quasar | 8fb83f7dcf99df1ee9f47544fc4387b22d48a40657d10b502f01a3c378b8ea3f

Analysis

max time kernel
107s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
06/10/2025, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dd.exe
Size 2.2MB
Sample251006-vmsbvatsew
SHA256 8fb83f7dcf99df1ee9f47544fc4387b22d48a40657d10b502f01a3c378b8ea3f
MD5 0517c7f29e89c73ae25acaa061e9d0ca
SHA1 e447986e061805bd3511c7744270a6f75cee22d1
SHA512 f2c4cf8867993331cbc9b5a4cf3d053cfbbbac81e725f484e72658e947a80a1140796506345406686c7359bd3ffed52acb074150fa7ffc1fde42e575df632e1e
SSDEEP 49152:Jjc8nkyf8W1rG6M3H94D2ewJH7KEDU7ngvyLCWwB4XTO0r6:BcxgnFG6ed4D2xJbKEDU7gvBYXK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ps defense_evasion discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.7.4

Botnet

66.59.196.120:4782

Mutex

dad50fa9-e485-45c5-867d-8e558ee485c4

Attributes

encryption_key
7948950F56E714A3ECF853664FFA65AE86A70051
install_name
wintindo.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
log_directory
Logs
reconnect_delay
3000
startup_key
wininit32
subdirectory
win

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000002a198-4.dat	family_quasar
behavioral2/memory/4076-17-0x00000243BFF90000-0x00000243C015E000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

pid	Process
4076	FIX.exe
3624	Hythera.exe
4860	wintindo.exe
3672	Hythera.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6112	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3696	schtasks.exe
4972	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4860	wintindo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3672	Hythera.exe
3672	Hythera.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3624	Hythera.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	FIX.exe
Token: SeDebugPrivilege	4860	wintindo.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3624	Hythera.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4076	2476	dd.exe	78
PID 2476 wrote to memory of 4076	2476	dd.exe	78
PID 2476 wrote to memory of 3624	2476	dd.exe	79
PID 2476 wrote to memory of 3624	2476	dd.exe	79
PID 4076 wrote to memory of 3696	4076	FIX.exe	80
PID 4076 wrote to memory of 3696	4076	FIX.exe	80
PID 4076 wrote to memory of 4860	4076	FIX.exe	82
PID 4076 wrote to memory of 4860	4076	FIX.exe	82
PID 4860 wrote to memory of 4972	4860	wintindo.exe	83
PID 4860 wrote to memory of 4972	4860	wintindo.exe	83
PID 3624 wrote to memory of 3672	3624	Hythera.exe	86
PID 3624 wrote to memory of 3672	3624	Hythera.exe	86
PID 4860 wrote to memory of 2504	4860	wintindo.exe	87
PID 4860 wrote to memory of 2504	4860	wintindo.exe	87
PID 4860 wrote to memory of 1072	4860	wintindo.exe	89
PID 4860 wrote to memory of 1072	4860	wintindo.exe	89
PID 1072 wrote to memory of 8	1072	cmd.exe	91
PID 1072 wrote to memory of 8	1072	cmd.exe	91
PID 1072 wrote to memory of 6112	1072	cmd.exe	92
PID 1072 wrote to memory of 6112	1072	cmd.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dd.exe
"C:\Users\Admin\AppData\Local\Temp\dd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Users\Admin\AppData\Local\Temp\FIX.exe
  "C:\Users\Admin\AppData\Local\Temp\FIX.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "wininit32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\win\wintindo.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3696
- - C:\Users\Admin\AppData\Roaming\win\wintindo.exe
    "C:\Users\Admin\AppData\Roaming\win\wintindo.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "wininit32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\win\wintindo.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4972
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /delete /tn "wininit32" /f
      4⤵
      PID:2504
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XtOXSjKdaNRA.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:8
    - - C:\Windows\system32\timeout.exe
        
        timeout /T 5 /NOBREAK
        5⤵
        Delays execution with timeout.exe
        
        PID:6112
- C:\Users\Admin\AppData\Local\Temp\Hythera.exe
  "C:\Users\Admin\AppData\Local\Temp\Hythera.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\ProgramData\Hythera\Hythera.exe
    "C:\ProgramData\Hythera\Hythera.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Hythera.exe

Path C:\ProgramData\Hythera\Hythera.exe
Size 14.1MB
SHA256 b66df5ada403abfda5df2f194b6fb0eba3dc5d9ca87fb18c99a63da2a82a5ff7
MD5 ce0bd2dd6c025a5f8d2070fadf2efe7b
SHA1 42795cbeea936adcf75b2536ddaf522991c4e271
SHA512 8a40249b479b31de0211267385de6d09f8102cbe64c5edfdc90b405d96da6793be338171029499058c411be1dbd74fedf2048a203a76e47c4bc3b9bff25b432b
SSDEEP 393216:TuJnmYY6/jEhWxLNQFeGMnASskRCWoaR:6FLh/mqL2dMnvoWo
MD5 SHA1 SHA512 SSDEEP

Submit Download

FIX.exe

Path C:\Users\Admin\AppData\Local\Temp\FIX.exe
Size 1.8MB
SHA256 d9613a163a1aba3d8ba0a49be51fa4472bb5531da81a01b1b7d0f231d478bac9
MD5 83071707d44cb6694ee2214d7e56e00f
SHA1 7fc6a2da312c8c0c7d79169c053872eefee05218
SHA512 6b90d9a400e079a985fcfa609ee3973d3752d2951d7da78e2b4d9e7443299a7d864992cb70379e041c4da276bf8e15f49dbedd1221ccdd2e8b1cae1042a7000e
SSDEEP 24576:vgrqRfHyclOYM5NKij8QzO4lcHNF0tXZWLuyWfEez8jOzuYBVIfcVWuI6:vgrGSGOGqnXpyWuu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hythera.exe

Path C:\Users\Admin\AppData\Local\Temp\Hythera.exe
Size 439KB
SHA256 f146264e7b16b66d27aa2be33545263e85f12b525be648f8141d61e251c70b24
MD5 194c14a0f79d9a15e62fa6b28f2b8e8a
SHA1 27feb32a73967d574a86977f2b9e83c824a4dfcf
SHA512 4bf856e9d0abd7333a57135a8b0dbe6d8a1b85251df8994de5cf91cae237c99a5271bbccbec7e6231aa18b463aed8b4103f83f6bd1118f2e206621f80f05db62
SSDEEP 6144:jxHguqQrKrpWYiwG5DtqtPRj13tt3oUBLEmEiDwR9tBk83o0GBLEp3kIHUjidPNB:tgtWxwIglRBtFS2/Ep0mPNri3nR
MD5 SHA1 SHA512 SSDEEP

Submit Download

XtOXSjKdaNRA.bat

Path C:\Users\Admin\AppData\Local\Temp\XtOXSjKdaNRA.bat
Size 211B
SHA256 435b7fc62350993f2387c3c5bdb38ca5404a08d758e6624f8615b370b301931d
MD5 65145766a3999baa20c21809fcf1d912
SHA1 e8244354b3c5d2233fca56b72ddf5c0019daeca5
SHA512 fdcf0aa037b5488394620660305b4f38de3144ae2e4fc5b419b5e6971a27bf7635b89c22fe828e93a620ef99829efc25d7123ca7e2e8adb467166fd56342f768
MD5 SHA1 SHA512

Submit Download

memory/3624-72-0x0000020FBE030000-0x0000020FBE1E3000-memory.dmp

Download

memory/3672-82-0x00007FF7DC100000-0x00007FF7DDA7D000-memory.dmp

Download

memory/3672-80-0x00007FF7DC100000-0x00007FF7DDA7D000-memory.dmp

Download

memory/3672-79-0x00007FFC089B0000-0x00007FFC089B2000-memory.dmp

Download

memory/3672-73-0x00007FF7DC100000-0x00007FF7DDA7D000-memory.dmp

Download

memory/4076-17-0x00000243BFF90000-0x00000243C015E000-memory.dmp

Download

memory/4076-20-0x00000243DA780000-0x00000243DA790000-memory.dmp

Download

memory/4076-21-0x00000243C1D40000-0x00000243C1D6C000-memory.dmp

Download

memory/4860-57-0x00000172F8A70000-0x00000172F8AB2000-memory.dmp

Download

memory/4860-61-0x00000172F8B40000-0x00000172F8B62000-memory.dmp

Download

memory/4860-56-0x00000172F89F0000-0x00000172F8A52000-memory.dmp

Download

memory/4860-60-0x00000172F8AD0000-0x00000172F8AEA000-memory.dmp

Download

memory/4860-59-0x00000172F8A50000-0x00000172F8A5A000-memory.dmp

Download

memory/4860-54-0x00000172F8970000-0x00000172F8996000-memory.dmp

Download

memory/4860-55-0x00000172F89A0000-0x00000172F89A8000-memory.dmp

Download

memory/4860-58-0x00000172F8930000-0x00000172F893A000-memory.dmp

Download

memory/4860-53-0x00000172F8940000-0x00000172F894A000-memory.dmp

Download

memory/4860-52-0x00000172F89B0000-0x00000172F89EC000-memory.dmp

Download

memory/4860-51-0x00000172F8950000-0x00000172F8962000-memory.dmp

Download

memory/4860-44-0x00000172DF690000-0x00000172DF6CA000-memory.dmp

Download

memory/4860-46-0x00000172F8310000-0x00000172F835A000-memory.dmp

Download

memory/4860-47-0x00000172F8360000-0x00000172F838A000-memory.dmp

Download

memory/4860-45-0x00000172F82C0000-0x00000172F830C000-memory.dmp

Download