Overview

overview

9

Static

static

1

2026-08-06...ry.exe

windows10-2004-x64

9

2026-08-06...ry.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    140s
  • max time network
    158s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 23:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_11d4419478a9bcf310036aa24da73d0a_dosia_elex_quasar-rat_wannacry.exe
  • Size 31.5MB
  • Sample260806-3jfsmsch34
  • SHA256 0d2e78e95036573caf695ca801d2448c96346e54f37ecfa17434b03d0a8ae66f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 14 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_11d4419478a9bcf310036aa24da73d0a_dosia_elex_quasar-rat_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_11d4419478a9bcf310036aa24da73d0a_dosia_elex_quasar-rat_wannacry.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\Setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5416
      • C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\DownloadManager.exe
        "C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\DownloadManager.exe" -u "https://edutrial.autodesk.com/NetSWDLD/ODIS/prd/2026/RVT/8986CA21-EA9C-32F3-A1DB-C34BD2BDA7A5/WI/Autodesk_Revit_2026_ML_setup.dat" -p "C:\Users\Admin\AppData\Local\Temp\odis_download_dest\2598194311511737927\Autodesk_Revit_2026_ML_setup.dat" --productname Bootstrap --productversion 2.21.0.14
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\upi.exe" --cmd=get-device-id C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          4⤵
          • Executes dropped EXE
          PID:2712
        • C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\upi.exe" C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\upiconfig.xml C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5880
      • C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\DownloadManager.exe
        C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\DownloadManager.exe -u https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/ODIS/C976E324-2E2F-3B7A-826C-6389BF66FB79/pkg.odis.tar -p C:\Users\Admin\AppData\Local\Temp\odis_download_dest\C976E324-2E2F-3B7A-826C-6389BF66FB79\pkg.odis.tar --productname BootStrap --productversion 2.21.0.14 --fileChecksum D28D082A2CD2EB7AB80292AE8F6C3416F24A6DE4804C716EF3129DB1C724CC59
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\upi.exe" --cmd=get-device-id C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          4⤵
          • Executes dropped EXE
          PID:4364
        • C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\upi.exe" C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\upiconfig.xml C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          4⤵
            PID:808

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          pkg.odis.xml
          • Path C:\Autodesk\WI\{8986CA21-EA9C-32F3-A1DB-C34BD2BDA7A5}\RVT_2026_zh-CN\ODIS\pkg.odis.xml
          • Size 2KB
          • SHA256 8635ce8a37c77aa464b3a6e08abdc28525ac0fcc573ab9a0322bb0c615c0a45f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          setup.xml
          • Path C:\Autodesk\WI\{8986CA21-EA9C-32F3-A1DB-C34BD2BDA7A5}\RVT_2026_zh-CN\setup.xml
          • Size 3KB
          • SHA256 462c38a19183390ce6eabfbf182948152be9ad09aacbd4db7797ac8396589923
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1A374813EDB1A6631387E414D3E73232
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232
          • Size 176KB
          • SHA256 f56e0dc616f9e58e0bc1f374bbcf630a260aa76a5ea1fb6e02f41f8e057f586f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          616AD1AB067CFD351D6C0EF6F3E12F40
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\616AD1AB067CFD351D6C0EF6F3E12F40
          • Size 1KB
          • SHA256 9d9e8ad7b7e2bebe98dee283adb6496263f945acb2db3f3af94b1b8b1228f195
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 727B
          • SHA256 31530c48d4b9d2903020d05bed553129a4d2c0b8df2d03b5bb4a961f28b95e15
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1A374813EDB1A6631387E414D3E73232
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232
          • Size 306B
          • SHA256 ae37d697fc68f244e014b356cbb8f3d9451c2e1b066ae1822d5a8f4de452d1b7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          616AD1AB067CFD351D6C0EF6F3E12F40
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40
          • Size 252B
          • SHA256 bc65042abb9c1f9b4b3255f6c401d653811a83127eac43568220e84d364251f0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 412B
          • SHA256 d51fce3048dae15966a2c18f7fbe151b7cc67428658f80d7bb7c7cdca1033732
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          cer.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\5fc9791ff15c90bcaebdce35e1bf4ead6d06eeaa\cer.log
          • Size 6KB
          • SHA256 b37736851246b1ba1dd308b4ed10487cc382116cfb3c12bc03952303776711ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sandbox_senddmp.location
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\cache\sandbox_senddmp.location
          • Size 69B
          • SHA256 f5176cf70932d29527c2c11ca769a1c0b85ed64d502cb0c646c5a8ae1ed1454a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
          • Size 850B
          • SHA256 cd0ae3b16096576f49fc5bd0928d4483bdb02b3e292247fd8bcd9707d180a27a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
          • Size 1KB
          • SHA256 85bc1f156587b9809ea43e05232790f6e8012809382e1f2cda385a9bf5dabc47
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
          • Size 3KB
          • SHA256 e2e47ce08cf31c30b29b76b648f6c45bc8ae860794391058b909212c645ee446
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DLM.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\ODIS\DLM.log
          • Size 1KB
          • SHA256 06bcd98355152089915b44c2cd4495a7745640e5472b8988c4911a4e8498f755
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Autodesk_dialog_512x512.png
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\Autodesk_dialog_512x512.png
          • Size 122KB
          • SHA256 bff55fcaf87784d76acf68f10b9d0a13da938ba2eadeb8a8482fc0a28e618237
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UPI.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\UPI.dll
          • Size 659KB
          • SHA256 df1a1da45a3f07388c7bcfd060893b25811e59961f0377be4516a043b2c1f911
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DeviceSettingsProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\service\DeviceSettingsProvider.dll
          • Size 10.0MB
          • SHA256 ad995c6765796fe169d9c591a06acae87054cc763afa39e4f939033a2335eac2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          upi.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\CER\upi.exe
          • Size 417KB
          • SHA256 a5ca75454365313920411e212f5380e3e921e3501cfce0571c1bc09f681906cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cer.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\cer.dll
          • Size 2.4MB
          • SHA256 b1889dc687ef9ac6472fa20b06e66e6bcf55eb13482b885a200114b0f8b55576
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          upiconfig.xml
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\CER\upiconfig.xml
          • Size 984B
          • SHA256 df91796ef977d62d6e29ca1d2aca073e52ec2d4e2bc779cdb40adf9be613bfea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DownloadManager.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\DownloadManager.exe
          • Size 18.5MB
          • SHA256 a43121d172933baba6413c924b10b9a0fe6279ebb53d7b13b5b5bbc6305ebd07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bootstrap.json
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\bootstrap.json
          • Size 1009B
          • SHA256 03cc2d69b489e94836e8ffe1c57678211e33205f99843ad877f54dcf64281738
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AdHttpLib.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\odis.bs.win\AdHttpLib.dll
          • Size 17.8MB
          • SHA256 9e6b1be5d5659016441d904eddef3c51e45c8ee5a61c86c4d0a8414e463d38bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdpSDKCore.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\odis.bs.win\AdpSDKCore.dll
          • Size 1009KB
          • SHA256 132f82ab141fd6bfa600b72fc01a0c59dd04c1d3ba9ce462ab6fc6c500582ded
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DeviceSettingsProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\odis.bs.win\DeviceSettingsProvider.dll
          • Size 10.0MB
          • SHA256 a91807ac33c524d476fbeaaef2e4048c49de6636f2ab05235e6f5d63fef5aec4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\odis.bs.win\VCRUNTIME140.dll
          • Size 83KB
          • SHA256 0164b1bfdcedb07295eae14fa5dca88b46862bc91ec2d317ef8559bbec8128ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\odis.bs.win\msvcp140.dll
          • Size 612KB
          • SHA256 bdf1d095d1419e9ce49e774590ee092b1b673ca259c0126f21afe595b3e661eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\odis.bs.win\vcruntime140_1.dll
          • Size 35KB
          • SHA256 54a38117f402f43d4e819642f6e74c048666e840037a3c1c0944bc8bb941d69c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wxbase331u_vc_x64_custom.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\odis.bs.wx\wxbase331u_vc_x64_custom.dll
          • Size 3.2MB
          • SHA256 000a5f9b788294852e764e52156f7646729d9e87f1c9b75be3e57c7828719e96
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wxmsw331u_core_vc_x64_custom.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\odis.bs.wx\wxmsw331u_core_vc_x64_custom.dll
          • Size 10.1MB
          • SHA256 9696175fd303290aa5fa7bf3bc2d2f60bdc79c7018053658b96c6ff5ce1e216c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          strings.xml
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\ODIS\strings.xml
          • Size 22KB
          • SHA256 ae652e226f0d983d0445178dcf8152265426460cabd6cfe49f7d5d9966c24a9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\Setup.exe
          • Size 23.3MB
          • SHA256 add11ecedc80266de63a54ed9678e736c96c752c35e9271b42e28de995914786
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ad.logconfig
          • Path C:\Users\Admin\AppData\Local\Temp\7z9DBC598C\SetupRes\ad.logconfig
          • Size 1KB
          • SHA256 768e351a487ff277f0f06f1af2dbfc0d2ad83d2ce6aa97b9389f6e67e2bc329a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Autodesk_Revit_2026_ML_setup.dat
          • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\2598194311511737927\Autodesk_Revit_2026_ML_setup.dat
          • Size 95B
          • SHA256 4316879b01d4ea1811c52d8cf14b9d94cb3de3dcb299a51cef54902ce8704c59
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi_deviceid2
          • Path C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          • Size 194B
          • SHA256 10e5117c8ee5dfcee9abb8f3412966addd8edb12da9857019bdced09cb323eb0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi_info.xml
          • Path C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          • Size 400B
          • SHA256 d45ab0ae5ec31cf3b6ec2965c265dfea321a6b10117ed70024cd9a165e645a74
          • MD5 SHA1 SHA512 TLSH
          Submit Download