quasar | 716a0a7af8fbbb64bb59316b86ba3313ac7b4669d15845365985c2193f007eee

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
23/11/2025, 00:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 3.1MB
Sample251123-asmnbsvrhs
SHA256 716a0a7af8fbbb64bb59316b86ba3313ac7b4669d15845365985c2193f007eee
MD5 22fdcda59eb88488ac0f3a9c33c8de71
SHA1 b9db244b9808a70fe0bda89410261d03d2f3404b
SHA512 2e5bd029aa5a8d778656924d71caab1d430c5f4113757ffda6898348b68ac14dd959e8f15e4ff437e06f5a7d8dbc671e227b0d9567645eb57aacace587049f8c
SSDEEP 49152:qvvI22SsaNYfdPBldt698dBcjHgtbR35oGd+RTHHB72eh2NT:qvg22SsaNYfdPBldt6+dBcjHg9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

win server execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Win server

192.168.245.144:4782

Mutex

0efe7f89-a47a-4a25-86b8-2cdd9a080a14

Attributes

encryption_key
3B2A0CC756485532964D867F5BF67B5B7AAD84D7
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4408-0-0x0000000000DD0000-0x00000000010F4000-memory.dmp	family_quasar
behavioral2/files/0x001a00000002b1a1-5.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
2824	Client.exe
2436	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
224	schtasks.exe
5476	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	Client.exe
Token: SeDebugPrivilege	2824	Client.exe
Token: SeDebugPrivilege	2436	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2824	Client.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 224	4408	Client.exe	78
PID 4408 wrote to memory of 224	4408	Client.exe	78
PID 4408 wrote to memory of 2824	4408	Client.exe	80
PID 4408 wrote to memory of 2824	4408	Client.exe	80
PID 2824 wrote to memory of 5476	2824	Client.exe	83
PID 2824 wrote to memory of 5476	2824	Client.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:224
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5476

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
MD5 SHA1 SHA512

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 716a0a7af8fbbb64bb59316b86ba3313ac7b4669d15845365985c2193f007eee
MD5 22fdcda59eb88488ac0f3a9c33c8de71
SHA1 b9db244b9808a70fe0bda89410261d03d2f3404b
SHA512 2e5bd029aa5a8d778656924d71caab1d430c5f4113757ffda6898348b68ac14dd959e8f15e4ff437e06f5a7d8dbc671e227b0d9567645eb57aacace587049f8c
SSDEEP 49152:qvvI22SsaNYfdPBldt698dBcjHgtbR35oGd+RTHHB72eh2NT:qvg22SsaNYfdPBldt6+dBcjHg9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2824-9-0x000000001B1F0000-0x000000001B200000-memory.dmp

Download

memory/2824-11-0x000000001B0A0000-0x000000001B0F0000-memory.dmp

Download

memory/2824-12-0x000000001B9C0000-0x000000001BA72000-memory.dmp

Download

memory/2824-13-0x000000001B1F0000-0x000000001B200000-memory.dmp

Download

memory/4408-0-0x0000000000DD0000-0x00000000010F4000-memory.dmp

Download

memory/4408-1-0x000000001BEE0000-0x000000001BEF0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads