quasar | fad86850a716b50ef38b74dc8e956e7c493be863690371d8317743f5909db93f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e2bet.exe
Size 3.1MB
Sample260418-pee4nag16w
SHA256 fad86850a716b50ef38b74dc8e956e7c493be863690371d8317743f5909db93f
MD5 2746ce9a35fe0d1b6bf3fe98098e70e8
SHA1 3961ac8c33fe377b95645d1a8c3fed73a44dfbe0
SHA512 dbb42c24f5d286b4aae0781e1f8815a3316f98d414e38c6fac46586c24b57d8469c3fbe4912fbb836022b9b692a861e6ed998145e09cd8f2fd135de4bb551998
SSDEEP 49152:nvsL82kyaNnwxPlllSWxc9LpQXbK4PWoGdMlbTHHB72eh2NT:nv282kyaNnwxPlllSWa9LpQXbK4+
TLSH
T10BE56B0437F85F33E16BD6B3D9B0501267F0F86AB3A3EB1B6191667E1C53B9058026A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

thelenoxnyc.com discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

thelenoxnyc.com

thelenoxnyc.com:80
thelenoxnyc.com:443
thelenoxnyc.com:3306
thelenoxnyc.com/vi-vn:80
thelenoxnyc.com/vi-vn:443
thelenoxnyc.com/vi-vn:3306

Mutex

73ccb855-1714-40cc-b11e-365a8bb7081e

Attributes

encryption_key
576D1496F563366ADEBFC3046D6584BB4AD91241
install_name
e2bet.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
10
startup_key
https://thelenoxnyc.com
subdirectory
e2bet

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/4312-0-0x0000000000AA0000-0x0000000000DC4000-memory.dmp	family_quasar
behavioral1/files/0x0007000000024307-4.dat	family_quasar

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	e2bet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	e2bet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	e2bet.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	e2bet.exe

Executes dropped EXE 5 IoCs

pid	Process
368	e2bet.exe
1828	e2bet.exe
848	e2bet.exe
1608	e2bet.exe
2084	e2bet.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://thelenoxnyc.com = "\"C:\\Users\\Admin\\AppData\\Roaming\\e2bet\\e2bet.exe\""	e2bet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://thelenoxnyc.com = "\"C:\\Users\\Admin\\AppData\\Roaming\\e2bet\\e2bet.exe\""	e2bet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://thelenoxnyc.com = "\"C:\\Users\\Admin\\AppData\\Roaming\\e2bet\\e2bet.exe\""	e2bet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://thelenoxnyc.com = "\"C:\\Users\\Admin\\AppData\\Roaming\\e2bet\\e2bet.exe\""	e2bet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\https://thelenoxnyc.com = "\"C:\\Users\\Admin\\AppData\\Roaming\\e2bet\\e2bet.exe\""	e2bet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2028	PING.EXE
1668	PING.EXE
1448	PING.EXE
4584	PING.EXE

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
2028	PING.EXE
1668	PING.EXE
1448	PING.EXE
4584	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2416	schtasks.exe
1528	schtasks.exe
1840	schtasks.exe
3520	schtasks.exe
2264	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	e2bet.exe
Token: SeDebugPrivilege	368	e2bet.exe
Token: SeDebugPrivilege	1828	e2bet.exe
Token: SeDebugPrivilege	848	e2bet.exe
Token: SeDebugPrivilege	1608	e2bet.exe
Token: SeDebugPrivilege	2084	e2bet.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
368	e2bet.exe
848	e2bet.exe
1608	e2bet.exe
2084	e2bet.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 2416	4312	e2bet.exe	83
PID 4312 wrote to memory of 368	4312	e2bet.exe	85
PID 368 wrote to memory of 1528	368	e2bet.exe	88
PID 368 wrote to memory of 4440	368	e2bet.exe	92
PID 4440 wrote to memory of 3432	4440	cmd.exe	94
PID 4440 wrote to memory of 2028	4440	cmd.exe	95
PID 4440 wrote to memory of 848	4440	cmd.exe	98
PID 848 wrote to memory of 1840	848	e2bet.exe	99
PID 848 wrote to memory of 224	848	e2bet.exe	103
PID 224 wrote to memory of 2664	224	cmd.exe	106
PID 224 wrote to memory of 1668	224	cmd.exe	107
PID 224 wrote to memory of 1608	224	cmd.exe	111
PID 1608 wrote to memory of 3520	1608	e2bet.exe	112
PID 1608 wrote to memory of 796	1608	e2bet.exe	114
PID 796 wrote to memory of 4396	796	cmd.exe	116
PID 796 wrote to memory of 1448	796	cmd.exe	117
PID 796 wrote to memory of 2084	796	cmd.exe	118
PID 2084 wrote to memory of 2264	2084	e2bet.exe	119
PID 2084 wrote to memory of 1160	2084	e2bet.exe	121
PID 1160 wrote to memory of 2896	1160	cmd.exe	123
PID 1160 wrote to memory of 4584	1160	cmd.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e2bet.exe
"C:\Users\Admin\AppData\Local\Temp\e2bet.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "https://thelenoxnyc.com" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2416
- C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe
  "C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "https://thelenoxnyc.com" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0y41NY2ANuZ6.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3432
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2028
  - - C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe
      "C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://thelenoxnyc.com" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1840
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Wr5SABwBEyH7.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:224
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2664
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1668
      - C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe
        
        "C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://thelenoxnyc.com" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3520
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bAMrFK1wwHQ5.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4396
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1448
        
        C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe
        
        "C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "https://thelenoxnyc.com" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2264
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oFiNywmsDloe.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1160
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2896
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4584

C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe
C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e2bet.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\e2bet.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

0y41NY2ANuZ6.bat

Path C:\Users\Admin\AppData\Local\Temp\0y41NY2ANuZ6.bat
Size 205B
SHA256 cc4b244c320ef6ee5abcdd97093d21dd28b2d7c0e0f33da338331ffe00e35af1
MD5 6a5abe670644d66de8df971c1fb15f31
SHA1 356073ecd7eb50c9c668a80eaa54399b9cead65b
SHA512 e5886febaa51ded9697c88fe97f67807cec5b314d6539ff1f82514d3e52cb75ed671421d4adbac5984af81e801c405459884906193ec4ed8f9caa547c8784cee
TLSH
T18BD022020381CB0EC7024C071EBAA288F0DA04EA6F8CBD92860288DD03C6C8CB597282
MD5 SHA1 SHA512 TLSH

Submit Download

Wr5SABwBEyH7.bat

Path C:\Users\Admin\AppData\Local\Temp\Wr5SABwBEyH7.bat
Size 205B
SHA256 dcb47b774e98eb73762849e5d958a2471b098b3e442768e2337701db75611a08
MD5 8703cc1c2be242f4b3469303382cb716
SHA1 0d43d26beb5b100bc1525d8538ba40a9198f71c9
SHA512 08cdffa91b2e88341491d01551f92fc201860eea4341ca3440e56c5f8818bdad89d97b45fc1e888d4570fbe92f307533ef894d630ae78ca0f33854caf839beec
TLSH
T17CD022024381CB0DD6024D0719A5628EB0AA04EA2F8CBDA2850688DC038688CB697282
MD5 SHA1 SHA512 TLSH

Submit Download

bAMrFK1wwHQ5.bat

Path C:\Users\Admin\AppData\Local\Temp\bAMrFK1wwHQ5.bat
Size 205B
SHA256 5cf8b68dd8d2b0bde300dcb0b84ff223e6ab361f5f57761af6ab04a4c50839a6
MD5 9bbd537f584a017dd39ce6f1d2d0cf25
SHA1 50ccae9442971e11e48b5d0963d8d28786467c2a
SHA512 f79da6aeefb013f1714c143e73af70d2363ad4d322f2cebc10d978944d4ae559a4bb00f335bb881ed59d2a1c191fcf4c8f236edf703c00033473174e2ae96e63
TLSH
T15ED022120385CB0E96064C4B59A172C8F0AA08EE2F8CBD92C5068CDC0386C9CB59B1C3
MD5 SHA1 SHA512 TLSH

Submit Download

oFiNywmsDloe.bat

Path C:\Users\Admin\AppData\Local\Temp\oFiNywmsDloe.bat
Size 205B
SHA256 488235ed88aa109c9d35de67e6a4e4851a2c222f3e22682402e204ed3e22c86e
MD5 379484abd6030a73fe41b87aa313a5ef
SHA1 40eda899d02e5db9ed4cae748848bb9ef859a69a
SHA512 6e39d77afe07d08bcb4af949d964ad0c53f64e7c95cfac71b3d3fe6454fe4b666670e0f0bd0cd8ecc2631a3a55cbdb385e807c18733201c1cd1cb0d20287b9ab
TLSH
T180D022420381CB2D96020C5729A2A28AB0DA04EA2F4DBD92850288EC03C788CB6D7182
MD5 SHA1 SHA512 TLSH

Submit Download

e2bet.exe

Path C:\Users\Admin\AppData\Roaming\e2bet\e2bet.exe
Size 3.1MB
SHA256 fad86850a716b50ef38b74dc8e956e7c493be863690371d8317743f5909db93f
MD5 2746ce9a35fe0d1b6bf3fe98098e70e8
SHA1 3961ac8c33fe377b95645d1a8c3fed73a44dfbe0
SHA512 dbb42c24f5d286b4aae0781e1f8815a3316f98d414e38c6fac46586c24b57d8469c3fbe4912fbb836022b9b692a861e6ed998145e09cd8f2fd135de4bb551998
SSDEEP 49152:nvsL82kyaNnwxPlllSWxc9LpQXbK4PWoGdMlbTHHB72eh2NT:nv282kyaNnwxPlllSWa9LpQXbK4+
TLSH
T10BE56B0437F85F33E16BD6B3D9B0501267F0F86AB3A3EB1B6191667E1C53B9058026A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/368-9-0x00000000017B0000-0x00000000017C0000-memory.dmp

Download

memory/368-11-0x0000000003190000-0x00000000031E0000-memory.dmp

Download

memory/368-13-0x000000001C3D0000-0x000000001C482000-memory.dmp

Download

memory/368-14-0x0000000001790000-0x000000000179C000-memory.dmp

Download

memory/368-15-0x00000000017B0000-0x00000000017C0000-memory.dmp

Download

memory/368-20-0x0000000001790000-0x000000000179C000-memory.dmp

Download

memory/848-23-0x0000000001200000-0x000000000120C000-memory.dmp

Download

memory/848-28-0x0000000001200000-0x000000000120C000-memory.dmp

Download

memory/1608-31-0x00000000031C0000-0x00000000031CC000-memory.dmp

Download

memory/1608-36-0x00000000031C0000-0x00000000031CC000-memory.dmp

Download

memory/1828-12-0x0000000001000000-0x000000000100C000-memory.dmp

Download

memory/2084-39-0x0000000001770000-0x000000000177C000-memory.dmp

Download

memory/2084-46-0x0000000001770000-0x000000000177C000-memory.dmp

Download

memory/4312-0-0x0000000000AA0000-0x0000000000DC4000-memory.dmp

Download

memory/4312-8-0x0000000002E20000-0x0000000002E2C000-memory.dmp

Download

memory/4312-1-0x000000001B9C0000-0x000000001B9D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads