quasar | e7fa9494811b479f00405027a8bad59dccaa410ac439bdd046ed2c440d0e101f

Analysis

max time kernel
149s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skibidi-main/CondoGenerator.exe
Size 3.1MB
Sample260912-nf8a6avhpb
SHA256 e7fa9494811b479f00405027a8bad59dccaa410ac439bdd046ed2c440d0e101f
MD5 5da0a355dcd44b29fdd27a5eba904d8d
SHA1 1099e489937a644376653ab4b5921da9527f50a9
SHA512 289ac0076045bcb1e8b35d572ed27eca424f718b9ef26d821a5cc7ee372203125a6c516b296044efc23ad4d4bd771e1d875cf74107b9205c5312a6c49d37b0a6
SSDEEP 49152:3viI22SsaNYfdPBldt698dBcjHFfRJ6fbR3LoGd5THHB72eh2NT:3vv22SsaNYfdPBldt6+dBcjHFfRJ6x
TLSH
T1E9E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.79:4782

Mutex

956eafb2-7482-407b-bff4-d2b57a1c3d75

Attributes

encryption_key
EFEBD005E03B8B8669985D9A167E2BEF9FFCA477
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral4/memory/5972-1-0x0000000000D50000-0x0000000001074000-memory.dmp	family_quasar
behavioral4/files/0x000e00000001c537-15.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2124	Client.exe
3632	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
52	cmd.exe
4732	cmd.exe
1764	cmd.exe
4260	cmd.exe
4636	cmd.exe
5824	cmd.exe
1220	cmd.exe
4156	cmd.exe
4492	cmd.exe
2456	cmd.exe
3080	cmd.exe
1984	cmd.exe
1812	cmd.exe
2724	cmd.exe
4292	cmd.exe
2380	cmd.exe
3252	cmd.exe
704	cmd.exe
692	cmd.exe
4384	cmd.exe
3332	cmd.exe
2316	cmd.exe
3436	cmd.exe
244	cmd.exe
3972	cmd.exe
2624	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 26 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4872	PING.EXE
4764	PING.EXE
2504	PING.EXE
3704	PING.EXE
5740	PING.EXE
2908	PING.EXE
5092	PING.EXE
6128	PING.EXE
1820	PING.EXE
3020	PING.EXE
1252	PING.EXE
5008	PING.EXE
952	PING.EXE
1524	PING.EXE
464	PING.EXE
4644	PING.EXE
4980	PING.EXE
4156	PING.EXE
4624	PING.EXE
2076	PING.EXE
2396	PING.EXE
4224	PING.EXE
5784	PING.EXE
2896	PING.EXE
2716	PING.EXE
3828	PING.EXE

Runs ping.exe 1 TTPs 26 IoCs

Remote System Discovery

T1018

pid	Process
4644	PING.EXE
5740	PING.EXE
2896	PING.EXE
3828	PING.EXE
4872	PING.EXE
2396	PING.EXE
4224	PING.EXE
5784	PING.EXE
5008	PING.EXE
952	PING.EXE
1524	PING.EXE
2716	PING.EXE
2076	PING.EXE
4764	PING.EXE
3704	PING.EXE
4156	PING.EXE
4624	PING.EXE
1820	PING.EXE
1252	PING.EXE
2504	PING.EXE
464	PING.EXE
2908	PING.EXE
5092	PING.EXE
4980	PING.EXE
6128	PING.EXE
3020	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 27 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4540	schtasks.exe
5724	schtasks.exe
5168	schtasks.exe
1636	schtasks.exe
6056	schtasks.exe
5816	schtasks.exe
2660	schtasks.exe
4752	schtasks.exe
4956	schtasks.exe
3424	schtasks.exe
1692	schtasks.exe
5148	schtasks.exe
2064	schtasks.exe
5684	schtasks.exe
2544	schtasks.exe
3684	schtasks.exe
5388	schtasks.exe
5340	schtasks.exe
1888	schtasks.exe
5708	schtasks.exe
5716	schtasks.exe
3228	schtasks.exe
2204	schtasks.exe
2752	schtasks.exe
1792	schtasks.exe
620	schtasks.exe
5828	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5972	CondoGenerator.exe
Token: SeDebugPrivilege	2124	Client.exe
Token: SeDebugPrivilege	3632	Client.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2124	Client.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2124	Client.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 3424	5972	CondoGenerator.exe	87
PID 5972 wrote to memory of 2124	5972	CondoGenerator.exe	89
PID 2124 wrote to memory of 2204	2124	Client.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\skibidi-main\CondoGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\skibidi-main\CondoGenerator.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3424
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eRUETfS0a8PS.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:704
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:568
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2908
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      PID:4788
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2752
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hvknbAF9ypgz.bat" "
        5⤵
        Executes a command shell one-liner
        
        PID:244
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3676
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5092
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        
        PID:2236
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YivrqfuJTi6Q.bat" "
        7⤵
        Executes a command shell one-liner
        
        PID:3972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4160
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4156
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        
        PID:1736
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AMmmuhjfeHQ6.bat" "
        9⤵
        Executes a command shell one-liner
        
        PID:2456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4092
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2716
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        
        PID:3864
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1636
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gBdBGTe4fOaR.bat" "
        11⤵
        Executes a command shell one-liner
        
        PID:4384
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4216
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2076
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        
        PID:4756
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5828
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AybE3T0iQzmk.bat" "
        13⤵
        Executes a command shell one-liner
        
        PID:5824
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:5992
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4872
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        
        PID:6076
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\doez8uFTtnHT.bat" "
        15⤵
        Executes a command shell one-liner
        
        PID:4732
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3448
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4764
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        
        PID:3452
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5716
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rrQCQrj6pEEi.bat" "
        17⤵
        Executes a command shell one-liner
        
        PID:4156
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1164
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1820
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        
        PID:5388
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5816
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TE9Vzwse4gaN.bat" "
        19⤵
        Executes a command shell one-liner
        
        PID:3080
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4612
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2396
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        
        PID:3404
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5724
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qWL9BUespc6k.bat" "
        21⤵
        Executes a command shell one-liner
        
        PID:1812
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3712
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4644
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        
        PID:4652
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5168
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rfy9NDidlYiE.bat" "
        23⤵
        Executes a command shell one-liner
        
        PID:4292
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2908
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1252
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        
        PID:4316
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XDgGXzzVa5Pj.bat" "
        25⤵
        Executes a command shell one-liner
        
        PID:3332
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:5416
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:952
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        
        PID:4160
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hSc2GAin9xIb.bat" "
        27⤵
        Executes a command shell one-liner
        
        PID:3252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:2728
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3704

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3632
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hENNlhupnyoB.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3436
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:752
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1524
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    PID:2852
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1792
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eKRVXqwRlDgg.bat" "
      4⤵
      Executes a command shell one-liner
      PID:692
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1064
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4980
    - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        5⤵
        
        PID:4880
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:620
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KizoAMOKNaw9.bat" "
        6⤵
        Executes a command shell one-liner
        
        PID:4260
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:6000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2896
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        7⤵
        
        PID:3364
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZoB9Goc4j1KO.bat" "
        8⤵
        Executes a command shell one-liner
        
        PID:4636
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:3180
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4624
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        9⤵
        
        PID:1480
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5340
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8ZY1MMhcJobN.bat" "
        10⤵
        Executes a command shell one-liner
        
        PID:2624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:6080
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3828
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        11⤵
        
        PID:4536
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1888
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\P19wpgTBiUaI.bat" "
        12⤵
        Executes a command shell one-liner
        
        PID:52
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:1940
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6128
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        13⤵
        
        PID:1560
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5708
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bqWMgUEIUJxe.bat" "
        14⤵
        Executes a command shell one-liner
        
        PID:1220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:2100
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:464
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        15⤵
        
        PID:1384
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rJ784TMNMhnZ.bat" "
        16⤵
        Executes a command shell one-liner
        
        PID:1764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:3704
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3020
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        17⤵
        
        PID:3276
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2660
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\finDUkzGuvfb.bat" "
        18⤵
        Executes a command shell one-liner
        
        PID:1984
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:3376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4224
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        19⤵
        
        PID:1712
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3228
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yxUDAEuYn0qa.bat" "
        20⤵
        Executes a command shell one-liner
        
        PID:2724
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:5604
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5784
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        21⤵
        
        PID:5752
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\09i3tuUsZMlS.bat" "
        22⤵
        Executes a command shell one-liner
        
        PID:4492
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:4928
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5008
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        23⤵
        
        PID:2612
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2064
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\361VvT03EQZ8.bat" "
        24⤵
        Executes a command shell one-liner
        
        PID:2380
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:6000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2504
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        25⤵
        
        PID:1388
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4E5YwIfvcYqd.bat" "
        26⤵
        Executes a command shell one-liner
        
        PID:2316
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:1240
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09i3tuUsZMlS.bat

Path C:\Users\Admin\AppData\Local\Temp\09i3tuUsZMlS.bat
Size 207B
SHA256 f44cb4c699861f35874c7b175d4f2615ccb7f3e587f63b83f782bcffc1769747
MD5 e716b5181bc848459910e243d3b0dc41
SHA1 74e9d9c3c2e2a9659f7ea99c38743b5cf3c7c850
SHA512 b1a957d2d7e027f2ead1524109fbd878aa935f98ecc0f4171bf2967bcece7d46c7bd34456d0b077711f6a23bd6eba99bb56ab729900f1f0095de0ce7cbc76612
TLSH
T1D5D023112340CD9E45001C471DE57288F0DA04A71F09BD614511489C5386D8C755F181
MD5 SHA1 SHA512 TLSH

Submit Download

361VvT03EQZ8.bat

Path C:\Users\Admin\AppData\Local\Temp\361VvT03EQZ8.bat
Size 207B
SHA256 07837a44e14a457cf76edbec152b8b33847b36049a8459276c2685981e842502
MD5 eb69c0eb7d036277d09bc6134597547f
SHA1 15296f4338d0914352333e7b5ae44955286e03b1
SHA512 18a736ecaa77478e768bac827e4efe0a33cdeb68010ff3edfeb410a950063ff32cda69168abf63cca0a8a056c22ae4060cf1314cf888fb9e9cfe8cff38ad591b
TLSH
T11ED023212381CD5E550018472DA5A6C8B0DA04AE1F087DB1C501889C478694CF55B541
MD5 SHA1 SHA512 TLSH

Submit Download

4E5YwIfvcYqd.bat

Path C:\Users\Admin\AppData\Local\Temp\4E5YwIfvcYqd.bat
Size 207B
SHA256 84b24b9aef4e7b75e0aa3c07baa5b9c46dc11b8fd35b9a3f68e9e68c179d567b
MD5 a46574cbe55f9dae366677908152045d
SHA1 4f284a2d200806fb8d4e6b12575cd69af46b044f
SHA512 c3fecc59dd72c6bfe461e03d52444681bf3123290659e26d8f5ee2c30bd0fcf75615c91314b821ba938bf5299f836742366b8fd501c337f28f078dea9e072b85
TLSH
T175D022512380CEAE490418475EA5A688F0AE04AB3F0CBDEA86018C9C4386E8CB59B282
MD5 SHA1 SHA512 TLSH

Submit Download

8ZY1MMhcJobN.bat

Path C:\Users\Admin\AppData\Local\Temp\8ZY1MMhcJobN.bat
Size 207B
SHA256 6e98a074a300116c27f6641de92086df76e8cb00746eb040fd3e7d4134e3513e
MD5 89bcad43cde1df6b7591dfb0dcf31c51
SHA1 9c1d146089da6d75d4e2f378f9318ae7ee044876
SHA512 5661390ce7beec8cb3867ef335fe6e475176f15d4194ab0d95745a6432d877d5a1b6daacc274241a34cbe0a43040ddcb44e31f684ced49bef412b73113ebf3f0
TLSH
T1F2D022013380CEAE450018472EA5B388B0FE08BA6F49BDE286018C9C1386C8CB59B982
MD5 SHA1 SHA512 TLSH

Submit Download

AMmmuhjfeHQ6.bat

Path C:\Users\Admin\AppData\Local\Temp\AMmmuhjfeHQ6.bat
Size 207B
SHA256 beebbe6d92823fba6ef6c2b08e341c69b14c9d77e546eda7a415b27ca4c18c82
MD5 bc89d3f50b9e9c880751bec3d58a598b
SHA1 549edd2195117c56f78b36cf387d813c647898e9
SHA512 a58f54bac241845e64dd1419712d55a86845b559a39907c49933a82eb5929b72590c7a6d2c61724552dd09f4cc6abf3bd3486e3814ba55bce177788e1370f042
TLSH
T19CD023016350CD5E450018475D6563CCB0AE04B62F087D714513CC9C07C688C756B281
MD5 SHA1 SHA512 TLSH

Submit Download

AybE3T0iQzmk.bat

Path C:\Users\Admin\AppData\Local\Temp\AybE3T0iQzmk.bat
Size 207B
SHA256 a3de39002058137d7f4777d38756e0bcdc938902cfadbdb41bdb03288b5e4ced
MD5 b13941dd3e77d07e14e29f5dd1ee8840
SHA1 7c532aabcba274c4a8364664d1b10b836f7ef082
SHA512 0b1e5b5d08a5d413e1ea7483c069bd5b643b2d45cf5de62a09816cf1e8656e45ef8e417dd1a57aeaec4f34a50e385b2cfee6393ea29d954b742642402e9f7e82
TLSH
T177D023112340CDDD450018875D6563C8F09A08A61F48BD624501489C038784CB55F541
MD5 SHA1 SHA512 TLSH

Submit Download

KizoAMOKNaw9.bat

Path C:\Users\Admin\AppData\Local\Temp\KizoAMOKNaw9.bat
Size 207B
SHA256 7106c9392ba5aa9292b2797a62135042089873e91330e9545f6df569b1bce1bc
MD5 c8dbf32dedf9cc161d8f4218638c3651
SHA1 c254c689e916577c7dc8b6e0709c704c68d0b429
SHA512 a8e8c8337ff38351edcfaf6e109bb740a1c46ca67934c8db06aed1699117ee97056ac413d00427a6067e8e057c85405a28b7212ac81230641ad784234cf4f6e9
TLSH
T1F5D023412741CDAE45001CC71EF57688B09B04B61F4C7D61C6018C9C43C7C4CB55B581
MD5 SHA1 SHA512 TLSH

Submit Download

P19wpgTBiUaI.bat

Path C:\Users\Admin\AppData\Local\Temp\P19wpgTBiUaI.bat
Size 207B
SHA256 da71377088d2196b5903f791e2fe7d8ce6f4d7516952c2c93f74ba3e64a442f6
MD5 2e11bf8ab6e1a878f84a033b338cea83
SHA1 7a425dcdff82554a59d5808b6fbee4f272f345d1
SHA512 9ffd209ddc28d66f7d41e4ae4bb9156664d146f9b899dde8eaee55f544e4f8d0e7bcf972d64f4eac0ae2b70d6cf6c81c765e071e7238647d4e2b4a87969bf731
TLSH
T152D023013381CE6D450018471D65A388F09B04A61F0DFDF18501489C03C795C765B141
MD5 SHA1 SHA512 TLSH

Submit Download

TE9Vzwse4gaN.bat

Path C:\Users\Admin\AppData\Local\Temp\TE9Vzwse4gaN.bat
Size 207B
SHA256 5b7614b2e22adcf5272f8ab2f772f8ee4c82e1ac63ab5fd6675e0c17f7421a2d
MD5 f0a2595cefeae9ce70e9f38eaa4ce893
SHA1 5677d59508c36ff6f8275f8aa606acd9f5ace8cb
SHA512 a6e42ca4d1894ec4c184a9e1e2ce6f6d20506b90dbb1a329b97f1b242c21e2b32ed7de9e46b323053230aaa81f02a84be5317cf6c6360772900fcbefbcd90cc7
TLSH
T14ED023012340CE5D4500184BAE75638CB0DF04A61F49BDE3450148AC03868CD755B143
MD5 SHA1 SHA512 TLSH

Submit Download

XDgGXzzVa5Pj.bat

Path C:\Users\Admin\AppData\Local\Temp\XDgGXzzVa5Pj.bat
Size 207B
SHA256 b819b1dfc4321cf0823863078eb3a5f212eb008af9d3eab205566b7d0d1d7733
MD5 0946ca02e1b811673a86048a1360c0ba
SHA1 2668a5669bff79778405a5d7aa069f15c6ab0156
SHA512 94c2ec11a22e4999a1194f70e0d8e030fa4601981923eb1082763bd65828bcc6bda7917d0411562191625e71587977a11eb4b81bde48c417beffbde906fb9d90
TLSH
T140D023013340CD5E45012C471DA5728CF0AA04E61F097D614601489C13C785CB55F581
MD5 SHA1 SHA512 TLSH

Submit Download

YivrqfuJTi6Q.bat

Path C:\Users\Admin\AppData\Local\Temp\YivrqfuJTi6Q.bat
Size 207B
SHA256 6a57187177071470536f2d3a1b462799e3bdf370365ee2feeb70af4fa66f8bb3
MD5 ddc5c6e2ffa2c5cf534e1c062b5f685f
SHA1 f3c096a4504709306e456d46e32d9450a658d8b6
SHA512 d92520abd9d12589848b1f0a6c906e849183c9710bb8d6e4f2128d7654747f9e6851d184d44ba1cc90f6d6a1db8b73c419b2ad1da6a90d5d30ac1bd31837492c
TLSH
T15ED022023390CE9E490168471EA5A7C8B0EE08AE2F08FDA2860588DC039688CF5EB582
MD5 SHA1 SHA512 TLSH

Submit Download

ZoB9Goc4j1KO.bat

Path C:\Users\Admin\AppData\Local\Temp\ZoB9Goc4j1KO.bat
Size 207B
SHA256 4a7a85eff46829ffb88e420f76cd6cd61ab392caf0610367d6f522a4b16bf8d8
MD5 05f52bc65725ad058d653058deddc29c
SHA1 e15bd554af19e457b33c676e72c17de438de4393
SHA512 ca3e1e7a6db88b700ea4827f976925b8df1b91ddc675b2a9e24ea9c1596002cdd01c1c909f788ff600c0b35fe5c9faca542ff87c53cd41e267ed0c24d8bb9c9d
TLSH
T192D022012381CE9E960018472EA5A388B0EF04FB2F8CBDA286018C9C038688DB99B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

bqWMgUEIUJxe.bat

Path C:\Users\Admin\AppData\Local\Temp\bqWMgUEIUJxe.bat
Size 207B
SHA256 be912f8d94392c8c1fcb955b1b2db77b9720cd3876b7f0471989ebd85b3f3296
MD5 4c968285ed258003cf5c34e8d96eafd6
SHA1 5af03f8b67915074a938b376bfdc2226c7d89da5
SHA512 9970c9d363ab419573b2237093dd201116fd72f79d5d96fd0cb8f9f5760ef8a8c684837548f0839bee5da7c1e7cc9dae849905dcd0769c2378669e1515425e6e
TLSH
T1D8D023012381CD5D550418471DA5638CF0EE04A72F097D614511489C138695CB55B582
MD5 SHA1 SHA512 TLSH

Submit Download

doez8uFTtnHT.bat

Path C:\Users\Admin\AppData\Local\Temp\doez8uFTtnHT.bat
Size 207B
SHA256 e94b9fac856c6c20cd5c27a4fdc908d83c8835aa3ebba81a87567a5e2545d2f9
MD5 3fde763adaf5457e82fae68a038cd2ed
SHA1 b8533dba7d5a55e39b3305f1cea29318736c980e
SHA512 90228650fac26984b1092e73e796a1903e453cf0b0a45cec9999b47a64b5e8c60770920cc06d2890e070632852f2f2288f7a8a171d14d3ec603e407e8794fe71
TLSH
T1ABD0230133C0CD5F450018875D65A288F09A08A61F0CBD754505489C538B88C755B542
MD5 SHA1 SHA512 TLSH

Submit Download

eKRVXqwRlDgg.bat

Path C:\Users\Admin\AppData\Local\Temp\eKRVXqwRlDgg.bat
Size 207B
SHA256 c2e79400501c3a4d790e025756b7d7754bfc7d5209b49d472c8ddbd2e60e7068
MD5 2c612e39dbdf4c97b1a5a1807c153c0c
SHA1 0ff023fe5c3dc206019bbc77bcca3f8a7d12f76a
SHA512 a08b4c51aac25e467943b5e71a0c5a5a3ac8fbea4ce2fefc6ab92d21c2d2b5f53d64f1e71178dc9bba78e283d8d1f2cafaeb5ccda39c45f3bea863ba279ce6b0
TLSH
T1B0D023012340CD5D55001C471D6573CCB09A04A62F08BD71C515889C03C7C5C755B581
MD5 SHA1 SHA512 TLSH

Submit Download

eRUETfS0a8PS.bat

Path C:\Users\Admin\AppData\Local\Temp\eRUETfS0a8PS.bat
Size 207B
SHA256 eafc60c8086db86158420726d6a2b9daea260de193df70ec33051a8efe8f46fb
MD5 a3dc869e0d63eb509b93c923c2c6608c
SHA1 8341e3fc9366c633e416d3012615fa0024b6de4c
SHA512 43030ebe694776441ca7081ee2ad1db1a2134c1e42790817a685d71647164d448dca52d68bec4feded347ba8d0534d4dc69769c5261cc7ab707ddd417dee9227
TLSH
T1F9D022012380CE9E5500184B2EB5A2C8B0AB44FB2F08BDA28A118C9C4386D9CB59B182
MD5 SHA1 SHA512 TLSH

Submit Download

finDUkzGuvfb.bat

Path C:\Users\Admin\AppData\Local\Temp\finDUkzGuvfb.bat
Size 207B
SHA256 c4c1c62cbc8a5dc62a49a4c1633cc30a83717b2861bd4ae87c9397d8a487d8fb
MD5 eeb0c80fe0c700fb58bd2ea0cb1197f8
SHA1 7c785449e9839c106bdc1841e037889fbcacc718
SHA512 7108708a70a3016fb511876571ce896d5a67d092015595a0dc33c90469cd9f2088d428f93dcdc4980428ce4c91ad55175e2816eba80eba50579c7a8543b27736
TLSH
T198D023013781CD5D4501284B1DA57288F09A04AB1F4C7F61C601489C578688C755B141
MD5 SHA1 SHA512 TLSH

Submit Download

gBdBGTe4fOaR.bat

Path C:\Users\Admin\AppData\Local\Temp\gBdBGTe4fOaR.bat
Size 207B
SHA256 0bee8b195c8bccdbd4a50bd8884e7c2d7eb980cf48160190927a0d892879cc35
MD5 b48cba147b988085ee5968e2fc152119
SHA1 01fc137eb3acb49a28e0e5baca067e003c39aee2
SHA512 a12ec993ebb5196de27cd875aa37aea2659e5f062e55af06e017950d2c55d3059d7ebdfcff3120177dc31d72c19383d9656fc9bd44507ccdea2b31fbe6c4b840
TLSH
T196D023412381CD5D4500184B5EA56288B0DA0CAA1F0C7D614511889C038794C755B142
MD5 SHA1 SHA512 TLSH

Submit Download

hENNlhupnyoB.bat

Path C:\Users\Admin\AppData\Local\Temp\hENNlhupnyoB.bat
Size 207B
SHA256 071f1b00e53aae287ca69bb9f57e8c50d5d0abcaf4c6f0e96f5aede853ab3ef2
MD5 12337c3986360ffbc78489018586bdad
SHA1 02ef7a3a1bb577cbfa31b4da4e4872bbc2969517
SHA512 77a34b67262fe6ab84fab833edd7b3025f76d9bdc79cd7f8a913ff398592aa45d175df85b1ce0ed1b814594fd96efb987b5e79f1bd07afeb9d72b0ee8f94eb9b
TLSH
T150D023412744CD5D450018471DE6628CF09A08AB1F0D7D6345018CDC0386C4C759B142
MD5 SHA1 SHA512 TLSH

Submit Download

hSc2GAin9xIb.bat

Path C:\Users\Admin\AppData\Local\Temp\hSc2GAin9xIb.bat
Size 207B
SHA256 8c132ea4b6b0171a2ae0b5fd73d05cfe8f7cd2ee0826eba9c864f1a759412161
MD5 8145fb622c600db84342649c3799213e
SHA1 ef6edb6c04dcceb2c5a24e341ad367f4b6e92e10
SHA512 5becb5adf74b407706b01ee02a7dd2e9a2e26834c6a2638e587a29a77dc77d455df44baeb21aa6f3912aa083e5c67b336a23cbb9ef4f0b1773bf4dfc8e52542e
TLSH
T1CAD023512781CD5D85001C471E756788F0AA04EA2F097D6147014C9C138694C759B542
MD5 SHA1 SHA512 TLSH

Submit Download

hvknbAF9ypgz.bat

Path C:\Users\Admin\AppData\Local\Temp\hvknbAF9ypgz.bat
Size 207B
SHA256 6bc7145e4e8678928e3fa7f68efd79e82360e083cd1999a9a4da2c8172af3db1
MD5 9a73b2d55da14712f71a7b5b707bdcc5
SHA1 fe217e4d02d4805cbfe323b3ea01635f4602f845
SHA512 5a1d58399038c6db8bcd7ac212dd2a5998c24f961016d6c141fa44296a41bb3df7cf90529faa41eeea3d96dfaddbcb247b9ee2716c203dd3d04b4558e6d896bb
TLSH
T13ED023012744CD5F550018471D75B288B09B04EA1F087D61C505489C43C784C76DB142
MD5 SHA1 SHA512 TLSH

Submit Download

qWL9BUespc6k.bat

Path C:\Users\Admin\AppData\Local\Temp\qWL9BUespc6k.bat
Size 207B
SHA256 cfa087539e4f9535bd44741ac928eaa4ed6a4087154069466fb8bc177cc458c1
MD5 3859e4cb12a9b8feb9a42cc1b14b0b65
SHA1 cd9b9316e1e356e9f0c34bfdcea4f48d92c5480b
SHA512 f43889c7ed8aa8bb74007c42c4db718c241a480538343e6b5eb160b411ca27262f474501716c660c232aecb5e7c13da54a3bb0e47c679c90978f553b2737ecca
TLSH
T1D2D023012344CF5E550118471D6562CCB09B04AB1F0D7D614505889C0386D5CB55B142
MD5 SHA1 SHA512 TLSH

Submit Download

rJ784TMNMhnZ.bat

Path C:\Users\Admin\AppData\Local\Temp\rJ784TMNMhnZ.bat
Size 207B
SHA256 f3f25f17d420d8315201b210a74081410183fc1edcadb736b0989188b608576d
MD5 53d8b120b26633c6c6b9a4c60ec33bc7
SHA1 f8aa9202d9a7bc9ae8dfdbc98638625c0ea2347b
SHA512 baccb28c29034107a537d61bb72446b7275130cb0fba4301386cb18ec949c0f3c6f1e518c55f2f342da62e7e113dd380aec2f651c2c28d30d2f3ca71e6a8ef40
TLSH
T1F9D023512340CE9D450258671D65E78CB0AB04A61F097D63C611489C0386D5C755F141
MD5 SHA1 SHA512 TLSH

Submit Download

rfy9NDidlYiE.bat

Path C:\Users\Admin\AppData\Local\Temp\rfy9NDidlYiE.bat
Size 207B
SHA256 38c2fbb8596d08addfee26696875748c86348f70af377efb14e5722441b3b82f
MD5 0d86dea90aaa6c20057e43d96f7421a2
SHA1 f90611dc4a28287db97c1370076fe8a051e3cc66
SHA512 82436fca86aaf8c5e1e67ad345a84896c1bedd2b0eb136e6adda0cbe2411d424b37288148312b3ad9c6585949205e9724057f0866906e202e275201c628206d4
TLSH
T15ED023112341CD5F4501184B5D796288F09A04B61F097D71460188DC038788C755B141
MD5 SHA1 SHA512 TLSH

Submit Download

rrQCQrj6pEEi.bat

Path C:\Users\Admin\AppData\Local\Temp\rrQCQrj6pEEi.bat
Size 207B
SHA256 5dfcf53b180a6e7d49e40525faf286d9c57624149ae0a92a7a311cf34e7a6e0b
MD5 1de489e34a780d44a25ee14d5758a04c
SHA1 15ae9609433e9d459201a8ff99b25d2a678c9b15
SHA512 51fd0ff25e616a96ba914b291744517830bde64a5ae3671510715ad81fe02cb57085e64973b6fda40101dc9e958119e37fca82b50b3c145d0e280303f2bc9c11
TLSH
T1D3D023012340CF5D450018471D7663C8B0BE04B61F4C7D61C501C89C03C784CF55B141
MD5 SHA1 SHA512 TLSH

Submit Download

yxUDAEuYn0qa.bat

Path C:\Users\Admin\AppData\Local\Temp\yxUDAEuYn0qa.bat
Size 207B
SHA256 5f4ba41b2540bd95d8b80852612bf555684a52d190233bfba98e29e576ad725c
MD5 4ca980585d88d2db360bfb00f5e7a53c
SHA1 6ce492a8409da8fc54b03877cce3402678b5ddfe
SHA512 80aa3c91c3a908a9b22091e48d91ef0564514fd3d22b351da0703fec42106ca6dbc2a1d6791c63b3a2b9637cea816566fc61f862f1f5ee124afa247659141b25
TLSH
T1DED023522741CD5D450058471E66A288B09E08A61F487D6285054C9C43C6C8C759F141
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 e7fa9494811b479f00405027a8bad59dccaa410ac439bdd046ed2c440d0e101f
MD5 5da0a355dcd44b29fdd27a5eba904d8d
SHA1 1099e489937a644376653ab4b5921da9527f50a9
SHA512 289ac0076045bcb1e8b35d572ed27eca424f718b9ef26d821a5cc7ee372203125a6c516b296044efc23ad4d4bd771e1d875cf74107b9205c5312a6c49d37b0a6
SSDEEP 49152:3viI22SsaNYfdPBldt698dBcjHFfRJ6fbR3LoGd5THHB72eh2NT:3vv22SsaNYfdPBldt6+dBcjHFfRJ6x
TLSH
T1E9E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-28-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/2124-21-0x000000001D090000-0x000000001D142000-memory.dmp

Download

memory/2124-20-0x000000001CF80000-0x000000001CFD0000-memory.dmp

Download

memory/2124-17-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/2124-16-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-11-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-8-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-12-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-14-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-0-0x00007FFDC3B0F000-0x00007FFDC3B10000-memory.dmp

Download

memory/5972-10-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-9-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-13-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-7-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-18-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-6-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-5-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-4-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-3-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-2-0x00007FFDC3980000-0x00007FFDC4324000-memory.dmp

Download

memory/5972-1-0x0000000000D50000-0x0000000001074000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads