quasar | 9d73688b12994f69f97ff9c04fec2734519b750001b0870b3df7db9de3ee5716

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/01/2026, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jammmmmes.exe
Size 3.1MB
Sample260131-hcmbmabs4a
SHA256 9d73688b12994f69f97ff9c04fec2734519b750001b0870b3df7db9de3ee5716
MD5 6c5efec519b2a234d5036ee408d548b9
SHA1 e956acfc5a87eb1699b000e016dc03b98ce04a95
SHA512 5822df13722df162148d32e197dcc187aef5e70295ea67f2aa2aa10eb05f37fbcbef6ac8485fcf8db59d2adf049b55a8a5190629d0eb06c026c939850f7933e7
SSDEEP 49152:LvulL26AaNeWgPhlmVqvMQ7XSKsv1oFs9AoG50G7THHB72eh2NT:LveL26AaNeWgPhlmVqkQ7XSKsvesW8G
TLSH
T1DAE55A1437F85E33E16AD6B3D5B0541A63F0F86AF363EB0B2181677E5C53B508842AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

yoenacevedo7-62402.portmap.host:62402

Mutex

eb473aac-8b27-4e7d-b89a-908be481bb25

Attributes

encryption_key
2818EA1D731DBD4DB63E4CC45C5C044CA953AF10
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/5068-0-0x0000000000DF0000-0x0000000001114000-memory.dmp	family_quasar
behavioral2/files/0x001a00000002b3ef-5.dat	family_quasar

Executes dropped EXE 4 IoCs

pid	Process
5708	Client.exe
5016	Client.exe
5616	Client.exe
5928	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4060	PING.EXE
4748	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4060	PING.EXE
4748	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1112	schtasks.exe
6012	schtasks.exe
2796	schtasks.exe
5480	schtasks.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	5068	jammmmmes.exe
Token: SeDebugPrivilege	5708	Client.exe
Token: SeDebugPrivilege	5016	Client.exe
Token: SeDebugPrivilege	5616	Client.exe
Token: SeDebugPrivilege	5928	Client.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5708	Client.exe
5616	Client.exe
5928	Client.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5708	Client.exe
5616	Client.exe
5928	Client.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 1112	5068	jammmmmes.exe	79
PID 5068 wrote to memory of 5708	5068	jammmmmes.exe	81
PID 5708 wrote to memory of 6012	5708	Client.exe	84
PID 5708 wrote to memory of 1160	5708	Client.exe	86
PID 1160 wrote to memory of 1488	1160	cmd.exe	88
PID 1160 wrote to memory of 4060	1160	cmd.exe	89
PID 1160 wrote to memory of 5616	1160	cmd.exe	90
PID 5616 wrote to memory of 2796	5616	Client.exe	91
PID 5616 wrote to memory of 2912	5616	Client.exe	93
PID 2912 wrote to memory of 5172	2912	cmd.exe	95
PID 2912 wrote to memory of 4748	2912	cmd.exe	96
PID 2912 wrote to memory of 5928	2912	cmd.exe	97
PID 5928 wrote to memory of 5480	5928	Client.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\jammmmmes.exe
"C:\Users\Admin\AppData\Local\Temp\jammmmmes.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1112
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jM5dCnSLOkiM.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:1488
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4060
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5616
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EKo8ZJPEaKVy.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2912
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5172
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4748
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5928
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5480

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

EKo8ZJPEaKVy.bat

Path C:\Users\Admin\AppData\Local\Temp\EKo8ZJPEaKVy.bat
Size 207B
SHA256 4b1eaacbc8e8ad68e7052bd1d1c0cf35248d55efb767652c71b8ec4c0e709d4f
MD5 723858602e87469d898c401e01b0fc45
SHA1 e3ed8178f63575d75dc1179f2adaf57be9a27809
SHA512 f5dd69c0a8bda321f1a342c62de54643a5e74f8259e637e5edf101f28f4e38372cbae0c84fcff3cfa8b08614bff392e385a216d54be28bcdc371c2c1c325f0c4
TLSH
T182D023022741CD5E450058471DE67288F0FA04F61F487E6145058C9C438685C755B143
MD5 SHA1 SHA512 TLSH

Submit Download

jM5dCnSLOkiM.bat

Path C:\Users\Admin\AppData\Local\Temp\jM5dCnSLOkiM.bat
Size 207B
SHA256 77815d3e83b38fb26bb79aca5cf3138b0fcb90c40240fcbbdcd533f513ccde24
MD5 16861f70ccc3327b181febe7bdbc76f9
SHA1 db4c9101c86a7a41694fc5b2711451bb16d9f1af
SHA512 83e828a005e2b424cfc83a95756c0df3a00ae820f56f98247cdd00358e1188b9e7db054253f981dbf0d21c54cb3a0e095d70c9b5990c5ffd465c10ebcb45bbb2
TLSH
T112D0234133C0CE9D450018471D75738CB0AB08FA1F087E61C61148DC038698CB59B181
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 9d73688b12994f69f97ff9c04fec2734519b750001b0870b3df7db9de3ee5716
MD5 6c5efec519b2a234d5036ee408d548b9
SHA1 e956acfc5a87eb1699b000e016dc03b98ce04a95
SHA512 5822df13722df162148d32e197dcc187aef5e70295ea67f2aa2aa10eb05f37fbcbef6ac8485fcf8db59d2adf049b55a8a5190629d0eb06c026c939850f7933e7
SSDEEP 49152:LvulL26AaNeWgPhlmVqvMQ7XSKsv1oFs9AoG50G7THHB72eh2NT:LveL26AaNeWgPhlmVqkQ7XSKsvesW8G
TLSH
T1DAE55A1437F85E33E16AD6B3D5B0541A63F0F86AF363EB0B2181677E5C53B508842AA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5068-0-0x0000000000DF0000-0x0000000001114000-memory.dmp

Download

memory/5068-1-0x000000001D020000-0x000000001D030000-memory.dmp

Download

memory/5708-8-0x000000001D100000-0x000000001D110000-memory.dmp

Download

memory/5708-11-0x000000001D950000-0x000000001D9A0000-memory.dmp

Download

memory/5708-12-0x000000001DA60000-0x000000001DB12000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads