quasar | 9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 16:30

Target

9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe
Size

3.9MB
MD5

7b9672083d54cdb55856a2ca0a033157
SHA1

d790bb2ad9e7346dd3bbed633fb14995450f4d5f
SHA256

9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307
SHA512

5d2886433fe226dd9d0d03bd383c0507f7bb263d4734f2693ed254f7bd787ebe2e285f304badd73b84a47f70949e6d4c82e0224b3dc17f4e719d0ade63f514bf
SSDEEP

98304:3v842pda6D+/PjlLOlZyQipV5PRJ6YLr3k1iRTtS8:fkOpplLr3B1tB

Score

10^/10

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1148-3275-0x0000000000400000-0x00000000007EC000-memory.dmp	family_quasar

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

12712 1148 WerFault.exe 9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe

pid	pid_target	process	target process
12712	1148	WerFault.exe	9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe

C:\Users\Admin\AppData\Local\Temp\9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe
"C:\Users\Admin\AppData\Local\Temp\9b2a1eb9454f3d758266f4e6f882cc664f86721d7f10285814e269a01601e307.exe"
1⤵
PID:1148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1148 -s 192
2⤵
- Program crash
PID:12712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1148 -ip 1148
1⤵
PID:12688

memory/1148-0-0x0000000000400000-0x00000000007EC000-memory.dmp

Filesize
3.9MB

Download
memory/1148-1-0x0000000076740000-0x0000000076955000-memory.dmp

Filesize
2.1MB

Download
memory/1148-3275-0x0000000000400000-0x00000000007EC000-memory.dmp

Filesize
3.9MB

Download