quasar | d0f1227b1a363081126ff63e603a98edfd5cebe7f9daaeae12b91f1c9e919921

Analysis

max time kernel
59s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/07/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
messenger_update.exe
Size 3.1MB
Sample260725-dse52ayfle
SHA256 d0f1227b1a363081126ff63e603a98edfd5cebe7f9daaeae12b91f1c9e919921
MD5 15455c9ebe864058e108a9ca1033e778
SHA1 2e50ce1c7b8c9e5eb60499b0475e806480ab8f89
SHA512 1d5bc21df87b625a276756869b9eb9465669035bfa6b8a3f5e53288ff137ed0389f60679eaadd22e6fe58f589d30c1bdbbb8ecb6fca185ad8b405e1b02e0d1d8
SSDEEP 49152:tyhJJHPNCC7J98vBgJh99oG4znXhOxUuxGtTHHB72eh2NT:tyhrHPh7J98vGJh99tTx
TLSH
T1A0E56C1577F86E23E16EE2B2D2B1041267F0F81EB3A3EB2B224257786C53B505C517A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

pingping execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

pingping

quickgpt.io
malware.quickgpt.io

Mutex

dff4d9d4-ee98-4856-b36f-7b3aeffd8d10

Attributes

encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/4496-0-0x0000000000450000-0x000000000077C000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 36 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	messenger_update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 36 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1136	cmd.exe
4104	cmd.exe
5000	cmd.exe
4332	cmd.exe
4528	cmd.exe
4748	cmd.exe
4044	cmd.exe
2052	cmd.exe
4492	cmd.exe
4948	cmd.exe
2692	cmd.exe
1084	cmd.exe
764	cmd.exe
840	cmd.exe
2832	cmd.exe
4552	cmd.exe
2992	cmd.exe
3148	cmd.exe
4444	cmd.exe
4452	cmd.exe
4152	cmd.exe
956	cmd.exe
1328	cmd.exe
1428	cmd.exe
2988	cmd.exe
1264	cmd.exe
4820	cmd.exe
4296	cmd.exe
2608	cmd.exe
960	cmd.exe
4608	cmd.exe
4632	cmd.exe
1256	cmd.exe
1768	cmd.exe
4460	cmd.exe
3356	cmd.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	messenger_update.exe
Token: SeDebugPrivilege	1216	messenger_update.exe
Token: SeDebugPrivilege	4404	messenger_update.exe
Token: SeDebugPrivilege	3492	messenger_update.exe
Token: SeDebugPrivilege	4132	messenger_update.exe
Token: SeDebugPrivilege	612	messenger_update.exe
Token: SeDebugPrivilege	2012	messenger_update.exe
Token: SeDebugPrivilege	3972	messenger_update.exe
Token: SeDebugPrivilege	1456	messenger_update.exe
Token: SeDebugPrivilege	2856	messenger_update.exe
Token: SeDebugPrivilege	2356	messenger_update.exe
Token: SeDebugPrivilege	4100	messenger_update.exe
Token: SeDebugPrivilege	4204	messenger_update.exe
Token: SeDebugPrivilege	836	messenger_update.exe
Token: SeDebugPrivilege	8	messenger_update.exe
Token: SeDebugPrivilege	1872	messenger_update.exe
Token: SeDebugPrivilege	2348	messenger_update.exe
Token: SeDebugPrivilege	2648	messenger_update.exe
Token: SeDebugPrivilege	3012	messenger_update.exe
Token: SeDebugPrivilege	3064	messenger_update.exe
Token: SeDebugPrivilege	4144	messenger_update.exe
Token: SeDebugPrivilege	3188	messenger_update.exe
Token: SeDebugPrivilege	4172	messenger_update.exe
Token: SeDebugPrivilege	2304	messenger_update.exe
Token: SeDebugPrivilege	4076	messenger_update.exe
Token: SeDebugPrivilege	1940	messenger_update.exe
Token: SeDebugPrivilege	4900	messenger_update.exe
Token: SeDebugPrivilege	2492	messenger_update.exe
Token: SeDebugPrivilege	4344	messenger_update.exe
Token: SeDebugPrivilege	628	messenger_update.exe
Token: SeDebugPrivilege	1000	messenger_update.exe
Token: SeDebugPrivilege	4432	messenger_update.exe
Token: SeDebugPrivilege	2736	messenger_update.exe
Token: SeDebugPrivilege	2872	messenger_update.exe
Token: SeDebugPrivilege	3408	messenger_update.exe
Token: SeDebugPrivilege	1732	messenger_update.exe
Token: SeDebugPrivilege	2684	messenger_update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 1136	4496	messenger_update.exe	85
PID 1136 wrote to memory of 2836	1136	cmd.exe	87
PID 1136 wrote to memory of 1216	1136	cmd.exe	88
PID 1216 wrote to memory of 2608	1216	messenger_update.exe	89
PID 2608 wrote to memory of 1492	2608	cmd.exe	91
PID 2608 wrote to memory of 4404	2608	cmd.exe	92
PID 4404 wrote to memory of 4104	4404	messenger_update.exe	93
PID 4104 wrote to memory of 632	4104	cmd.exe	95
PID 4104 wrote to memory of 3492	4104	cmd.exe	96
PID 3492 wrote to memory of 5000	3492	messenger_update.exe	97
PID 5000 wrote to memory of 3292	5000	cmd.exe	99
PID 5000 wrote to memory of 4132	5000	cmd.exe	100
PID 4132 wrote to memory of 4452	4132	messenger_update.exe	101
PID 4452 wrote to memory of 4072	4452	cmd.exe	103
PID 4452 wrote to memory of 612	4452	cmd.exe	104
PID 612 wrote to memory of 4332	612	messenger_update.exe	105
PID 4332 wrote to memory of 2624	4332	cmd.exe	107
PID 4332 wrote to memory of 2012	4332	cmd.exe	108
PID 2012 wrote to memory of 1084	2012	messenger_update.exe	109
PID 1084 wrote to memory of 1816	1084	cmd.exe	111
PID 1084 wrote to memory of 3972	1084	cmd.exe	112
PID 3972 wrote to memory of 764	3972	messenger_update.exe	113
PID 764 wrote to memory of 4272	764	cmd.exe	115
PID 764 wrote to memory of 1456	764	cmd.exe	116
PID 1456 wrote to memory of 2992	1456	messenger_update.exe	117
PID 2992 wrote to memory of 4112	2992	cmd.exe	119
PID 2992 wrote to memory of 2856	2992	cmd.exe	120
PID 2856 wrote to memory of 956	2856	messenger_update.exe	121
PID 956 wrote to memory of 3460	956	cmd.exe	123
PID 956 wrote to memory of 2356	956	cmd.exe	124
PID 2356 wrote to memory of 960	2356	messenger_update.exe	125
PID 960 wrote to memory of 2336	960	cmd.exe	127
PID 960 wrote to memory of 4100	960	cmd.exe	128
PID 4100 wrote to memory of 1328	4100	messenger_update.exe	129
PID 1328 wrote to memory of 4232	1328	cmd.exe	131
PID 1328 wrote to memory of 4204	1328	cmd.exe	132
PID 4204 wrote to memory of 2052	4204	messenger_update.exe	133
PID 2052 wrote to memory of 4520	2052	cmd.exe	135
PID 2052 wrote to memory of 836	2052	cmd.exe	136
PID 836 wrote to memory of 4528	836	messenger_update.exe	137
PID 4528 wrote to memory of 2284	4528	cmd.exe	139
PID 4528 wrote to memory of 8	4528	cmd.exe	140
PID 8 wrote to memory of 1428	8	messenger_update.exe	141
PID 1428 wrote to memory of 2264	1428	cmd.exe	143
PID 1428 wrote to memory of 1872	1428	cmd.exe	144
PID 1872 wrote to memory of 840	1872	messenger_update.exe	145
PID 840 wrote to memory of 4508	840	cmd.exe	147
PID 840 wrote to memory of 2348	840	cmd.exe	148
PID 2348 wrote to memory of 2988	2348	messenger_update.exe	149
PID 2988 wrote to memory of 2308	2988	cmd.exe	151
PID 2988 wrote to memory of 2648	2988	cmd.exe	152
PID 2648 wrote to memory of 4492	2648	messenger_update.exe	155
PID 4492 wrote to memory of 3936	4492	cmd.exe	157
PID 4492 wrote to memory of 3012	4492	cmd.exe	158
PID 3012 wrote to memory of 4948	3012	messenger_update.exe	159
PID 4948 wrote to memory of 1364	4948	cmd.exe	161
PID 4948 wrote to memory of 3064	4948	cmd.exe	162
PID 3064 wrote to memory of 3148	3064	messenger_update.exe	163
PID 3148 wrote to memory of 4512	3148	cmd.exe	165
PID 3148 wrote to memory of 4144	3148	cmd.exe	166
PID 4144 wrote to memory of 4608	4144	messenger_update.exe	167
PID 4608 wrote to memory of 2484	4608	cmd.exe	169
PID 4608 wrote to memory of 3188	4608	cmd.exe	170
PID 3188 wrote to memory of 1768	3188	messenger_update.exe	171

C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\estBFiWGnXgP.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
    "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eZ6fST34NCXM.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        5⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4404
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\czEZMLgFffbO.bat" "
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        7⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aEdF9z3WiJCx.bat" "
        8⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        9⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7oeK4HzP7Wpi.bat" "
        10⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        11⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:612
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ab7lBwpIPc74.bat" "
        12⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        13⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dYgjZfVNCF1h.bat" "
        14⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        15⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UbZczZgLwfl8.bat" "
        16⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        17⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9vR3Yz4JmOAn.bat" "
        18⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        19⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hgxUliDOHcEC.bat" "
        20⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        21⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\db91tpcdcuw3.bat" "
        22⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        23⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4100
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pTY1JTefxR6C.bat" "
        24⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        25⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BATu2L1WlmuG.bat" "
        26⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        27⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UPkwTdDg6Pgr.bat" "
        28⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        29⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:8
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fxgeQzlk8p3g.bat" "
        30⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        31⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JWXMsoXejbC8.bat" "
        32⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        33⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oJrBwl10PRbk.bat" "
        34⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        35⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        35⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2648
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uvFWnE5sz2XO.bat" "
        36⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        37⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        37⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SgUNJrpCTI27.bat" "
        38⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        39⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        39⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zQLJTyC1nnp6.bat" "
        40⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        41⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        41⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NSwAZH4QatVS.bat" "
        42⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        43⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        43⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MoRQLlbH78L3.bat" "
        44⤵
        Executes a command shell one-liner
        
        PID:1768
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        45⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        45⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4172
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0aEX5gFdM2oi.bat" "
        46⤵
        Executes a command shell one-liner
        
        PID:1264
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        47⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        47⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2304
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Bn64M2pdN8xy.bat" "
        48⤵
        Executes a command shell one-liner
        
        PID:4820
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        49⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        49⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ciKIHhvLdrXz.bat" "
        50⤵
        Executes a command shell one-liner
        
        PID:4460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        51⤵
        
        PID:1480
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        51⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\h1IcOUL9BImS.bat" "
        52⤵
        Executes a command shell one-liner
        
        PID:2832
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        53⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        53⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IDDcet5pwuc2.bat" "
        54⤵
        Executes a command shell one-liner
        
        PID:4444
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        55⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        55⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Vp6wQrVI3mWG.bat" "
        56⤵
        Executes a command shell one-liner
        
        PID:4748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        57⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        57⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6V2MUgyP71c3.bat" "
        58⤵
        Executes a command shell one-liner
        
        PID:4152
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        59⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        59⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nDYRVCKLEXpx.bat" "
        60⤵
        Executes a command shell one-liner
        
        PID:4044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        61⤵
        
        PID:1156
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        61⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1000
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1oJmluDy2nLB.bat" "
        62⤵
        Executes a command shell one-liner
        
        PID:3356
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        63⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        63⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:4432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\c3otfviJAvE1.bat" "
        64⤵
        Executes a command shell one-liner
        
        PID:2692
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        65⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        65⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2736
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Xm1IYsSj7Lhj.bat" "
        66⤵
        Executes a command shell one-liner
        
        PID:4632
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        67⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        67⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\72N4sN1pLUBA.bat" "
        68⤵
        Executes a command shell one-liner
        
        PID:4296
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        69⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        69⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yFU3gQDVKYYs.bat" "
        70⤵
        Executes a command shell one-liner
        
        PID:4552
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        71⤵
        
        PID:1380
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        71⤵
        Checks computer location settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1732
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Mo7U68uvuP3g.bat" "
        72⤵
        Executes a command shell one-liner
        
        PID:1256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        73⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\messenger_update.exe
        
        "C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"
        73⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

messenger_update.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\messenger_update.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

1oJmluDy2nLB.bat

Path C:\Users\Admin\AppData\Local\Temp\1oJmluDy2nLB.bat
Size 185B
SHA256 38d1a498338486faf3060a45a9fe597a47fd4cb79a0558530d9e37f86d42637b
MD5 26b1ccaeb743bece9f80eee19d9c18e9
SHA1 30af789d3dc5fecb74cd717186bff68c51758ddd
SHA512 fb67143e1b539b2064acacd97812fd5ba8f03c8d43f034e29f2c42934a1487c35301eac18dc7e7f8d8a7ef4ed8f298d2bdfe792eb40cb794e6b79fa0876aee37
TLSH
T172C012024185CA5F55146C0B59AAA68CF0950D9929497FA445028C9C73D2C58B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

6V2MUgyP71c3.bat

Path C:\Users\Admin\AppData\Local\Temp\6V2MUgyP71c3.bat
Size 185B
SHA256 caba5d8a4b4fd5390c93e4f87ccc802f0806850e6b4072ab5bf7cf2c9f9636b5
MD5 63c19b62c682ed174993048e4668b93d
SHA1 a8b213942e62fd1038716958e3d1453d81cbb698
SHA512 42cf95b9f4d94cd2a3c56cdf4fc35fdb4962019ede38581deeca1c6e536a6e8d78d0d93e6fef46796d15c41b84e4ca96992b67ba926246a1e78ff3574f74bb2d
TLSH
T1D0C012015181CA6E45145C0A1DEAA78CF09608A96E497FE48901889C13D2C98B5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

72N4sN1pLUBA.bat

Path C:\Users\Admin\AppData\Local\Temp\72N4sN1pLUBA.bat
Size 185B
SHA256 50628fa66ca6de5b9e56f9fd26c0830c8d7ac101efac6e14c41f3e8b9345496a
MD5 c5602a43d868d9fb6df555ec8ed0ac97
SHA1 27ee2a4731473970fc55a614810d68b24e553b44
SHA512 ae9a30944e5bec982410cc710220c2db5d93115c1c6e11a29944412d7ba8b050aa2fb1aca3ed169390c135c89f83ae71a1866f3508c937e0b26183ae81552f81
TLSH
T102C0220149918A3E49002C1B29A9628CF095089829087FA00900889C13D2C68B6CB7C6
MD5 SHA1 SHA512 TLSH

Submit Download

7oeK4HzP7Wpi.bat

Path C:\Users\Admin\AppData\Local\Temp\7oeK4HzP7Wpi.bat
Size 185B
SHA256 0a018019e6002b877282bf6a04cd723761cc3325cf02c45932e4c146c9b1dc3f
MD5 b1e27b069585393eae6fc47e9c621402
SHA1 07e918e541f0619860fcc7d072b42c00bf07e1cb
SHA512 665b64e560653acfa371bc7771e422e90af15758f340a59e9d056c73aed8b7e07d432d2a111c90c3762e7415e43b9def73a97d0ab171f9659e2ddd9492514ae7
TLSH
T167C0120141918A5E4A146C0A19A9B68CF0DA099D69497FA14911889C53D6C58B9CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

9vR3Yz4JmOAn.bat

Path C:\Users\Admin\AppData\Local\Temp\9vR3Yz4JmOAn.bat
Size 185B
SHA256 e56a5f80e9d2482b59775e32a51271590937f58ab0da646d4b0fd0505b3df581
MD5 cb862ff9d06a5d5be8c5368218f4c078
SHA1 00a11d0e6a4959e430ac526a092adb2ec542dda1
SHA512 f3f397b3ce8ddb00fe0feb52126fdd25c4367a22df88b8e0301ffe1eaeafc61b1ed964c728f03427366a68c9f55f2f737c598b10cb5e62e7f2cfa8d4cfb25625
TLSH
T1CEC0120181818A5E45146C0A1AA9A68DF09909E969497FA545018C5C13D7C59B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

BATu2L1WlmuG.bat

Path C:\Users\Admin\AppData\Local\Temp\BATu2L1WlmuG.bat
Size 185B
SHA256 ed9e18e32a53b7db624c473a57719d3ff9a9f0b72f333552ee56ecdf9ecac0f9
MD5 99281a1cc023ec9edea466493079abee
SHA1 4c61ae8c8069b42994b006363ee2baff870aaea3
SHA512 516b03211508c01e7af8d04585f0ff61e83da4cd49746d5b9ad3531b90f6359c32528b880d4ce3eba98dc2ae8704444c4a45fbb24f9d9a6417047ce6aa1a9941
TLSH
T164C0120141C18A5F55045C0A59A9668CF195099D69497FE14941C85C13D2C68B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Bn64M2pdN8xy.bat

Path C:\Users\Admin\AppData\Local\Temp\Bn64M2pdN8xy.bat
Size 185B
SHA256 3c1219250caccc6a8ba089edebbe6f8680eca2b925757c68f0412a4c491a725b
MD5 86f35392bc0f2d81a67ae62d9c2d20e1
SHA1 7b91d27cf37237eb4ee5a50de46f6519f6908f91
SHA512 6bbb036019f0de5bddaedfddb28728a433d0ff4cf20039c3356e7f11242a567e2fd638679cfcf7f2fb66cb0c7e117d4fef4a658f5a6287af66fdb203b9433abf
TLSH
T1EDC012015185CA6E49085C0A19A9768CF0E509A929497FA08541C85D27D6C59B5CB787
MD5 SHA1 SHA512 TLSH

Submit Download

IDDcet5pwuc2.bat

Path C:\Users\Admin\AppData\Local\Temp\IDDcet5pwuc2.bat
Size 185B
SHA256 b20cbe2d3b1836aef6f79aee2a2b009a37a18f1cb39a3cdf5f5fce2f297bb5a6
MD5 c1d15d789fdfd1a95d8d5d37d1e2b523
SHA1 e4ee7f38765ccdae4ebe7795d0a6ec96b6f849a9
SHA512 5ea5a97b042fb4262c7b73adf15a1b68d24caba34791e43ffcee6e01089bf5fcbe428aeaab02a4a4578684826b5d47c8a3cc76060bb8131657936e91084ab2ae
TLSH
T1EFC0120181818A5E45046C0A19E966CCF195099969497FA08501889C27D6D59B5CF7D3
MD5 SHA1 SHA512 TLSH

Submit Download

JWXMsoXejbC8.bat

Path C:\Users\Admin\AppData\Local\Temp\JWXMsoXejbC8.bat
Size 185B
SHA256 06d27b81c316101e0acfeb7ca9fbffd1a99c24cfc5b111f189bb13b8e9180a3f
MD5 d2f10f531c9e58f79f5dc5f8b4a560bd
SHA1 b526893289109c7300b502ccf57dbe2f4de41da5
SHA512 6c1d106b9d4484bd2b9c458a52e8442682ee756bcf456cf458106a15432d815a2b1b879599bd33a9891d2b128e6d00c6366f8c6b0afcaeffabdc35f38cd1b986
TLSH
T1C1C0120186818A5E45049D1A19AA678CF09A089969497FA04511889D13D2D9DB9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

Mo7U68uvuP3g.bat

Path C:\Users\Admin\AppData\Local\Temp\Mo7U68uvuP3g.bat
Size 185B
SHA256 046e90405c67f7ffbffa2376bf39e0b69690284b305e46dda7e2150672f94d59
MD5 56c201406a8fd7f1f2af1b3bd06ec89b
SHA1 a6a88ec02df4fca00ad6cf7df0b29921a879f3d8
SHA512 127a9a656874fe56da70884e112ba274ff0d635b5c91334ce94c0ce020563568a3b9657dcab9777f751f692309ebcf4627fec8ce77a4e55c81336395ab2dfb41
TLSH
T118C0120151928A5E55445C0A19A9A78CF09508AD29497FA04501C89C53D3DACB9CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

MoRQLlbH78L3.bat

Path C:\Users\Admin\AppData\Local\Temp\MoRQLlbH78L3.bat
Size 185B
SHA256 d7e53725f7865b720adcef79db6fdc9db2956db9b70ce614d1e0087468d3300d
MD5 7df4f39222d37c14a97be6b5b5c51982
SHA1 447cd75a885f53ade379a7ea16d02a30b10c3d55
SHA512 adb11e30925ace200fef8c1cb83bf50e1b2c3915435fe974d2714a31210742e1a6be7df313ad06509a0a43e9e3637232c6764cf274892353f79dd6927cecf766
TLSH
T18EC012018581CA5F45045C0A19ADA68DF09509AD29497FA14A11889C67D6C98B9CB782
MD5 SHA1 SHA512 TLSH

Submit Download

NSwAZH4QatVS.bat

Path C:\Users\Admin\AppData\Local\Temp\NSwAZH4QatVS.bat
Size 185B
SHA256 7f0274c85f319759404fdf5a18cc7c978be1c918aa1fccce80545b61f6d5f53a
MD5 eea68409684b718c393e11308a30a45e
SHA1 fcb902f56d67d683ce2ad843351617cc42daaf86
SHA512 0d70d05b52a8d6b505b429d916fd1d8a4948f145d81dbee222e7ecfb5007813b279e2d72054a08e60956f7afa01aec74d05dd03b03e7089e2d5bcff87fd961c4
TLSH
T1A2C0120141858A5E45145C0A19EAA68CF09509996A49BFA04541885D53D2CACB5EB782
MD5 SHA1 SHA512 TLSH

Submit Download

SgUNJrpCTI27.bat

Path C:\Users\Admin\AppData\Local\Temp\SgUNJrpCTI27.bat
Size 185B
SHA256 70d5ca65d83507dd4654e14f30999ad025195c8accbdeeeb5507b5f55e8165d4
MD5 6e00f947951dd531a1e809637fd2e672
SHA1 b3e363732a0a889f6b3a8fd510ae86c7df2b2cf4
SHA512 b3d1637b2e0ca4e09105aa421312e70e12f9cd60f970abc56490d57e204166087b6632e9e961ada3f1aebdbf57cc1bff031e1d7a2f8163bf67e2a558b1ea7f50
TLSH
T106C0120141829A6E45045C1A19AA66CCF19508992A497FA04605885D13D6C99B5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

UPkwTdDg6Pgr.bat

Path C:\Users\Admin\AppData\Local\Temp\UPkwTdDg6Pgr.bat
Size 185B
SHA256 50a7157ec28c96d79aae6a276747b6df6cb58ff522563f781c41ece1d5c296d4
MD5 072f5e6634b36c07ebc29345aa80320e
SHA1 d9935d6a56cb66b6c5a309fd34d799dedba171de
SHA512 9fbc847595981d4abdfd87817a560cb43af61455ec38c22fd0e6cbb24e03971f2f79a03efd64a1379355b91315b16662c8ef9214e4a33935bb2f6b9924f98a71
TLSH
T16AC012014581CA5E5A145C4A19A977CCF095089D2949BFA04641885C57D3C9CB5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

UbZczZgLwfl8.bat

Path C:\Users\Admin\AppData\Local\Temp\UbZczZgLwfl8.bat
Size 185B
SHA256 1c42bb089ac3ba9f7f01856f61c436607caff8af0757436cc0839fe8f30c65cb
MD5 4e9dc0205d2d10fabb5656b34cc849de
SHA1 025705fcc365c347fb5eadc281f61e021f407009
SHA512 9c86dc38318fe22b7dfe37d62548afb90f84c23ffd9ee9b2bd5f2f0479485187cbbc100fa3d18728ae206788db34afeaed6e4a67ed343e784e15ec1c678c10bd
TLSH
T124C0120156818A5F99045C1A29A9678CF196089D6D497FA04501885C23D2C58B5CF7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Vp6wQrVI3mWG.bat

Path C:\Users\Admin\AppData\Local\Temp\Vp6wQrVI3mWG.bat
Size 185B
SHA256 30d916809e693ae3698768ad384969dc5d4892ee75887dfc25be51d0f00bb797
MD5 5a8fb0d3d1664c4f1a1e1c8c4603d352
SHA1 603175302dcb15c794243408c8ca64b76b25f714
SHA512 b57a2152616cce698c8e7add976b68843eb9328f137f02ff08544d29622db03f761872194a8bd64d2518a2069fd67947962cf05b4a69723f436f1b51581ae400
TLSH
T158C0120185818A6E45145C1B59AAA68CF19609997A49BFA44E418C5C23D2C5CB5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

Xm1IYsSj7Lhj.bat

Path C:\Users\Admin\AppData\Local\Temp\Xm1IYsSj7Lhj.bat
Size 185B
SHA256 dc43f9adb07f870b41420f9cc51d421c90f1c2f278d69de5dddbf2fd2ebf2fa5
MD5 8e6799154f48ef25b3d1935b82466f6c
SHA1 c03c4b282ed58ef866ff6908dfefead159b1b8de
SHA512 225c579cb3a5d89e50fb8e9e228d059f7e59eda99662fadf13f08bb997d4fc52e9e44015d01458b477a12a4b27f7c823846b74bb927b7e43274c1d138a739507
TLSH
T15BC0220191818A1F05000C0A08AA628CF09608982909BFA005408C4C13C3C58B8CF382
MD5 SHA1 SHA512 TLSH

Submit Download

aEdF9z3WiJCx.bat

Path C:\Users\Admin\AppData\Local\Temp\aEdF9z3WiJCx.bat
Size 185B
SHA256 601c2714aa672e635c7f4ad0b00f5854841791da7c85371885e2829c268fd048
MD5 312da1fdba2ea5162670e0438dec640d
SHA1 d4b0fac49558ee9f5c5eaded933bd84b56c95dff
SHA512 221862d32f50a758168fd8f7702dbf92e9a2afe84a0afe9ad00101131de1ced216c429c6f27f3e4d3ab8aefd741d6ec2d956d02f9b6bd0e8faada62a3936fd89
TLSH
T187C0120181928A5E56145C4B19AAA78CF095099A2D49BFA449118C5C57D2C68B5CB782
MD5 SHA1 SHA512 TLSH

Submit Download

ab7lBwpIPc74.bat

Path C:\Users\Admin\AppData\Local\Temp\ab7lBwpIPc74.bat
Size 185B
SHA256 38d6404b7339a574ad11f5b6997007938f91c8cf415c647db9d395fc1784fdfa
MD5 a79b471eb216ee6878ea63a5d71a613c
SHA1 f24f6b7576a893e07261901620af716363f728ef
SHA512 df288f779cce08ead05b881581904bafef4081f1edc9200d53a396f4d5c3aebd222d558a7b7c86cd09c7c4bc45b6c97c202faf8133ff0240a3ed3d46ca0d21d9
TLSH
T190C0120191818A5E5A145C0A5DE9668CF1D608A929497FA44601889C23D2C98B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

c3otfviJAvE1.bat

Path C:\Users\Admin\AppData\Local\Temp\c3otfviJAvE1.bat
Size 185B
SHA256 1f51f630995458f327c16edd5f6ea3d082035ca07b2b86c090b5d85e7a857427
MD5 d4d18d18802b086041b3cee7d44943ca
SHA1 5ab6ad44db23cab58c5742b04aa25aab179edf01
SHA512 fa063479d03087d3307ec270cc9f405b9665acc14c074210d66a07da67c80c65f998cfac7dc54b0ee9f7e55dc2845b43bc970180de666fe0aadac86efa737629
TLSH
T1B9C012014191CA5E45145C0A19AA768CF0990AA929897FA04A51885C67D6C58B5DF782
MD5 SHA1 SHA512 TLSH

Submit Download

ciKIHhvLdrXz.bat

Path C:\Users\Admin\AppData\Local\Temp\ciKIHhvLdrXz.bat
Size 185B
SHA256 45525ea0cceadbfe2f5351fee2a4b9e5569e0b64c117ac88fa864aad398651c7
MD5 4a7b0b85ca57a30b7c04ee537665e68a
SHA1 fe28f37d7bd97ccc1f731790286b7d5fffa03325
SHA512 3ffdbaa1f3096549470773cb2f3c45805c3eb3d02579d6244246a75dc7a007cd9376e0b7f342019b51ac3de501b1e81e3deab19fdfdc7a14eec15ae416fc82ca
TLSH
T111C0120142868A5E55046C1A19A9668CF095099969497FA04901885C53D3CA8B5DB782
MD5 SHA1 SHA512 TLSH

Submit Download

czEZMLgFffbO.bat

Path C:\Users\Admin\AppData\Local\Temp\czEZMLgFffbO.bat
Size 185B
SHA256 f55f055fd55260bc46cef1e3ba56cf562ee3ac8d96cf67ae4f0012445840334a
MD5 684dac997426596539e7a4a89347c171
SHA1 8c7be4cd201c97755ab736614a5d04abfafc86bd
SHA512 5416eca6c95aacd9a1846768aeceefea297c2907346b15cd787054494930505f42b3091b1748bd2d0421ebdf0693797df5ef5983e15341b7fa88cab6090f306e
TLSH
T14BC0120151958A5E56145C1A19A9778CF0E9089929897FA04901889C13E2C58B9CF792
MD5 SHA1 SHA512 TLSH

Submit Download

dYgjZfVNCF1h.bat

Path C:\Users\Admin\AppData\Local\Temp\dYgjZfVNCF1h.bat
Size 185B
SHA256 c0a6c70ad92460adc14ea8c7ddcb0082e913e6ade84e543bec23a032b58f7989
MD5 5bc8b3544a9e4ec868507be88191095c
SHA1 4c9a65470e834896c593d321a18abb86977a00f8
SHA512 c0b0294d3038e2b47319eb9945fd38873cec6a342ef45cc10b9341ade05cac5c9c259fca36c32744522bf15751b094ca0c40b4a70c391345d2ee6b83a804dc4f
TLSH
T12EC0220242818A6E0A000C0A08A9A6CCF0E9089829087FA40600885C13C2C9CB4CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

db91tpcdcuw3.bat

Path C:\Users\Admin\AppData\Local\Temp\db91tpcdcuw3.bat
Size 185B
SHA256 25f8c807bf609f47d9159c19179910999ec30011d06b3bcbc1fc4d6954eb372c
MD5 374be6472cddaae6ec38474da8fe6ede
SHA1 7a980d2a4c33c8a1c63c6d7ce1b7f3c4245c1883
SHA512 a895f07b6f98d693aff10ddc81bdf11c86896ec2b3958cb99797cff3bf2dd0d302f91da4142d34204eaabb12cb8f925379b327afb0b7f6d7576af5e334f35aed
TLSH
T1AFC012015291CA5E45145C0A19AD6ACCF095099D294A7FA04A428C5D23D6C9CB5DB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

eZ6fST34NCXM.bat

Path C:\Users\Admin\AppData\Local\Temp\eZ6fST34NCXM.bat
Size 185B
SHA256 f194bcf05b8e1f8be2c3dc84bb743bc2e6a8bfe858bee119d21727735db73b11
MD5 1b878ef53fc4309c20ba66c0c0d68295
SHA1 f0b27cdfe482424b1b53525904c5b6e69d5f161b
SHA512 f52514f1ec8aa2d4dc90eae2648a769c36a5b00829209c9e0b78e46772affffb7fbdae46c8c957915743218b50c64fd2dcced51f2431d9936d9d9552048c6a60
TLSH
T12AC0120141958A5E5A145C1B19A9778CF0E90899294A7FA045018C9C63D3C5CB5CB792
MD5 SHA1 SHA512 TLSH

Submit Download

estBFiWGnXgP.bat

Path C:\Users\Admin\AppData\Local\Temp\estBFiWGnXgP.bat
Size 185B
SHA256 6bed6da56672d3dbf6b2a223bff0daba76358dfb902e1b3a806ff20c8ee00e01
MD5 7c8d355efce1c5c67cf3b09d47527b50
SHA1 ff5e2119082cae9e8226c0bf03fd0d9045dd0257
SHA512 47c7ef5637c428adc0773443a5366859c06ac2e750d522e56dae8061409d39ad70a14f1a9cb055f8edc60528626c611a99c92f68e47e66937ca6462a0b69eb60
TLSH
T126C0120145818A6E55045C0B19A976CCF0D60DAD29497FA445058C5C23D3C69B9CBB82
MD5 SHA1 SHA512 TLSH

Submit Download

fxgeQzlk8p3g.bat

Path C:\Users\Admin\AppData\Local\Temp\fxgeQzlk8p3g.bat
Size 185B
SHA256 83fe5084144bf9dbd6c3f8a57aba790c0b3c717fb6c752edacf055399c5b93e9
MD5 0a30d60a8ccf5a50a9f53ffcf0b523c5
SHA1 d166257681d8695f4fdc3ba5ef0891f2ce31a757
SHA512 4a9f9a4469f556cf4cd51b775f866a0d47d98942c39476938f22ceebe4c1e085ab032b488432b10c8f111cfa0d1b3cbee47e628fb6d72eff81b865785526d78d
TLSH
T11EC0120155918A5E45045C0A19AAA78CF0A608A969497FA14641C85D13D2C58B5CBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

h1IcOUL9BImS.bat

Path C:\Users\Admin\AppData\Local\Temp\h1IcOUL9BImS.bat
Size 185B
SHA256 14431307bb6e18d098641cc1fbbce764cffca9da613f6cf750b51afa07c25595
MD5 f7930f442ebe161819725328ea1f2f14
SHA1 d3e9aabf49930f27d05b83587b0fb1c758db9618
SHA512 a6fc1e794451f025147bddbd4813b53b5d1b0775e4666937bdc0af71d4349d386d7c9d372af2d2284ece95b693ca64bf2da8a510b42ed9aaee0009f74fd922f8
TLSH
T1B8C0120195858A5E4A045C0A1DA9768CF19608996D49BFB04541889D27D6C5DB9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

hgxUliDOHcEC.bat

Path C:\Users\Admin\AppData\Local\Temp\hgxUliDOHcEC.bat
Size 185B
SHA256 f78614680ba1926202a86a8a84f18bcfc1a47cb61226a8dd469485703b19c03e
MD5 6ffe8e8cd44dc8fc32bde44995c9e5b5
SHA1 1a1c7e5bc8fe9fc956fc46dbde631f7a0991b15d
SHA512 d9bbffbeba3e3c717e4cdf5dc3e868145462a21fdfeb79debb5769d2f791ede2ed20c18a50701cc985db0e8ccf3199a4b34d0fbfea7cc01fd48e88ef4e4fc0f2
TLSH
T16CC012015182CA6E45045C0A19A966CCF0D609992949BFA0461288AC13D2C68B5DB792
MD5 SHA1 SHA512 TLSH

Submit Download

nDYRVCKLEXpx.bat

Path C:\Users\Admin\AppData\Local\Temp\nDYRVCKLEXpx.bat
Size 185B
SHA256 f811e1760812b4d592c68c81e488089347405fc7479a2bb993d256b8076202c7
MD5 1b0ff33d41f79d171783d6ceb15b57a1
SHA1 46f61a9530349ecfd25cc9dfb374f1ce6d275d93
SHA512 6b493a1a76cb4a5adce6f822712e319d535b45105ed498bbe7ba474033313f04ddf83ad87d522b8ff3085cdcf8ae6d649935c528678df6499e5a75fa2ae6a15c
TLSH
T16FC0120181828A5E5B145D1A19AA768CF0A5099929497FA44911885C13D2C58B5CF782
MD5 SHA1 SHA512 TLSH

Submit Download

oJrBwl10PRbk.bat

Path C:\Users\Admin\AppData\Local\Temp\oJrBwl10PRbk.bat
Size 185B
SHA256 fdf34b46104147aa309cc9eae795c29b42524a74878e96e544eb5b8ba396ed69
MD5 4ef771c59e9c91f8d860d418a92511ff
SHA1 c1b6aa212c9696cffde9766fb168596bf161bd03
SHA512 c5c5e8d0c159b3d198aba710c5f5be86fc97fb903421d80ac5c652025cf2949f89711af45be6d46a99321ce803926f6c73d9b968c4fe50d29b9c342dcf0e3d72
TLSH
T19AC012014185CE5E59045C1B19AA67CCF0A9089969497FA44901889D53D6C58B6CB792
MD5 SHA1 SHA512 TLSH

Submit Download

pTY1JTefxR6C.bat

Path C:\Users\Admin\AppData\Local\Temp\pTY1JTefxR6C.bat
Size 185B
SHA256 a95598ac93874a048e13e76316c152011b9676f0ac510cf60fa46db4b9b43ec5
MD5 c0356ccff4943e4175e73bf0b2bf4d76
SHA1 ab186f018d88963c808c3fa8919477ba92474285
SHA512 686ad9c0c6a5726fc382765a9bc751bb62bf341be14307bc507135ecf0ca83437aef24f85e09adbec26a14b204d74c5d062bdb16a1ae409424a1695c85c920de
TLSH
T10CC0120142918A6E45045C0A29B9668DF09508AD2949BFA045018C9C13D2C58B9DB7E2
MD5 SHA1 SHA512 TLSH

Submit Download

uvFWnE5sz2XO.bat

Path C:\Users\Admin\AppData\Local\Temp\uvFWnE5sz2XO.bat
Size 185B
SHA256 25790fdc2da4a7c9a9807b312ca603981119314e545199589f26123855c636da
MD5 bad637ff4aefbd32544a3dca43f3d5ef
SHA1 57592620ef078ba68a1429ca46c69bc58385c962
SHA512 2ad46e1cfb3b23e0ed713e7cd7478a5c02230ed7f53d3925dc8929938792070713cf931178dc616fa6aec0a1e37eebf8fd4cc4c9ad06d1ece72f3f15459a0b84
TLSH
T1CBC0120145818A6E49045C0A19EDAACCF0D909A92D497FA04541C85C53D3C58B5CB7C2
MD5 SHA1 SHA512 TLSH

Submit Download

yFU3gQDVKYYs.bat

Path C:\Users\Admin\AppData\Local\Temp\yFU3gQDVKYYs.bat
Size 185B
SHA256 0887d2be40190969be7cb48acf88bc83c255c8ba220a75498589e1928fc3221e
MD5 17e0ffeb4930b4de80b0121c1cc6899b
SHA1 0ccdc4fd97f8316dd8d8ff6290fe6b071b24b86a
SHA512 749625041b9d75c4074b731e6edfe5ac3a41eea20072afe04dec381e07c6eca24c96981005b9c93b261f96649fa6e175209bb6377b968c2d8cfa979589c83214
TLSH
T103C0120145828A5E45049C1A5DA966CCF0D60D9D2D497FA445418C5C63D3C68B9CF782
MD5 SHA1 SHA512 TLSH

Submit Download

zQLJTyC1nnp6.bat

Path C:\Users\Admin\AppData\Local\Temp\zQLJTyC1nnp6.bat
Size 185B
SHA256 00c771134bf66e6b24ba9d7027b84be30d21dd0713f6e54ef5355231145f79fe
MD5 492b6795802249348c371bf0a87e8aa8
SHA1 fa451c63b0b82532bc833714f37f7aed4ff89182
SHA512 e90b8fb68ddbfc9952db0e539b3a25cea6135d819ed77d4930c53c95988a83759ad20f250806d46b854bc5a60376f14989c6ae8aaa872ce9fd052899c804d62a
TLSH
T100C012014282CA6E45085C0A59A9668CF0A5199969497FA04901C85D23D2C68B9CBB92
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-8-0x000000001B7B0000-0x000000001B7C0000-memory.dmp

Download

memory/4496-0-0x0000000000450000-0x000000000077C000-memory.dmp

Download

memory/4496-1-0x0000000002990000-0x00000000029A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads