Overview

overview

6

Static

static

1

2026-08-06...ry.exe

windows10-2004-x64

6

2026-08-06...ry.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 05:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_162a443086e3cd8feca4cf49e9c63a28_dosia_elex_quasar-rat_wannacry.exe
  • Size 31.5MB
  • Sample260806-gbthwathqa
  • SHA256 0377af4eec521a2d4c8fb96a9654b6c1800b86c15949ddcc4cc476ca1fb959fe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discovery

Malware Config

Signatures

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 15 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_162a443086e3cd8feca4cf49e9c63a28_dosia_elex_quasar-rat_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_162a443086e3cd8feca4cf49e9c63a28_dosia_elex_quasar-rat_wannacry.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1068
    • C:\Users\Admin\AppData\Local\Temp\7z9284F42C\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\7z9284F42C\Setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\DownloadManager.exe
        "C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\DownloadManager.exe" -u "https://efulfillment.autodesk.com/NetSWDLD/ODIS/prd/2026/PLC0000037/9D2CCBC9-11A1-3394-8800-C26A6E6306BB/WI/Autodesk_DWG_TrueView_2026_en-US_setup.dat" -p "C:\Users\Admin\AppData\Local\Temp\odis_download_dest\11262431351109164580\Autodesk_DWG_TrueView_2026_en-US_setup.dat" --productname Bootstrap --productversion 2.21.0.14
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3260
        • C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\upi.exe" --cmd=get-device-id C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          4⤵
          • Executes dropped EXE
          PID:1364
        • C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\upi.exe" C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\upiconfig.xml C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6096
      • C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\DownloadManager.exe
        C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\DownloadManager.exe -u https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/ODIS/C976E324-2E2F-3B7A-826C-6389BF66FB79/pkg.odis.tar -p C:\Users\Admin\AppData\Local\Temp\odis_download_dest\C976E324-2E2F-3B7A-826C-6389BF66FB79\pkg.odis.tar --productname BootStrap --productversion 2.21.0.14 --fileChecksum D28D082A2CD2EB7AB80292AE8F6C3416F24A6DE4804C716EF3129DB1C724CC59
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3116
        • C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\upi.exe" --cmd=get-device-id C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          4⤵
          • Executes dropped EXE
          PID:4392
        • C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\upi.exe" C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\upiconfig.xml C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4984
      • C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\7za.exe
        C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\7za.exe x -ttar C:\Users\Admin\AppData\Local\Temp\odis_download_dest\C976E324-2E2F-3B7A-826C-6389BF66FB79\pkg.odis.tar -aoa "-o""C:\Users\Admin\AppData\Local\Temp\odis_download_dest\14695981039346656039"""
        3⤵
          PID:5408

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          pkg.odis.xml
          • Path C:\Autodesk\WI\{9D2CCBC9-11A1-3394-8800-C26A6E6306BB}\PLC0000037_2026_en-US\ODIS\pkg.odis.xml
          • Size 2KB
          • SHA256 8635ce8a37c77aa464b3a6e08abdc28525ac0fcc573ab9a0322bb0c615c0a45f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          setup.xml
          • Path C:\Autodesk\WI\{9D2CCBC9-11A1-3394-8800-C26A6E6306BB}\PLC0000037_2026_en-US\setup.xml
          • Size 3KB
          • SHA256 9faa403e47379610dd50233a6ea74901bf5420961330bc19b4de6902812103a6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          329B6147266C1E26CD774EA22B79EC2E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E
          • Size 176KB
          • SHA256 7ae4f315cb0cabe9631ff048d0097efca81c7398117119021d3a7655640e3f22
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
          • Size 471B
          • SHA256 84bd2f8e8edf2c1e8faf64423787c6f281fd81bd2c2761a68bd507996b14de46
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 727B
          • SHA256 95c852c2808ea9464b8ef2648912a121d6a2bfdd95126cc3f6c11d41c0b461b0
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          329B6147266C1E26CD774EA22B79EC2E
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E
          • Size 306B
          • SHA256 a9524253322f9636212d261d5676c216d3867550593cb88b5efe8fe9e1a46a6a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
          • Size 400B
          • SHA256 f9850fed7c471d2ef33c2efcb5ed6a0f3178863f1ccf058b2f38dc2c52549c43
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 412B
          • SHA256 3f50dd2fcd76d7e309da61083385e082fdbb4a89befcbf9b010ff352cf53b991
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          cer.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\63671bce8f9a25c2ff9262fcf1eba1e4d445ce0c\cer.log
          • Size 4KB
          • SHA256 902ecf4ce27aec95cf46bfce579d0f1f954e040359e3babcee14427b2268f575
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sandbox_senddmp.location
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\cache\sandbox_senddmp.location
          • Size 69B
          • SHA256 3bd2bb13b938f08a8a098dacd4766e92975326123e961d833d98a3885388ef6f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
          • Size 850B
          • SHA256 595cbd0f89af93cf6c5d8d7eab119817a17a695e456a62d2553c82efd431ce3a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
          • Size 1KB
          • SHA256 a5594e5f8aadc1e53656b3e23eaa05e35d9ea5ec86cba53d7f7fe25258dbf709
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
          • Size 3KB
          • SHA256 26b709af32d715b9913001ff4545462725ffdd9fa5a7a55bbe7ee6511378a582
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DLM.log
          • Path C:\Users\Admin\AppData\Local\Autodesk\ODIS\DLM.log
          • Size 1KB
          • SHA256 7bb42cb4b83bca2b0524b41a438f8db827eca6aea077f47b24c683d59640fd24
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          7za.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\7za.exe
          • Size 1.1MB
          • SHA256 49e64a3e6a4b69c98e647201ad0b18c5a3fb16487d9cad618b2c2b824b3c9dac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Autodesk_dialog_512x512.png
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\Autodesk_dialog_512x512.png
          • Size 122KB
          • SHA256 bff55fcaf87784d76acf68f10b9d0a13da938ba2eadeb8a8482fc0a28e618237
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          UPI.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\UPI.dll
          • Size 659KB
          • SHA256 df1a1da45a3f07388c7bcfd060893b25811e59961f0377be4516a043b2c1f911
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DeviceSettingsProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\service\DeviceSettingsProvider.dll
          • Size 10.0MB
          • SHA256 ad995c6765796fe169d9c591a06acae87054cc763afa39e4f939033a2335eac2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          upi.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\CER\upi.exe
          • Size 417KB
          • SHA256 a5ca75454365313920411e212f5380e3e921e3501cfce0571c1bc09f681906cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cer.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\cer.dll
          • Size 2.4MB
          • SHA256 b1889dc687ef9ac6472fa20b06e66e6bcf55eb13482b885a200114b0f8b55576
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          upiconfig.xml
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\CER\upiconfig.xml
          • Size 984B
          • SHA256 df91796ef977d62d6e29ca1d2aca073e52ec2d4e2bc779cdb40adf9be613bfea
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DownloadManager.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\DownloadManager.exe
          • Size 18.5MB
          • SHA256 a43121d172933baba6413c924b10b9a0fe6279ebb53d7b13b5b5bbc6305ebd07
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          bootstrap.json
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\bootstrap.json
          • Size 968B
          • SHA256 9d964feae325fd444d40364382622466b4c2469a649db98ac01b0d2f564a5c7f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          AdHttpLib.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\odis.bs.win\AdHttpLib.dll
          • Size 17.8MB
          • SHA256 9e6b1be5d5659016441d904eddef3c51e45c8ee5a61c86c4d0a8414e463d38bc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdpSDKCore.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\odis.bs.win\AdpSDKCore.dll
          • Size 1009KB
          • SHA256 132f82ab141fd6bfa600b72fc01a0c59dd04c1d3ba9ce462ab6fc6c500582ded
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DeviceSettingsProvider.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\odis.bs.win\DeviceSettingsProvider.dll
          • Size 10.0MB
          • SHA256 a91807ac33c524d476fbeaaef2e4048c49de6636f2ab05235e6f5d63fef5aec4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\odis.bs.win\VCRUNTIME140_1.dll
          • Size 35KB
          • SHA256 54a38117f402f43d4e819642f6e74c048666e840037a3c1c0944bc8bb941d69c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\odis.bs.win\msvcp140.dll
          • Size 612KB
          • SHA256 bdf1d095d1419e9ce49e774590ee092b1b673ca259c0126f21afe595b3e661eb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\odis.bs.win\vcruntime140.dll
          • Size 83KB
          • SHA256 0164b1bfdcedb07295eae14fa5dca88b46862bc91ec2d317ef8559bbec8128ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wxbase331u_vc_x64_custom.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\odis.bs.wx\wxbase331u_vc_x64_custom.dll
          • Size 3.2MB
          • SHA256 000a5f9b788294852e764e52156f7646729d9e87f1c9b75be3e57c7828719e96
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wxmsw331u_core_vc_x64_custom.dll
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\odis.bs.wx\wxmsw331u_core_vc_x64_custom.dll
          • Size 10.1MB
          • SHA256 9696175fd303290aa5fa7bf3bc2d2f60bdc79c7018053658b96c6ff5ce1e216c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          strings.xml
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\ODIS\strings.xml
          • Size 22KB
          • SHA256 ae652e226f0d983d0445178dcf8152265426460cabd6cfe49f7d5d9966c24a9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Setup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\Setup.exe
          • Size 23.3MB
          • SHA256 add11ecedc80266de63a54ed9678e736c96c752c35e9271b42e28de995914786
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ad.logconfig
          • Path C:\Users\Admin\AppData\Local\Temp\7z9284F42C\SetupRes\ad.logconfig
          • Size 1KB
          • SHA256 768e351a487ff277f0f06f1af2dbfc0d2ad83d2ce6aa97b9389f6e67e2bc329a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Autodesk_DWG_TrueView_2026_en-US_setup.dat
          • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\11262431351109164580\Autodesk_DWG_TrueView_2026_en-US_setup.dat
          • Size 95B
          • SHA256 32be371273c35ca195080860ea82bbf28f678c66446e51828a838a4a62610368
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi_deviceid2
          • Path C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          • Size 194B
          • SHA256 48442ec4db2685d8df04898da98742fc863ac35570635cfe84f4bd08f1e521e8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          upi_info.xml
          • Path C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          • Size 400B
          • SHA256 d45ab0ae5ec31cf3b6ec2965c265dfea321a6b10117ed70024cd9a165e645a74
          • MD5 SHA1 SHA512 TLSH
          Submit Download