quasar | d65862ab1d8dfcba06ab6e1fc40d109d9c644cac4e02ef0c8fb30f96ec199b61

Analysis

max time kernel
137s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
20/05/2025, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
Size 3.7MB
Sample250520-lyhr4sxpw8
SHA256 d65862ab1d8dfcba06ab6e1fc40d109d9c644cac4e02ef0c8fb30f96ec199b61
MD5 d7b8cf49c37ef4cedb481ea114fbc9e3
SHA1 bd6ddfad9434df868f935657b50f00c03eadf04b
SHA512 6e7acccbe44aee628803df3e0a9295a3f536ceb250cf6ef70711b898a799601a0a0e96561aa2aeba2d18068574204ec2d82d3297fb1be519ef5b211cc01b9cf0
SSDEEP 98304:ah1iMoXVuBhWKbGYw2h8nN35EK9sYoRs7RuO:a61FuBhWKbOe8nN4WwO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar office04 discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.6.0

Botnet

Office04

mjoatboating.ydns.eu:4785

Mutex

f11636cc-9e8f-4906-853d-b95a77a3c260

Attributes

encryption_key
00393B0225056730419D70586E1F489FB4E99224
install_name
Client.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
log_directory
Logs
reconnect_delay
3000
startup_key
Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4496-9-0x0000000000400000-0x0000000000592000-memory.dmp	family_quasar

Executes dropped EXE 6 IoCs

pid	Process
2996	Client.exe
2648	Client.exe
2140	Client.exe
2108	Client.exe
3288	Client.exe
6092	Client.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5392 set thread context of 4496	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	83
PID 5392 set thread context of 4880	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	84
PID 2648 set thread context of 2140	2648	Client.exe	92
PID 2648 set thread context of 2108	2648	Client.exe	93
PID 2996 set thread context of 3288	2996	Client.exe	99
PID 2996 set thread context of 6092	2996	Client.exe	100

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5848	2140	WerFault.exe	92
3048	2108	WerFault.exe	93
436	3288	WerFault.exe	99

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1276	schtasks.exe
4500	schtasks.exe
2752	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
6092	Client.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
Token: SeDebugPrivilege	4880	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
Token: SeDebugPrivilege	4496	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
Token: SeDebugPrivilege	2648	Client.exe
Token: SeDebugPrivilege	2996	Client.exe
Token: SeDebugPrivilege	6092	Client.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 4496	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	83
PID 5392 wrote to memory of 4496	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	83
PID 5392 wrote to memory of 4496	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	83
PID 5392 wrote to memory of 4496	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	83
PID 5392 wrote to memory of 4496	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	83
PID 5392 wrote to memory of 4496	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	83
PID 5392 wrote to memory of 4496	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	83
PID 5392 wrote to memory of 4496	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	83
PID 5392 wrote to memory of 4880	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	84
PID 5392 wrote to memory of 4880	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	84
PID 5392 wrote to memory of 4880	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	84
PID 5392 wrote to memory of 4880	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	84
PID 5392 wrote to memory of 4880	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	84
PID 5392 wrote to memory of 4880	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	84
PID 5392 wrote to memory of 4880	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	84
PID 5392 wrote to memory of 4880	5392	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	84
PID 4496 wrote to memory of 1276	4496	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	85
PID 4496 wrote to memory of 1276	4496	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	85
PID 4496 wrote to memory of 1276	4496	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	85
PID 4880 wrote to memory of 4500	4880	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	87
PID 4880 wrote to memory of 4500	4880	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	87
PID 4880 wrote to memory of 4500	4880	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	87
PID 4880 wrote to memory of 2996	4880	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	89
PID 4880 wrote to memory of 2996	4880	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	89
PID 4880 wrote to memory of 2996	4880	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	89
PID 4496 wrote to memory of 2648	4496	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	90
PID 4496 wrote to memory of 2648	4496	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	90
PID 4496 wrote to memory of 2648	4496	SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe	90
PID 2648 wrote to memory of 2140	2648	Client.exe	92
PID 2648 wrote to memory of 2140	2648	Client.exe	92
PID 2648 wrote to memory of 2140	2648	Client.exe	92
PID 2648 wrote to memory of 2140	2648	Client.exe	92
PID 2648 wrote to memory of 2140	2648	Client.exe	92
PID 2648 wrote to memory of 2140	2648	Client.exe	92
PID 2648 wrote to memory of 2140	2648	Client.exe	92
PID 2648 wrote to memory of 2140	2648	Client.exe	92
PID 2648 wrote to memory of 2108	2648	Client.exe	93
PID 2648 wrote to memory of 2108	2648	Client.exe	93
PID 2648 wrote to memory of 2108	2648	Client.exe	93
PID 2648 wrote to memory of 2108	2648	Client.exe	93
PID 2648 wrote to memory of 2108	2648	Client.exe	93
PID 2648 wrote to memory of 2108	2648	Client.exe	93
PID 2648 wrote to memory of 2108	2648	Client.exe	93
PID 2648 wrote to memory of 2108	2648	Client.exe	93
PID 2996 wrote to memory of 3288	2996	Client.exe	99
PID 2996 wrote to memory of 3288	2996	Client.exe	99
PID 2996 wrote to memory of 3288	2996	Client.exe	99
PID 2996 wrote to memory of 3288	2996	Client.exe	99
PID 2996 wrote to memory of 3288	2996	Client.exe	99
PID 2996 wrote to memory of 3288	2996	Client.exe	99
PID 2996 wrote to memory of 3288	2996	Client.exe	99
PID 2996 wrote to memory of 3288	2996	Client.exe	99
PID 2996 wrote to memory of 6092	2996	Client.exe	100
PID 2996 wrote to memory of 6092	2996	Client.exe	100
PID 2996 wrote to memory of 6092	2996	Client.exe	100
PID 2996 wrote to memory of 6092	2996	Client.exe	100
PID 2996 wrote to memory of 6092	2996	Client.exe	100
PID 2996 wrote to memory of 6092	2996	Client.exe	100
PID 2996 wrote to memory of 6092	2996	Client.exe	100
PID 2996 wrote to memory of 6092	2996	Client.exe	100
PID 6092 wrote to memory of 2752	6092	Client.exe	104
PID 6092 wrote to memory of 2752	6092	Client.exe	104
PID 6092 wrote to memory of 2752	6092	Client.exe	104

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1276
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      4⤵
      Executes dropped EXE
      PID:2140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 92
        5⤵
        Program crash
        
        PID:5848
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      4⤵
      Executes dropped EXE
      PID:2108
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 92
        5⤵
        Program crash
        
        PID:3048
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4500
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      4⤵
      Executes dropped EXE
      PID:3288
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 92
        5⤵
        Program crash
        
        PID:436
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2140 -ip 2140
1⤵
PID:2388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2108 -ip 2108
1⤵
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3288 -ip 3288
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.BackDoor.Rat.532.19245.6269.exe.log
Size 706B
SHA256 d9febc24cdfe2a616fff0e891fb055951aad00be6d57b0bc3cf8f4f643c5f6ae
MD5 80305b9a250a27091f46fa147674ffb3
SHA1 81b485761494618e4c8bba9af56c29b2ea8e8a07
SHA512 52544d526e83ae2a71d63768457435dbe79843a76146f60b7e41ec7b53ddb620323592325e19d6776b92b7e1fbb8dc79db85e94a30d970f0983563456ccd7a19
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.7MB
SHA256 d65862ab1d8dfcba06ab6e1fc40d109d9c644cac4e02ef0c8fb30f96ec199b61
MD5 d7b8cf49c37ef4cedb481ea114fbc9e3
SHA1 bd6ddfad9434df868f935657b50f00c03eadf04b
SHA512 6e7acccbe44aee628803df3e0a9295a3f536ceb250cf6ef70711b898a799601a0a0e96561aa2aeba2d18068574204ec2d82d3297fb1be519ef5b211cc01b9cf0
SSDEEP 98304:ah1iMoXVuBhWKbGYw2h8nN35EK9sYoRs7RuO:a61FuBhWKbOe8nN4WwO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4496-28-0x0000000075180000-0x0000000075931000-memory.dmp

Download

memory/4496-18-0x0000000075180000-0x0000000075931000-memory.dmp

Download

memory/4496-17-0x0000000005B80000-0x0000000005B8A000-memory.dmp

Download

memory/4496-15-0x00000000058E0000-0x00000000058FC000-memory.dmp

Download

memory/4496-9-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/4496-12-0x0000000075180000-0x0000000075931000-memory.dmp

Download

memory/4880-13-0x0000000075180000-0x0000000075931000-memory.dmp

Download

memory/4880-27-0x0000000075180000-0x0000000075931000-memory.dmp

Download

memory/4880-16-0x0000000075180000-0x0000000075931000-memory.dmp

Download

memory/5392-7-0x0000000008C50000-0x0000000008CE2000-memory.dmp

Download

memory/5392-1-0x00000000003C0000-0x000000000077A000-memory.dmp

Download

memory/5392-8-0x0000000005270000-0x0000000005276000-memory.dmp

Download

memory/5392-0-0x000000007518E000-0x000000007518F000-memory.dmp

Download

memory/5392-6-0x0000000009960000-0x0000000009F06000-memory.dmp

Download

memory/5392-5-0x0000000008BB0000-0x0000000008C4C000-memory.dmp

Download

memory/5392-4-0x0000000008760000-0x0000000008BAA000-memory.dmp

Download

memory/5392-3-0x0000000075180000-0x0000000075931000-memory.dmp

Download

memory/5392-2-0x0000000001280000-0x0000000001286000-memory.dmp

Download

memory/5392-14-0x0000000075180000-0x0000000075931000-memory.dmp

Download

memory/6092-37-0x00000000068D0000-0x000000000690A000-memory.dmp

Download

memory/6092-38-0x0000000006980000-0x00000000069D0000-memory.dmp

Download

memory/6092-39-0x0000000006BF0000-0x0000000006CA2000-memory.dmp

Download

memory/6092-40-0x0000000006B50000-0x0000000006B9E000-memory.dmp

Download

memory/6092-41-0x0000000006CB0000-0x0000000006CFC000-memory.dmp

Download

memory/6092-42-0x0000000006D00000-0x0000000006D4A000-memory.dmp

Download

memory/6092-43-0x0000000006D70000-0x0000000006D9A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads