quasar | 1bf41d92ab79e9ef2d9c743aa6b0d41d47f2f5559f0843ad8eb73ce9f6e564b5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
malware.exe
Size 3.1MB
Sample260503-glms3sb171
SHA256 1bf41d92ab79e9ef2d9c743aa6b0d41d47f2f5559f0843ad8eb73ce9f6e564b5
MD5 97fba1c5b5845700a0a74f7217e007d0
SHA1 c4e5c6405ffc617e5e8ec78aa758cb69ecd371c9
SHA512 63ff6f432423a31e6924ee9320a4619581af3a1365dee0af9213caf4c42226c09352e973acdd09616591738533452de4727921320dff865c5972cf66f0c96dfb
SSDEEP 49152:DvOe821/aQWl8P0lSk3aKA3Z+nYpxNESEbk/iJLoGd7THHB72eh2NT:DvN821/aQWl8P0lSk3DA3Z+nqxmZ
TLSH
T1DFE55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B5191677E1C53B5058426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xoilac discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

xoilac

aidas.us:443
aidas.us:80
data.aidas.us:443
ddos.aidas.us:443
malware.aidas.us:443

Mutex

b074bb76-509d-4f22-9881-b2e406eacc36

Attributes

encryption_key
B7E4985BC6F561AFD5FC99CACB2E00523B40A73D
install_name
molliza.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
malware
subdirectory
malware

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1444-0-0x0000000000BA0000-0x0000000000EC4000-memory.dmp	family_quasar
behavioral2/files/0x002000000002b1b9-5.dat	family_quasar

Executes dropped EXE 7 IoCs

pid	Process
1112	molliza.exe
3068	molliza.exe
4820	molliza.exe
4212	molliza.exe
3332	molliza.exe
4180	molliza.exe
4580	molliza.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1576	PING.EXE
1704	PING.EXE
228	PING.EXE
3292	PING.EXE
3420	PING.EXE

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
228	PING.EXE
3292	PING.EXE
3420	PING.EXE
1576	PING.EXE
1704	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4320	schtasks.exe
1872	schtasks.exe
3104	schtasks.exe
4768	schtasks.exe
3976	schtasks.exe
4252	schtasks.exe
2448	schtasks.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1444	malware.exe
Token: SeDebugPrivilege	1112	molliza.exe
Token: SeDebugPrivilege	3068	molliza.exe
Token: SeDebugPrivilege	4820	molliza.exe
Token: SeDebugPrivilege	4212	molliza.exe
Token: SeDebugPrivilege	3332	molliza.exe
Token: SeDebugPrivilege	4180	molliza.exe
Token: SeDebugPrivilege	4580	molliza.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4768	1444	malware.exe	80
PID 1444 wrote to memory of 1112	1444	malware.exe	82
PID 1112 wrote to memory of 3976	1112	molliza.exe	85
PID 1112 wrote to memory of 4892	1112	molliza.exe	87
PID 4892 wrote to memory of 5012	4892	cmd.exe	89
PID 4892 wrote to memory of 1576	4892	cmd.exe	90
PID 4892 wrote to memory of 4820	4892	cmd.exe	91
PID 4820 wrote to memory of 4252	4820	molliza.exe	92
PID 4820 wrote to memory of 488	4820	molliza.exe	94
PID 488 wrote to memory of 4380	488	cmd.exe	96
PID 488 wrote to memory of 1704	488	cmd.exe	97
PID 488 wrote to memory of 4212	488	cmd.exe	98
PID 4212 wrote to memory of 2448	4212	molliza.exe	99
PID 4212 wrote to memory of 4860	4212	molliza.exe	101
PID 4860 wrote to memory of 2680	4860	cmd.exe	103
PID 4860 wrote to memory of 228	4860	cmd.exe	104
PID 4860 wrote to memory of 3332	4860	cmd.exe	105
PID 3332 wrote to memory of 4320	3332	molliza.exe	106
PID 3332 wrote to memory of 1268	3332	molliza.exe	108
PID 1268 wrote to memory of 3704	1268	cmd.exe	110
PID 1268 wrote to memory of 3292	1268	cmd.exe	111
PID 1268 wrote to memory of 4180	1268	cmd.exe	112
PID 4180 wrote to memory of 1872	4180	molliza.exe	113
PID 4180 wrote to memory of 3960	4180	molliza.exe	115
PID 3960 wrote to memory of 4312	3960	cmd.exe	117
PID 3960 wrote to memory of 3420	3960	cmd.exe	118
PID 3960 wrote to memory of 4580	3960	cmd.exe	119
PID 4580 wrote to memory of 3104	4580	molliza.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\malware.exe
"C:\Users\Admin\AppData\Local\Temp\malware.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4768
- C:\Users\Admin\AppData\Roaming\malware\molliza.exe
  "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rwg0stZv1nvq.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5012
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1576
  - - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
      "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4820
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8XftZtjmMtdy.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:488
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4380
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1704
      - C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2448
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D3C3HqX9Dnxt.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2680
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:228
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3332
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4320
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9BMJQdIBsQ0p.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3704
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3292
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1872
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5nwGYgCc2UHr.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:3960
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4312
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3420
        
        C:\Users\Admin\AppData\Roaming\malware\molliza.exe
        
        "C:\Users\Admin\AppData\Roaming\malware\molliza.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "malware" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\malware\molliza.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3104

C:\Users\Admin\AppData\Roaming\malware\molliza.exe
C:\Users\Admin\AppData\Roaming\malware\molliza.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

molliza.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\molliza.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

5nwGYgCc2UHr.bat

Path C:\Users\Admin\AppData\Local\Temp\5nwGYgCc2UHr.bat
Size 209B
SHA256 a2f4853c4e27f17b7a2542f9eb76f27b0b4c6c446a3719d7592792e0ae683b9e
MD5 21a8b4a77869a958059a12414a604043
SHA1 0d38542e9fb8325c96975e9bec8b5772e4d6f152
SHA512 4b6f4fb83974668853ef9ad342293d933fea939b2ba6f3377317f9e362b5b64688fc0800878eb7dd4d05e6161c687ed8fc7159b02a8e3e02d666d1ee07d6dffd
TLSH
T197D023011781C75D490048471EB5728CB05504F71F887D9186004C9D13878DCF557581
MD5 SHA1 SHA512 TLSH

Submit Download

8XftZtjmMtdy.bat

Path C:\Users\Admin\AppData\Local\Temp\8XftZtjmMtdy.bat
Size 209B
SHA256 8093821a6f61fd36bd8e13e6c8ebe4f44e4eb2f7d5d7bf791e9ccb0fddf3847a
MD5 951bd9aecf2c7706f7173e7e6e01b32b
SHA1 e3c074e714077db83a7deb0ab11791e2b009923e
SHA512 b93b36ada2c1d118aba4e90bf9ca808de0be496abf8c2954d13a89eaa83d496aacef90c3aa33c219887ba951e4d0c19b688f30f93a6c8faec6899d1619b53a37
TLSH
T1E4D023421790C75D4500484B5EE1738CF0E504E71F487D934F054C9C0386CCCF6AB581
MD5 SHA1 SHA512 TLSH

Submit Download

9BMJQdIBsQ0p.bat

Path C:\Users\Admin\AppData\Local\Temp\9BMJQdIBsQ0p.bat
Size 209B
SHA256 720d7f938cc669675313de14225226ab4b604bc00526e423ae2a53a8f2a49875
MD5 e366b7276d1d37097cd329bbbec5c36c
SHA1 27c47c9f0d56680e584b31a023c45c8fcaac8efb
SHA512 620868113236aea6b210e4108e3ed41d5b8365e1a162f50e9cfe92b143f6714793db3f30d80d16da96dce130ad768f548bd067d22949330ea2c951b8789783af
TLSH
T14BD023121791C75D4900884B5E65728CB05504EA1F487DE186004C9C038689CF5975C2
MD5 SHA1 SHA512 TLSH

Submit Download

D3C3HqX9Dnxt.bat

Path C:\Users\Admin\AppData\Local\Temp\D3C3HqX9Dnxt.bat
Size 209B
SHA256 ee9bebd1c66417f4a582d9e1ee745c25601f127378a6442529783c616c799851
MD5 05d18600a00efd9fd80227bffd5e22b1
SHA1 b653b9f301e90defb61605267ef6519b37b91ac4
SHA512 b71d35042b3d8d382ecd827c37370fe0d44113471a338fd86552a548a896566460bc74a6e910bbbbe4f68b6020a90bdab856e51d5fc4e48225a1785ff9f5b5ab
TLSH
T133D0230257C0C75D590048475F62728CB09504F61F487D9145008C9C43C6C8CB5979C2
MD5 SHA1 SHA512 TLSH

Submit Download

rwg0stZv1nvq.bat

Path C:\Users\Admin\AppData\Local\Temp\rwg0stZv1nvq.bat
Size 209B
SHA256 2ad70d9119cc087835655692878c4ad5c6588198c304beeb13eaddc5503e49c2
MD5 c5628e7d4fb18fdd864852c3a467ae68
SHA1 fc7458821a5e61e768c547014432dc76b1fe9a61
SHA512 7831c565179b24094b4cdcf920aeedab861b884ec8efabd23ac539951815dbb2204138d8c90c0c40d552befdf23cc0c3cd7f09aa3eb245785e698bd8864ef8e3
TLSH
T1C9D023011780C75D450048471E65738CF09504F61F487DA24A004CAC038688CB6575C2
MD5 SHA1 SHA512 TLSH

Submit Download

molliza.exe

Path C:\Users\Admin\AppData\Roaming\malware\molliza.exe
Size 3.1MB
SHA256 1bf41d92ab79e9ef2d9c743aa6b0d41d47f2f5559f0843ad8eb73ce9f6e564b5
MD5 97fba1c5b5845700a0a74f7217e007d0
SHA1 c4e5c6405ffc617e5e8ec78aa758cb69ecd371c9
SHA512 63ff6f432423a31e6924ee9320a4619581af3a1365dee0af9213caf4c42226c09352e973acdd09616591738533452de4727921320dff865c5972cf66f0c96dfb
SSDEEP 49152:DvOe821/aQWl8P0lSk3aKA3Z+nYpxNESEbk/iJLoGd7THHB72eh2NT:DvN821/aQWl8P0lSk3DA3Z+nqxmZ
TLSH
T1DFE55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B5191677E1C53B5058426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-15-0x0000000001700000-0x0000000001712000-memory.dmp

Download

memory/1112-14-0x000000001BE30000-0x000000001BEE2000-memory.dmp

Download

memory/1112-17-0x000000001B920000-0x000000001B930000-memory.dmp

Download

memory/1112-16-0x0000000001C30000-0x0000000001C39000-memory.dmp

Download

memory/1112-13-0x000000001B6C0000-0x000000001B710000-memory.dmp

Download

memory/1112-25-0x0000000001C30000-0x0000000001C39000-memory.dmp

Download

memory/1112-9-0x000000001B920000-0x000000001B930000-memory.dmp

Download

memory/1444-8-0x0000000003100000-0x0000000003112000-memory.dmp

Download

memory/1444-1-0x000000001BCB0000-0x000000001BCC0000-memory.dmp

Download

memory/1444-0-0x0000000000BA0000-0x0000000000EC4000-memory.dmp

Download

memory/3068-12-0x00000000026B0000-0x00000000026C2000-memory.dmp

Download

memory/3332-46-0x000000001BF10000-0x000000001BF19000-memory.dmp

Download

memory/3332-45-0x0000000003300000-0x0000000003312000-memory.dmp

Download

memory/4180-49-0x00000000017B0000-0x00000000017C2000-memory.dmp

Download

memory/4180-50-0x00000000017F0000-0x00000000017F9000-memory.dmp

Download

memory/4180-57-0x00000000017F0000-0x00000000017F9000-memory.dmp

Download

memory/4212-38-0x0000000002D80000-0x0000000002D92000-memory.dmp

Download

memory/4212-39-0x0000000002DD0000-0x0000000002DD9000-memory.dmp

Download

memory/4580-61-0x0000000002650000-0x0000000002659000-memory.dmp

Download

memory/4580-60-0x00000000025F0000-0x0000000002602000-memory.dmp

Download

memory/4820-32-0x0000000002770000-0x0000000002779000-memory.dmp

Download

memory/4820-31-0x0000000002720000-0x0000000002732000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads