quasar | 2666b50bc5c6f0ece0654679301ab85c4ec4eece839809264d5d336ebc2eac18

Analysis

max time kernel
151s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
Size 5.9MB
Sample260720-lcw3lsfw8x
SHA256 2666b50bc5c6f0ece0654679301ab85c4ec4eece839809264d5d336ebc2eac18
MD5 8845de9a3ffac91177a3bba275779bca
SHA1 9d4feeedd6539f342a96c7b579db86b8c19b321e
SHA512 80e7acca8aa170e9659d05c55c04c20bf29266dc2c4f5ee36c8d2fadc36adaca9596214d398d823fa7317647be7d0744b5c370a3803513f1aa57bff994114005
SSDEEP 98304:hX0FYH9PTBFruK71lvB/W6K5hORtH+Y+wCkc6BMz/qbAWGTm:hXsYHVTuK7LI5itCYuzSbAWGTm
TLSH
T1AC562227BD42D8FBCD461076E92E8238C5774128C3314DE352DBFD2C6A17BE06A7952A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery quasar persistence spyware trojan

Malware Config

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\DefineMonitor.exe,"	DefineMonitor.exe

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/5292-219-0x000002245C710000-0x000002245C830000-memory.dmp	family_quasar

Custom signature

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/5292-219-0x000002245C710000-0x000002245C830000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Custom signature

Detects executables containing bas64 encoded gzip files 1 IoCs

resource	yara_rule
behavioral2/memory/5292-219-0x000002245C710000-0x000002245C830000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Custom signature

Detects executables containing common artifacts observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/5292-219-0x000002245C710000-0x000002245C830000-memory.dmp	INDICATOR_SUSPICIOUS_GENInfoStealer

Executes dropped EXE 7 IoCs

pid	Process
3344	wRYUHFJhqJIWYiE.exe
4216	wRYUHFJhqJIWYiE.exe
4468	DefineMonitor.exe
2780	ReloadSpecify.exe
1524	ReloadSpecify.exe
2036	CheckExhibit.exe
2812	ReloadSpecify.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com
5	api.ipify.org

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2780 set thread context of 5376	2780	ReloadSpecify.exe	100
PID 1524 set thread context of 5560	1524	ReloadSpecify.exe	104
PID 2812 set thread context of 4960	2812	ReloadSpecify.exe	108
PID 4468 set thread context of 5292	4468	DefineMonitor.exe	109
PID 4468 set thread context of 5856	4468	DefineMonitor.exe	110

Drops file in Program Files directory 43 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UnderstandIllustrate\2_FocusLead.xml	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\psRMEDkSfQPVTTwCxoPxrMEYFCYaKc	wRYUHFJhqJIWYiE.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\2_DefineMonitor.exe	wRYUHFJhqJIWYiE.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\2_ReloadSpecify.exe	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\ff9777c6-70d4-4984-9932-1448e4e1c2d0.tmp	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\d21fb7a8-de16-4aa1-aa94-44f2fee4ffbf.data	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\87d9e181-e798-4351-bd58-794a95ee0d10.data	DefineMonitor.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\2_DefineMonitor.exe	wRYUHFJhqJIWYiE.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\wRYUHFJhqJIWYiE.exe	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\AchieveReviewerKnowledgeable	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\2_ReloadSpecify.exe	wRYUHFJhqJIWYiE.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\FocusLead.exe	wRYUHFJhqJIWYiE.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\AchieveReviewerKnowledgeable	wRYUHFJhqJIWYiE.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\PursueSpecify.sys	wRYUHFJhqJIWYiE.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\ScalabilityIdentify.exe	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\K7CeSgMxHv9Ey8IeVpz.Log	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\2_ThreadSteer.xml	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\4378c7c0-8421-4613-977e-18632d6effcb.tmp	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\MzHRdMW7Ajj5SxxYvcG.Log	DefineMonitor.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\ThreadSteer.exe	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\d8b28890-d5ba-4f34-9978-aee0a3393820.tmp	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\zShgcDBPWk.Log	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\S0kol2hUBjnKd.Log	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\PursueSpecify.sys	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\ScalabilityIdentify.exe	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\fPHYRkpakthoUm.Log	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\zKK6kUZbSgSoYm.Log	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\ThreadSteer.exe	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\CheckExhibit.exe	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\6fe88c7e-6c89-4052-a58f-eb37e9e74385.tmp	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\4b9e60f0-d530-46de-9dac-70ce170402d3.tmp	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\grOpFn7Xlz11q.Log	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\49RU9pHJft.Log	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\5a41a564-8c49-49f6-8887-30fab87e35a9.data	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\91f6aa76-9626-4370-b8cf-076a3abf96b5.data	DefineMonitor.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\FocusPortalLimitless	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\2_FocusLead.xml	wRYUHFJhqJIWYiE.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\2_ThreadSteer.xml	wRYUHFJhqJIWYiE.exe
File opened for modification	C:\Program Files (x86)\UnderstandIllustrate\psRMEDkSfQPVTTwCxoPxrMEYFCYaKc	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\FocusLead.exe	wRYUHFJhqJIWYiE.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\7c83ea00-bdeb-4f35-b9e7-c36e09b88ed9.tmp	DefineMonitor.exe
File created	C:\Program Files (x86)\UnderstandIllustrate\a5a7479b-213f-46e2-b0c4-fbdde87220ab.data	DefineMonitor.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\ScalabilityIdentify.exe	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File created	C:\Windows\DefineMonitor.exe.config	DefineMonitor.exe
File created	C:\Windows\FocusLead.exe	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File created	C:\Windows\FocusLead.xml	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File created	C:\Windows\psRMEDkSfQPVTTwCxoPxrMEYFCYaKc	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File created	C:\Windows\PursueSpecify.sys	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File created	C:\Windows\ReloadSpecify.exe	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File created	C:\Windows\ThreadSteer.exe	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File created	C:\Windows\ThreadSteer.xml	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
File created	C:\Windows\CheckExhibit.exe	DefineMonitor.exe
File created	C:\Windows\DefineMonitor.exe	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wRYUHFJhqJIWYiE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wRYUHFJhqJIWYiE.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4140	wmic.exe
4140	wmic.exe
4140	wmic.exe
4140	wmic.exe
1796	wmic.exe
1796	wmic.exe
1796	wmic.exe
1796	wmic.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe
4468	DefineMonitor.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4140	wmic.exe
Token: SeSecurityPrivilege	4140	wmic.exe
Token: SeTakeOwnershipPrivilege	4140	wmic.exe
Token: SeLoadDriverPrivilege	4140	wmic.exe
Token: SeSystemProfilePrivilege	4140	wmic.exe
Token: SeSystemtimePrivilege	4140	wmic.exe
Token: SeProfSingleProcessPrivilege	4140	wmic.exe
Token: SeIncBasePriorityPrivilege	4140	wmic.exe
Token: SeCreatePagefilePrivilege	4140	wmic.exe
Token: SeBackupPrivilege	4140	wmic.exe
Token: SeRestorePrivilege	4140	wmic.exe
Token: SeShutdownPrivilege	4140	wmic.exe
Token: SeDebugPrivilege	4140	wmic.exe
Token: SeSystemEnvironmentPrivilege	4140	wmic.exe
Token: SeRemoteShutdownPrivilege	4140	wmic.exe
Token: SeUndockPrivilege	4140	wmic.exe
Token: SeManageVolumePrivilege	4140	wmic.exe
Token: 33	4140	wmic.exe
Token: 34	4140	wmic.exe
Token: 35	4140	wmic.exe
Token: 36	4140	wmic.exe
Token: SeIncreaseQuotaPrivilege	4140	wmic.exe
Token: SeSecurityPrivilege	4140	wmic.exe
Token: SeTakeOwnershipPrivilege	4140	wmic.exe
Token: SeLoadDriverPrivilege	4140	wmic.exe
Token: SeSystemProfilePrivilege	4140	wmic.exe
Token: SeSystemtimePrivilege	4140	wmic.exe
Token: SeProfSingleProcessPrivilege	4140	wmic.exe
Token: SeIncBasePriorityPrivilege	4140	wmic.exe
Token: SeCreatePagefilePrivilege	4140	wmic.exe
Token: SeBackupPrivilege	4140	wmic.exe
Token: SeRestorePrivilege	4140	wmic.exe
Token: SeShutdownPrivilege	4140	wmic.exe
Token: SeDebugPrivilege	4140	wmic.exe
Token: SeSystemEnvironmentPrivilege	4140	wmic.exe
Token: SeRemoteShutdownPrivilege	4140	wmic.exe
Token: SeUndockPrivilege	4140	wmic.exe
Token: SeManageVolumePrivilege	4140	wmic.exe
Token: 33	4140	wmic.exe
Token: 34	4140	wmic.exe
Token: 35	4140	wmic.exe
Token: 36	4140	wmic.exe
Token: SeIncreaseQuotaPrivilege	1796	wmic.exe
Token: SeSecurityPrivilege	1796	wmic.exe
Token: SeTakeOwnershipPrivilege	1796	wmic.exe
Token: SeLoadDriverPrivilege	1796	wmic.exe
Token: SeSystemProfilePrivilege	1796	wmic.exe
Token: SeSystemtimePrivilege	1796	wmic.exe
Token: SeProfSingleProcessPrivilege	1796	wmic.exe
Token: SeIncBasePriorityPrivilege	1796	wmic.exe
Token: SeCreatePagefilePrivilege	1796	wmic.exe
Token: SeBackupPrivilege	1796	wmic.exe
Token: SeRestorePrivilege	1796	wmic.exe
Token: SeShutdownPrivilege	1796	wmic.exe
Token: SeDebugPrivilege	1796	wmic.exe
Token: SeSystemEnvironmentPrivilege	1796	wmic.exe
Token: SeRemoteShutdownPrivilege	1796	wmic.exe
Token: SeUndockPrivilege	1796	wmic.exe
Token: SeManageVolumePrivilege	1796	wmic.exe
Token: 33	1796	wmic.exe
Token: 34	1796	wmic.exe
Token: 35	1796	wmic.exe
Token: 36	1796	wmic.exe
Token: SeIncreaseQuotaPrivilege	1796	wmic.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4140	5024	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe	89
PID 5024 wrote to memory of 1796	5024	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe	92
PID 5024 wrote to memory of 3344	5024	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe	94
PID 5024 wrote to memory of 4216	5024	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe	96
PID 5024 wrote to memory of 4468	5024	2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe	98
PID 2780 wrote to memory of 5376	2780	ReloadSpecify.exe	100
PID 2780 wrote to memory of 5376	2780	ReloadSpecify.exe	100
PID 1524 wrote to memory of 5560	1524	ReloadSpecify.exe	104
PID 1524 wrote to memory of 5560	1524	ReloadSpecify.exe	104
PID 2812 wrote to memory of 4960	2812	ReloadSpecify.exe	108
PID 2812 wrote to memory of 4960	2812	ReloadSpecify.exe	108
PID 4468 wrote to memory of 5292	4468	DefineMonitor.exe	109
PID 4468 wrote to memory of 5292	4468	DefineMonitor.exe	109
PID 4468 wrote to memory of 5856	4468	DefineMonitor.exe	110
PID 4468 wrote to memory of 5856	4468	DefineMonitor.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_8845de9a3ffac91177a3bba275779bca_akira_amadey_elex_glassworm.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic" process get name
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4140
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic" process get name
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Program Files (x86)\UnderstandIllustrate\wRYUHFJhqJIWYiE.exe
  "C:\Program Files (x86)\UnderstandIllustrate\wRYUHFJhqJIWYiE.exe" x "C:\Program Files (x86)\UnderstandIllustrate\FocusPortalLimitless" -p:_397ZRapODiscoverPromoterNimble "-oC:\Program Files (x86)\UnderstandIllustrate" -y
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3344
- C:\Program Files (x86)\UnderstandIllustrate\wRYUHFJhqJIWYiE.exe
  "C:\Program Files (x86)\UnderstandIllustrate\wRYUHFJhqJIWYiE.exe" x "C:\Program Files (x86)\UnderstandIllustrate\AchieveReviewerKnowledgeable" "-oC:\Program Files (x86)\UnderstandIllustrate" -p{.+17GzWCnEvaluateContributorLuminous -x!1_DefineMonitor.exe -x!1_ReloadSpecify.exe -x!vpm_alky -x!zfrpp_thhoi -x!k_g_nk_ka -x!yv_hfg_l -x!1_FocusLead.xml -x!1_ThreadSteer.xml -x!zzf_h -x!CheckExhibit.exe -y
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4216
- C:\Windows\DefineMonitor.exe
  "C:\Windows\DefineMonitor.exe" -UnderstandIllustrated Understand -UnderstandIllustrateS Illustrate -UnderstandIllustrateP 1078
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\System32\dllhost.exe
    /Processid:{13B6B196-AD7B-4C7F-9BDC-B1CB2EE86552}
    3⤵
    PID:5292
- - C:\Windows\System32\dllhost.exe
    /Processid:{13B6B196-AD7B-4C7F-9BDC-B1CB2EE86552}
    3⤵
    PID:5856

C:\Windows\ReloadSpecify.exe
"C:\Windows\ReloadSpecify.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\System32\dllhost.exe
  /Processid:{13B6B196-AD7B-4C7F-9BDC-B1CB2EE86552}
  2⤵
  PID:5376

C:\Windows\ReloadSpecify.exe
C:\Windows\ReloadSpecify.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\System32\dllhost.exe
  /Processid:{13B6B196-AD7B-4C7F-9BDC-B1CB2EE86552}
  2⤵
  PID:5560

C:\Windows\CheckExhibit.exe
C:\Windows\CheckExhibit.exe
1⤵
- Executes dropped EXE
PID:2036

C:\Windows\ReloadSpecify.exe
"C:\Windows\ReloadSpecify.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\System32\dllhost.exe
  /Processid:{13B6B196-AD7B-4C7F-9BDC-B1CB2EE86552}
  2⤵
  PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2_DefineMonitor.exe

Path C:\Program Files (x86)\UnderstandIllustrate\2_DefineMonitor.exe
Size 2.7MB
SHA256 5867249f9cccf293810b9c18634d3f6a9890bdebecff84dc42301f0d58e4c1fb
MD5 10fbe4397a0f456b0e7ed586103edf47
SHA1 d534d8358032d8f3e01c75e71b20385b0078ad97
SHA512 dae0f86b395a8bb9627ca190266666806a085eea856ef42f25116cb00086840191bd948661899b1027c523a2aa4421d51d51918b4f9d4755558270793aec8e8b
SSDEEP 49152:Nw+axN+frb/T9vO90dL3BmAFd4A64nsfJhKQLCM8MgvCkg6MnHD1Ng7oGO9vANvz:2+PGKQ5Jkg6WCoG2yz
TLSH
T13DD57C53BC9460B4C5E9D23189B992917731B8980B3327C72F61A6FA2F72FC45E743A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_FocusLead.xml

Path C:\Program Files (x86)\UnderstandIllustrate\2_FocusLead.xml
Size 470B
SHA256 1d5b757be38ba3a7a6b30c274d13258f1f9253556a394353be67378ace58b411
MD5 e87c87c7d8482ba4624f6bc095655411
SHA1 513aceb1e2b689ee59e8df852a1ac3a70c486126
SHA512 042bcd6ae7eeca6a370eba049802aa728fe596a08868136a8dd85c25c620c37be7a464f717b2da826ff77f063ba37dbb0b5b4aec2416743b723828d28970edd0
TLSH
T1A9F0975445CA7BA3A43C5448B923EBE81225C3E46A684C8072AD821350918CA2A7FF83
MD5 SHA1 SHA512 TLSH

Submit Download

2_ReloadSpecify.exe

Path C:\Program Files (x86)\UnderstandIllustrate\2_ReloadSpecify.exe
Size 2.5MB
SHA256 c5199ec9d63a665c5702570675eea26785881f3b1f05268b1c2a3a47cf0c4d5d
MD5 e378fe4989ad68898c088ac58a567d95
SHA1 2797f8850700503db47996329083e18861badbd8
SHA512 dfebbb0ab68ed447d49bee4432b1eb83e4356434577fba65480a411ac589511672070c36219a6c3e825a2f594ece8031700997a08d8ca0e99adc6b0371caf0d7
SSDEEP 49152:x7tAt8HVlkrb/T8vO90dL3BmAFd4A64nsfJignCrlBMCXgvipjuTnD1wUBHeompM:xRVTngCrLdpjuyeMG
TLSH
T16AC57CA7BC9190F9C4A9D2308966D6517A2278540F3323D73F90AAFA2F72FC45E78354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2_ThreadSteer.xml

Path C:\Program Files (x86)\UnderstandIllustrate\2_ThreadSteer.xml
Size 425B
SHA256 0d01cbe61b8b405bea0ac5b5bddcdec93ffb8e3bf9c1fb5769f05529787a54fe
MD5 66bd5cea24dd27e5bc1668bb7acf0522
SHA1 476997fcf2e15963329afa3c0ee4efb4ba2658c5
SHA512 4c608af0feb1010161baa9999e9f0319aa167389920a04ec06eb5264f605d8eb0fe3b81df57ca1b16ff5dc11bef55838d01e97d87eb61be494a7102a3b40da58
TLSH
T115E05C5098D1BBF2067DA0D9BD1253391051A69514C80D9375C94B0245814DD48BFF03
MD5 SHA1 SHA512 TLSH

Submit Download

AchieveReviewerKnowledgeable

Path C:\Program Files (x86)\UnderstandIllustrate\AchieveReviewerKnowledgeable
Size 4.6MB
SHA256 0b724393f199b390a7c6dbddfae0f4b78aaf9189f12d99be8db4962b0d8d8003
MD5 31716664d9c5c614ea3863e7a621a041
SHA1 d46b199eb7bc7d30097771d668a33cc730c1e259
SHA512 96732ce6567ed252a850082bbae27f6995635c71e254bf491bf8ab1da23f7dbaa3dc552475ffcebd570446c170f21de2db8df7083c5efad0e63b243268cc092a
SSDEEP 98304:8ueiV4GOdiwtTrGzuYml2uODUbqdKYsrhuC9Kasd21QzNTZoxj:8ueW4Gol27DUbqnsZsd26hT6xj
TLSH
T19A26338D7EBB522B3AE39868356D7F1344DB505A11D8F7B4DC0FAA39427426FB43012A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FocusLead.exe

Path C:\Program Files (x86)\UnderstandIllustrate\FocusLead.exe
Size 606KB
SHA256 7b36e127e1fa53e0c6462312777c5d004ea83bde67e6df32fb8920b6c001d664
MD5 4e85cc36adc996c3ddd3a9825d4b7f73
SHA1 e5aa0e5db7d9fd27e2a0484f3fd6c322fc5ee97f
SHA512 2d7b7c5eb54cf68a218fca7239c0e194af0b81796e621bc039edccea64b60a202670a47af207988467a8c25584cef96a6652f52d53464ce3cf01006c680f2980
SSDEEP 6144:HcNM+RCns3iTVqKxGE5eYHM2GevEYlm3NI0vHhaL3gEXm//mAm+snmFMuImPSyqj:8NvRWVqceY1Emm9t2QEQmNONI
TLSH
T1F4D427103BF8961BF2BE37B1A97006249BB4F956E7BAE74F598415AC1C637008D2137B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FocusPortalLimitless

Path C:\Program Files (x86)\UnderstandIllustrate\FocusPortalLimitless
Size 4.6MB
SHA256 d47addbcc29751ea523e8e0231ecc3542964f3e11736334b20378cadc30e1028
MD5 7214bfef366d2909d4799030f551be20
SHA1 2069e2e82d8015313daabb8acf03ba994ef846b0
SHA512 85cf1964b6e7255da9f141b5c6f44d3787e66a6806207020e948ce2dde1400d869d205adcf5570e81ceae17fe9b877b002e0951cdaf6b2b8db3db809c806b5d7
SSDEEP 98304:YAnpvANYTmlURmIZY/2KWBYBp0cbLm889/ZIO6WlSjPjQ/f:BpvCYTo5eRBY0j99/ZIhWlQm
TLSH
T1B32633A8AFED423546013ED5083EA59F422B19E55E65720A7E907375EEF0CC42C2CEF6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PursueSpecify.sys

Path C:\Program Files (x86)\UnderstandIllustrate\PursueSpecify.sys
Size 1.1MB
SHA256 668ff7bbc51d69a4353cd24f1c27247ede9b6bcdd35661109c5994329b908513
MD5 0a0e9756bb8deaacb1fdba6830b15871
SHA1 594cdcc77f5f009b460c7cf8718a8c059d706fba
SHA512 e00152e41ad5d711091a2655c6f22279a6797bec5804eef6784bb333d2fa81a6b71de7826bc469c039a2159216f48e8bcc31a5f85144bd03ae9c6ca488d5094b
SSDEEP 24576:vSeiUq86jApPGN/phLtbaIuR/X9h2RvqossFDvL15KLUrnUWIE:6wIjApPs/phLtPuVT2Riobv3PrmE
TLSH
T1514533F77BDC236A640590709CCCA3C2185D8FFBE6D81AE753467962E6A35AF2173600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScalabilityIdentify.exe

Path C:\Program Files (x86)\UnderstandIllustrate\ScalabilityIdentify.exe
Size 232KB
SHA256 8c6379a0d5909d8d2b29bbed20c3e088b868d7ab50aeba9d1344d09f40eeb611
MD5 662afb17f56e59e568fa3bc4967540ad
SHA1 a420058e9ef28c6a79ef3dfa81b64a568dc2a810
SHA512 d3f58d0d499e81920e2792b45dc6c3cedfee461be637cf87f6e69c9344983845113ecf83eb586d2eb6422c7cc39695085ce09e05e2ec23f7f286146b65f084aa
SSDEEP 6144:86ye/1jJB9te2ghg4I5CltsrqHbqdn9EZM4b:86ygH9te2gS3M0EZM8
TLSH
T18C34AE21BDD08472D933083145E8DA715EBDBD314F64959BA36C272E6F30AC3A635B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8b28890-d5ba-4f34-9978-aee0a3393820.tmp

Path C:\Program Files (x86)\UnderstandIllustrate\d8b28890-d5ba-4f34-9978-aee0a3393820.tmp
Size 1B
SHA256 36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068
MD5 7215ee9c7d9dc229d2921a40e899ec5f
SHA1 b858cb282617fb0956d960215c8e84d1ccf909c6
SHA512 f90ddd77e400dfe6a3fcf479b00b1ee29e7015c5bb8cd70f5f15b4886cc339275ff553fc8a053f8ddc7324f45168cffaf81f8c3ac93996f6536eef38e5e40768
MD5 SHA1 SHA512

Submit Download

psRMEDkSfQPVTTwCxoPxrMEYFCYaKc

Path C:\Program Files (x86)\UnderstandIllustrate\psRMEDkSfQPVTTwCxoPxrMEYFCYaKc
Size 22KB
SHA256 0b14af7ddbd946de4d71db5474487c3a109636f6f01700e989174a2a7944454d
MD5 925e19dbe74c7f6d002b53e7b7b58efe
SHA1 3a3ea915f7c950fb5933456cef7dfc4f488c74cb
SHA512 ec2c4d3ee7991a82b2f4447a829c1164108cb49085609dc8b6872f1782c78aa817bac7f014df536cae4efd2efc96afd7a67cc5caa8202d83fd6d79c11a3a6f01
SSDEEP 384:Je81Y0HertXWnYPLkSX5eMdbyFRe9WvQyw9h2tO:h1YCStXWbXCMvw2O
TLSH
T1B0A24BD28B285486E9C38E7083D5EB67BC38F7812F5445EF41A6D6E11E82FE0B72461D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wRYUHFJhqJIWYiE.exe

Path C:\Program Files (x86)\UnderstandIllustrate\wRYUHFJhqJIWYiE.exe
Size 577KB
SHA256 06654d17334fa342f62d42bd805c8bc6da8105612d9ff45c45b8f092a7c46e17
MD5 0fe04f5747f21419bc96e130b2068238
SHA1 558279fe10e5dc98419c3d7e138a569e7ca59011
SHA512 a76fe81d96b1c4af92f4cee5ec567cee1393960bccf290963541e50df0b5286154878de577f7e383b5c0a75a4e134b71243e4e6154ab10ddda0d7a3a4c1a939b
SSDEEP 12288:YdyZcuzXeA53PgZ/C8Qdi7cP/ruuX56cEnjsFMfVS63TLR2Ry:YdCLeSE/CDdigHrvkJnjsFMN73TLRWy
TLSH
T18CC49F163AE5C07EC6521530CB1E6BB590FE83680B3248C767C45E6D2B349E6D63B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\WindowsNT\p
Size 133B
SHA256 3d02a87c2a5975ed635a2af6fca2e25882a2a8d59450a2552ac8541b6173102a
MD5 50428027e22686f2f6ce3d01b50440bf
SHA1 d0d7f597b0db01fca8da754c07f63e902557cdc9
SHA512 68d425dde947e4884ec3fa7041424902e88b0c0881410c40a459f483221d174468c6cd03a3a373e274bd0db3bedc53878f4beeb0705cc2dcb446c073b31f03b8
TLSH
T13EC04821C7024B068030564C2107EFE8170DCAA05E248D85422CC2A258291EA2EBE3A3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1524-126-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-116-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-123-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-124-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-121-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-125-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-120-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-119-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-118-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-117-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-115-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-122-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/1524-114-0x000002522FE00000-0x000002522FEE4000-memory.dmp

Download

memory/2780-95-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-94-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-96-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-83-0x0000010F359D0000-0x0000010F35A78000-memory.dmp

Download

memory/2780-84-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-85-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-87-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-86-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-91-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-88-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-89-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-90-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-92-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/2780-93-0x0000010F35B60000-0x0000010F35C44000-memory.dmp

Download

memory/4468-44-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-48-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-56-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-54-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-53-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-52-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-51-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-49-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-45-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-55-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-218-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-43-0x000001CBDE450000-0x000001CBDE51D000-memory.dmp

Download

memory/4468-46-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-57-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/4468-50-0x000001CBDE650000-0x000001CBDE77D000-memory.dmp

Download

memory/5292-220-0x0000022443C30000-0x0000022443C42000-memory.dmp

Download

memory/5292-219-0x000002245C710000-0x000002245C830000-memory.dmp

Download

memory/5376-98-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-99-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-106-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-109-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-108-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-107-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-105-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-104-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-103-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-102-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-101-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-100-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5376-97-0x0000022DB2710000-0x0000022DB2790000-memory.dmp

Download

memory/5560-130-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-132-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-139-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-138-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-137-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-129-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-136-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-131-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-133-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-134-0x00000247296E0000-0x0000024729760000-memory.dmp

Download

memory/5560-135-0x00000247296E0000-0x0000024729760000-memory.dmp

Download