quasar | 97475fb99d3757805de17717c1af9bdd90611c496df6c863a57cd0f83c8abb04

Analysis

max time kernel
157s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 14:58

Target

97475fb99d3757805de17717c1af9bdd90611c496df6c863a57cd0f83c8abb04.exe
Size

3.9MB
MD5

0049d59493a5ff8c12a9847ff81224a5
SHA1

9e81b9f2803b3e886997832ffcffe6ca1cba7c34
SHA256

97475fb99d3757805de17717c1af9bdd90611c496df6c863a57cd0f83c8abb04
SHA512

6b0252cd276a21629d4d1e443c66f29997041cc55175bc771f588a83ae5b82b970d5bc8c9b8d9635a21f776de4ab1268048dfd81cfaa3fd1d4bb24d1a3ec62e5
SSDEEP

98304:H4hu/gmohlT7+EIRGZubl/WoJBcnn6dy/x:HpgmohlT7+EIRGZ5oQ6dMx

Score

10^/10

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4204-0-0x0000000000AF0000-0x0000000000EE8000-memory.dmp	family_quasar

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	97475fb99d3757805de17717c1af9bdd90611c496df6c863a57cd0f83c8abb04.exe

C:\Users\Admin\AppData\Local\Temp\97475fb99d3757805de17717c1af9bdd90611c496df6c863a57cd0f83c8abb04.exe
"C:\Users\Admin\AppData\Local\Temp\97475fb99d3757805de17717c1af9bdd90611c496df6c863a57cd0f83c8abb04.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2972,i,4036376905309803364,5412922217215781933,262144 --variations-seed-version /prefetch:8
1⤵
PID:1704

memory/4204-0-0x0000000000AF0000-0x0000000000EE8000-memory.dmp

Filesize
4.0MB

Download
memory/4204-1-0x00007FF913890000-0x00007FF914351000-memory.dmp

Filesize
10.8MB

Download
memory/4204-2-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/4204-4-0x000000001D610000-0x000000001D632000-memory.dmp

Filesize
136KB

Download
memory/4204-5-0x000000001D690000-0x000000001D6E0000-memory.dmp

Filesize
320KB

Download
memory/4204-6-0x000000001D7A0000-0x000000001D852000-memory.dmp

Filesize
712KB

Download
memory/4204-7-0x000000001DB60000-0x000000001DBD6000-memory.dmp

Filesize
472KB

Download
memory/4204-8-0x000000001D760000-0x000000001D795000-memory.dmp

Filesize
212KB

Download
memory/4204-10-0x00007FF913890000-0x00007FF914351000-memory.dmp

Filesize
10.8MB

Download
memory/4204-11-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download