quasar | 044549c0db7f2f175e1d707a658c6e4147e610913fb6be768105de1dc1ef3d44

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 16:30

Target

044549c0db7f2f175e1d707a658c6e4147e610913fb6be768105de1dc1ef3d44.exe
Size

3.9MB
MD5

12fc8503d08ef3d14d075ac2269ccf4d
SHA1

eab2886e7dddc947fe044e9c0cdab0d1e0361c66
SHA256

044549c0db7f2f175e1d707a658c6e4147e610913fb6be768105de1dc1ef3d44
SHA512

c21487472a1c3e67efa0f978a18298fc88ffb503a77ca80664785edf91c3ff4bb715b3e47c472ed40560f39dacd4837257ae0429a8f67e1e24066da29e2f431c
SSDEEP

98304:gv842pda6D+/PjlLOlZyQipV5PRJ6YZh6wrOvRH:ekOpplZhPr+

Score

10^/10

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1864-3275-0x0000000000400000-0x00000000007EE000-memory.dmp	family_quasar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

12372 1864 WerFault.exe 044549c0db7f2f175e1d707a658c6e4147e610913fb6be768105de1dc1ef3d44.exe

pid	pid_target	process	target process
12372	1864	WerFault.exe	044549c0db7f2f175e1d707a658c6e4147e610913fb6be768105de1dc1ef3d44.exe

C:\Users\Admin\AppData\Local\Temp\044549c0db7f2f175e1d707a658c6e4147e610913fb6be768105de1dc1ef3d44.exe
"C:\Users\Admin\AppData\Local\Temp\044549c0db7f2f175e1d707a658c6e4147e610913fb6be768105de1dc1ef3d44.exe"
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 308
2⤵
- Program crash
PID:12372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1864 -ip 1864
1⤵
PID:12340

memory/1864-0-0x0000000000400000-0x00000000007EE000-memory.dmp

Filesize
3.9MB

Download
memory/1864-1-0x0000000076820000-0x0000000076A35000-memory.dmp

Filesize
2.1MB

Download
memory/1864-3275-0x0000000000400000-0x00000000007EE000-memory.dmp

Filesize
3.9MB

Download