quasar | 2a722d4828c2c0f5826ce72e1ba22578831ac55b4c1e2e319a3ac651a1baffbd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ssa.exe
Size 3.1MB
Sample260907-v816wadn6x
SHA256 2a722d4828c2c0f5826ce72e1ba22578831ac55b4c1e2e319a3ac651a1baffbd
MD5 984a44dfb36007588c79d795bf664083
SHA1 2eb3d530f32c63e0df0f8baf1354d5579d0fa779
SHA512 dea7a376222a28167021c4e59b944e6fb6d37dc7b8e6d0e571c48dfea61d4b53121db36d8aef3c62ef45747542a75a5b716c68d8560a202090d90cfa4c246580
SSDEEP 49152:gv7L82kyaNnwxPlllSWxc9LpQX/x57eXMfUYoGdn8THHB72eh2NT:gvH82kyaNnwxPlllSWa9LpQX/x57e6
TLSH
T1B5E55A143BF85E63E16AD373DAB0501663F1FC2AF363EB1B6191667E1C53B4058026AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

kotami.co/vi-vn/discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

kotami.co/vi-vn/

kotami.co/vi-vn/:4782
kotami.co/vi-vn/:80
kotami.co/vi-vn/:8080
kotami.co/vi-vn/:443
kotami.co/vi-vn/:8443
kotami.co/vi-vn/:23

Mutex

c5d2d708-e66f-4351-b915-e068af7ab273

Attributes

encryption_key
7DB184117F5356211726F6C83149373E39585AB4
install_name
svchost.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
https://kotami.co/vi-vn/
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3088-0-0x0000000000720000-0x0000000000A44000-memory.dmp	family_quasar
behavioral1/files/0x0008000000024683-5.dat	family_quasar

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 14 IoCs

pid	Process
4252	svchost.exe
3580	svchost.exe
208	svchost.exe
568	svchost.exe
4852	svchost.exe
4164	svchost.exe
3960	svchost.exe
5048	svchost.exe
724	svchost.exe
2008	svchost.exe
3732	svchost.exe
3068	svchost.exe
4720	svchost.exe
2652	svchost.exe

Adds Run key to start application 2 TTPs 15 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	ssa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://kotami.co/vi-vn/ = "\"C:\\Program Files\\SubDir\\svchost.exe\""	svchost.exe

Drops file in Program Files directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir	ssa.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File created	C:\Program Files\SubDir\svchost.exe	ssa.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	ssa.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe
File opened for modification	C:\Program Files\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Program Files\SubDir	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1904	cmd.exe
3280	cmd.exe
1808	cmd.exe
4992	cmd.exe
3332	cmd.exe
2276	cmd.exe
3508	cmd.exe
3876	cmd.exe
2100	cmd.exe
2604	cmd.exe
3224	cmd.exe
2108	cmd.exe
2840	cmd.exe
4824	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3680	PING.EXE
3836	PING.EXE
8	PING.EXE
5048	PING.EXE
4120	PING.EXE
4416	PING.EXE
1888	PING.EXE
2716	PING.EXE
3220	PING.EXE
1228	PING.EXE
4156	PING.EXE
1708	PING.EXE
4040	PING.EXE
4152	PING.EXE

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
5048	PING.EXE
4156	PING.EXE
4120	PING.EXE
4040	PING.EXE
4152	PING.EXE
1888	PING.EXE
2716	PING.EXE
1228	PING.EXE
8	PING.EXE
1708	PING.EXE
4416	PING.EXE
3680	PING.EXE
3220	PING.EXE
3836	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2056	schtasks.exe
2012	schtasks.exe
2104	schtasks.exe
3040	schtasks.exe
4320	schtasks.exe
1828	schtasks.exe
4324	schtasks.exe
3392	schtasks.exe
5072	schtasks.exe
576	schtasks.exe
4432	schtasks.exe
4540	schtasks.exe
1180	schtasks.exe
1508	schtasks.exe
2804	schtasks.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	3088	ssa.exe
Token: SeDebugPrivilege	4252	svchost.exe
Token: SeDebugPrivilege	3580	svchost.exe
Token: SeDebugPrivilege	208	svchost.exe
Token: SeDebugPrivilege	568	svchost.exe
Token: SeDebugPrivilege	4852	svchost.exe
Token: SeDebugPrivilege	4164	svchost.exe
Token: SeDebugPrivilege	3960	svchost.exe
Token: SeDebugPrivilege	5048	svchost.exe
Token: SeDebugPrivilege	724	svchost.exe
Token: SeDebugPrivilege	2008	svchost.exe
Token: SeDebugPrivilege	3732	svchost.exe
Token: SeDebugPrivilege	3068	svchost.exe
Token: SeDebugPrivilege	4720	svchost.exe
Token: SeDebugPrivilege	2652	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2012	3088	ssa.exe	87
PID 3088 wrote to memory of 4252	3088	ssa.exe	89
PID 4252 wrote to memory of 2104	4252	svchost.exe	91
PID 4252 wrote to memory of 1904	4252	svchost.exe	93
PID 1904 wrote to memory of 2664	1904	cmd.exe	95
PID 1904 wrote to memory of 8	1904	cmd.exe	96
PID 1904 wrote to memory of 3580	1904	cmd.exe	99
PID 3580 wrote to memory of 2056	3580	svchost.exe	100
PID 3580 wrote to memory of 3280	3580	svchost.exe	102
PID 3280 wrote to memory of 3884	3280	cmd.exe	104
PID 3280 wrote to memory of 5048	3280	cmd.exe	105
PID 3280 wrote to memory of 208	3280	cmd.exe	106
PID 208 wrote to memory of 3392	208	svchost.exe	107
PID 208 wrote to memory of 3876	208	svchost.exe	109
PID 3876 wrote to memory of 452	3876	cmd.exe	111
PID 3876 wrote to memory of 4156	3876	cmd.exe	112
PID 3876 wrote to memory of 568	3876	cmd.exe	119
PID 568 wrote to memory of 1180	568	svchost.exe	121
PID 568 wrote to memory of 1808	568	svchost.exe	123
PID 1808 wrote to memory of 1312	1808	cmd.exe	125
PID 1808 wrote to memory of 4120	1808	cmd.exe	126
PID 1808 wrote to memory of 4852	1808	cmd.exe	129
PID 4852 wrote to memory of 3040	4852	svchost.exe	130
PID 4852 wrote to memory of 2100	4852	svchost.exe	132
PID 2100 wrote to memory of 2648	2100	cmd.exe	134
PID 2100 wrote to memory of 1708	2100	cmd.exe	135
PID 2100 wrote to memory of 4164	2100	cmd.exe	136
PID 4164 wrote to memory of 5072	4164	svchost.exe	137
PID 4164 wrote to memory of 4992	4164	svchost.exe	139
PID 4992 wrote to memory of 572	4992	cmd.exe	141
PID 4992 wrote to memory of 4040	4992	cmd.exe	142
PID 4992 wrote to memory of 3960	4992	cmd.exe	143
PID 3960 wrote to memory of 1508	3960	svchost.exe	144
PID 3960 wrote to memory of 2604	3960	svchost.exe	146
PID 2604 wrote to memory of 3320	2604	cmd.exe	148
PID 2604 wrote to memory of 4416	2604	cmd.exe	149
PID 2604 wrote to memory of 5048	2604	cmd.exe	150
PID 5048 wrote to memory of 576	5048	svchost.exe	151
PID 5048 wrote to memory of 3224	5048	svchost.exe	153
PID 3224 wrote to memory of 4032	3224	cmd.exe	155
PID 3224 wrote to memory of 4152	3224	cmd.exe	156
PID 3224 wrote to memory of 724	3224	cmd.exe	157
PID 724 wrote to memory of 4432	724	svchost.exe	158
PID 724 wrote to memory of 2108	724	svchost.exe	160
PID 2108 wrote to memory of 3796	2108	cmd.exe	162
PID 2108 wrote to memory of 1888	2108	cmd.exe	163
PID 2108 wrote to memory of 2008	2108	cmd.exe	164
PID 2008 wrote to memory of 4320	2008	svchost.exe	165
PID 2008 wrote to memory of 3332	2008	svchost.exe	167
PID 3332 wrote to memory of 1476	3332	cmd.exe	169
PID 3332 wrote to memory of 3680	3332	cmd.exe	170
PID 3332 wrote to memory of 3732	3332	cmd.exe	171
PID 3732 wrote to memory of 1828	3732	svchost.exe	172
PID 3732 wrote to memory of 2840	3732	svchost.exe	174
PID 2840 wrote to memory of 3760	2840	cmd.exe	176
PID 2840 wrote to memory of 2716	2840	cmd.exe	177
PID 2840 wrote to memory of 3068	2840	cmd.exe	178
PID 3068 wrote to memory of 2804	3068	svchost.exe	179
PID 3068 wrote to memory of 2276	3068	svchost.exe	181
PID 2276 wrote to memory of 3808	2276	cmd.exe	183
PID 2276 wrote to memory of 3220	2276	cmd.exe	184
PID 2276 wrote to memory of 4720	2276	cmd.exe	185
PID 4720 wrote to memory of 4324	4720	svchost.exe	186
PID 4720 wrote to memory of 4824	4720	svchost.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ssa.exe
"C:\Users\Admin\AppData\Local\Temp\ssa.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2012
- C:\Program Files\SubDir\svchost.exe
  "C:\Program Files\SubDir\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\T6T1ku6VTkVz.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:2664
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:8
  - - C:\Program Files\SubDir\svchost.exe
      "C:\Program Files\SubDir\svchost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2056
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\39ylXwR7qXCL.bat" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3280
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3884
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5048
      - C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3392
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CrYKZtCSE1jG.bat" "
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:452
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4156
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1180
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A4NQO8vxkGVP.bat" "
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1312
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4120
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3040
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4qS9u7as09F9.bat" "
        11⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2648
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1708
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5072
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D2WFQBWyXcG7.bat" "
        13⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:572
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4040
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QSGBWFIIzio3.bat" "
        15⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3320
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4416
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:576
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WVao0TUfdfFQ.bat" "
        17⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3224
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4032
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4152
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:724
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AmIgNcMqhSeU.bat" "
        19⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3796
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1888
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Ua08rojjOHs3.bat" "
        21⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1476
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3680
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lIqyB2VSYsOA.bat" "
        23⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3760
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2716
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2804
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eRnMDp03yV5O.bat" "
        25⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3808
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3220
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4720
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4324
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XngMZR63ac5T.bat" "
        27⤵
        Executes a command shell one-liner
        
        PID:4824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:3320
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1228
        
        C:\Program Files\SubDir\svchost.exe
        
        "C:\Program Files\SubDir\svchost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2652
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://kotami.co/vi-vn/" /sc ONLOGON /tr "C:\Program Files\SubDir\svchost.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Er5pf9TiBu7G.bat" "
        29⤵
        Executes a command shell one-liner
        
        PID:3508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:1340
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Program Files\SubDir\svchost.exe
Size 3.1MB
SHA256 2a722d4828c2c0f5826ce72e1ba22578831ac55b4c1e2e319a3ac651a1baffbd
MD5 984a44dfb36007588c79d795bf664083
SHA1 2eb3d530f32c63e0df0f8baf1354d5579d0fa779
SHA512 dea7a376222a28167021c4e59b944e6fb6d37dc7b8e6d0e571c48dfea61d4b53121db36d8aef3c62ef45747542a75a5b716c68d8560a202090d90cfa4c246580
SSDEEP 49152:gv7L82kyaNnwxPlllSWxc9LpQX/x57eXMfUYoGdn8THHB72eh2NT:gvH82kyaNnwxPlllSWa9LpQX/x57e6
TLSH
T1B5E55A143BF85E63E16AD373DAB0501663F1FC2AF363EB1B6191667E1C53B4058026AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
Size 2KB
SHA256 da740d78ae00b72cb3710d1a1256dc6431550965d20afaa65e5d5860a4748e8c
MD5 8f0271a63446aef01cf2bfc7b7c7976b
SHA1 b70dad968e1dda14b55ad361b7fd4ef9ab6c06d7
SHA512 78a403c69f1284b7dd41527019f3eede3512a5e4d439d846eca83557b741ca37bcf56c412f3e577b9dd4cfa5a6d6210961215f14cb271b143f6eb94f69389cf5
TLSH
T1EA41E27122B6B1D94D063F461C5D2AC003BF47287664AE0CBA99231EED2741B9F221F7
MD5 SHA1 SHA512 TLSH

Submit Download

39ylXwR7qXCL.bat

Path C:\Users\Admin\AppData\Local\Temp\39ylXwR7qXCL.bat
Size 194B
SHA256 b5473f5bc89fbfb1ebf38d81326307a6cb4c96b25705588d9062b4fc171610b9
MD5 ac77eed76c2e45844fadf4698ce84416
SHA1 b0e3c9fe7254e279baca9586bfa3ac5830d6423a
SHA512 0289702a7b79a34ad68afa02b04d3061fb5f870161a303e6e4f2e6aac2c99ed40c3bb00f27fd9c8d86be8abb6da85399c48f48b21c1c1761eeac638a8aad6829
TLSH
T147C0C0401701CDAD11000C462E403645B1DB04BE1B0CBCE3022A88ED13CBE9CB17F6C2
MD5 SHA1 SHA512 TLSH

Submit Download

4qS9u7as09F9.bat

Path C:\Users\Admin\AppData\Local\Temp\4qS9u7as09F9.bat
Size 194B
SHA256 3a59d51b2222d30d6e2e380a1bd948b24e451dc0575b7a9fe3dcdf75db935cc6
MD5 f60b3a00430e1087a8a4ffc7413f3890
SHA1 11744d3f1504ad53c149caeaf9899f0706c8a107
SHA512 b1b27abdf1ee33ee805d3f9bd7f97e5e6ec46c2a8d2809f660bd6d03a5e30f07cf0ba7320d0399b90a7331a4be714b7c8f884704bfde321f135ef6bd11d22da7
TLSH
T1D2C02200A601CD9952000C452E903744B08A14AE2B4CACE24A2B88AE13CAE9C706B681
MD5 SHA1 SHA512 TLSH

Submit Download

A4NQO8vxkGVP.bat

Path C:\Users\Admin\AppData\Local\Temp\A4NQO8vxkGVP.bat
Size 194B
SHA256 cd49b7d03d184495bee254b05a75a435e1df55f95c24d6a786bfd6bb56a0bf4b
MD5 4e5a13b2453aa96852190f2576eb28a4
SHA1 48f8ca4e37efe7901d9078ae64215ddfc01050cf
SHA512 520cce04a9ac7012f22de49700ebe612fb14be203d881cdc44a5ac7a6946194a12dc9cc6efafc149efc53ed6c96802c85163c44bf07e9f016f2f4c7cc3e5452c
TLSH
T16CC02200AA01CD89110408862A413784B08A08AE2B0CACA2021A88AD238BD9C607F6E1
MD5 SHA1 SHA512 TLSH

Submit Download

AmIgNcMqhSeU.bat

Path C:\Users\Admin\AppData\Local\Temp\AmIgNcMqhSeU.bat
Size 194B
SHA256 6f913b487ce56978649dcbb3b5ba0bb294ccfa8bcc1620ed096bf0103cd6b7a0
MD5 5d7c3be913448d02dbfb940054a697c1
SHA1 7a72d0f28f16e5c9ae3d9c1587a61ac06d1ddffd
SHA512 e292f1dfefa6e2b9632c163787e6937e6be14a9399f95ba5630595f1bb28cc4b24f9099b86c89fae853f5ec93eb1a57fdb23f8d05c1e1bec532d7f274e20e38d
TLSH
T1E8C022019600C98D120108892A54B684B18A08AE2B0CAEA2061B89AD238A99C606F682
MD5 SHA1 SHA512 TLSH

Submit Download

CrYKZtCSE1jG.bat

Path C:\Users\Admin\AppData\Local\Temp\CrYKZtCSE1jG.bat
Size 194B
SHA256 033a37d1a1d2b93e1cf3473dad3169e4cff88ed48e62f60beaab31d58588d9f7
MD5 1107ea19d26e6b671ce06cc3f7087aac
SHA1 9c5c41928d6db3eff2e0e414514187de59fc2985
SHA512 38437acfc37ae74668781a32f87691c8cf0e4482780b2b5d40e1a68f65964368879450442c06415dd4cc754502d3ca51edde4f3d1bb09161551fea3a7d09cd53
TLSH
T1B8C022011700CE89121008452A41364AB09A04AE1B08ACA2062A88AE938ADAC70ABA81
MD5 SHA1 SHA512 TLSH

Submit Download

D2WFQBWyXcG7.bat

Path C:\Users\Admin\AppData\Local\Temp\D2WFQBWyXcG7.bat
Size 194B
SHA256 81f57c7ff102819e88e663180d919c7ac9f5d12636ea835b53f25f4c97cd86f8
MD5 0c403bedc1a3756fa18ccee34e491fef
SHA1 9a75af27612c68b4456af661c1ceb454080030b2
SHA512 77375ec864fec8d433d4a9ad78796458bee78100be206ae066df037f6e9be34ad3a672042f3d2f7351e009f4cc733cb67ba5f89b91e674e42f65a89e67637ec3
TLSH
T186C0C0005700CD8D12000C456E403646B0CA0CEE1B0CBCE3022E88AE53CBDDC70BF6C1
MD5 SHA1 SHA512 TLSH

Submit Download

Er5pf9TiBu7G.bat

Path C:\Users\Admin\AppData\Local\Temp\Er5pf9TiBu7G.bat
Size 194B
SHA256 410b164518cf2dc7c6afda8de216fab9b5f3904748f651e93d624aebef78a6fa
MD5 0b5575c26c10d66ea02dce3401f17a47
SHA1 cf7dade509a53a3a825bd3af56d8f874c358e3a3
SHA512 fbe3cf2ef51ef9a5647ff99b030a0f7d95132997db2337627d6c5011f973b15adae90295254f772ec7cecde50bbd38f0fba82a324fc30792dfd6dec4bc9b8c6d
TLSH
T1E0C02200D600CE89150018452A503A45B08A04AE1B08ACA3861A88ADA38AA9CA4ABA82
MD5 SHA1 SHA512 TLSH

Submit Download

QSGBWFIIzio3.bat

Path C:\Users\Admin\AppData\Local\Temp\QSGBWFIIzio3.bat
Size 194B
SHA256 6af8a1fd77b4b477d4daaaeb389a1f0a5c69441bd72afbc195839c9b1288cec8
MD5 2c6bc3d7a6be977e578fa1c48362af98
SHA1 db4c3a66c73eab205366aa44bd34d53c0fa0dce3
SHA512 0eedd4c60b18271821132b80cc92c918874ce77781d1bd5d9422300580795f61da23f959d3496d3352e99956086df15636f3c390cb1adfbc38bc07cfb860d5b9
TLSH
T1ACC022501602C9895600084A2A447648B08A04AE1B08ACA2061A88AD138ED9C616BA81
MD5 SHA1 SHA512 TLSH

Submit Download

T6T1ku6VTkVz.bat

Path C:\Users\Admin\AppData\Local\Temp\T6T1ku6VTkVz.bat
Size 194B
SHA256 80f9a4cb048e33c99bd597621709e3503552e9238018f06b7179303c91809120
MD5 f255afb9d23e1d8c148fbcb0c56c08ff
SHA1 9ffa474110b85ba1019194c84486a6b52ccb8132
SHA512 5cbced7e30557c39af4f237a0315fe0c18e0ff05efe7522e2f01c0196ad0b778d8afb6b7811c1e1eba1c7be533e2988076725ce3c1e38114375f41ff0b174cdd
TLSH
T123C022401A40C99A25000C862E457644B0CE18AE2B0CACA2062A88AE178B99CA06B681
MD5 SHA1 SHA512 TLSH

Submit Download

Ua08rojjOHs3.bat

Path C:\Users\Admin\AppData\Local\Temp\Ua08rojjOHs3.bat
Size 194B
SHA256 dfcf41c74e54dd6ee3c71c27a8dbe25fee555a1e1c06d1153291ad8cc9209d2b
MD5 89f9b18c9a71a6774f721cc692bd402e
SHA1 71c101f8a174fcfeef03dd216212d404bea01d4b
SHA512 c6ec57087df1bdcd045a4dc39ab579a941e38dbd4c4f369327d37de0906777d8c94647b51195600d649f3b6a49e9c0c31095ff70342958330bb4c050a7b627c2
TLSH
T1A0C022002E00CA9E66000C852A417644B08A84AE2B48ACE2061A88EE17CB99C647B681
MD5 SHA1 SHA512 TLSH

Submit Download

WVao0TUfdfFQ.bat

Path C:\Users\Admin\AppData\Local\Temp\WVao0TUfdfFQ.bat
Size 194B
SHA256 b7697835cc4f83b1c0548569dc29e6eee459e2fea8b5b7e937db7634c6d3dfed
MD5 e8adc9e6183c49a8654eebe2f9794df7
SHA1 c5cbc6d19f270467a9beeb304c0e7e24d6781d69
SHA512 4cf120cae903c2be3775b8e20e36cdf94248e477ae3bd640f4d58bc1a645d643a8b3dd4a92763511f8dda28089f5b1d8b7509df7a2e4f6453d893f054c5af26f
TLSH
T13BC022411A00CD89120008492A413688B09E08AE1B0CADE3021A88AE538B99C60AB681
MD5 SHA1 SHA512 TLSH

Submit Download

XngMZR63ac5T.bat

Path C:\Users\Admin\AppData\Local\Temp\XngMZR63ac5T.bat
Size 194B
SHA256 4f5073b691052a1f812b20d1cd1e25f5e818cf4bf7c8a4684a61c52f57d69396
MD5 8a9b531ad5afb51e179f3b6485bc618a
SHA1 9e030802f6116f3060b7208493be1faf4712463b
SHA512 4a50406fdcce93a1ceb3d03e6644bdcd0c7576be1a93cdfd17c7b54b664a90a284fbf5307fd961382a629b4f5de0fef9671c54f3b07c8b64c6a435f9fb27e4b6
TLSH
T1C9C022002600CE89510128862A543788B08A04AE1B08ACA2461E88AE23CB99CB07BA81
MD5 SHA1 SHA512 TLSH

Submit Download

eRnMDp03yV5O.bat

Path C:\Users\Admin\AppData\Local\Temp\eRnMDp03yV5O.bat
Size 194B
SHA256 c81b3d6980bfb09b37103c00c4444024a36a13042ba971dc35c0c2e4f87ac463
MD5 72fd255216a4f9ee2c4e8aaf7a2b12f5
SHA1 85c2937bf8b819878b043076f171ff2a56cd4737
SHA512 ecdad7588f11022d6f0546669047d4e0cd819a1a1856de96e621b616953a4be9e7c5cec09d5b5e5bf6b875f71e9257d4b3e83c73eed76cfa129abdcddf468ed1
TLSH
T10DC02200AA00C98A220108453A807689B0CE04AE1F08ACA2032A88AD138AD9C61AB682
MD5 SHA1 SHA512 TLSH

Submit Download

lIqyB2VSYsOA.bat

Path C:\Users\Admin\AppData\Local\Temp\lIqyB2VSYsOA.bat
Size 194B
SHA256 9d3fe31a75a9cb01598e0ee74aacdbf5e3d90fa5fdae7c4a836c71b98300d5be
MD5 563c1f7a4f152901c016237d79adb5a0
SHA1 6583a7018026b38f23dd2b7cd04ab24e2906559b
SHA512 fed04f76809fc799be5fba0920d420d605f80f410dc8cdabdba4711c7ee2922a678c610b1098b9a16b8dd7ea9b3c69208c0a414ba33fed7b79ff9257f33afcf4
TLSH
T177C022401A00C98A210008492A907649B08A08AE2B08ADA2062A8CAE138A99C606B6C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3088-0-0x0000000000720000-0x0000000000A44000-memory.dmp

Download

memory/3088-1-0x000000001B810000-0x000000001B820000-memory.dmp

Download

memory/4252-9-0x000000001E9D0000-0x000000001EA82000-memory.dmp

Download

memory/4252-8-0x000000001E8C0000-0x000000001E910000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads