quasar | 1bf41d92ab79e9ef2d9c743aa6b0d41d47f2f5559f0843ad8eb73ce9f6e564b5

Analysis

user interaction
yes
max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
malware.exe
Size 3.1MB
Sample260503-glms3sb171
SHA256 1bf41d92ab79e9ef2d9c743aa6b0d41d47f2f5559f0843ad8eb73ce9f6e564b5
MD5 97fba1c5b5845700a0a74f7217e007d0
SHA1 c4e5c6405ffc617e5e8ec78aa758cb69ecd371c9
SHA512 63ff6f432423a31e6924ee9320a4619581af3a1365dee0af9213caf4c42226c09352e973acdd09616591738533452de4727921320dff865c5972cf66f0c96dfb
SSDEEP 49152:DvOe821/aQWl8P0lSk3aKA3Z+nYpxNESEbk/iJLoGd7THHB72eh2NT:DvN821/aQWl8P0lSk3DA3Z+nqxmZ
TLSH
T1DFE55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B5191677E1C53B5058426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xoilac discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

xoilac

aidas.us:443
aidas.us:80
data.aidas.us:443
ddos.aidas.us:443
malware.aidas.us:443

Mutex

b074bb76-509d-4f22-9881-b2e406eacc36

Attributes

encryption_key
B7E4985BC6F561AFD5FC99CACB2E00523B40A73D
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/4584-0-0x00000000005C0000-0x00000000008E4000-memory.dmp	family_quasar
behavioral1/files/0x000800000002447f-5.dat	family_quasar

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	molliza.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	molliza.exe

Executes dropped EXE 5 IoCs

pid	Process
1064	molliza.exe
4776	molliza.exe
1284	molliza.exe
4984	molliza.exe
3764	molliza.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
468	PING.EXE
6116	PING.EXE
4148	PING.EXE

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
468	PING.EXE
6116	PING.EXE
4148	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4560	schtasks.exe
3724	schtasks.exe
4784	schtasks.exe
5984	schtasks.exe
3036	schtasks.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	malware.exe
Token: SeDebugPrivilege	1064	molliza.exe
Token: SeDebugPrivilege	4776	molliza.exe
Token: SeDebugPrivilege	1284	molliza.exe
Token: SeDebugPrivilege	4984	molliza.exe
Token: SeDebugPrivilege	3764	molliza.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4560	4584	malware.exe	84
PID 4584 wrote to memory of 1064	4584	malware.exe	86
PID 1064 wrote to memory of 3724	1064	molliza.exe	89
PID 1064 wrote to memory of 2408	1064	molliza.exe	95
PID 2408 wrote to memory of 4368	2408	cmd.exe	97
PID 2408 wrote to memory of 468	2408	cmd.exe	98
PID 2408 wrote to memory of 1284	2408	cmd.exe	102
PID 1284 wrote to memory of 4784	1284	molliza.exe	104
PID 1284 wrote to memory of 6132	1284	molliza.exe	108
PID 6132 wrote to memory of 5044	6132	cmd.exe	110
PID 6132 wrote to memory of 6116	6132	cmd.exe	111
PID 6132 wrote to memory of 4984	6132	cmd.exe	112
PID 4984 wrote to memory of 5984	4984	molliza.exe	113
PID 4984 wrote to memory of 2516	4984	molliza.exe	116
PID 2516 wrote to memory of 228	2516	cmd.exe	118
PID 2516 wrote to memory of 4148	2516	cmd.exe	119
PID 2516 wrote to memory of 3764	2516	cmd.exe	120
PID 3764 wrote to memory of 3036	3764	molliza.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\malware.exe
"C:\Users\Admin\AppData\Local\Temp\malware.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4560
- C:\Users\Admin\AppData\Roaming\malware\molliza.exe
  "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eiZoaLvSYbw5.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4368
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:468
  - - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
      "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jVUNGfEfj1UA.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6132
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5044
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6116
      - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5984
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WF29dHFGGxWU.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:228
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4148
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3036

C:\Users\Admin\AppData\Roaming\malware\molliza.exe
C:\Users\Admin\AppData\Roaming\malware\molliza.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

molliza.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\molliza.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

WF29dHFGGxWU.bat

Path C:\Users\Admin\AppData\Local\Temp\WF29dHFGGxWU.bat
Size 209B
SHA256 71d2ef9278410c0853a32323ecd4a4738ad997d7e0a3dd1edcfaab3aae55eb50
MD5 9e7fa3f4e6180a11e6c78671d9a516bb
SHA1 1e1836ac346f4d8b1dc5b5f844c331ce926348d9
SHA512 df8a652efb2eca794a1dc4772ccfd5a1de702d1c7f8d0bbbfea1391fdabec3bf7f207bb0bc3f19115f55ceff3bb70444a4f75feb475c871e54242ae35be146b7
TLSH
T1F0D023015780C75D4500485F5E6573CCB05944EA1F4CBD9345054C9C03C688CB577581
MD5 SHA1 SHA512 TLSH

Submit Download

eiZoaLvSYbw5.bat

Path C:\Users\Admin\AppData\Local\Temp\eiZoaLvSYbw5.bat
Size 209B
SHA256 4949166416f8eec1e4d3f183bde42880bf2d22f59ed9c01b33553796db74495e
MD5 4d6c07325ec3cf28f265987536518691
SHA1 b68df435d1437418e306434f7145b52543655a4e
SHA512 2646ed6a8f18919413f0384ed9508d799e9275240664bd8631b3fc96e98b51f13f829d796af701e3aba6eb575935197712d5f24d6b1b4feadb710791bdcda014
TLSH
T161D022026780CBAD59018C4B6EB5778CB09A04EE2F48BE928B008C9C03C788CB5AB5C2
MD5 SHA1 SHA512 TLSH

Submit Download

jVUNGfEfj1UA.bat

Path C:\Users\Admin\AppData\Local\Temp\jVUNGfEfj1UA.bat
Size 209B
SHA256 c320ee82baf18990fadaf63cb4c986a08c81135485cd3bedd5ca419235ae898c
MD5 f66f8b086dfe08debf7bdf417dab835b
SHA1 2521a3bccd6f96a478b234ccfcf245d0e776e451
SHA512 ac779356c4a490c81a52636594c764f9698c148d2fd87e4a9cec6fb34f29ee101d393bf2556aefa4b9c0b74e26d2f6b65457ddee2d4a0d94f6d8565660a2f64e
TLSH
T158D023015BD0C75D450148471E6172CCB0550CE71F487D9149004CDD0387C8CF59B5C1
MD5 SHA1 SHA512 TLSH

Submit Download

molliza.exe

Path C:\Users\Admin\AppData\Roaming\malware\molliza.exe
Size 3.1MB
SHA256 1bf41d92ab79e9ef2d9c743aa6b0d41d47f2f5559f0843ad8eb73ce9f6e564b5
MD5 97fba1c5b5845700a0a74f7217e007d0
SHA1 c4e5c6405ffc617e5e8ec78aa758cb69ecd371c9
SHA512 63ff6f432423a31e6924ee9320a4619581af3a1365dee0af9213caf4c42226c09352e973acdd09616591738533452de4727921320dff865c5972cf66f0c96dfb
SSDEEP 49152:DvOe821/aQWl8P0lSk3aKA3Z+nYpxNESEbk/iJLoGd7THHB72eh2NT:DvN821/aQWl8P0lSk3DA3Z+nqxmZ
TLSH
T1DFE55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B5191677E1C53B5058426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-15-0x0000000001420000-0x000000000142C000-memory.dmp

Download

memory/1064-11-0x000000001BC10000-0x000000001BC60000-memory.dmp

Download

memory/1064-14-0x000000001BD20000-0x000000001BDD2000-memory.dmp

Download

memory/1064-9-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/1064-16-0x0000000002D70000-0x0000000002D80000-memory.dmp

Download

memory/1064-24-0x0000000001420000-0x000000000142C000-memory.dmp

Download

memory/1284-32-0x00000000026C0000-0x00000000026CC000-memory.dmp

Download

memory/1284-27-0x00000000026C0000-0x00000000026CC000-memory.dmp

Download

memory/3764-43-0x0000000002F90000-0x0000000002F9C000-memory.dmp

Download

memory/4584-0-0x00000000005C0000-0x00000000008E4000-memory.dmp

Download

memory/4584-8-0x0000000001080000-0x000000000108C000-memory.dmp

Download

memory/4584-1-0x000000001B650000-0x000000001B660000-memory.dmp

Download

memory/4776-13-0x0000000002F30000-0x0000000002F3C000-memory.dmp

Download

memory/4984-35-0x0000000000D40000-0x0000000000D4C000-memory.dmp

Download

memory/4984-40-0x0000000000D40000-0x0000000000D4C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads