quasar | cddf8ed8ce548c2c1254ee53dbb92cb70bc5ddf1ab314185dc72de672818bbbc

Analysis

max time kernel
149s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
12/09/2026, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample260912-ke7fpasdja
SHA256 cddf8ed8ce548c2c1254ee53dbb92cb70bc5ddf1ab314185dc72de672818bbbc
MD5 d6b7b25b4d8650710611403e4719e141
SHA1 93653e63b4533b1e112f90ac33defac7b46905d2
SHA512 f634c8e991415ddf37e4b8443e5c0e297321b48e11e16e14bd9605fd82c62b793d75e52d37936d813ed080e94fb5d0dfadae134b11c3c9eaa833017463a3ed1b
SSDEEP 98304:jv6L26AaNeWgPhlmVqkQ7XSKb+RJ6GDZ:La4ShrV
TLSH
T11FE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

ratu88hoki.com:443
malware.ratu88hoki.com:443

Mutex

113a1acf-eae6-48f6-993c-1b6f95dce078

Attributes

encryption_key
F099FC50E900CAA52299FD44FD3089CF7142A9BF
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4524-0-0x0000000000470000-0x0000000000794000-memory.dmp	family_quasar
behavioral2/files/0x00090000000285ec-2.dat	family_quasar

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2584227348-426884507-1572084426-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 11 IoCs

pid	Process
4600	Client.exe
4704	Client.exe
5828	Client.exe
1932	Client.exe
1788	Client.exe
3628	Client.exe
1320	Client.exe
5652	Client.exe
4068	Client.exe
4120	Client.exe
1016	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2380	cmd.exe
4788	cmd.exe
3856	cmd.exe
6052	cmd.exe
5664	cmd.exe
2836	cmd.exe
3892	cmd.exe
4268	cmd.exe
3928	cmd.exe
5176	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 10 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2424	PING.EXE
1548	PING.EXE
636	PING.EXE
712	PING.EXE
1776	PING.EXE
4008	PING.EXE
5836	PING.EXE
3320	PING.EXE
4740	PING.EXE
5980	PING.EXE

Runs ping.exe 1 TTPs 10 IoCs

Remote System Discovery

T1018

pid	Process
5980	PING.EXE
2424	PING.EXE
636	PING.EXE
3320	PING.EXE
4740	PING.EXE
1776	PING.EXE
1548	PING.EXE
4008	PING.EXE
712	PING.EXE
5836	PING.EXE

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	Client-built.exe
Token: SeDebugPrivilege	4600	Client.exe
Token: SeDebugPrivilege	4704	Client.exe
Token: SeDebugPrivilege	5828	Client.exe
Token: SeDebugPrivilege	1932	Client.exe
Token: SeDebugPrivilege	1788	Client.exe
Token: SeDebugPrivilege	3628	Client.exe
Token: SeDebugPrivilege	1320	Client.exe
Token: SeDebugPrivilege	5652	Client.exe
Token: SeDebugPrivilege	4068	Client.exe
Token: SeDebugPrivilege	4120	Client.exe
Token: SeDebugPrivilege	1016	Client.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4600	Client.exe
4704	Client.exe
5828	Client.exe
1932	Client.exe
1788	Client.exe
3628	Client.exe
1320	Client.exe
5652	Client.exe
4068	Client.exe
4120	Client.exe
1016	Client.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
4600	Client.exe
4704	Client.exe
5828	Client.exe
1932	Client.exe
1788	Client.exe
3628	Client.exe
1320	Client.exe
5652	Client.exe
4068	Client.exe
4120	Client.exe
1016	Client.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4600	4524	Client-built.exe	81
PID 4600 wrote to memory of 2380	4600	Client.exe	82
PID 2380 wrote to memory of 5904	2380	cmd.exe	84
PID 2380 wrote to memory of 4740	2380	cmd.exe	85
PID 2380 wrote to memory of 4704	2380	cmd.exe	86
PID 4704 wrote to memory of 4788	4704	Client.exe	87
PID 4788 wrote to memory of 5452	4788	cmd.exe	89
PID 4788 wrote to memory of 5980	4788	cmd.exe	90
PID 4788 wrote to memory of 5828	4788	cmd.exe	91
PID 5828 wrote to memory of 2836	5828	Client.exe	92
PID 2836 wrote to memory of 3292	2836	cmd.exe	94
PID 2836 wrote to memory of 1776	2836	cmd.exe	95
PID 2836 wrote to memory of 1932	2836	cmd.exe	96
PID 1932 wrote to memory of 3892	1932	Client.exe	97
PID 3892 wrote to memory of 1556	3892	cmd.exe	99
PID 3892 wrote to memory of 2424	3892	cmd.exe	100
PID 3892 wrote to memory of 1788	3892	cmd.exe	101
PID 1788 wrote to memory of 4268	1788	Client.exe	102
PID 4268 wrote to memory of 2924	4268	cmd.exe	104
PID 4268 wrote to memory of 1548	4268	cmd.exe	105
PID 4268 wrote to memory of 3628	4268	cmd.exe	106
PID 3628 wrote to memory of 3856	3628	Client.exe	107
PID 3856 wrote to memory of 3984	3856	cmd.exe	109
PID 3856 wrote to memory of 4008	3856	cmd.exe	110
PID 3856 wrote to memory of 1320	3856	cmd.exe	111
PID 1320 wrote to memory of 6052	1320	Client.exe	112
PID 6052 wrote to memory of 6000	6052	cmd.exe	114
PID 6052 wrote to memory of 636	6052	cmd.exe	115
PID 6052 wrote to memory of 5652	6052	cmd.exe	116
PID 5652 wrote to memory of 3928	5652	Client.exe	117
PID 3928 wrote to memory of 2468	3928	cmd.exe	119
PID 3928 wrote to memory of 712	3928	cmd.exe	120
PID 3928 wrote to memory of 4068	3928	cmd.exe	121
PID 4068 wrote to memory of 5176	4068	Client.exe	122
PID 5176 wrote to memory of 476	5176	cmd.exe	124
PID 5176 wrote to memory of 5836	5176	cmd.exe	125
PID 5176 wrote to memory of 4120	5176	cmd.exe	126
PID 4120 wrote to memory of 5664	4120	Client.exe	127
PID 5664 wrote to memory of 2532	5664	cmd.exe	129
PID 5664 wrote to memory of 3320	5664	cmd.exe	130
PID 5664 wrote to memory of 1016	5664	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\INJPjphnrupQ.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5904
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4740
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FSLL48mE1sos.bat" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4788
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5452
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5980
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\naTpfG8vVF0G.bat" "
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2836
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3292
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1776
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\24fVBgbEUEtO.bat" "
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1556
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2424
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MSBhtmUcyGmT.bat" "
        11⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2924
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1548
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Njwo0HFibE51.bat" "
        13⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3984
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4008
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pd2GBxbpQr9l.bat" "
        15⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6052
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:6000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:636
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5652
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\k6sGzW4vf1jr.bat" "
        17⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2468
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:712
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7J0EEcQ4Y5zR.bat" "
        19⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:476
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5836
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RpCFq6rUoGaR.bat" "
        21⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3320
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 2KB
SHA256 c339149818fa8f9e5af4627715c3afe4f42bc1267df17d77a278d4c811ed8df1
MD5 7787ce173dfface746f5a9cf5477883d
SHA1 4587d870e914785b3a8fb017fec0c0f1c7ec0004
SHA512 3a630053ae99114292f8cf8d45600f8fe72125795252bf76677663476bd2275be084a1af2fcb4ce30409ba1b5829b2b3ffb6795de46d2a703c3314017a86f1ff
TLSH
T17C41CD7032B6B1D54D063F560C2D69C417BF8718B564AE0CBFA8221EE92B41B4F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

24fVBgbEUEtO.bat

Path C:\Users\Admin\AppData\Local\Temp\24fVBgbEUEtO.bat
Size 207B
SHA256 abab805e2203e3907831b248d7822693cd2d35637508e137eddd33d1fdc877c5
MD5 577553655cb1e9e86125d7eea78de1f7
SHA1 e353cd2775d7618b5c93a3ca6915ffcad99f9a94
SHA512 001f9f1c3425d8b3568321dee66cc620a233b9de502130bff53819d2d042dfb40c7e3f441fb71b9b672bee615282a3b7589ade88307db1419a5076a0e491b63d
TLSH
T1E3D022013380CEAE450058471EA9B388B0EE08BA2F49BDA28609889C13CAC8CB59B182
MD5 SHA1 SHA512 TLSH

Submit Download

7J0EEcQ4Y5zR.bat

Path C:\Users\Admin\AppData\Local\Temp\7J0EEcQ4Y5zR.bat
Size 207B
SHA256 73f386b933423cfc11c713ae252c9a14f28c7f5c247b2aa2ddd6368b587e02e9
MD5 94097f7a6ca20216233118477431b17f
SHA1 0a39a575e35d984d8138dbbc8d3c1ebfbe9bd44c
SHA512 29e1fddb1198d5ba165142c10cadbacbf662025d93e9f7091700672eb60a934a0d5bd74d71916c2d9a6816e5c4855de3e60ec60a4ce7d6bffb4e5ec39fb26567
TLSH
T144D023023740CE5D45011C4B1EA5B288B09A04B61F087DA14505C8DC038694C755B182
MD5 SHA1 SHA512 TLSH

Submit Download

FSLL48mE1sos.bat

Path C:\Users\Admin\AppData\Local\Temp\FSLL48mE1sos.bat
Size 207B
SHA256 4659aa0ba5a8cd46271d7e31bc5eebe11d928eea8a42d7dc03ec6ce12f703a91
MD5 6759fecacb5578a7f53e56d98d496552
SHA1 224362b0ab39900d555169a22c6101be06e6d8bf
SHA512 2922cd15f37d2c01e45a22b707e904d6a4803a60880cb0dccd03a0d6d1d65175ad8f85264a9b923d0c179dfe0cc1beece9480e264ecf183ebedfe5f1c2462753
TLSH
T199D023012340CE9D450018471D7563C8B09A04B61F087E7145054CDC43C689CB59F141
MD5 SHA1 SHA512 TLSH

Submit Download

INJPjphnrupQ.bat

Path C:\Users\Admin\AppData\Local\Temp\INJPjphnrupQ.bat
Size 207B
SHA256 861d9b9623dbd3a8534e8c06f5e273650b18300d4fcd8b72096ef34340ff6dd5
MD5 13f6ffe583dfbaf0107e249b92f0b17a
SHA1 9cb9fb812d951552c8aa0f49652932274bef3601
SHA512 7c177833059a7da5123d9339922e3d1d40446c0cd6823e26e24c9e0a2b6600a30550e06859a34bb6f241772587994186ca6919194c38fa46a5f681849fe01a61
TLSH
T1E4D022512381CE9E45002A4B1EB5F288F0AA08EA2F48FEA38601889D13C688CB59F182
MD5 SHA1 SHA512 TLSH

Submit Download

MSBhtmUcyGmT.bat

Path C:\Users\Admin\AppData\Local\Temp\MSBhtmUcyGmT.bat
Size 207B
SHA256 850b103b762274c3416e530e4a663ed5da9629eec9095e7c4d7375f6f8b9e346
MD5 2b02baaafb8a97f88dffdc47b597bd31
SHA1 7c7049241ae1aa3f753e6990a077a7364a336d47
SHA512 95fe4e1b185f0291ec7e902ef3a2cbafa142257a78c080a319012576ac32005d751af26a7872679aa6c76a302a5267fa26cf0250e2c4dac393989736cf983aa0
TLSH
T119D023113340CE5D550018475D656288B09A04EA1F09FD624601489C438794DB5DB141
MD5 SHA1 SHA512 TLSH

Submit Download

Njwo0HFibE51.bat

Path C:\Users\Admin\AppData\Local\Temp\Njwo0HFibE51.bat
Size 207B
SHA256 29258dbf7ef8bdb00b460bde48417706707c836b933a036f1fed65a36ca0e936
MD5 ab0dde0fe624b40d14fec111e91bb99a
SHA1 c4cbd6b2f99901c1203f0feacf72db98887a1bd1
SHA512 ddeb344f28a10ce758ee9f78406a27d5efd8c38b4dfe4430d71b3f648ad1549f5e87ad504beaa69daad503c7a2fdcfaa770c65ac17301000e27852538658ecde
TLSH
T1F9D023012340CE9D461018471DB56288B0AE04F61F097D714501489C47C7C4C759F182
MD5 SHA1 SHA512 TLSH

Submit Download

RpCFq6rUoGaR.bat

Path C:\Users\Admin\AppData\Local\Temp\RpCFq6rUoGaR.bat
Size 207B
SHA256 379f4d0f253a007ea06d199edd35931ff19cad4d88485c89beb241a606159911
MD5 d3121c740188460a905f7f5355f498d0
SHA1 e7863447963164df0d6c43d6969c17397c7191a0
SHA512 ac51d137dbcdffe6b77bcc19c1eff4487a05516806637dcb4dd23dd639f5f34bff9c1808d1873c5dccc1dcae6dd611365d86905b1ebfb2ad93cf69b9187d75fc
TLSH
T19BD023112341CD5D4501584B1D657A88B09B04AA2F49BD614511889C138688C755F141
MD5 SHA1 SHA512 TLSH

Submit Download

k6sGzW4vf1jr.bat

Path C:\Users\Admin\AppData\Local\Temp\k6sGzW4vf1jr.bat
Size 207B
SHA256 8389194240d0b2d616c5863a18aa44059ec5ec446c9090990d20076d374802b4
MD5 0d63f4f33359a8d623e40ac5145ad92b
SHA1 fbdc40543c585730055dad354a63e4edfc36f951
SHA512 2b4a0cd100a670d1d626d05523a124131296e3e20d91e80bac7b3019ef4c35fcc41b9b8a6a880acd8af6e1e4643ad0f0a146daecd505be88403a5690f9c02758
TLSH
T14FD023012340CD9D55011C871D6563CCB09A04A72F0CBD618615589D43C684CB59F141
MD5 SHA1 SHA512 TLSH

Submit Download

naTpfG8vVF0G.bat

Path C:\Users\Admin\AppData\Local\Temp\naTpfG8vVF0G.bat
Size 207B
SHA256 6304526e9085d6e0879491cf2664c4361abef0257f07848c20d6ff2bdca3fb21
MD5 c6e9feb2d12a60aa094f8215986e3429
SHA1 de2d7aee12ebbd92bbce92f91a6cecf00f60a2ee
SHA512 e53837a8c732e94d249f2dcaa02e1c8b331834233a00a7391a6bd4602bb9ae73166c7567e9afcf3660770b531478ee8db01ef88ec5c9c429fc5c190a1ccc0289
TLSH
T117D0230123C1CD5F490018471D66A388F0AA04A61F48BDF14611489C038684C759B581
MD5 SHA1 SHA512 TLSH

Submit Download

pd2GBxbpQr9l.bat

Path C:\Users\Admin\AppData\Local\Temp\pd2GBxbpQr9l.bat
Size 207B
SHA256 b437cd316f248fa5781342340ef1514bcf65a4206ab676846d520aa8cf06c842
MD5 d9e245cede24a62c72dc1e274df9aec7
SHA1 25e78fabc1330d9bae63ab14716f8a4394988fe2
SHA512 178ba2d361321eb653e9ab2558d35a0cf10db49e3f9ada6a96f9eb184f6ecc682fb0bc4bd0398fd51ebc07e34707d3768d5b256a124c3cfce2e8bc6f338e3ec6
TLSH
T1B3D023012340CD5D450029471DB5B289B0BB04BA1F0CBD624501489C038795C756F181
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 cddf8ed8ce548c2c1254ee53dbb92cb70bc5ddf1ab314185dc72de672818bbbc
MD5 d6b7b25b4d8650710611403e4719e141
SHA1 93653e63b4533b1e112f90ac33defac7b46905d2
SHA512 f634c8e991415ddf37e4b8443e5c0e297321b48e11e16e14bd9605fd82c62b793d75e52d37936d813ed080e94fb5d0dfadae134b11c3c9eaa833017463a3ed1b
SSDEEP 98304:jv6L26AaNeWgPhlmVqkQ7XSKb+RJ6GDZ:La4ShrV
TLSH
T11FE56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4524-0-0x0000000000470000-0x0000000000794000-memory.dmp

Download

memory/4524-1-0x0000000000F50000-0x0000000000F60000-memory.dmp

Download

memory/4600-6-0x000000001D7F0000-0x000000001D8A2000-memory.dmp

Download

memory/4600-5-0x000000001D6E0000-0x000000001D730000-memory.dmp

Download

memory/4600-4-0x000000001B7F0000-0x000000001B800000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads