quasar | 1812dc467d6e39cf081bb07cc494c3c342238244cbbcc847480e085c6c82ed69

Analysis

user interaction
yes
max time kernel
126s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/11/2026, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Onimai_1.7.1.rar
Size 10.2MB
Sample261111-jlztraff86
SHA256 1812dc467d6e39cf081bb07cc494c3c342238244cbbcc847480e085c6c82ed69
MD5 457eb89c65bcdb236331ca9703e96d67
SHA1 c2ea612387fdd409f0330912e537d109561befdb
SHA512 7a47aafa47dcdfaf4f7ff5880959e40dc82ddf3d4eca683003745cb0a690ea34b34936f74bb7a709dcf267a693a0b1d3b28354708b0ed4b53ee90110e8ba90b8
SSDEEP 196608:OXQPnNCUWTFy+pJEbmWf4c8pGSx8quHN8F3WJ83hW6D3zXxIf4AMxoP0:OgPNDavzumWfmpLxCHNIfw67jxkDP0
TLSH
T182B63303E5076FB05AD0AD527E7D6056C6590242EFB5F08AFCB7963E563A220B31C27B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution quasar ransomware spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
reconnect_delay
5000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243eb-57.dat	family_quasar
behavioral1/files/0x000700000002440e-214.dat	family_quasar
behavioral1/memory/3208-216-0x000001915D4A0000-0x000001915D7FA000-memory.dmp	family_quasar
behavioral1/memory/3208-219-0x0000019177B80000-0x0000019177B98000-memory.dmp	family_quasar
behavioral1/files/0x0007000000024415-217.dat	family_quasar
behavioral1/memory/4452-243-0x00000000000F0000-0x0000000000196000-memory.dmp	family_quasar

Executes dropped EXE 5 IoCs

pid	Process
2684	Onimai.exe
3176	Onimai.exe
2948	Crypter.exe
3208	onimai.exe
4452	Client.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4088	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
208	cmd.exe
1540	cmd.exe
4736	cmd.exe
1424	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	onimai.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	onimai.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onimai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Onimai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Crypter.exe

Delays execution with timeout.exe 23 IoCs

defense_evasion

pid	Process
4380	timeout.exe
2236	timeout.exe
2220	timeout.exe
980	timeout.exe
5104	timeout.exe
3336	timeout.exe
1428	timeout.exe
3020	timeout.exe
2536	timeout.exe
1964	timeout.exe
640	timeout.exe
2052	timeout.exe
3452	timeout.exe
400	timeout.exe
3248	timeout.exe
4432	timeout.exe
3304	timeout.exe
4520	timeout.exe
2596	timeout.exe
2264	timeout.exe
2824	timeout.exe
4740	timeout.exe
3164	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	onimai.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	onimai.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	onimai.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	7zFM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0 = 7e003100000000006b5d023e11004465736b746f7000680009000400efbe2b5ded786b5d023e2e00000055e101000000010000000000000000003e00000000005be764004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	Crypter.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 78003100000000002b5ded781100557365727300640009000400efbe874f77486b5df13d2e000000c70500000000010000000000000000003a000000000087e2c70055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\NodeSlot = "3"	Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 50003100000000002b5dc583100041646d696e003c0009000400efbe2b5ded786b5df13d2e0000004be1010000000100000000000000000000000000000075d4d100410064006d0069006e00000014000000	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = 00000000ffffffff	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff	Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Crypter.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Crypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\0\MRUListEx = ffffffff	Crypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff	Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	Crypter.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
368	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2168	7zFM.exe
2168	7zFM.exe
2168	7zFM.exe
2168	7zFM.exe
4088	powershell.exe
4088	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2168	7zFM.exe
3208	onimai.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2168	7zFM.exe
Token: 35	2168	7zFM.exe
Token: SeSecurityPrivilege	2168	7zFM.exe
Token: SeSecurityPrivilege	2168	7zFM.exe
Token: SeSecurityPrivilege	2168	7zFM.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	3208	onimai.exe
Token: SeDebugPrivilege	4452	Client.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2168	7zFM.exe
2168	7zFM.exe
2168	7zFM.exe
2168	7zFM.exe
2168	7zFM.exe
2168	7zFM.exe
3208	onimai.exe
3208	onimai.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3208	onimai.exe
3208	onimai.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2948	Crypter.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 368	2168	7zFM.exe	93
PID 2168 wrote to memory of 2684	2168	7zFM.exe	94
PID 2684 wrote to memory of 208	2684	Onimai.exe	97
PID 208 wrote to memory of 1540	208	cmd.exe	98
PID 3176 wrote to memory of 4736	3176	Onimai.exe	104
PID 4736 wrote to memory of 1424	4736	cmd.exe	105
PID 1424 wrote to memory of 4088	1424	cmd.exe	107
PID 1424 wrote to memory of 2948	1424	cmd.exe	108
PID 1424 wrote to memory of 3208	1424	cmd.exe	109
PID 1424 wrote to memory of 640	1424	cmd.exe	110
PID 1424 wrote to memory of 2220	1424	cmd.exe	111
PID 1424 wrote to memory of 2052	1424	cmd.exe	112
PID 1424 wrote to memory of 980	1424	cmd.exe	113
PID 1424 wrote to memory of 5104	1424	cmd.exe	114
PID 1424 wrote to memory of 3452	1424	cmd.exe	115
PID 1424 wrote to memory of 3336	1424	cmd.exe	116
PID 1424 wrote to memory of 400	1424	cmd.exe	117
PID 1424 wrote to memory of 3248	1424	cmd.exe	118
PID 1424 wrote to memory of 2824	1424	cmd.exe	119
PID 1424 wrote to memory of 4432	1424	cmd.exe	120
PID 1424 wrote to memory of 1428	1424	cmd.exe	121
PID 1424 wrote to memory of 3020	1424	cmd.exe	122
PID 1424 wrote to memory of 3304	1424	cmd.exe	123
PID 1424 wrote to memory of 4740	1424	cmd.exe	125
PID 1424 wrote to memory of 2536	1424	cmd.exe	126
PID 1424 wrote to memory of 3164	1424	cmd.exe	127
PID 1424 wrote to memory of 4520	1424	cmd.exe	128
PID 1424 wrote to memory of 2596	1424	cmd.exe	129
PID 1424 wrote to memory of 4380	1424	cmd.exe	130
PID 1424 wrote to memory of 1964	1424	cmd.exe	131
PID 1424 wrote to memory of 2264	1424	cmd.exe	132
PID 1424 wrote to memory of 2236	1424	cmd.exe	133

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Onimai_1.7.1.rar"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO878FAE79\PASSWORD.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:368
- C:\Users\Admin\AppData\Local\Temp\7zO8783B5A9\Onimai.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO8783B5A9\Onimai.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\8ED8.tmp\8ED9.tmp\8EDA.bat C:\Users\Admin\AppData\Local\Temp\7zO8783B5A9\Onimai.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:208
  - - C:\Windows\system32\cmd.exe
      cmd /c "Onimai\Launcher\OnimaiLauncher.bat"
      4⤵
      Executes a command shell one-liner
      PID:1540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1352

C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai.exe
"C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EBFC.tmp\EBFD.tmp\EBFE.bat C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\cmd.exe
    cmd /c "Onimai\Launcher\OnimaiLauncher.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -File "Onimai\Launcher\play.ps1" "Onimai\Launcher\o1.gif" "Onimai\Launcher\o2.gif" 2 3
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4088
  - - C:\Users\Admin\Desktop\Onimai_1.7.1\OniCHAIN\Crypter.exe
      "OniCHAIN\Crypter.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:2948
  - - C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\onimai.exe
      onimai.exe
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Enumerates system info in registry
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3208
  - - C:\Windows\system32\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:640
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2220
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2052
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:980
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5104
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3452
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3336
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:400
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3248
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2824
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4432
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1428
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3020
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3304
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4740
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2536
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3164
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4520
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2596
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4380
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1964
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2264
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2236

C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Client.exe
"C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Onimai.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO8783B5A9\Onimai.exe
Size 218KB
SHA256 0993fdfb990262df70f01ae6fffb6b88c753bca389b34625b8447322a5212300
MD5 62baa64c34ab78fcc587e0063ba15e61
SHA1 eed4f68aad2d49a5fce8e4ac427523a80e4ec877
SHA512 5f4a9f0b90430c8effd75f452ef9e9782fa6173bdb0d411184ef73aef5c115a9c5487567f2b91b55c975ddf83e585521c4a748172fc41499f296a72e4af32aa8
SSDEEP 6144:aBlkZvaF4NTBSXKC5TB1kQYPjjjjGtAf5PSEW:aoSWNToXKIfkQYPjjjjGti5PSEW
TLSH
T1D2241730B6D54EA2E250503E40A2F1369634A9339F1EF59FBF721992453398CED24EDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PASSWORD.txt

Path C:\Users\Admin\AppData\Local\Temp\7zO878FAE79\PASSWORD.txt
Size 12B
SHA256 90ec92e572defac5645f670a992b86b67ff742a3ac4647abbb1a0cc75c474e31
MD5 adc89471487e7b502a4ef157a56f1ca3
SHA1 cc887b37b4ed0613a023ac5722f2ee0f4b11b817
SHA512 599b2bcd46329e0225d120711440e8b878f3e40d0399d844cb7388d882223e3fdf49f358b4fb04769e94bfaaa95a739adf76ff86178045f45111c694e1a26067
MD5 SHA1 SHA512

Submit Download

8EDA.bat

Path C:\Users\Admin\AppData\Local\Temp\8ED8.tmp\8ED9.tmp\8EDA.bat
Size 79B
SHA256 f82c24f7a3e24616c77e1ac75ab1cff4c2d53a67accdec8230dd847f2d012088
MD5 6fcd0662625278316cdfc85bf3754273
SHA1 16183d0b1b5bd93f750f96096365b4ba98b2386d
SHA512 85873e0492b673ee5b47249f43edcd6bd0fe61574336fa2eaf6f2921c4ff22de5094aa34abcb4d6ff3c2bc64d2ce684be9033fe6cd24b97688632fbd354d5f23
TLSH
T1BCA02200088802080BA30F0033BE20B030ACC2C3CC82AE200832302CC82FCEC38BA8EB
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_unczcx5q.kop.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_unczcx5q.kop.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Crypter.exe

Path C:\Users\Admin\Desktop\Onimai_1.7.1\OniCHAIN\Crypter.exe
Size 17KB
SHA256 be414d4b463c8ae303fc8f458217ab948485c9fdde63012db5d66c811984a5e7
MD5 05df8dc84cb3cf91a309111b451b9cd1
SHA1 e1bf8b05efd59293d9989c1ccae98128546dc701
SHA512 644eb6b625520cf31d2339410006bdb649d4dcc54e51f3d91081822e440f7b318777abde992570d12fe4b3ed9434dfb1062d32fd383fd4eacad2fa714b6c17ff
SSDEEP 384:m02BAwjQfEHYM6wXhNfea/0yRRMGqhH5NTYc4L/u:m08Qm6CjTRRMGqhH5N34L/u
TLSH
T1D672395837D0C772D7AD09B7686246414BB4FE51B8A2FFCE4C8C998E09637D08582FA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Client.exe

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Client.exe
Size 637KB
SHA256 d24a538a3e127a55e92735dde553a9cf44da42f7f6a9ba59d267a88b13fd85de
MD5 2d3b17e3a7dd2febc7fa9a011355fbd8
SHA1 7bc605ec4ef0ee3d78e08dfe30b91c60e5563731
SHA512 b559eed8a0e7eeb9ae635ee06e20c8b99ec8ce90a5005f5474833ce5d4ee134d9e150e09178f47f827e15a2680b5082ad6b3a84ca41d3389d9ab8d62be176025
SSDEEP 12288:4hL3041G0juj/9vNaSFgpiKMVzpCpB8Lc:4hLF1GyY/9UcVIpB8Lc
TLSH
T160D46C4033E8E727D1AE1375D8B00A2907F6F606AA62EB5F4594B1F92C63B479D413E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Guna.UI2.dll

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Guna.UI2.dll
Size 2.1MB
SHA256 2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd
MD5 b464fc896b14bfa34f608da53856e999
SHA1 55568eecc97895cad49a42bffe757e3588c5313c
SHA512 1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca
SSDEEP 24576:ITL3GQ2wuP82+lTVG+3VvkPMb4yk8z1xcfeGwrSe+a/gZmxVsFdHQ/jzaM5PT:U5+dSRzIZ8VsFWN
TLSH
T124A5FA147ED4EB27D16BCE33D6E25011E2F1E5A32AB1EB0E72D35768184234578863BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OnimaiLauncher.bat

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Launcher\OnimaiLauncher.bat
Size 2KB
SHA256 c205e7be3ef6a3de73750ee19984ccc0775e59da82fa44a140c0cf81b0ee5e89
MD5 2545358a0039195773976b6e7e500305
SHA1 49a6a90bb2bc47cae8c06975e8525b597458e0ac
SHA512 7ce555f1cd7ca462398b42997d6b9136f5c6a5b6c139f7999dd817bbf11642572ad40295fdf23d662ea1270a16f172e017328a35eb0f845726cebc432d7469d1
TLSH
T10C41DA1C1D9A1F589F72CAB94F389452F24FA003C5EC27957CAD96F2072B42D03AE2D2
MD5 SHA1 SHA512 TLSH

Submit Download

o1.gif

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Launcher\o1.gif
Size 48KB
SHA256 f10782e2bb82189102677e6848b54cb666c36f6dff6669989ecf2022148fdccc
MD5 d095b07047bc15932951e62adc6c1b08
SHA1 3ce5c181e7f5be271db8d98f1df80e88fe0e9cca
SHA512 449992292309fd115deeae929efd980131fe47a6576aadf9d8dcd51bbf029138b9a3fdd0dffe20026b9a2f8338efdc31b82e70aad2b6f0b42a1013683c3d2d27
SSDEEP 1536:L0xXN+rDjnL7zDV98CoPuT9z26Z/1iu9SbPaTJjyC/0M:LWIrHICoPuRz26Liu9S7mJ5r
TLSH
T1A223F1C5C934CCC4C4927738452AB037CE2A8ED379FA886AF9D84F8764062AD51E5EF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o2.gif

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Launcher\o2.gif
Size 14KB
SHA256 4478d78a56908a0c6621318d3546beb30f5f240cf2f264ba58a33b55e7db5597
MD5 72755224926234fe5f03c629f25f2ba4
SHA1 e216c0e482d9c6c8bf85233687ff4369b0501621
SHA512 fc2acca052f48c2be3475e2c1937a85daa694665348e5201c7e308a2361600f5c0391e9bdc726f4cec3a84274332b5f150ca6d0ab54f8fa2406e5efc7bed997a
SSDEEP 384:CPuf2uzsueZSFj35cMmDJJnyGhKJZnNOrsc5s:CPuf2uzsueWJcMsiG2NOrscC
TLSH
T13C52B06AF75150524E60BFA82BF274673776102804E9D5DE3C09FE03980B677E5E898A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

play.ps1

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Launcher\play.ps1
Size 1KB
SHA256 12163e738fb3d7e2e14d1e473b5f804fd737f541bc72d68150b85279415ba230
MD5 4e7fd4fc66d66e4d60ff6408d3028ff2
SHA1 c745af657d2ecf5ecb7eedca0e85495155d219d7
SHA512 bd7b43b4a64dd93f9d82c3dad7685a9ae83e88a0582f4ee37e475379544d1c0e4a1fe2184120ffa9c9899597243292d7006d88f2b4ecb26119313c4843f2faf9
TLSH
T12C31FFBDC21792456BB04A0B5F8B534CDB29133B101ED82637BEC685EF75941E23879C
MD5 SHA1 SHA512 TLSH

Submit Download

Open.Nat.dll

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Open.Nat.dll
Size 68KB
SHA256 0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5
MD5 cc6f6503d29a99f37b73bfd881de8ae0
SHA1 92d3334898dbb718408f1f134fe2914ef666ce46
SHA512 7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f
SSDEEP 768:sF6vHHLFkywkNh5qtHMjkCifoydVXw5FxusiolecziijiSvD+ZGFa4Pw6OdrGHUm:8GmyJNh0tbt3MLQ9W2rG0Ydd
TLSH
T166633B0833FC8A22D6FE1BBDA4B506518675F9167832EBCD4A4CA8EA18977C04D60777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Default.xml

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Profiles\Default.xml
Size 990B
SHA256 905a7c6fa1d27a11e440cf72b40fa74d761b9349b0839deb74e8bc2dd3298cb8
MD5 df2721b10982d811240668e3c79a11f1
SHA1 6ba93ef463eb19ba09c15ae514d1401dd239b165
SHA512 9d3fddd91ebb24ae94ee592b5fba153ae72b3d161178debe6228246a14b474fc765ee84f4aebb0217dd65709846981df8396f3d8ec6b7814cf4f1f8a05b79ab4
TLSH
T1BE119CB8FCC87126B4320321FB219E94BD80CFD9410A0CD4FACA43CF2650819636B1FA
MD5 SHA1 SHA512 TLSH

Submit Download

Quasar.Common.dll

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\Quasar.Common.dll
Size 72KB
SHA256 d7a74254b48ed75c1457c6c6158cc9bbe367d741bd5da4d46a118724662b583f
MD5 5f151fafb1d7bbfee64ff52ca2222772
SHA1 1d27cfa608b501d498e57f286f4e15b34861a679
SHA512 564df0035d0a3162c950d8fb9ee6eba40b6ac8a7269816958a22e32bce2a3ef891c7d428348c03f9fae8ba1060b73668c3d9f10f39777aa71f51748b374e3305
SSDEEP 1536:A9Tb8zPsQtWOOMOOOOyZwOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOa:lzcPVmkJV04pAG
TLSH
T18473F7253B6DC36FCF9D0639F8764D290679C109B111EBBEBB64F45A3EE638260105B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

onimai.exe

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\onimai.exe
Size 3.3MB
SHA256 9f4874075209025e1186afa9de8c41768dea8e44a0f95d602f8ff7aadc90a5d1
MD5 92bee90bcb6e9de2ee003a5bd648ba81
SHA1 aae853854cdfd6e004d16c3852ecc26001131bce
SHA512 ea57ac2296df33803407fd93e5eb10b6941418ebb66fab243ff859846e42784dddd807720b708be7a942fd63b5a6cc91db4e1b08c673e2f7f01ca18b69760e11
SSDEEP 49152:/iW7fCQZHxBcDIek2BUbowEOvygS7/1sHOqJ02nTPFdRPqxMaimE6M4m:qqCQZHxB2IF2BUcwti78OqJ7TPBmh
TLSH
T1DBF5DF2132A86D06D16523FC5821D07093F2AC179A99960EACF67DAF34BB743CD41F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

profile.png

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\profile.png
Size 40KB
SHA256 5790117be7c29fa2c8beb55a6c1f568afb10623d0f187439afdcd1e5e33ac64f
MD5 71db3f8bbccc3360dd118190227dce67
SHA1 215edc0eb34fd3f8fa99f80abffd49b58ddd0aa1
SHA512 d211c8aabbeae27c14cc82365ee0c9ec28ce08bf6212bddcd26b338727f5ab75a2880e219b0f6eb5bd28189e2feb7e82e7840995a77aa4e5f4b5b2753b79fd48
SSDEEP 768:aN3sfBhRzaaM2BFCV0q9C9HLD594SHdDfZUcnj51YzdYU7ya:aiEaMLV0yCRLD5RDfjj51YJY4ya
TLSH
T174035D3909242703C49D5030B8F55E54169B0BDE9ECEB2A42E0D49FF949C92FF6EEA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protobuf-net.dll

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\protobuf-net.dll
Size 284KB
SHA256 9429f05aa4ab1ef92a0237410ea103cffa406b071953d50f5e7a55496d517c02
MD5 1c2c6b341535661b7501f5c4a434a78e
SHA1 f45aefa816f86830bee41c0e5426e641d5af3c06
SHA512 14b8653b04865a8efeda23149cd624cbe0ebd6e676a7f9cb4ba994a129cba975b9eb928de0f396eb3a37449469549ede36ec2ceec7e61d68773fd72c422fef8e
SSDEEP 6144:oRxmgHi29FKwOOZmI3jnX2/aNVm12bEm:8BC29HOgmwL2/ao2bE
TLSH
T1CF546B1467ED4A1AE2FFA3B4E838181C47F6F506622EFB8D14A091FD5953BD086007BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

quasar.p12

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\quasar.p12
Size 4KB
SHA256 3b779cc175ad0272cf48bd5e69c9f4b77f7100d0c48244357fe6fef271b19dfc
MD5 1426ce52345553dd316aea4c38627186
SHA1 72a0c8057e5b11fada265623d8538f411f43e379
SHA512 264727f006530f34d1b3014a2d0190b62cfa8e7eaf6e833bace776545ed971fa03691376f309fa97e5fdfb5f9c1f838c34237a82de47a2a1a16054c01419fc6e
SSDEEP 96:DRW8D15VoQuBs0i9rc36/oJRMR2hlWPSFSKjf86R0xva0q:DRWq17oVi9rcq/oJCshaKjfZRKNq
TLSH
T10C916D672A7E124F35F8931962FDD4873184EF09DE287CAF10A732542E724118B6C70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.xml

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\settings.xml
Size 452B
SHA256 b8bf7522290a174f56e1c885b7cf50c97a2d809d9343276f195d344dfd3ad928
MD5 c002e319586fd8588d41560e75974b00
SHA1 ec6646812a3c3678a479d838eecbb1d81bb2327a
SHA512 70a192d044e3e2f0a077ac8ee082fdd618889c3cd273d5af6db04547fbb021592a0d479461e5665d8fd063bb480857e75890fee83b2280f35c8f0a552a61240c
TLSH
T13FF05C7869DCF20554B5C2363200439159C0CFF3818E4EA0F459124F3185E976E47637
MD5 SHA1 SHA512 TLSH

Submit Download

user.txt

Path C:\Users\Admin\Desktop\Onimai_1.7.1\Onimai\user.txt
Size 22B
SHA256 06825bc3eea4b86fe705984322f602514b5a3991e0a948684001c1c3bda93c63
MD5 8e2a73a168dd78198bb37630e0d04cdd
SHA1 239a28409510533f3d569d9b462a5a0bc2e1dbb9
SHA512 31966d3b4511f8cccaa4fe1f075558cc3e41415e6da795db20a0e14c2980618940231d880861b022c7840619ef96fbcdb8101f1e9702c0558a8500eb06dd3a3b
MD5 SHA1 SHA512

Submit Download

memory/2948-218-0x0000000000340000-0x000000000034A000-memory.dmp

Download

memory/2948-223-0x0000000004D40000-0x0000000004DD2000-memory.dmp

Download

memory/2948-224-0x0000000004ED0000-0x0000000004EDA000-memory.dmp

Download

memory/2948-222-0x0000000005210000-0x00000000057B4000-memory.dmp

Download

memory/3208-232-0x000001917A160000-0x000001917A178000-memory.dmp

Download

memory/3208-219-0x0000019177B80000-0x0000019177B98000-memory.dmp

Download

memory/3208-221-0x0000019179210000-0x000001917942C000-memory.dmp

Download

memory/3208-233-0x000001917A1D0000-0x000001917A220000-memory.dmp

Download

memory/3208-234-0x000001917A9D0000-0x000001917AA82000-memory.dmp

Download

memory/3208-235-0x000001917CC20000-0x000001917D0EC000-memory.dmp

Download

memory/3208-237-0x000001917A910000-0x000001917A95E000-memory.dmp

Download

memory/3208-216-0x000001915D4A0000-0x000001915D7FA000-memory.dmp

Download

memory/3208-239-0x000001917A6F0000-0x000001917A90C000-memory.dmp

Download

memory/4088-202-0x000001CC69380000-0x000001CC693A2000-memory.dmp

Download

memory/4452-243-0x00000000000F0000-0x0000000000196000-memory.dmp

Download