5bd8c84fd1551f3c37
MD5 e6947255f6ef6ee5a1e6f1592176ec60
SHA1 502283f2d775d22cee4d40b05bcd562d3bfd9ad4
SHA512 04502513c3596e3ed31375c7262162412307ac3157bb244992c88845ff485c39bbb97b501da02902d33f8aa89905881e4fd2128c9f920620b6255833f75e0bdf
TLSH
T192C0120146828A6E46145C0A19AA768CF0A608AD2A49FFA44601885C53D6C69B9DB783
MD5 SHA1 SHA512 TLSH

Submit Download

F67b1svJjTdm.bat

Path C:\Users\Admin\AppData\Local\Temp\F67b1svJjTdm.bat
Size 185B
SHA256 f4ac9e21e8316919f8e0f304400155d7485093c6d4f06214801d016a0a17179d
MD5 f705f637c81e8ebebb9f952d3ad89dfe
SHA1 69ed1287e160c53de3f82022e55cb63c3cb679d0
SHA512 fffa429603754b17e7d92cf1498770ebd5be5903b7c0d25a35d017d1c8b8442104e70d4e4dcc9ff85033a3e35566e598f7a2951bc6bcb2d50bd75adb7b8dfef2
TLSH
T1FCC0120151868A6F5A045C0A19EA6ACCF0D508A92D497FA046418C5C17D3C58F5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

GtJyN6xCm6r6.bat

Path C:\Users\Admin\AppData\Local\Temp\GtJyN6xCm6r6.bat
Size 185B
SHA256 39c1a1db4161547a3a6ca85a05a4bcbe197e68a6f441dd843304270bb956e466
MD5 d1ffbd0fd69a2b59750eb91acb0d7ae8
SHA1 973f6734c6730b16562a20e4a7fdf17a12c18c1e
SHA512 9b6ea8fc3f36d8684e22b1f3f9d4779e81f944e94a6a6049bdb3805feb2744f7f589bbda2b3644d60b2039bb2268098c3941d9e558687bdf39ce9aeeaf20cff0
TLSH
T13DC012015585CA5E49045C1B19B966CCF0D908992A49BFA04501CC5D53D6C58B6DB782
MD5 SHA1 SHA512 TLSH

Submit Download

JXgHvAFl9XC7.bat

Path C:\Users\Admin\AppData\Local\Temp\JXgHvAFl9XC7.bat
Size 185B
SHA256 e3967d477a218c8eee814fb380f4a450175bca8ece920721de3e78b4151077ae
MD5 2f0608fb6cea3eaca80b08886ff2e7e4
SHA1 f4dc20ceda4416789fdf594041fb19722943f1d4
SHA512 6079755e493f52dc0b3fd1f7d1330d899e1d7cd2c0edd30603ffa94a8b6c0018ef6174b2a176ce33dfdb9350a03fe720d7ec49295b1057b7e846c49b6d17d4b9
TLSH
T1FEC012024181CA6E55445D0A19E9678CF09508A92949BFA04511885C23D2CA9B5CBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

Jgf1CTxGmBo9.bat

Path C:\Users\Admin\AppData\Local\Temp\Jgf1CTxGmBo9.bat
Size 185B
SHA256 89430ed562ec5ad9776b73adfe0927ee0cb6f8f1a8e70074c78a98b46c0710b3
MD5 f44bf2c6b5825ec832c7960970b1f3ed
SHA1 f21f62266ce6e3621f31eb3d8e5b3aac41eef020
SHA512 29c7df7aa966739791039e68fb77e7ee30e188b64e62bfade9a5a5b5430b30d1fa0452c2ffa3a275a683112f64e830524bea0434f44b2afa210ab508058c2b7a
TLSH
T19BC0120185828A6E49045C0A19AA768CF0D5089D6989BFA04902889C13D2C58B5DB7C3
MD5 SHA1 SHA512 TLSH

Submit Download

M0kCQ8f290Ho.bat

Path C:\Users\Admin\AppData\Local\Temp\M0kCQ8f290Ho.bat
Size 185B
SHA256 125f35c3d5f7ac78609d87a742feb28d5bb7d4ae9c0283d8c341569a0a142836
MD5 e23c117cef2b70fa3162fc1b663ad69e
SHA1 4fa39ac5de0b5cbd21a5f58b5e3ab0a69cfa1782
SHA512 d3f5fff4d429de94b048a8f83bc18291534438017e5c853bde775b72854af875cfcf01ef3a626220f1c6425afdc5970c0339c441578181d48b577de0b2c4da6a
TLSH
T154C0120146818E5E55045C0B19B9A68CF0D5089D39497FA04551885C53D3C59B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

N2l9l9UaohiI.bat

Path C:\Users\Admin\AppData\Local\Temp\N2l9l9UaohiI.bat
Size 185B
SHA256 8f1726d1dd858d6e1b8244b37ffb8faa65f88c15ef48e891d3554a261528e2bb
MD5 4cc7022910eff30c0fefb5d6c6773bfb
SHA1 716cb6d0be01f64c9cf0e3912c700932e7af9363
SHA512 3f344ad8e05f9466124003e9b27359d6456409b8ba455cb4d22161a4e17948f20d9865704cf0962d0f7ed082ac9b54fb742682f61d1a76355845a127517213ca
TLSH
T12DC0120145868A5E46045C0A19AA668CF19508992949BFA445018C9C53D3C98B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

N3KObZeAYjbu.bat

Path C:\Users\Admin\AppData\Local\Temp\N3KObZeAYjbu.bat
Size 185B
SHA256 71156dc2718a4d3a08506613a5bfbad2d589b13313f23c9d309a9ad689ecae17
MD5 199875df78ae4e8d74fe9470f5958527
SHA1 fd3ecfa05e2d81e925363b5295b234eb9405540a
SHA512 2a25f5e98d089b5ec72033e46548f54ac0a7fd4fc7882b16c1716ec1d002fc0091a3312c163ee3d637a0fa30a2a496d58776bbe1aece0ef56c848b6faacb5215
TLSH
T1C2C0120141868A6E56145C0A59A9668CF1A508992A497FA04A11885D23D7C5CB5CBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

TIRXrtZ8GAEo.bat

Path C:\Users\Admin\AppData\Local\Temp\TIRXrtZ8GAEo.bat
Size 185B
SHA256 df885e8aef6a95a0474420101e3ff14e506cfcd0908609a5189da446fb4e7fd3
MD5 b94c36cfb2498fa0c929bcd6b60d83aa
SHA1 8971a4ad85d036fa784cb9d1ba2a0e2a245a02c6
SHA512 b97d0161332ba7767eda6b45e83e6c2215932767023e986de8e96a44a500d485f53614e523cdf7a773260e45175b7ca85f7946d72c3dcf566cb80ffad65e50a0
TLSH
T1C4C012019185CA5E49045C5A19EA768CF0E9099969497FA049418C5C13D2CA8B9DF782
MD5 SHA1 SHA512 TLSH

Submit Download

Uozc1spc4euv.bat

Path C:\Users\Admin\AppData\Local\Temp\Uozc1spc4euv.bat
Size 185B
SHA256 0ad319d2d72ffda33b4b87d4f5bdfc4591ed4f77f6afa68490cea3ced5338a7a
MD5 c5051686e91b1aadf70f7b17f45268ff
SHA1 6ef8ad5051406971f03cfdb40113679e0b330a97
SHA512 0633ad5c66d24005be26cfc7a9a5b8fe0f1829aa9ef7ac4c57f1d77281e083d33846f547dbb38ee9f449362b577effd4032b6ad1e21c32cd0766c8b612e78ca1
TLSH
T129C0120141918A5E55045C0B19A9A78CF09508A92A497FE086018C5C27E6C5DB9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

Yl6kTCYFWhOF.bat

Path C:\Users\Admin\AppData\Local\Temp\Yl6kTCYFWhOF.bat
Size 185B
SHA256 6b18ba21108a912112b00c5715ec2247b30df47b8b7f35fb3c31e45e251016be
MD5 aabb1262fc9ef705ee871cf5e128c01a
SHA1 2f17ecfe853d5c69982d2392ccd6388933e13994
SHA512 01d0ef693e0e9d4a55287e4b0cc22f201e035ac4c3614912fb1f10afbefb42aa083518bfb35b711d0e1eebca2b3d89c64f65271f8c7e23b43df5f73eb2ceb1a2
TLSH
T10CC012015681CE9E49049C0A19ED67CCF0A5089929497FA146118C9C13D6C5CB5DF792
MD5 SHA1 SHA512 TLSH

Submit Download

ZeI1OCU5AFF6.bat

Path C:\Users\Admin\AppData\Local\Temp\ZeI1OCU5AFF6.bat
Size 185B
SHA256 22626cb310955e4c56efc28f4e1e04980c0e2270ead1a6ae23a9452934ac9e13
MD5 ebe01381d103ec3b3d047884047babf4
SHA1 9175e7e526a947b9e419559572542a0e23ad6289
SHA512 9e749d7147cf0c1e74cc7ec7c4aea6ce9b1fe9844c25d4cfc4fbb1177634d55ef19fe77c02d07f9c5fbbf843adf84ef2a49da1c2729b23c42a42f91647c0f27a
TLSH
T168C012014186CA5E45145C0A1AE9778CF0E50A992D497FA14901C85D53D6C6CB5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

e4Nv9RNbNRRo.bat

Path C:\Users\Admin\AppData\Local\Temp\e4Nv9RNbNRRo.bat
Size 185B
SHA256 489cd9b757b7a4040c5e2ce385bf79c00da71dd96560224736c8660b0edd7b8e
MD5 a170b05b37c151727d20fe83d816d24a
SHA1 36189bb83b09406f05865a4fd159167062ab15f7
SHA512 46233f507dc1f7542e3749650bc6a5e59c9a2ea758fad72908b7a9a33af71b42ed4c684d2a622861467146fb8ded4a428d39cca1ccfc835798d45825a23cd40b
TLSH
T131C0120156918A5E59145C0A19E9668CF1A5099D2D49BFE04641885C13D7C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

exCzXzRrCByn.bat

Path C:\Users\Admin\AppData\Local\Temp\exCzXzRrCByn.bat
Size 185B
SHA256 93446a2694a39363666cc2e6ed0dc74724cdc31137efde67b953dd4b675eac43
MD5 4c91de0de629f8cdb72dd4deecff2df6
SHA1 a844d344e44f77edb168530f682b4d73a60aa842
SHA512 8a6cfc56d1f742311ee13b17638af9595e00d0973e5220e624d46f9e9be1057cd639af22b11da735b26d620b1e0c66692af4a6e6465666987cf517ccb4e290a2
TLSH
T12FC0120185918A6E55045C0A5AE9B68CF0A5089D2A497FA04A118C6D1BD7C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

g9UX300OLyBd.bat

Path C:\Users\Admin\AppData\Local\Temp\g9UX300OLyBd.bat
Size 185B
SHA256 4d1134805417f77ab440e80aae9003b295e01a28ffd5bb19041351b1549cf8ac
MD5 9bb3777e0d2641cc04b270aaa95aa243
SHA1 4848cf8362c58ea3286aaab6884df9e250504638
SHA512 529a25dd9c4fc40796857ac9fdcbc74e809aeb8bc690bb24210b2961c4947a39caf0b7a36f0559c2302c297523a170c5d13da16be0356a076183d2b40998fd1d
TLSH
T14FC0120141868A5E49045C1B59A966CCF0D508996D49BFA04511CC5C63D2D58B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

hY5JRjttVwUj.bat

Path C:\Users\Admin\AppData\Local\Temp\hY5JRjttVwUj.bat
Size 185B
SHA256 925e3c1314c7a648ea8a6c3bb111616a18c23cb3024f20abd18ca129c884e9fe
MD5 22de2c314d1bcb59b1f4e270697367e9
SHA1 b445c5e6affc8fc3d8db85994372913eea414c96
SHA512 02f0de31819b95bd87848261105d47de79a9dd79f8efe568777ab20478c17fd877461f0f7802a29b3aaebc291a5c11d7b042bf66c7ef3e2456edd70133f87f5b
TLSH
T16CC0120146818A5E4A045C0B1DFAB68CF0A9089929497FA08641C85D17D2CACB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

hrjode6SCHQv.bat

Path C:\Users\Admin\AppData\Local\Temp\hrjode6SCHQv.bat
Size 185B
SHA256 3eb333919d2d3c17db7e8c0444bfa2e1a3416cfbaffff030d3d216cbd6285431
MD5 5a3f11879ebdafef423543064f171ad9
SHA1 f1b2e15468c5fb010a545926b7f5877a94a360c1
SHA512 435cd8092287abf46c640ad296a6308faf0c6f40500bb91d06fbe1f6daf451cb29f1bba30b9f96c31f218f58fbe95333c6386fa7ce0bd19a40a2720252c56a70
TLSH
T18FC0120151818A5E45145C0B59A9768CF0A509E92E49BFA04611CC5C23D2D58B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

iShUdSSiF0q0.bat

Path C:\Users\Admin\AppData\Local\Temp\iShUdSSiF0q0.bat
Size 185B
SHA256 cfb9ad5e3684b8255189e788da11a08cb14873b3f56e3806454e7d328fdabc06
MD5 b9f772fbc74666f3c298ab92571c9c73
SHA1 d272e27059be662075411208b2a48e39dda422dd
SHA512 f9494be1879f4a8ae72106dfd255de1562cef6f57e826acb7b78e3eb6ced583bbb2c11c7170dfedac7e18081283776437095593bb7b9c3015e01dab4425070f3
TLSH
T1B3C0120146828A7E46145C0A19A9668CF095089929497FA44541885C13D2C6DB9EF782
MD5 SHA1 SHA512 TLSH

Submit Download

lmSzADvg35oO.bat

Path C:\Users\Admin\AppData\Local\Temp\lmSzADvg35oO.bat
Size 185B
SHA256 b1b7253b40b54ed40079add63fe5e8f3dc91752cc0fbd888ba433d40cbdba722
MD5 65ee63a71fba046a462061278addd941
SHA1 b3e2dc027661951a40eb185183f0cb2c429c5d76
SHA512 7aa94641b128fb5e3081912502effd84014fa6b49fec071ccefd2b80f1127157188817140c145683121578a41454666d83eb3ff2c71858a11768b96a3dac48c1
TLSH
T101C012014586CA5E49045C0B19A9668CF1E908AD2A4A7FA04511CC5C23D7C59B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

loKSVOkMIYTo.bat

Path C:\Users\Admin\AppData\Local\Temp\loKSVOkMIYTo.bat
Size 185B
SHA256 10ca41d690e3cbd69b36addf5c0883254e1ff906fbb5a56380224c6b2727d006
MD5 47d939ea087bddd817f81b1c314c370b
SHA1 46cffd47e25c52469bafb9e5d9401f70640abf63
SHA512 6a4fdee3443e6b2cdd8594515121417339b4a712b43e7086026b17fac6e33616f0997e29a235af3576e5adb2cc3e681d5e602252a09bebf0778a526a6da9507a
TLSH
T184C0121145858A5F55045C0A1AA9AA8CF095089A2D497FA44541C89C13D2C9CB9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

nojGtlNfaGDW.bat

Path C:\Users\Admin\AppData\Local\Temp\nojGtlNfaGDW.bat
Size 185B
SHA256 cef9569b726a6fc27b1a978de35e89bb807aa714cd7df1c00a13e2c318f859e7
MD5 d667d528e6330593f7be08cc3bf4ab42
SHA1 fd9bac6904f06fbaa448ed0ef0f142d1d160b602
SHA512 0a85332dd9a4786d3c74bbde2e184c0e86004ebf1b13f77c7765d35907247b0b4e8c5d82b8e27d7b061e15c27b825b4f8c9a9ee1d6fcab47a08589de5795af84
TLSH
T1BDC0120141D2CA6E49045C0B19EBA78CF09508992A49BFA14941885C67D2C69B9CB7C6
MD5 SHA1 SHA512 TLSH

Submit Download

oazKidmVD5WA.bat

Path C:\Users\Admin\AppData\Local\Temp\oazKidmVD5WA.bat
Size 185B
SHA256 e26e2288c1fafaa970f9a4ecc8d3b4e3ee8069bf98248e41edc786e8342d51fd
MD5 faa78a63dd021645819b58638a875406
SHA1 2f1963110a78c8512c93bf61a6a07e73efb87f82
SHA512 2a84b5c4e9387cac8291022e204ce9eb851ce37cb96ef7e86ad313b65ad6ee53901c06c403001fd864567db75fe1d52c90d15064fbfa722db4e7e487e39e1320
TLSH
T169C080018192CA5E49145C4B19E977CCF0D9099D2D497FA04911CC5D13D7C5CB9CF7C3
MD5 SHA1 SHA512 TLSH

Submit Download

otNOPumVwztP.bat

Path C:\Users\Admin\AppData\Local\Temp\otNOPumVwztP.bat
Size 185B
SHA256 473c108b82cfee27a96cb63caa7fa88dd05ef20d8b43e438446f59e3eeebc0c0
MD5 68102070d26c5b60f7b1147b7ae3a529
SHA1 9e435f4d6caf8356de377301b0d7faba0ec3e6d9
SHA512 cac75f8b7373338fd069585c793a0cc5b2173dad7492862c21bae7799060b4024313218f01f92bf473cc3cb43131a78d0f469b74d9d55d96f5155ab5acd86857
TLSH
T167C012024191CA6E45145C1A19AA668CF09A08992A497FA44611C89D23D3C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

rckTUhjdKykU.bat

Path C:\Users\Admin\AppData\Local\Temp\rckTUhjdKykU.bat
Size 185B
SHA256 baad22082753634f7c5b2897b26e4297a010e432547f83427ffc9d989701be25
MD5 78709793758d77324e32d35bd555f841
SHA1 9be76d31be0edc0fbb4952a6166f96821242a929
SHA512 4fa3aac01bf3bd7ddb26dc4d15dccc64a2cae469f2aae751a1410f275c7b186c05184ae171560d10fe1a419fa17afba244c58664952ff0b664a82372be560cf1
TLSH
T1D7C0120182818A5E56145C1B19A976CCF0950C9929497FA04641885C13D7C59B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

sDOofsNwycwG.bat

Path C:\Users\Admin\AppData\Local\Temp\sDOofsNwycwG.bat
Size 185B
SHA256 9ec4e8a0ecb8fb784c55164c1f3657c8255277a39dae82850d58c334a58cb5f6
MD5 4e73c26e8e967c8de2c1c8801057dcb9
SHA1 cbdecaa4ec15b7f6cd7b2e8920ad601813d62bee
SHA512 6d00710d15d4bf01ae02f4595fe9096811d6f6fd7de567ec93522d8e3e6444940f37a85a5b9110776358528e7b9e445b7e8fdfe3a0520ecf9a21007b02403eb2
TLSH
T142C0120142958A5E45195C1B19A9668CF09908A92E497FA14901C85C13D2CA9B5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

sordL8Y4XdXD.bat

Path C:\Users\Admin\AppData\Local\Temp\sordL8Y4XdXD.bat
Size 185B
SHA256 3fccdc32918c9f1e361f749ce722edd072c77bc354ff6d87f4620a5aafa4fef2
MD5 8d832bd82fb55634c56106b961f16669
SHA1 b4499fd5f37631e1eef3434e878eb5054cbfc7d3
SHA512 c0ea35b671396d72b724846b1677dd6b8a83f92689310c8889d373263cda2b70cb4e6890fc0dea2a0de3d51080eed7eaf2010c95db8966fa55be1c67d8442904
TLSH
T101C0120191868A5F4A045C1B59A9B68CF1D60D9929497FA045018C5C53D2C58B9DB782
MD5 SHA1 SHA512 TLSH

Submit Download

wOaX8wpsEzLR.bat

Path C:\Users\Admin\AppData\Local\Temp\wOaX8wpsEzLR.bat
Size 185B
SHA256 8e093aed58298a61afe05d4f87c8e436897bde3a0f0b5a099feea16de87a0ab1
MD5 b508d418c2ddd0c301055e20a8834863
SHA1 f4fdbb29dc3f34cec7647ee2f67469639565c18c
SHA512 a75badcc5ce2e393073e5d2783eeb831cb24fcfb78851f79e19e37f57d1fafaee1281d49d7b26af79925746290aad133b8629dac798378312c20cbb56f0b2cf8
TLSH
T12FC0120152818A5E4A045C0A19A9668CF1990D992A497FA04612C89C23E2C99B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

zbx0Bu36Pp6M.bat

Path C:\Users\Admin\AppData\Local\Temp\zbx0Bu36Pp6M.bat
Size 185B
SHA256 54680671a8f92f05e03ac1b783ad3cebbed86cc39f0b8ef62b6ee9617d85cd09
MD5 62137753dbf5c83f9bbf69f09d7a493a
SHA1 f2382a4e778364a8c38545b70742ab83398fa612
SHA512 8e303436347d7e6e6df317386b5c4b41a24ceaca0a30bf29d786650c395b93ebef379a74cd3dd11526a5ecc4d1a7757a780244c8da348f15cebb58e0403eca44
TLSH
T1DBC0120151818A6E45045C4A19AA768CF095099D29497FA04511889D23D6C58FACF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3212-8-0x000000001BDA0000-0x000000001BDB0000-memory.dmp

Download

memory/4772-0-0x0000000000880000-0x0000000000BAC000-memory.dmp

Download

memory/4772-1-0x000000001B830000-0x000000001B840000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads