quasar | 54b1c6040f16d38701cbd80e9500b711c5b1223d7a681fef2a4976b72f079f67

Analysis

max time kernel
59s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260722-wefhra1bna
SHA256 54b1c6040f16d38701cbd80e9500b711c5b1223d7a681fef2a4976b72f079f67
MD5 c70f63002b76832a07ea11ae99342061
SHA1 100c21d44774894b49dcc5043aabf715d91602e5
SHA512 120beb1b730f59861dc7159f697f98360b4097f174210f821b18d1793ccd726c53871f76fae30215e948490a03b6548bf6589853e8d2f511d006c17aaf760874
SSDEEP 49152:PyhJJHPNCC7J98vBgJh99oG4znX2wxUuxG5THHB72eh2NT:PyhrHPh7J98vGJh99t8x
TLSH
T1B7E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

dedaluswine.com
malware.dedaluswine.com

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2228-0-0x0000000000310000-0x000000000063C000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 34 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	messenger_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 35 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
924	cmd.exe
2400	cmd.exe
1344	cmd.exe
4608	cmd.exe
1708	cmd.exe
4572	cmd.exe
1084	cmd.exe
1880	cmd.exe
2456	cmd.exe
740	cmd.exe
3524	cmd.exe
1760	cmd.exe
968	cmd.exe
4128	cmd.exe
4024	cmd.exe
4476	cmd.exe
4348	cmd.exe
4812	cmd.exe
4980	cmd.exe
2404	cmd.exe
4120	cmd.exe
3692	cmd.exe
3152	cmd.exe
4472	cmd.exe
5080	cmd.exe
4764	cmd.exe
2356	cmd.exe
960	cmd.exe
4320	cmd.exe
2636	cmd.exe
4192	cmd.exe
4804	cmd.exe
312	cmd.exe
2140	cmd.exe
3824	cmd.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	messenger_update.exe
Token: SeDebugPrivilege	336	messenger_update.exe
Token: SeDebugPrivilege	1804	messenger_update.exe
Token: SeDebugPrivilege	1460	messenger_update.exe
Token: SeDebugPrivilege	4548	messenger_update.exe
Token: SeDebugPrivilege	4152	messenger_update.exe
Token: SeDebugPrivilege	2812	messenger_update.exe
Token: SeDebugPrivilege	4916	messenger_update.exe
Token: SeDebugPrivilege	2868	messenger_update.exe
Token: SeDebugPrivilege	3628	messenger_update.exe
Token: SeDebugPrivilege	1420	messenger_update.exe
Token: SeDebugPrivilege	3388	messenger_update.exe
Token: SeDebugPrivilege	5116	messenger_update.exe
Token: SeDebugPrivilege	2252	messenger_update.exe
Token: SeDebugPrivilege	4112	messenger_update.exe
Token: SeDebugPrivilege	3160	messenger_update.exe
Token: SeDebugPrivilege	556	messenger_update.exe
Token: SeDebugPrivilege	1976	messenger_update.exe
Token: SeDebugPrivilege	2236	messenger_update.exe
Token: SeDebugPrivilege	3748	messenger_update.exe
Token: SeDebugPrivilege	3732	messenger_update.exe
Token: SeDebugPrivilege	616	messenger_update.exe
Token: SeDebugPrivilege	3032	messenger_update.exe
Token: SeDebugPrivilege	5076	messenger_update.exe
Token: SeDebugPrivilege	8	messenger_update.exe
Token: SeDebugPrivilege	2772	messenger_update.exe
Token: SeDebugPrivilege	3040	messenger_update.exe
Token: SeDebugPrivilege	2836	messenger_update.exe
Token: SeDebugPrivilege	4720	messenger_update.exe
Token: SeDebugPrivilege	1996	messenger_update.exe
Token: SeDebugPrivilege	4356	messenger_update.exe
Token: SeDebugPrivilege	2920	messenger_update.exe
Token: SeDebugPrivilege	1464	messenger_update.exe
Token: SeDebugPrivilege	1436	messenger_update.exe
Token: SeDebugPrivilege	4556	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1084	2228	messenger_update.exe	87
PID 1084 wrote to memory of 3768	1084	cmd.exe	89
PID 1084 wrote to memory of 336	1084	cmd.exe	90
PID 336 wrote to memory of 4476	336	messenger_update.exe	91
PID 4476 wrote to memory of 3720	4476	cmd.exe	93
PID 4476 wrote to memory of 1804	4476	cmd.exe	94
PID 1804 wrote to memory of 924	1804	messenger_update.exe	95
PID 924 wrote to memory of 2788	924	cmd.exe	97
PID 924 wrote to memory of 1460	924	cmd.exe	98
PID 1460 wrote to memory of 3152	1460	messenger_update.exe	99
PID 3152 wrote to memory of 1864	3152	cmd.exe	101
PID 3152 wrote to memory of 4548	3152	cmd.exe	102
PID 4548 wrote to memory of 4980	4548	messenger_update.exe	103
PID 4980 wrote to memory of 4456	4980	cmd.exe	105
PID 4980 wrote to memory of 4152	4980	cmd.exe	106
PID 4152 wrote to memory of 4192	4152	messenger_update.exe	108
PID 4192 wrote to memory of 1764	4192	cmd.exe	110
PID 4192 wrote to memory of 2812	4192	cmd.exe	111
PID 2812 wrote to memory of 4472	2812	messenger_update.exe	112
PID 4472 wrote to memory of 3656	4472	cmd.exe	114
PID 4472 wrote to memory of 4916	4472	cmd.exe	115
PID 4916 wrote to memory of 2400	4916	messenger_update.exe	116
PID 2400 wrote to memory of 1964	2400	cmd.exe	118
PID 2400 wrote to memory of 2868	2400	cmd.exe	119
PID 2868 wrote to memory of 4804	2868	messenger_update.exe	120
PID 4804 wrote to memory of 4972	4804	cmd.exe	122
PID 4804 wrote to memory of 3628	4804	cmd.exe	123
PID 3628 wrote to memory of 4348	3628	messenger_update.exe	124
PID 4348 wrote to memory of 4356	4348	cmd.exe	126
PID 4348 wrote to memory of 1420	4348	cmd.exe	127
PID 1420 wrote to memory of 5080	1420	messenger_update.exe	128
PID 5080 wrote to memory of 4200	5080	cmd.exe	130
PID 5080 wrote to memory of 3388	5080	cmd.exe	131
PID 3388 wrote to memory of 2404	3388	messenger_update.exe	132
PID 2404 wrote to memory of 1800	2404	cmd.exe	134
PID 2404 wrote to memory of 5116	2404	cmd.exe	135
PID 5116 wrote to memory of 4764	5116	messenger_update.exe	136
PID 4764 wrote to memory of 4228	4764	cmd.exe	138
PID 4764 wrote to memory of 2252	4764	cmd.exe	139
PID 2252 wrote to memory of 4120	2252	messenger_update.exe	140
PID 4120 wrote to memory of 2788	4120	cmd.exe	142
PID 4120 wrote to memory of 4112	4120	cmd.exe	143
PID 4112 wrote to memory of 1344	4112	messenger_update.exe	144
PID 1344 wrote to memory of 4708	1344	cmd.exe	146
PID 1344 wrote to memory of 3160	1344	cmd.exe	147
PID 3160 wrote to memory of 1880	3160	messenger_update.exe	148
PID 1880 wrote to memory of 4332	1880	cmd.exe	150
PID 1880 wrote to memory of 556	1880	cmd.exe	151
PID 556 wrote to memory of 312	556	messenger_update.exe	153
PID 312 wrote to memory of 2008	312	cmd.exe	155
PID 312 wrote to memory of 1976	312	cmd.exe	156
PID 1976 wrote to memory of 4812	1976	messenger_update.exe	158
PID 4812 wrote to memory of 4648	4812	cmd.exe	160
PID 4812 wrote to memory of 2236	4812	cmd.exe	161
PID 2236 wrote to memory of 3524	2236	messenger_update.exe	162
PID 3524 wrote to memory of 2368	3524	cmd.exe	164
PID 3524 wrote to memory of 3748	3524	cmd.exe	165
PID 3748 wrote to memory of 1760	3748	messenger_update.exe	166
PID 1760 wrote to memory of 1544	1760	cmd.exe	168
PID 1760 wrote to memory of 3732	1760	cmd.exe	169
PID 3732 wrote to memory of 2356	3732	messenger_update.exe	170
PID 2356 wrote to memory of 1748	2356	cmd.exe	172
PID 2356 wrote to memory of 616	2356	cmd.exe	173
PID 616 wrote to memory of 2140	616	messenger_update.exe	174

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GsDzpWa54hIi.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3768
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:336
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\42hw18WgFbRc.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1804
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aswsdDKdqwri.bat" "
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SCoopyX37c1z.bat" "
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3152
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t6hz6tnI4Jrr.bat" "
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TndxfD4hISbe.bat" "
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uwm5hFQjnu9m.bat" "
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yswLa8VfCJaH.bat" "
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ucQVUVrkhHOt.bat" "
        18⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wnqLipZvWrt4.bat" "
        20⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c3VHsBILCTn1.bat" "
        22⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3ybj3t5RKLh8.bat" "
        24⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7cXa45hyfCra.bat" "
        26⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WZ2xN85ifeL1.bat" "
        28⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DpHSdHlZvCm3.bat" "
        30⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\O6HomXvovinb.bat" "
        32⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Djtei25CYU76.bat" "
        34⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:2008
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1ZJO2Hybs9rz.bat" "
        36⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ImaB5pk9HII9.bat" "
        38⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bEYTNnvBVm8u.bat" "
        40⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:1544
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JUMTtnmy6UuT.bat" "
        42⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:616
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5mBtp0xxeTYY.bat" "
        44⤵
        Executes a command shell one-liner
        
        PID:2140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5ro9S0XkhIh5.bat" "
        46⤵
        Executes a command shell one-liner
        
        PID:3824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lolyP6EmX3KH.bat" "
        48⤵
        Executes a command shell one-liner
        
        PID:960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:8
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qwal25N96huy.bat" "
        50⤵
        Executes a command shell one-liner
        
        PID:4320
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\y3SBvivQ1dks.bat" "
        52⤵
        Executes a command shell one-liner
        
        PID:4608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QrMDMNxTpnnk.bat" "
        54⤵
        Executes a command shell one-liner
        
        PID:1708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LQ2Ef9CIVIAl.bat" "
        56⤵
        Executes a command shell one-liner
        
        PID:2456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TvtfbqOFztvq.bat" "
        58⤵
        Executes a command shell one-liner
        
        PID:968
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\r7rtVE2D6JZR.bat" "
        60⤵
        Executes a command shell one-liner
        
        PID:4128
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kO06FGoVVoZh.bat" "
        62⤵
        Executes a command shell one-liner
        
        PID:740
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OM6jTPolKcqd.bat" "
        64⤵
        Executes a command shell one-liner
        
        PID:4024
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1464
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\o1O4J1PXjJyg.bat" "
        66⤵
        Executes a command shell one-liner
        
        PID:4572
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1436
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vsFMDF3XiSCb.bat" "
        68⤵
        Executes a command shell one-liner
        
        PID:2636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4556
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qFeaWEUg23Fi.bat" "
        70⤵
        Executes a command shell one-liner
        
        PID:3692
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:1120
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        
        PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

1ZJO2Hybs9rz.bat

Path C:\Users\Admin\AppData\Local\Temp\1ZJO2Hybs9rz.bat
Size 185B
SHA256 4180c3bcf266cab4c626bbc3ce8304eb11c529e86396ae02c6f5a1680b4bd002
MD5 776cd8a027cea8427bb73c0c648a27df
SHA1 ba85e45b1066b53e192534ff8649019dec681782
SHA512 fa63a01d0c2fe5dce785bdd718d68b82dc0948e6a0413c066c38f79bcb01d6d54639962a6d5e2863fcf9adbc7310aa7cb2df56d4cc6a9be1074254a2fa0fb620
TLSH
T189C0120241858A5E49046C1A59A9B68CF19508A939497FA04511885C23D6C6CF5CB783
MD5 SHA1 SHA512 TLSH

Submit Download

3ybj3t5RKLh8.bat

Path C:\Users\Admin\AppData\Local\Temp\3ybj3t5RKLh8.bat
Size 185B
SHA256 cc262056cf592e1eaa2814e1d16c0eb4b36435cd3fba79e678c305ab3d956df5
MD5 79e51f975ac4a67197638ce4b46cd072
SHA1 a72c8b244dfbae9ebaa695b685ea92642031d3e5
SHA512 44d8c2d0ef707fb7adf3c36c7b881623a6bed2945428ca7ae9f7750f4616d7d144bfa970a4b30fda5bb589349de87b6691953187b5a3d97f34fc6dccbc50753e
TLSH
T189C0120142868A6E45155C1A19A9A6CCF0D50C9D6949BFA049018C5D23E7C58B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

42hw18WgFbRc.bat

Path C:\Users\Admin\AppData\Local\Temp\42hw18WgFbRc.bat
Size 185B
SHA256 d76696ca8fd31f6b50e6684d40075b68df8903d81e27561cb8b874aa2215f5f3
MD5 eaf722e78022d066ca1cacc385e583b6
SHA1 af9af8303981edc4d72a45037762088a57afbb97
SHA512 54ecf3680b6c5f8ebab0df2c53c6ee5b5a8e226f62f214d188efdeca09d1fdc5f6c67cd081de9b1f3af990df9fbddfdbf551ad6518fdbfda1f214c1b842ff78a
TLSH
T18AC012015281CA6E45045C0A19A9678CF0A5089A29497FA04A01885D53D6C99B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

5mBtp0xxeTYY.bat

Path C:\Users\Admin\AppData\Local\Temp\5mBtp0xxeTYY.bat
Size 185B
SHA256 270e7a992c7f4793787c565bcb4af78089e089786ebcffe9965a11424dab0938
MD5 5d1982b1cd2a2fe7ed455510a04da504
SHA1 6b698455ba508f35d6eb60362036441cfeb46929
SHA512 41f53d5d4f2aaa2c3e70826ba5a6069d6000bee6c1444bc0eee2a8758facdf440e57202eea7189a62c82dd10fa9dd919e5cfe2ed029b340dcfd1374a77fcaafc
TLSH
T1D2C0120145958A5E59045C0B59A9768CF09A08E92D4EBFA145018C5D53D3C59B5CB7C3
MD5 SHA1 SHA512 TLSH

Submit Download

5ro9S0XkhIh5.bat

Path C:\Users\Admin\AppData\Local\Temp\5ro9S0XkhIh5.bat
Size 185B
SHA256 ed7d55edd7369137d5643f8e740e0914c003f74f9fd2f96b4d72f2497ac28e69
MD5 1621e289b1e80357d95e4d615be010df
SHA1 0665ded582ff61fbae7e27b22d575b6a171c9bd3
SHA512 6a6f58f09c11c9fad64d76101c299215b20844ffad01809f6208af0437ff270cbd5d839fc3ebc69b4806c7e1178e369750dd122a1e3aea8b6c050dd18d116f58
TLSH
T1FDC0120191828B5E49055C0A19A966CCF099099D2D49BFA04505C85C13D2C68B5DF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

7cXa45hyfCra.bat

Path C:\Users\Admin\AppData\Local\Temp\7cXa45hyfCra.bat
Size 185B
SHA256 d974fa357a237ea667e8d06176bde2d6e654764bf239fa46025c5fc69a755d19
MD5 7512d97f50a375b1e8b06c241acc4de1
SHA1 845dadedb684864995222f9b17ffc6aa9b79c598
SHA512 a0790e00bf05938347d6780e5e2cb14ee450afdd0fd480b0c82c1b5da807ff9bf854f54272a46f12de7236f97018f844f3abc945516f433c2814fe4df11660e7
TLSH
T1A3C0220041818B2E05504C0B09EF638CF1D508982908BFE14A00C84C13C2C6DB5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Djtei25CYU76.bat

Path C:\Users\Admin\AppData\Local\Temp\Djtei25CYU76.bat
Size 185B
SHA256 63200cdfcd70e4f6e17484354e3f7e365db2e1b268b58e5b8cc0e2c9583d1cac
MD5 9d90d27a68c32c1f0e785a9fc5e155e7
SHA1 954d41f2be517fbc5f1ed600523cc6d280a3f277
SHA512 d750e1e0de651cb53c91672f2631138635285806f960554631e0de30fc34b7c89ef1a8ee9458591740409ebea068514fc81cd1a35d17ae34e280ad0cb9092aa8
TLSH
T1DEC012018186CA6E45085C0A59A966CCF1E5089D2D497FA44511CC5D53D2C58B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

DpHSdHlZvCm3.bat

Path C:\Users\Admin\AppData\Local\Temp\DpHSdHlZvCm3.bat
Size 185B
SHA256 aa2ceea0c95b7db3ba122a446b44ecb2147ff2f1e28ee94adbfe3931556b66cd
MD5 d857616b3b3e337b28351293f43bd321
SHA1 46366d9739335e814a6b4ef88180991de57b73a2
SHA512 8bc7106611a7eda5ce7860a4e9697ab918e4d908c0244e1dc16393df69ee11dc529639bf4a5aad721dffd96d28c4b2a68174475468499a0d188d03d86f155e61
TLSH
T1FFC012014581CA5E45145C0B59E976CCF0E5089D3A49BFA14A41889C57D2C59B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

GsDzpWa54hIi.bat

Path C:\Users\Admin\AppData\Local\Temp\GsDzpWa54hIi.bat
Size 185B
SHA256 e91f1d4b018affa1c72137dbb0243ad1eca9534f8acbf59a3b94bf159fb70bef
MD5 ea82b3d857a0e852409844e27491c967
SHA1 f0544c8834aa5265022b13e0f7c79eff5c3a2d8e
SHA512 0b1f6e3d6e997f97772f8373a8b4b499ed92c9afa93d24ee5e3cf6a2041b3b737f1d44696bb943266695bef1ae5d20cdaee34a9e9e8ce1478cb1090c3e1f0d3f
TLSH
T1B5C0120141818A5E49045C5A19AA778CF0DD099929497FA18A128C5C57D6C5CB5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

ImaB5pk9HII9.bat

Path C:\Users\Admin\AppData\Local\Temp\ImaB5pk9HII9.bat
Size 185B
SHA256 0c8f159ab55214ba228e216750a5d8323d28b990ac3b64b1ef3a7097c845cdc3
MD5 ae22d6f6d64c98917b6addde55d18b02
SHA1 0c734f9fbb837f399684267b02386bfa15eb1c40
SHA512 6dbc5687258dac2d8a062bbe53c1ea752e7d664008e734d05d2047fcac0e0e0cbdfda47c0c64d0d8fcc8c989c375e3eb258f26064292f14fee297775e30c5ae6
TLSH
T1A6C012018581CA5E46045C0A19B966CCF0D909A9294A7FA54601889C23D3C98B5CBB82
MD5 SHA1 SHA512 TLSH

Submit Download

JUMTtnmy6UuT.bat

Path C:\Users\Admin\AppData\Local\Temp\JUMTtnmy6UuT.bat
Size 185B
SHA256 af52edf0ddbd9b3e904b5f580d1711f01aba5e542759a3477e0ec0b6b0b389b8
MD5 128a5bac9a297482253bac3a6840fba5
SHA1 e90f620aae584e1b8811a875b422ba3939246f12
SHA512 f1a7fcd354109d7700d93cc1b18fe48e445777b0dc1e82ec2dd874a6e019cfa0c8525f20679d6306028d3beec1129a1d1512e7cfce2dbae0982ea95f57803b66
TLSH
T1C2C0120141C28A6E55045C1A19A9778CF0A5099D6D49BFA04601885D13D2C5CB9DB792
MD5 SHA1 SHA512 TLSH

Submit Download

LQ2Ef9CIVIAl.bat

Path C:\Users\Admin\AppData\Local\Temp\LQ2Ef9CIVIAl.bat
Size 185B
SHA256 c4dd3f89d53e3d38b520f83fac659c53968026443168cf1f5336772862420824
MD5 fcaee0bb068d9d38d4c171e9aa250f74
SHA1 d57d1b3dc73cf499c981fb2b6bb36ea70c83480e
SHA512 9d6aaafee5d9dccfbc6fce66bdca5d8c7ddb3bc11ea6d709f0369c06eeee8e3ff062792a68cbd870f8285ae5e3119326a8fe583a77efa06585cd86775d7c2905
TLSH
T187C01201C1818A5E45049C0A19A96A8CF0960899294D7FA149028C5C13E2C6DB5DBB82
MD5 SHA1 SHA512 TLSH

Submit Download

O6HomXvovinb.bat

Path C:\Users\Admin\AppData\Local\Temp\O6HomXvovinb.bat
Size 185B
SHA256 21921badd2a5b3d39bb7ffade69798df68f2fea6d37554032f1cabfae5cd1c44
MD5 c96dd756d68e6291dcbe260e3e07bde4
SHA1 191b1c87be799c221e967a866405d000b9aa3fce
SHA512 a7d68ad741e29522febcb3d4b42257298f13e26534f2f0c56d1f2e4c823387c00613890b8e541f6babd94140a1171e19185cbee4f1dc45f69f85e02f1e751d92
TLSH
T17BC0120151828A6E55045C0B19A9678CF0E608AD29497FB04611885D17D6C98B6CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

OM6jTPolKcqd.bat

Path C:\Users\Admin\AppData\Local\Temp\OM6jTPolKcqd.bat
Size 185B
SHA256 b9a0d785fe3d47cd8d87740ee0d7d32cf4a85961dd31acea573b3ab46310d14f
MD5 6ca4f002db000ae899d3aff46b62d6e1
SHA1 87cb4b89f8aaf7a4e87abcff4292760dbefa6986
SHA512 56a58a1d8fbada27772c7be4d282ca91337b9a2e8d4fd3a1aaead3977794bb26d344beab641e58ec6b523ed24ae4415a1db9b3ac2bff64d8eb1ccaef184b0f69
TLSH
T155C0120152918BAE49045C1B19AA768CF09608992D497FA449518C9D53D2CA9B9CB792
MD5 SHA1 SHA512 TLSH

Submit Download

QrMDMNxTpnnk.bat

Path C:\Users\Admin\AppData\Local\Temp\QrMDMNxTpnnk.bat
Size 185B
SHA256 e46f24be172bce23f3fa7d73c01c80df448e828c6edffc7a5e7a56031f2188ac
MD5 58b64fe3390bd9017354b1aa7b9767fa
SHA1 637e32844129f0530401bf3ac09d6275c4462abc
SHA512 07e4cecf812991446fd31bd3f9d91cf8ab06138b14990f61cac728814dc55a8d7df321d1f3e6f12005cf50ff979ab2348a5cad0df83f630ccde008bf6b70e8c5
TLSH
T1FAC0120142818A5E4A149C0A19A9668CF1A9089929497FA04551885D13D6C58B5CB783
MD5 SHA1 SHA512 TLSH

Submit Download

SCoopyX37c1z.bat

Path C:\Users\Admin\AppData\Local\Temp\SCoopyX37c1z.bat
Size 185B
SHA256 ec1385dc9e6528deeb1e1581e92d360be3b90cb807b996826919ec8311b65561
MD5 026c7fd10adbbb8982e66a58c3c87164
SHA1 e1000115b4bf8a22ae6976b158174c8820035fd0
SHA512 c2a3648f80c3a4cab1cd611c50e9d1eb3c9bd3f7147bed3f63b09b44b9ea687cd32fe59f98451f8eb066979ab80c858418d67fd7fb9efeb87cc7ad9e5457dc58
TLSH
T191C0120141868A5E46045C1A19A966CCF1A908A92A497FA44501885C13D2C58B5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

TndxfD4hISbe.bat

Path C:\Users\Admin\AppData\Local\Temp\TndxfD4hISbe.bat
Size 185B
SHA256 0d0a97784c8e026a4a50f3878087f7ab174d05b493da05df775d128f25024410
MD5 d2ea78af0e68d575356a0b69eac71896
SHA1 95425d70b1790ea813c51914ecfdaeb4b2f99f53
SHA512 11478b47e7d2485508d6fed41254284b13d37586c62a367cbfead3400c8f9abc8ad765ebb2997987e483323ccfe8ff650922dd2c78287fd261081ab679a9093b
TLSH
T1BBC0120141928A6E55045C0A19ADA68CF0E908996A497FA08941885C27D6C59B5CB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

TvtfbqOFztvq.bat

Path C:\Users\Admin\AppData\Local\Temp\TvtfbqOFztvq.bat
Size 185B
SHA256 8b6750c1109381b1f433be8b72a1fa085582c45bce8aee99cfef6ad1abae9a5c
MD5 5c3aad27fc5eaedcec00032808e22b1b
SHA1 066f99e048b896a9060f3d3a87dab23e61f3cf86
SHA512 d53efe1e81cb5370ade0d35ba75726d322ef857885299afcac923808c0574c4d0e97f06d991d0f60d1a4a55d3ede7d3dcf3f278e73b038e272c20e3c725284e0
TLSH
T176C012014181CA5E4A045C0B59EA66CCF0E90D9969497FA04905C85C17D6C5CB5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

WZ2xN85ifeL1.bat

Path C:\Users\Admin\AppData\Local\Temp\WZ2xN85ifeL1.bat
Size 185B
SHA256 6275f3b5a31ba7ba0e97d511748eb90dc38d55b2f14121aa3ca49a0a66886031
MD5 f794593fb0f8a7076f13b6fa01120191
SHA1 a5338e27e7153eb26dc1a67e144c5a0c6953d20b
SHA512 33ba31b7608a0d83e2eca9ff775e2d8d7dada8175166784f1206715770a7c42604260a019e2495fbf44358d6321015ba5d9e2f4105e2b78ce0ed733eb6949fe6
TLSH
T19FC012019595CA5E49045C0A19A9768CF1A508AD29497FA14941C85C53D3C5DB5DB783
MD5 SHA1 SHA512 TLSH

Submit Download

aswsdDKdqwri.bat

Path C:\Users\Admin\AppData\Local\Temp\aswsdDKdqwri.bat
Size 185B
SHA256 a99a690d943373aa26d0260de9caa5c6b6fa5cca6323dbf49c8a146ac51dbfa4
MD5 64b16bb38e7dce3b0ff693b7e281f0d8
SHA1 f9659ca6998e7df1dead61c9a5da0a6ba696faaa
SHA512 e33ff599c9a29f827e3f16387f77392c6b8b4f1f86017f8dfc2f42c6d6bf118ccd049f590f838b6c35ae5083a3409b0886e2ab1617ec4b5ac2f6771ca44342cd
TLSH
T1EEC0120145958A6E45146C0A19AA668CF0D9089929497FA44A01C85C23D7D58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

bEYTNnvBVm8u.bat

Path C:\Users\Admin\AppData\Local\Temp\bEYTNnvBVm8u.bat
Size 185B
SHA256 b4d64dded43cec15429e592fd46c8f1faee785dd6cb3e49d8c7fd3290feda988
MD5 f382b3dc421bb80326885f43bbe3a227
SHA1 7cb73081153106981c27f9f7853796a39b832f1a
SHA512 7d86026ef469cf5896acb218e30a56e8b7d3e68076df420ca495951844b1de969b33fd1cd649e4c1bd135beed658099c69ddcdf2bffdfc2f8fdf5c6178b51233
TLSH
T15DC0120146858A5E56045C0B19A9668CF0A5199929497FA14641885D13D2C9DB5CB786
MD5 SHA1 SHA512 TLSH

Submit Download

c3VHsBILCTn1.bat

Path C:\Users\Admin\AppData\Local\Temp\c3VHsBILCTn1.bat
Size 185B
SHA256 d94155b3110fdb2720d3abfea23c60a81f7a3a20d6411da88b07efee4df381f0
MD5 8c3461f5ba44093d2499e1ea694d4789
SHA1 830f903496d784c0607e96f1fe3c7ac9d4be7e6a
SHA512 bd53f6da13a54409172f984891f3cf67940b9d065b85dbfcd9dcdaf3f702739ef9ff346ab5777400db69d3856711a3876f89aa0470d6f92136187402cef258c5
TLSH
T121C012014286CA5E49045C0A19AA768CF1A508992D497FA24951C85C53D6C59B9CBB82
MD5 SHA1 SHA512 TLSH

Submit Download

kO06FGoVVoZh.bat

Path C:\Users\Admin\AppData\Local\Temp\kO06FGoVVoZh.bat
Size 185B
SHA256 53d9baf4a67d295bd56b3603d84463e320f6fdca47833771575e37ee5884f371
MD5 071a5a02967ab74cb216f91e1274c944
SHA1 6f8d3c25d59e8dba692d9d05a5e04ff979e71c87
SHA512 ef29ea5e71011ad5b8d1496d026b2b2271de4f5e1f401f64f9a16b45ad7fa8768afdf8ff2d644604c260ad5a39116605dfa8faa18ba78a92d615ced8e90d3f90
TLSH
T143C0120181918A5E46045C0B59AAA68CF095089D6A49BFA04A05C8DD13D2C58B9DB7D2
MD5 SHA1 SHA512 TLSH

Submit Download

lolyP6EmX3KH.bat

Path C:\Users\Admin\AppData\Local\Temp\lolyP6EmX3KH.bat
Size 185B
SHA256 989a1f9f1f908991c7d8f8d68226f1a964c736b50f0b94a0b87983fb9599a99c
MD5 dc7f9fe55daff202a740e425678b41fe
SHA1 fd7c48af099f49a5b0cd6c3ac6327688ad2b92c6
SHA512 7f15da404ba2e8ae17878d6e61a4e6053780f0d3f641969f23c3fb9a0f5f018fe365aff3ade99935a3cfd28ac1622c4952af55723ad2f07a07b4793aca8f56aa
TLSH
T1EDC0120145818A5F56045C4A19AAB6CCF0D5089D2D89BFA04511885D53D3C9CB9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

o1O4J1PXjJyg.bat

Path C:\Users\Admin\AppData\Local\Temp\o1O4J1PXjJyg.bat
Size 185B
SHA256 25699e02b95cb9ab7f711f58fd2db9c387336e86a741c7602edd4683bd008ce9
MD5 65f553ef430f0d98ff70344bdc1c7ab8
SHA1 f9f9eedda0bc9f558ab664c582b563398c99b555
SHA512 15906a26c2a1ff043b6c367d063101177af2dd0c1a982fef95b4150f563d886a859ff094a7760385573777a8d93a206be32d79247be96d3f2a9d0b2a2b23666b
TLSH
T1F0C0120191918A5E45145C1A69EA768CF0D5099929497FA05501889C23D2C58B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

qFeaWEUg23Fi.bat

Path C:\Users\Admin\AppData\Local\Temp\qFeaWEUg23Fi.bat
Size 185B
SHA256 3358372e4c2a84ac6c49bc437ac4d7724f53fcfc640dd260dec0a2646f29952d
MD5 131b49eb20d7f698e5ca692daae1ea43
SHA1 b3f4c8716421961b26adf63cedde11d614e947a4
SHA512 8b2dde5dbf27ff1648a8d79515b99f7d9ace396cdb7b86f096c267bf50c634eea497211d88613f664fcd2e22704d0c0500a92eac85572f4cace524734c1538bf
TLSH
T19FC022004581CE1E06001C2A18A9B38CF0D909AC2A487FB00600884C23C6C5DB5CB3C3
MD5 SHA1 SHA512 TLSH

Submit Download

qwal25N96huy.bat

Path C:\Users\Admin\AppData\Local\Temp\qwal25N96huy.bat
Size 185B
SHA256 b901429918bd92a923734302f4d663e2f6d471d102bc00944ffc8f126d3e2c0d
MD5 59ce6b09c798880957c9d485fef241b3
SHA1 d93fdb47868f9720a16b7c1abcd5b8f92439b577
SHA512 7ec239019f9ba97a25e1ec4677875e7b303b9192c66798ac79ef671fd4e44938082de9739f2a6c2beffc0995f0360cccfeb509b39cc57a14a23b8158be16d888
TLSH
T144C012014182CA5E5A045C0B19E9B78CF1D608A92D497FA14541885C23D6C68B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

r7rtVE2D6JZR.bat

Path C:\Users\Admin\AppData\Local\Temp\r7rtVE2D6JZR.bat
Size 185B
SHA256 0aee944308c884ac9bbc2515de83e87edb43a8a9b4430e8bb6d516ebe85f5b75
MD5 3956d3375468009d4e16d0f7b0789df2
SHA1 2ae17e4417c8db83f4b73cd52de65de4d8da2f99
SHA512 8d288c44701d1535b22dbc32700a08ff5d14bf77a13ffd52b08080306b724b81a4dffd0d9c100b37b6b200ce88f8e786b1641adfaff220495e549752e64023a8
TLSH
T179C0120142918A5E46045C1F59AB668CF0D908996A897FA04611C85C13D3C58B5CB793
MD5 SHA1 SHA512 TLSH

Submit Download

t6hz6tnI4Jrr.bat

Path C:\Users\Admin\AppData\Local\Temp\t6hz6tnI4Jrr.bat
Size 185B
SHA256 6804c6635f99fce9c64588372c29311c3503d0fffa6d9416f95a1cd7d66fa0fb
MD5 cd11793b66b121c312433d010735b523
SHA1 e773e4ff22fa70b2ad892dac42f833740f0ad5ac
SHA512 46e8398724dfd37f540f0dc2e329ff1cb02610d3c84d55bcfae9c000ef486383918b46ef65ff855c2b0717078067d8e5785ce8406be07b0a4f5097c650a46206
TLSH
T146C012014182CA5E55445C0F19A9668CF1A508AD2949BFA48601885C17E6C58B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ucQVUVrkhHOt.bat

Path C:\Users\Admin\AppData\Local\Temp\ucQVUVrkhHOt.bat
Size 185B
SHA256 9a21db56039fd0b42328bbf3b780cd770ae7565c1fb751bfb41f54ada50d1936
MD5 81ed551caa4a4229d655c343677f942d
SHA1 50d0f74139ad29d210a66846f808d6f6ef16c233
SHA512 ccdec95d7a883c203e1a802916736c13e5c03e4450fc5b36717702fa183e3298905418ab436c9d71dc8ec55200d7e4d1ec39a07e356b8dce94e60cbad648060a
TLSH
T10BC012014182CA6F46045C0B19A966CCF0D5089929497FA14615CC5D17D6C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

uwm5hFQjnu9m.bat

Path C:\Users\Admin\AppData\Local\Temp\uwm5hFQjnu9m.bat
Size 185B
SHA256 b2db7e539c7a6edeaf4792e4a51e4dd5fabe9b63053dc88261c03583e85e9d0e
MD5 79f96a313f8dbcca8a82c421c07eda19
SHA1 dac38273f7404e8bd34da5b3dcf73983601566f3
SHA512 158529fc8d9ac82dae7694d8806fadc00a835f6fe795e02d7f5cd11d1d69501d406b2973be0ee04e809c16c89ff6542cbbbf52549e0dedd68d0c875873b3fa61
TLSH
T101C0120281868A5F46045C4B69A966CCF09508992A4D7FA14545885C13D2C98B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

vsFMDF3XiSCb.bat

Path C:\Users\Admin\AppData\Local\Temp\vsFMDF3XiSCb.bat
Size 185B
SHA256 a4cee6308b2c5ec9e287d0de84e936960b2b5d3d065a2ca9af149426fef10618
MD5 8fd23bbd12a18d95a75305e9bc90b353
SHA1 74bc4202e87e020486df052edccf07cf44835c0f
SHA512 2065057933093bff53ee7766934330933e21f6adf52c9d6846ed059edd2ca354a6e2e9a10d4e8e3e5a0a55b483ab0d63c9b82af7c3481b2656f5a3fe022a0378
TLSH
T11DC0120191828A5E45045C4B19A9B6CCF0E5089D2A497FA04A11C89D63D2C5CB9CF786
MD5 SHA1 SHA512 TLSH

Submit Download

wnqLipZvWrt4.bat

Path C:\Users\Admin\AppData\Local\Temp\wnqLipZvWrt4.bat
Size 185B
SHA256 f19458d1fe4d2012b9f0a8ae6a7af6d783fc7df7b9566cd1ac3fec7f793580f1
MD5 f19f386eda7631d8cec055991d00f943
SHA1 44296273d567ffcf3793c81fec297edf4c7f5491
SHA512 840a9c3876d5968fbb833472b10415115a96c904d3ce7ba74a5155aecfad2c78b75873f298bee5919df38732f9397d9093ad84d455d00709e25f5ceea8499794
TLSH
T1D1C0120185918A5E45145C1A19A9668CF0A5089929497FA085018C5D67D2C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

y3SBvivQ1dks.bat

Path C:\Users\Admin\AppData\Local\Temp\y3SBvivQ1dks.bat
Size 185B
SHA256 41544cfc7e1fdb9876110220281567c58bdeaa356913f6d1453cec418fc62b46
MD5 a583676ea439a62911780d06947f2b8b
SHA1 292c69733100e462e3e05c64adde5df2d548b52e
SHA512 f23daf4056e9e6de360347c25279a3f0542f282190e1b92fbeee90e38cd2b6d1cb7b528d8fe0f9052ecddc12539f883455123b6539bd3963b1abb563440b53b0
TLSH
T13EC0121192918F5E49045C0A19AD66CCF0D9099D2D497FA045118C5C53D3C58B9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

yswLa8VfCJaH.bat

Path C:\Users\Admin\AppData\Local\Temp\yswLa8VfCJaH.bat
Size 185B
SHA256 970a85581d7f2088959ecb472ad0314e51e7e85e19b19bc95a04bf0e8e876129
MD5 2e9a3353b226076aaeeafc610d1aba6f
SHA1 b1e13eb321f17be98e4f5465cb2d2294f58d85ef
SHA512 bff26b887430edf5ad10b7d8e7e3a91a115313239ee8d6f676f780cb3d6bbd6099157d576f47abe1b7bb4aa35173031462d2ca14b5ac0fb07a09ae792e5ece87
TLSH
T10AC0120141858A5E45045C0A69A976CCF0D508992D49BFA046018C5C27D2C98B5CF792
MD5 SHA1 SHA512 TLSH

Submit Download

memory/336-8-0x0000000000F00000-0x0000000000F10000-memory.dmp

Download

memory/2228-0-0x0000000000310000-0x000000000063C000-memory.dmp

Download

memory/2228-1-0x000000001B310000-0x000000001B320000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads