quasar | 8d1e47419d36503849b50dada0c3e1dde11380b85681c9586a1675694b23fbeb

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/09/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sike.exe
Size 3.1MB
Sample260915-ncqlyaeh43
SHA256 8d1e47419d36503849b50dada0c3e1dde11380b85681c9586a1675694b23fbeb
MD5 46a36543d0127374bbaa1432a8f55812
SHA1 71c1e88f3e3bf665812d7edccc5759da0999d1bc
SHA512 880264da789350493f177cbf7137ca80ea83a297fef76ad66067bce3d50cc11c7f4b3fec5284dce814b33d4a7523f80845dddb8081a94080b9de057ce3459e23
SSDEEP 49152:dvGju2k/aiC9VPAl1WzPnNLNsiQC51JnpoGdRTHHB72eh2NT:dvAu2k/aiC9VPAl1WzPNLNsiQC/
TLSH
T135E54A1437F85F23E1BBE273D5B0041267F1E82AB3A3FB5B6181677A1C53B505841AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

slotmachinesoldiveri.com/vi-vn/ discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

slotmachinesoldiveri.com/vi-vn/

slotmachinesoldiveri.com/vi-vn/:4782
slotmachinesoldiveri.com/vi-vn/:80
slotmachinesoldiveri.com/vi-vn/:8080
slotmachinesoldiveri.com/vi-vn/:443
slotmachinesoldiveri.com/vi-vn/:8443
slotmachinesoldiveri.com/vi-vn/ :6666

Mutex

f12e079f-162d-44c6-83c0-32d27c3deb4d

Attributes

encryption_key
0F2F00EECD1A030EB1393AC0A5B56706DB6A6C0D
install_name
svchost.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
https://slotmachinesoldiveri.com/vi-vn/
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/3064-0-0x00000000007D0000-0x0000000000AF4000-memory.dmp	family_quasar
behavioral1/files/0x0008000000024388-5.dat	family_quasar

Checks computer location settings 2 TTPs 15 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 16 IoCs

pid	Process
4588	svchost.exe
3720	svchost.exe
1092	svchost.exe
2680	svchost.exe
2308	svchost.exe
2020	svchost.exe
4512	svchost.exe
1320	svchost.exe
3512	svchost.exe
4404	svchost.exe
4772	svchost.exe
1192	svchost.exe
3196	svchost.exe
4916	svchost.exe
4784	svchost.exe
912	svchost.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	sike.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://slotmachinesoldiveri.com/vi-vn/ = "\"C:\\Windows\\system32\\SubDir\\svchost.exe\""	svchost.exe

Drops file in System32 directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	sike.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File created	C:\Windows\system32\SubDir\svchost.exe	sike.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	sike.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe
File opened for modification	C:\Windows\system32\SubDir\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system32\SubDir	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 15 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
996	cmd.exe
3188	cmd.exe
1256	cmd.exe
3676	cmd.exe
4748	cmd.exe
2420	cmd.exe
3776	cmd.exe
1808	cmd.exe
208	cmd.exe
3112	cmd.exe
3460	cmd.exe
2400	cmd.exe
4256	cmd.exe
3508	cmd.exe
2452	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3280	PING.EXE
1100	PING.EXE
4656	PING.EXE
1908	PING.EXE
1100	PING.EXE
2960	PING.EXE
1964	PING.EXE
1040	PING.EXE
3492	PING.EXE
1732	PING.EXE
2712	PING.EXE
3432	PING.EXE
4712	PING.EXE
3820	PING.EXE
2960	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
3432	PING.EXE
1040	PING.EXE
1100	PING.EXE
1732	PING.EXE
4712	PING.EXE
3492	PING.EXE
4656	PING.EXE
1100	PING.EXE
1964	PING.EXE
2712	PING.EXE
2960	PING.EXE
3280	PING.EXE
1908	PING.EXE
2960	PING.EXE
3820	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3440	schtasks.exe
2524	schtasks.exe
2212	schtasks.exe
4028	schtasks.exe
1860	schtasks.exe
4768	schtasks.exe
1596	schtasks.exe
1084	schtasks.exe
3364	schtasks.exe
2200	schtasks.exe
3276	schtasks.exe
3624	schtasks.exe
4824	schtasks.exe
4488	schtasks.exe
3348	schtasks.exe
3496	schtasks.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	sike.exe
Token: SeDebugPrivilege	4588	svchost.exe
Token: SeDebugPrivilege	3720	svchost.exe
Token: SeDebugPrivilege	1092	svchost.exe
Token: SeDebugPrivilege	2680	svchost.exe
Token: SeDebugPrivilege	2308	svchost.exe
Token: SeDebugPrivilege	2020	svchost.exe
Token: SeDebugPrivilege	4512	svchost.exe
Token: SeDebugPrivilege	1320	svchost.exe
Token: SeDebugPrivilege	3512	svchost.exe
Token: SeDebugPrivilege	4404	svchost.exe
Token: SeDebugPrivilege	4772	svchost.exe
Token: SeDebugPrivilege	1192	svchost.exe
Token: SeDebugPrivilege	3196	svchost.exe
Token: SeDebugPrivilege	4916	svchost.exe
Token: SeDebugPrivilege	4784	svchost.exe
Token: SeDebugPrivilege	912	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4588	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2212	3064	sike.exe	83
PID 3064 wrote to memory of 4588	3064	sike.exe	85
PID 4588 wrote to memory of 1596	4588	svchost.exe	88
PID 4588 wrote to memory of 3188	4588	svchost.exe	90
PID 3188 wrote to memory of 4960	3188	cmd.exe	92
PID 3188 wrote to memory of 4656	3188	cmd.exe	93
PID 3188 wrote to memory of 1092	3188	cmd.exe	94
PID 1092 wrote to memory of 4028	1092	svchost.exe	95
PID 1092 wrote to memory of 3776	1092	svchost.exe	97
PID 3776 wrote to memory of 2168	3776	cmd.exe	99
PID 3776 wrote to memory of 1908	3776	cmd.exe	100
PID 3776 wrote to memory of 2680	3776	cmd.exe	101
PID 2680 wrote to memory of 1860	2680	svchost.exe	102
PID 2680 wrote to memory of 3508	2680	svchost.exe	104
PID 3508 wrote to memory of 2652	3508	cmd.exe	106
PID 3508 wrote to memory of 1100	3508	cmd.exe	107
PID 3508 wrote to memory of 2308	3508	cmd.exe	108
PID 2308 wrote to memory of 3624	2308	svchost.exe	109
PID 2308 wrote to memory of 1256	2308	svchost.exe	111
PID 1256 wrote to memory of 1740	1256	cmd.exe	113
PID 1256 wrote to memory of 2960	1256	cmd.exe	114
PID 1256 wrote to memory of 2020	1256	cmd.exe	115
PID 2020 wrote to memory of 4824	2020	svchost.exe	116
PID 2020 wrote to memory of 1808	2020	svchost.exe	118
PID 1808 wrote to memory of 4288	1808	cmd.exe	120
PID 1808 wrote to memory of 1732	1808	cmd.exe	121
PID 1808 wrote to memory of 4512	1808	cmd.exe	122
PID 4512 wrote to memory of 1084	4512	svchost.exe	123
PID 4512 wrote to memory of 3460	4512	svchost.exe	125
PID 3460 wrote to memory of 3332	3460	cmd.exe	127
PID 3460 wrote to memory of 4712	3460	cmd.exe	128
PID 3460 wrote to memory of 1320	3460	cmd.exe	129
PID 1320 wrote to memory of 4488	1320	svchost.exe	130
PID 1320 wrote to memory of 2400	1320	svchost.exe	132
PID 2400 wrote to memory of 2984	2400	cmd.exe	134
PID 2400 wrote to memory of 1964	2400	cmd.exe	135
PID 2400 wrote to memory of 3512	2400	cmd.exe	136
PID 3512 wrote to memory of 3348	3512	svchost.exe	137
PID 3512 wrote to memory of 4256	3512	svchost.exe	139
PID 4256 wrote to memory of 3376	4256	cmd.exe	141
PID 4256 wrote to memory of 2712	4256	cmd.exe	142
PID 4256 wrote to memory of 4404	4256	cmd.exe	143
PID 4404 wrote to memory of 2200	4404	svchost.exe	144
PID 4404 wrote to memory of 3676	4404	svchost.exe	146
PID 3676 wrote to memory of 1588	3676	cmd.exe	148
PID 3676 wrote to memory of 3820	3676	cmd.exe	149
PID 3676 wrote to memory of 4772	3676	cmd.exe	150
PID 4772 wrote to memory of 3496	4772	svchost.exe	151
PID 4772 wrote to memory of 4748	4772	svchost.exe	153
PID 4748 wrote to memory of 464	4748	cmd.exe	155
PID 4748 wrote to memory of 3432	4748	cmd.exe	156
PID 4748 wrote to memory of 1192	4748	cmd.exe	157
PID 1192 wrote to memory of 4768	1192	svchost.exe	158
PID 1192 wrote to memory of 2420	1192	svchost.exe	160
PID 2420 wrote to memory of 4880	2420	cmd.exe	162
PID 2420 wrote to memory of 1040	2420	cmd.exe	163
PID 2420 wrote to memory of 3196	2420	cmd.exe	164
PID 3196 wrote to memory of 3364	3196	svchost.exe	165
PID 3196 wrote to memory of 996	3196	svchost.exe	167
PID 996 wrote to memory of 1680	996	cmd.exe	169
PID 996 wrote to memory of 1100	996	cmd.exe	170
PID 996 wrote to memory of 4916	996	cmd.exe	171
PID 4916 wrote to memory of 3276	4916	svchost.exe	172
PID 4916 wrote to memory of 208	4916	svchost.exe	174

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sike.exe
"C:\Users\Admin\AppData\Local\Temp\sike.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2212
- C:\Windows\system32\SubDir\svchost.exe
  "C:\Windows\system32\SubDir\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5FdP7S7ereEp.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4960
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4656
  - - C:\Windows\system32\SubDir\svchost.exe
      "C:\Windows\system32\SubDir\svchost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1092
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4028
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ruCsD0YzvIQ8.bat" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3776
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2168
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1908
      - C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2680
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Uih0oFfMUipQ.bat" "
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2652
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1100
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3624
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UPmqEfFkbtNG.bat" "
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1740
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2960
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4824
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aZT4QxkMgc4e.bat" "
        11⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4288
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1732
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1084
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZqKMnMBwSfyC.bat" "
        13⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3332
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4712
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7U4yYrPV2TcR.bat" "
        15⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2984
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1964
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3348
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7FEVL6mCfLMf.bat" "
        17⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4256
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2712
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\26MkjwJEteNC.bat" "
        19⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:1588
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3820
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\iijTD0eT7RTr.bat" "
        21⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:464
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3432
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1192
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\j9hi06p0xVLf.bat" "
        23⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:4880
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1040
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3196
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\byMBBiTvTJVv.bat" "
        25⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1680
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1100
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3276
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tO7reJ9JQNns.bat" "
        27⤵
        Executes a command shell one-liner
        
        PID:208
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1208
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2960
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:4784
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3440
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sAlgdN1VBvLl.bat" "
        29⤵
        Executes a command shell one-liner
        
        PID:3112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2404
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3280
        
        C:\Windows\system32\SubDir\svchost.exe
        
        "C:\Windows\system32\SubDir\svchost.exe"
        30⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:912
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://slotmachinesoldiveri.com/vi-vn/" /sc ONLOGON /tr "C:\Windows\system32\SubDir\svchost.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2524
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\pdZ6O4VGcwP3.bat" "
        31⤵
        Executes a command shell one-liner
        
        PID:2452
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2784
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3492

C:\Windows\system32\SubDir\svchost.exe
C:\Windows\system32\SubDir\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

26MkjwJEteNC.bat

Path C:\Users\Admin\AppData\Local\Temp\26MkjwJEteNC.bat
Size 197B
SHA256 c1c9f1eb12c1e1cad69e68363b039b1bf0a2589293d4bd64b254ed9005f77ec0
MD5 5e2f117ab49569c8a07a619f08f1b2c1
SHA1 3fb1f776ca589979c66c0db4eb74ab955e225403
SHA512 c9326479257125a46d44e3e97d5cc82385db6a7c80a0944e92e14e99b38a52b4296a23e07c0103a753d3564ebefcbd3fd8f38ad472e0ca4633a5a08685010d6c
TLSH
T18CD02200A301C8AD41008C0928992285B19A60AA1B08ECA2040288ACAB8A89DBA7BBE1
MD5 SHA1 SHA512 TLSH

Submit Download

5FdP7S7ereEp.bat

Path C:\Users\Admin\AppData\Local\Temp\5FdP7S7ereEp.bat
Size 197B
SHA256 6a66e8406ac8a78b80468617fc0cfe016e75f62f24bb9e100638efb3abb9cf9d
MD5 6667abcb6c9155d2aaa668ccf2a53b00
SHA1 72e3a07669ea80ffbf7b226525ad19e490584b8d
SHA512 b7fa7c5a0404d2054c65c5cea55fadba97edfebb08cb4c379e491c5e95382ef6e6abc6fb672713efdbe55b374d58932a00f8dad39015ce257e9fe651bca2c6a1
TLSH
T193D022422600C99D45002C19284A2244B19E64AB1B0AADE2052748A8978A89C6E6BB91
MD5 SHA1 SHA512 TLSH

Submit Download

7FEVL6mCfLMf.bat

Path C:\Users\Admin\AppData\Local\Temp\7FEVL6mCfLMf.bat
Size 197B
SHA256 53885b50efab707426e19b87c2c3b012f4870b435f847e871d5fccd40e2fdd12
MD5 cfce2e20867cf5561c938572959b6af4
SHA1 b72fdbf906b74f03bccfd9eeeb3a71c85d25f83d
SHA512 5646831df0bc5203225cadbe2490aad0bee76b9d7c900b844317835fba418f40fb9d3eaac13014c4f284c971433d8d84fbb0ed6835548c1c1d22f86913efdbee
TLSH
T14FD0C0401311CC9E41100C1A28993384B0DAA0AF1B0CBDE2001388EC978B99CBABFBD1
MD5 SHA1 SHA512 TLSH

Submit Download

7U4yYrPV2TcR.bat

Path C:\Users\Admin\AppData\Local\Temp\7U4yYrPV2TcR.bat
Size 197B
SHA256 739371fefdb0afc1882f0126fb0d05ed4c61cf1fd0676e0867e786e1587b6c12
MD5 6a235d987be62f6f76ac23ce6cd97682
SHA1 73abad34849ba2a074a7e2ea4e19ece4bb3cc02b
SHA512 4d425ccc2c62f7cb48893d64ab8a981bc9e29ca951683e16f73462eac33adda8c0a107491139d20a1e4955aa844d533c50c83ea8d59c844d3088b8e053a332a9
TLSH
T17DD022001710C89D41108C0928992648B19AA4AB1B08ACA2452788A8978A89C696BBD1
MD5 SHA1 SHA512 TLSH

Submit Download

UPmqEfFkbtNG.bat

Path C:\Users\Admin\AppData\Local\Temp\UPmqEfFkbtNG.bat
Size 197B
SHA256 a202f4950805df94c1208be3b93a51c98a4e2ffdc368d6ccdf1bc20f27bfae5a
MD5 a97fffa0edba02c9e3d99af46183e27c
SHA1 10b4cf8ae65e6f4ead90b44ef9bc4b4354ff4f88
SHA512 64539f5c6c2d052367f9426c69c9d6a72146cfd7f56670424de3b3088ee1edf749753f8b5e89198b4fb8ff1bd246b2932b02687579cefa64e2fed2d8f1c3ce3a
TLSH
T14DD022002300C9AD91100C99288A2349B0DA60AA1B08ACA2450248A8978B88CBAABBD1
MD5 SHA1 SHA512 TLSH

Submit Download

Uih0oFfMUipQ.bat

Path C:\Users\Admin\AppData\Local\Temp\Uih0oFfMUipQ.bat
Size 197B
SHA256 5455c09d8c84bdbfa1e360359fe585feb546f154a7b1fd93b18447362a800a23
MD5 bf7784d85e8cf10bb5d81e6eb226e601
SHA1 83390655d9ad46164c55dd37c831c78fc748fbce
SHA512 36f07f331c89ea1fd6e081b148d4e38ba64b14124d9671729486daed85c4982d704c4898ae1b316f8083f2c5047bba7577332357c978dd3cc2d73fcacb97fd5f
TLSH
T1A4D022002200C89E85140C1A28492344B19A60AE1B08ADA2400348A99B8A89C696BB91
MD5 SHA1 SHA512 TLSH

Submit Download

ZqKMnMBwSfyC.bat

Path C:\Users\Admin\AppData\Local\Temp\ZqKMnMBwSfyC.bat
Size 197B
SHA256 64ecccfa728112b5a918cd203f330fe796c638e07e83d6e5a12a4e1f93f2bb0b
MD5 decef39470cb89230d7e592e253e8e89
SHA1 30fa5d29d99558aaadd0dffe3a4a4c4544b8c09d
SHA512 0bcaee88f80506d5c1049058851f96c02aea280e7c7eb355841e639102bdb987bf3f2ee53c233fc5836d6888163924dc817a5f5059cb1faae177f27852eac7b8
TLSH
T109D022001210C99D41040C0A288AB24CB1AA64AA1B08BCE3051348AD9B8B88C697BBA1
MD5 SHA1 SHA512 TLSH

Submit Download

aZT4QxkMgc4e.bat

Path C:\Users\Admin\AppData\Local\Temp\aZT4QxkMgc4e.bat
Size 197B
SHA256 f3e63e812ce3c7419385869c5f13a3908c36010b3eb908b50dbdd139250c4bf8
MD5 3d6eff70299aac040ba10927305f35e6
SHA1 00fd12aff3549bf42c5f6421acd9190e742eb5d7
SHA512 22c85c71becf7590fc70c44528930f8037f845d8910e21d01f920d5a087f5211c0f06416e12420e876de3084f69982c5dbdcf2c720f24428ceb7bca3c721f11e
TLSH
T193D022001252C89D8A100C0928493284F09A60AA2B48ADA2040688A8978A88C696BBE2
MD5 SHA1 SHA512 TLSH

Submit Download

byMBBiTvTJVv.bat

Path C:\Users\Admin\AppData\Local\Temp\byMBBiTvTJVv.bat
Size 197B
SHA256 35e8ccd23df4109d9b056e87ab3fc2f7a1bb7ef3372d36db22e9bf7fab8452df
MD5 c97bca0ffd65ccbf22bbf00a008adae1
SHA1 efbd6df69bc5adee3f36d1ca53b03cb551d881c0
SHA512 3dd434649f72c98079ff5606b8e9e673f2ceba55dde54b628703d35ff808ea08aaf053221af8f05fb5f1853591e3d47122853dad4767db555f0e7c6f7d914a67
TLSH
T112D022001200C89D41040C4A284A6244B0AA64BE1B08ACA2804288ADAB8A88C69ABB92
MD5 SHA1 SHA512 TLSH

Submit Download

iijTD0eT7RTr.bat

Path C:\Users\Admin\AppData\Local\Temp\iijTD0eT7RTr.bat
Size 197B
SHA256 5ab320276a764d5c65c4f9bfa0568f20e02314815ae25b5c3bb220d53ab61e58
MD5 eb2defca82b871900e2e582580419a45
SHA1 ee5434a01280c28c1deb00798e1bdf6a8e2a903f
SHA512 22bf3c4be0f9eeb006cccbdf86e535427c7adc7141afba432bee486cb5b489cdd25e98b0f110841ea12b1c75ba55b9b56d8437b27ffcd92af1b47df65ec08a63
TLSH
T1F6D0C0402300CC9D42200C892859334CB0DA60AF1B09BCF2830348EC9B8BC9CBD7FBD1
MD5 SHA1 SHA512 TLSH

Submit Download

j9hi06p0xVLf.bat

Path C:\Users\Admin\AppData\Local\Temp\j9hi06p0xVLf.bat
Size 197B
SHA256 d115d428b3fd2c0eeca48be3fb00e8c323abf640fa9fa5f4a0f287f669de4089
MD5 79b2fa13d48f664d32382a350b4e70a3
SHA1 5d8746bb8dabf2e6bdbaebbd6568d834d31c37cb
SHA512 48a7aea425a41c8584330ddb5cd572ddebbf2fd13511c4b6cbc90f9e503465b4cdc4e6049618d3ec1922a91a660767b03cdca5b2e92274a8ff221257b1eaf952
TLSH
T142D022002201C89D41000C0AA8492248B0AAA0AA1B08BEAB000248E8978B98C696BB91
MD5 SHA1 SHA512 TLSH

Submit Download

pdZ6O4VGcwP3.bat

Path C:\Users\Admin\AppData\Local\Temp\pdZ6O4VGcwP3.bat
Size 197B
SHA256 78901ded16be8ce335abe8f992076acfa94a2bd988a48d24889d0951b9ce99e6
MD5 6184430c70cd58ac95dbe38fad1a8523
SHA1 ad42070a960cc217c1b75c350ac4529e87382f86
SHA512 e6811e379a9bd9bf2ec5ed38b04284b4d6c199e470c3f65b8cc06e3b7b2e553260b4a23a7132c8fe6b729c82f257d6423e2b42e7eaeb313166c9b5675c8ba1d1
TLSH
T101D022011300C89D45000C4928897244B2DAA0AA1B08ADA3490749AC9B8A9ACA9ABBA1
MD5 SHA1 SHA512 TLSH

Submit Download

ruCsD0YzvIQ8.bat

Path C:\Users\Admin\AppData\Local\Temp\ruCsD0YzvIQ8.bat
Size 197B
SHA256 b9a24f944dbe93743001fd2cc749eaeee73ddecb56127987ec00c9c5db061d47
MD5 2bc216989ff2ea0adf1f94058f4fda6a
SHA1 ab64f374fc4c31658531d6a74d0f165ef35a34e9
SHA512 cd0565218d50bece742f0dd67cdfdf8dba8cd6d390aaec430e155ba15bf94cba90a6d317ed2bfa17a7c539d836cea1b4fbd925dda2f78f2094b02c696ba6a158
TLSH
T1F2D022001300C8DE41040C2A28997248B09A60AA2B08ACA2011688E9978A88C797BBD1
MD5 SHA1 SHA512 TLSH

Submit Download

sAlgdN1VBvLl.bat

Path C:\Users\Admin\AppData\Local\Temp\sAlgdN1VBvLl.bat
Size 197B
SHA256 bc563f7e661b2321ee5cf4807c971cc366a24d9645650ab4575b0c1c319e5924
MD5 36a866cf2ae3ec4babb5ae3082e47745
SHA1 61746c4e3432c3065dac99e5fc0101805dae6934
SHA512 4d1abb8d39525dee71ed791c729b4bbe8c531065139483fecae19f8e6f87e99c19a6e26736186c406eabe2169fe4f59925f9d100866e9cb53a6be29cb75c0c03
TLSH
T1CAD022001200C89E81104C1928992346B0EA60AA1B08ACA2000288AD978B89C7A6BBA1
MD5 SHA1 SHA512 TLSH

Submit Download

tO7reJ9JQNns.bat

Path C:\Users\Admin\AppData\Local\Temp\tO7reJ9JQNns.bat
Size 197B
SHA256 88153fec7aef50e341b7585a88e836a0179e0da92b77dbe05e69c3b5e81ee38f
MD5 339cdc5e6333909ed10269de2afebd8e
SHA1 1fffbb0814fc8913b86033cf6f8b3d8adca67b0d
SHA512 836582eb0f966d27f739581f3c8a6eb2f87ea6f5c02bf0ef71c308f934a26bc9dc2033f30250d0518fd3c78fb29b6ae3583ec70803c850a5c567f4e1571a298c
TLSH
T16ED022002200CC9E45040C4929492289B0EA64AE1B08AEA2091248E8D79A89CAAABB91
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Windows\System32\SubDir\svchost.exe
Size 3.1MB
SHA256 8d1e47419d36503849b50dada0c3e1dde11380b85681c9586a1675694b23fbeb
MD5 46a36543d0127374bbaa1432a8f55812
SHA1 71c1e88f3e3bf665812d7edccc5759da0999d1bc
SHA512 880264da789350493f177cbf7137ca80ea83a297fef76ad66067bce3d50cc11c7f4b3fec5284dce814b33d4a7523f80845dddb8081a94080b9de057ce3459e23
SSDEEP 49152:dvGju2k/aiC9VPAl1WzPnNLNsiQC51JnpoGdRTHHB72eh2NT:dvAu2k/aiC9VPAl1WzPNLNsiQC/
TLSH
T135E54A1437F85F23E1BBE273D5B0041267F1E82AB3A3FB5B6181677A1C53B505841AAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3064-0-0x00000000007D0000-0x0000000000AF4000-memory.dmp

Download

memory/3064-1-0x000000001B940000-0x000000001B950000-memory.dmp

Download

memory/4588-10-0x000000001F120000-0x000000001F1D2000-memory.dmp

Download

memory/4588-9-0x000000001F010000-0x000000001F060000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads