Overview

overview

4

Static

static

1

2026-08-06...ry.exe

windows10-2004-x64

4

2026-08-06...ry.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 07:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_19cbeedc013953d4d3ed968a54df6a6c_dosia_elex_quasar-rat_wannacry.exe
  • Size 31.5MB
  • Sample260806-hwpabswapd
  • SHA256 3ece4466df469c0b027791f15f1f9f49e1e63a19dd0bdc345fcc22c7f72dbb69
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 16 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_19cbeedc013953d4d3ed968a54df6a6c_dosia_elex_quasar-rat_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_19cbeedc013953d4d3ed968a54df6a6c_dosia_elex_quasar-rat_wannacry.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5288
    • C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\Setup.exe
      C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\Setup.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5972
      • C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\DownloadManager.exe
        "C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\DownloadManager.exe" -u "https://efulfillment.autodesk.com/NetSWDLD/ODIS/prd/2025/RSAPRO/3D7D7301-4C7B-3E1D-B59C-CB6B6F348963/WI/Robot_Structural_Analysis_Professional_2025_ML_setup.dat" -p "C:\Users\Admin\AppData\Local\Temp\odis_download_dest\7558147082222508134\Robot_Structural_Analysis_Professional_2025_ML_setup.dat" --productname Bootstrap --productversion 2.21.0.14
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\upi.exe" --cmd=get-device-id C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          4⤵
          • Executes dropped EXE
          PID:4792
        • C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\upi.exe" C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\upiconfig.xml C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5420
      • C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\DownloadManager.exe
        C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\DownloadManager.exe -u https://dds.autodesk.com/NetSWDLD/ODIS/prd/1.0/ODIS/C976E324-2E2F-3B7A-826C-6389BF66FB79/pkg.odis.tar -p C:\Users\Admin\AppData\Local\Temp\odis_download_dest\C976E324-2E2F-3B7A-826C-6389BF66FB79\pkg.odis.tar --productname BootStrap --productversion 2.21.0.14 --fileChecksum D28D082A2CD2EB7AB80292AE8F6C3416F24A6DE4804C716EF3129DB1C724CC59
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\upi.exe" --cmd=get-device-id C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
          4⤵
          • Executes dropped EXE
          PID:2084
        • C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\upi.exe
          "C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\upi.exe" C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\upiconfig.xml C:\Users\Admin\AppData\Local\Temp\upi_info.xml
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6016

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        pkg.odis.xml
        • Path C:\Autodesk\WI\{3D7D7301-4C7B-3E1D-B59C-CB6B6F348963}\RSAPRO_2025_en-US\ODIS\pkg.odis.xml
        • Size 2KB
        • SHA256 8635ce8a37c77aa464b3a6e08abdc28525ac0fcc573ab9a0322bb0c615c0a45f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        setup.xml
        • Path C:\Autodesk\WI\{3D7D7301-4C7B-3E1D-B59C-CB6B6F348963}\RSAPRO_2025_en-US\setup.xml
        • Size 3KB
        • SHA256 2928aaea39f900537b92145aa5436e0b28a79fa1846ebe1f34c954ccca48e0d8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 471B
        • SHA256 84bd2f8e8edf2c1e8faf64423787c6f281fd81bd2c2761a68bd507996b14de46
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8EC9B1D0ABBD7F98B401D425828828CE_D58694AA291688CC248CEA5056CDB4B5
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_D58694AA291688CC248CEA5056CDB4B5
        • Size 727B
        • SHA256 ed7b75ffed17b64e0a7a9361b80c68f340af6171584b9f8f7fa22aab7f531bdd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 727B
        • SHA256 95c852c2808ea9464b8ef2648912a121d6a2bfdd95126cc3f6c11d41c0b461b0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
        • Size 400B
        • SHA256 bcd74585839f01db6d6b626bbb1830c4ce274249e51985cb05d108db51e9113c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8EC9B1D0ABBD7F98B401D425828828CE_D58694AA291688CC248CEA5056CDB4B5
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_D58694AA291688CC248CEA5056CDB4B5
        • Size 412B
        • SHA256 5e7e1c0a495dffa88ce70456c68edf05d49b0b86c13fb2ad6dff036216887875
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
        • Size 412B
        • SHA256 291b959eb3254932a07d747d5653cfb8d2ab657b69b9c0c3150170a45f6910c4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        cer.log
        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\0302e778351eba9ec967b60771e34d0911213940\cer.log
        • Size 4KB
        • SHA256 a594f37ca56851d4e92f845e83419124dae3a123ed2b1daf9f0b6d74d06d8c48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sandbox_senddmp.location
        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\cache\sandbox_senddmp.location
        • Size 69B
        • SHA256 278739384b15459584afd33c00d6190830b2ffc5aab6eda1262d20274e6673af
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        upi.log
        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
        • Size 850B
        • SHA256 ecae5031e84b64fa37510f2206b30f7c9a35ba6d926e5a0a84b024ee802b35a8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        upi.log
        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
        • Size 1KB
        • SHA256 809e3f5320be77143c4491b63c5642862f7d106b650ed66ac3e7c6f0377362b0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        upi.log
        • Path C:\Users\Admin\AppData\Local\Autodesk\CER\upi.log
        • Size 3KB
        • SHA256 aeaacedbbf5de003dac2ac6974fcde68a6f42a230ebda27c8636dfc0e57f0474
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DLM.log
        • Path C:\Users\Admin\AppData\Local\Autodesk\ODIS\DLM.log
        • Size 1KB
        • SHA256 fff2db25ef433f9f4c0908eace7f17004089e37ab3361d31688a83b940ec24d1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Autodesk_dialog_512x512.png
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\Autodesk_dialog_512x512.png
        • Size 122KB
        • SHA256 bff55fcaf87784d76acf68f10b9d0a13da938ba2eadeb8a8482fc0a28e618237
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UPI.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\UPI.dll
        • Size 659KB
        • SHA256 df1a1da45a3f07388c7bcfd060893b25811e59961f0377be4516a043b2c1f911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DeviceSettingsProvider.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\service\DeviceSettingsProvider.dll
        • Size 10.0MB
        • SHA256 ad995c6765796fe169d9c591a06acae87054cc763afa39e4f939033a2335eac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        upi.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\CER\upi.exe
        • Size 417KB
        • SHA256 a5ca75454365313920411e212f5380e3e921e3501cfce0571c1bc09f681906cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\cer.dll
        • Size 2.4MB
        • SHA256 b1889dc687ef9ac6472fa20b06e66e6bcf55eb13482b885a200114b0f8b55576
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        upiconfig.xml
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\CER\upiconfig.xml
        • Size 984B
        • SHA256 df91796ef977d62d6e29ca1d2aca073e52ec2d4e2bc779cdb40adf9be613bfea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        DownloadManager.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\DownloadManager.exe
        • Size 18.5MB
        • SHA256 a43121d172933baba6413c924b10b9a0fe6279ebb53d7b13b5b5bbc6305ebd07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bootstrap.json
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\bootstrap.json
        • Size 1000B
        • SHA256 2deeb4262420972721bdef76dec597befe6c590e7e7e11a6692a6e501cd88488
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        AdHttpLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\odis.bs.win\AdHttpLib.dll
        • Size 17.8MB
        • SHA256 9e6b1be5d5659016441d904eddef3c51e45c8ee5a61c86c4d0a8414e463d38bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AdpSDKCore.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\odis.bs.win\AdpSDKCore.dll
        • Size 1009KB
        • SHA256 132f82ab141fd6bfa600b72fc01a0c59dd04c1d3ba9ce462ab6fc6c500582ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DeviceSettingsProvider.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\odis.bs.win\DeviceSettingsProvider.dll
        • Size 10.0MB
        • SHA256 a91807ac33c524d476fbeaaef2e4048c49de6636f2ab05235e6f5d63fef5aec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\odis.bs.win\MSVCP140.dll
        • Size 612KB
        • SHA256 bdf1d095d1419e9ce49e774590ee092b1b673ca259c0126f21afe595b3e661eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\odis.bs.win\vcruntime140.dll
        • Size 83KB
        • SHA256 0164b1bfdcedb07295eae14fa5dca88b46862bc91ec2d317ef8559bbec8128ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\odis.bs.win\vcruntime140_1.dll
        • Size 35KB
        • SHA256 54a38117f402f43d4e819642f6e74c048666e840037a3c1c0944bc8bb941d69c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wxbase331u_vc_x64_custom.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\odis.bs.wx\wxbase331u_vc_x64_custom.dll
        • Size 3.2MB
        • SHA256 000a5f9b788294852e764e52156f7646729d9e87f1c9b75be3e57c7828719e96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wxmsw331u_core_vc_x64_custom.dll
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\odis.bs.wx\wxmsw331u_core_vc_x64_custom.dll
        • Size 10.1MB
        • SHA256 9696175fd303290aa5fa7bf3bc2d2f60bdc79c7018053658b96c6ff5ce1e216c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        strings.xml
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\ODIS\strings.xml
        • Size 22KB
        • SHA256 ae652e226f0d983d0445178dcf8152265426460cabd6cfe49f7d5d9966c24a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Setup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\Setup.exe
        • Size 23.3MB
        • SHA256 add11ecedc80266de63a54ed9678e736c96c752c35e9271b42e28de995914786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ad.logconfig
        • Path C:\Users\Admin\AppData\Local\Temp\7z9A14D4A8\SetupRes\ad.logconfig
        • Size 1KB
        • SHA256 768e351a487ff277f0f06f1af2dbfc0d2ad83d2ce6aa97b9389f6e67e2bc329a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Robot_Structural_Analysis_Professional_2025_ML_setup.dat
        • Path C:\Users\Admin\AppData\Local\Temp\odis_download_dest\7558147082222508134\Robot_Structural_Analysis_Professional_2025_ML_setup.dat
        • Size 94B
        • SHA256 b94d4f2cb16fba011b5ec2e8606c4c2cd1ed6b3f8aed90fa5ef99ae938d6b29f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        upi_deviceid2
        • Path C:\Users\Admin\AppData\Local\Temp\upi_deviceid2
        • Size 194B
        • SHA256 e5deeb56fef43583d5f756cb3a640b94683252d342e186899e82f7e0ba98d35f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        upi_info.xml
        • Path C:\Users\Admin\AppData\Local\Temp\upi_info.xml
        • Size 400B
        • SHA256 d45ab0ae5ec31cf3b6ec2965c265dfea321a6b10117ed70024cd9a165e645a74
        • MD5 SHA1 SHA512 TLSH
        Submit Download