quasar | f7ebddff5d7ebd52d585ea20d025fb79aee34ef3985cbd29c505edaf29b36c0b

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/05/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
avb.eu.exe
Size 3.1MB
Sample260518-eckw1sfx4y
SHA256 f7ebddff5d7ebd52d585ea20d025fb79aee34ef3985cbd29c505edaf29b36c0b
MD5 87466448bd027d73314293d7312bf5a9
SHA1 f3841fdd32f0191d6959fb6ee7eae1b69e12afec
SHA512 839c3915275d698f27e7e5ff76a264c25a463fb86be9673851fa95459156cfb75209e1d761d40d88ad80554ea556dc38cdb2b5562b4d2a05bb5235e3bcd4a178
SSDEEP 49152:Hv/e821/aQWl8P0lSk3aKA3Z+nBSU3rarJLoGdttpTHHB72eh2NT:Hv2821/aQWl8P0lSk3DA3Z+nH3e
TLSH
T123E54A1437F85E23E1ABE373D5B0041367F1F82AB3A3EB0B6191677A5C53B5049826A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

avb.eu.com:443
www.avb.eu.com:443
avb.eu.com:80
www.avb.eu.com:80

Mutex

f86288cf-f9a7-4ee9-b664-decdbd168297

Attributes

encryption_key
ED3227F773701D05083B11A65776F95F93EEEF5E
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/4496-0-0x0000000000950000-0x0000000000C74000-memory.dmp	family_quasar
behavioral1/files/0x000a000000024342-5.dat	family_quasar

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 15 IoCs

pid	Process
2060	Client.exe
3948	Client.exe
3688	Client.exe
3508	Client.exe
2404	Client.exe
4880	Client.exe
1152	Client.exe
4824	Client.exe
1488	Client.exe
1756	Client.exe
1412	Client.exe
4528	Client.exe
2528	Client.exe
1632	Client.exe
4140	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3116	PING.EXE
2904	PING.EXE
4868	PING.EXE
4024	PING.EXE
4280	PING.EXE
1704	PING.EXE
2540	PING.EXE
4904	PING.EXE
1100	PING.EXE
1704	PING.EXE
4748	PING.EXE
4504	PING.EXE
4524	PING.EXE
3028	PING.EXE

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
4868	PING.EXE
4024	PING.EXE
1704	PING.EXE
4504	PING.EXE
1704	PING.EXE
3028	PING.EXE
2904	PING.EXE
1100	PING.EXE
4748	PING.EXE
4280	PING.EXE
4524	PING.EXE
2540	PING.EXE
4904	PING.EXE
3116	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4268	schtasks.exe
540	schtasks.exe
1232	schtasks.exe
4448	schtasks.exe
980	schtasks.exe
3604	schtasks.exe
2532	schtasks.exe
2056	schtasks.exe
4080	schtasks.exe
640	schtasks.exe
744	schtasks.exe
1800	schtasks.exe
3752	schtasks.exe
3780	schtasks.exe
2496	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4496	avb.eu.exe
Token: SeDebugPrivilege	2060	Client.exe
Token: SeDebugPrivilege	3948	Client.exe
Token: SeDebugPrivilege	3688	Client.exe
Token: SeDebugPrivilege	3508	Client.exe
Token: SeDebugPrivilege	2404	Client.exe
Token: SeDebugPrivilege	4880	Client.exe
Token: SeDebugPrivilege	1152	Client.exe
Token: SeDebugPrivilege	4824	Client.exe
Token: SeDebugPrivilege	1488	Client.exe
Token: SeDebugPrivilege	1756	Client.exe
Token: SeDebugPrivilege	1412	Client.exe
Token: SeDebugPrivilege	4528	Client.exe
Token: SeDebugPrivilege	2528	Client.exe
Token: SeDebugPrivilege	1632	Client.exe
Token: SeDebugPrivilege	4140	Client.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
2060	Client.exe
3688	Client.exe
3508	Client.exe
2404	Client.exe
4880	Client.exe
1152	Client.exe
4824	Client.exe
1488	Client.exe
1756	Client.exe
1412	Client.exe
4528	Client.exe
2528	Client.exe
1632	Client.exe
4140	Client.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2060	Client.exe
3688	Client.exe
3508	Client.exe
2404	Client.exe
4880	Client.exe
1152	Client.exe
4824	Client.exe
1488	Client.exe
1756	Client.exe
1412	Client.exe
4528	Client.exe
2528	Client.exe
1632	Client.exe
4140	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 2532	4496	avb.eu.exe	88
PID 4496 wrote to memory of 2060	4496	avb.eu.exe	90
PID 2060 wrote to memory of 4268	2060	Client.exe	93
PID 2060 wrote to memory of 1936	2060	Client.exe	95
PID 1936 wrote to memory of 752	1936	cmd.exe	97
PID 1936 wrote to memory of 4904	1936	cmd.exe	98
PID 1936 wrote to memory of 3688	1936	cmd.exe	101
PID 3688 wrote to memory of 4448	3688	Client.exe	102
PID 3688 wrote to memory of 2420	3688	Client.exe	104
PID 2420 wrote to memory of 4376	2420	cmd.exe	106
PID 2420 wrote to memory of 3116	2420	cmd.exe	107
PID 2420 wrote to memory of 3508	2420	cmd.exe	108
PID 3508 wrote to memory of 540	3508	Client.exe	109
PID 3508 wrote to memory of 3952	3508	Client.exe	112
PID 3952 wrote to memory of 1916	3952	cmd.exe	114
PID 3952 wrote to memory of 2904	3952	cmd.exe	115
PID 3952 wrote to memory of 2404	3952	cmd.exe	123
PID 2404 wrote to memory of 640	2404	Client.exe	124
PID 2404 wrote to memory of 3376	2404	Client.exe	127
PID 3376 wrote to memory of 3892	3376	cmd.exe	129
PID 3376 wrote to memory of 1100	3376	cmd.exe	130
PID 3376 wrote to memory of 4880	3376	cmd.exe	133
PID 4880 wrote to memory of 980	4880	Client.exe	134
PID 4880 wrote to memory of 4940	4880	Client.exe	137
PID 4940 wrote to memory of 2328	4940	cmd.exe	139
PID 4940 wrote to memory of 4868	4940	cmd.exe	140
PID 4940 wrote to memory of 1152	4940	cmd.exe	141
PID 1152 wrote to memory of 3604	1152	Client.exe	142
PID 1152 wrote to memory of 1712	1152	Client.exe	145
PID 1712 wrote to memory of 4532	1712	cmd.exe	147
PID 1712 wrote to memory of 4024	1712	cmd.exe	148
PID 1712 wrote to memory of 4824	1712	cmd.exe	150
PID 4824 wrote to memory of 744	4824	Client.exe	151
PID 4824 wrote to memory of 1916	4824	Client.exe	154
PID 1916 wrote to memory of 2460	1916	cmd.exe	156
PID 1916 wrote to memory of 1704	1916	cmd.exe	157
PID 1916 wrote to memory of 1488	1916	cmd.exe	158
PID 1488 wrote to memory of 1232	1488	Client.exe	159
PID 1488 wrote to memory of 3084	1488	Client.exe	162
PID 3084 wrote to memory of 3536	3084	cmd.exe	164
PID 3084 wrote to memory of 4748	3084	cmd.exe	165
PID 3084 wrote to memory of 1756	3084	cmd.exe	167
PID 1756 wrote to memory of 2056	1756	Client.exe	168
PID 1756 wrote to memory of 3996	1756	Client.exe	171
PID 3996 wrote to memory of 3056	3996	cmd.exe	173
PID 3996 wrote to memory of 4280	3996	cmd.exe	174
PID 3996 wrote to memory of 1412	3996	cmd.exe	176
PID 1412 wrote to memory of 1800	1412	Client.exe	177
PID 1412 wrote to memory of 3796	1412	Client.exe	180
PID 3796 wrote to memory of 1012	3796	cmd.exe	182
PID 3796 wrote to memory of 4504	3796	cmd.exe	183
PID 3796 wrote to memory of 4528	3796	cmd.exe	185
PID 4528 wrote to memory of 4080	4528	Client.exe	186
PID 4528 wrote to memory of 944	4528	Client.exe	189
PID 944 wrote to memory of 2348	944	cmd.exe	191
PID 944 wrote to memory of 4524	944	cmd.exe	192
PID 944 wrote to memory of 2528	944	cmd.exe	195
PID 2528 wrote to memory of 3752	2528	Client.exe	196
PID 2528 wrote to memory of 1396	2528	Client.exe	199
PID 1396 wrote to memory of 936	1396	cmd.exe	201
PID 1396 wrote to memory of 1704	1396	cmd.exe	202
PID 1396 wrote to memory of 1632	1396	cmd.exe	203
PID 1632 wrote to memory of 3780	1632	Client.exe	204
PID 1632 wrote to memory of 4648	1632	Client.exe	207

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\avb.eu.exe
"C:\Users\Admin\AppData\Local\Temp\avb.eu.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2532
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qmr9Gk5LS80Q.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:752
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4904
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3688
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4448
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uymzesw1LpZH.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2420
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4376
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3116
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\OH4GbX2QIYDz.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1916
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2904
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:640
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nxKja2MXFFRU.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:3892
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1100
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3B3u6MYJcu2w.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:2328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4868
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3604
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nnYrWVdwSY71.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4532
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4024
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Acozmy5pqX7f.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:2460
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1704
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BNPKTGl3OnFD.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:3536
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4748
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2056
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vKkQr2fxOUTw.bat" "
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:3056
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4280
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1800
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QA4XULDw6V9y.bat" "
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1012
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4504
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4080
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FE5MMPpCbAhi.bat" "
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:2348
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4524
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3752
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jlHNKetQSgts.bat" "
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:936
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1704
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xPwylqULazRD.bat" "
        27⤵
        
        PID:4648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4916
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3028
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4140
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2496
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fc2LtgQJOMtt.bat" "
        29⤵
        
        PID:4408
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4596
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2540

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

3B3u6MYJcu2w.bat

Path C:\Users\Admin\AppData\Local\Temp\3B3u6MYJcu2w.bat
Size 207B
SHA256 ff5812de0cb9c8c76acd28bae48d58b1cb774f71834838c6485a388601002141
MD5 7a62a6d478ce817fdec38e37997e808c
SHA1 89be44430d29861d869a485fd2621047b3ebe8c4
SHA512 0633686a3ffefbd35e1cf1c548e20edf0c45ca317da3e2d3f7cf7c607af55d5b00f732043f610bdf688b3b226c23c4fa6f12230f7802fc0c9ffa9895dc2be4e1
TLSH
T15CD023512741CD5D450018471D65B788F0DB04AE1F0C7D7146068CDC038684C759B182
MD5 SHA1 SHA512 TLSH

Submit Download

Acozmy5pqX7f.bat

Path C:\Users\Admin\AppData\Local\Temp\Acozmy5pqX7f.bat
Size 207B
SHA256 58d41aa5b1003d30c8a8b7cc9c3886161636e8cddb65715cc07fac8604da36fa
MD5 0198cb2b3ade416badc6a015719a8d5e
SHA1 3c7637d1d82cc845b4e5a68c8ee9970f29ad64fb
SHA512 46e066fe5a8b44847cda4b0d2fabc561e2a932bc71a0a1ba9d31cb1d4b5876762afe53d7fa27469b15eb8b988d0d722a5ae63ca2f4804b335e34503ed8299280
TLSH
T150D023016340CD5D450018475EA5A3C8B0DE04A61F08BD624505C89C5387D8D755B141
MD5 SHA1 SHA512 TLSH

Submit Download

BNPKTGl3OnFD.bat

Path C:\Users\Admin\AppData\Local\Temp\BNPKTGl3OnFD.bat
Size 207B
SHA256 9c5b6e4c02c0e8755b56b0d128d7ed2e6b57c7bcbaf53d3f9bc79df4b7ab9ee8
MD5 ecc571b376ea1aeb33ffcf6f4f952dcf
SHA1 ad4148a9bea47a49be55fad17f88f234af2c0a2d
SHA512 8826f711c810787fd7f9233dffdf8d488b8241c0762733b4a97bf287632567d7169075ada5bc5ae30ec38d7cd5311f13ee5eaf40aa5b239731c8245d78eef210
TLSH
T14CD023012341CE9D4500594B5DE57388B0DE04E62F097E614501889C03C684DB55B141
MD5 SHA1 SHA512 TLSH

Submit Download

FE5MMPpCbAhi.bat

Path C:\Users\Admin\AppData\Local\Temp\FE5MMPpCbAhi.bat
Size 207B
SHA256 bae08ff958648b48d2ca8375ee14c7981dbaf9d4bf0e3ad8a6316ac9d714ad8e
MD5 d983725c1ae453a3bb1a2a7762872b1c
SHA1 a443f5023c73d2e0d3b3bb5f4602777ebda22dd9
SHA512 62c1cf4f6cf753afcb8b80946054c4f4eda797df4b0a31b083cfd1c5df80aeb49ef4b1f55bd8e4a0c651d49846dc95438843f9310a3d0c04b74e08d54873194e
TLSH
T1AED023012340CD5E450028475D75A28CB0AE04B61F48BD614515489C438694CF59B543
MD5 SHA1 SHA512 TLSH

Submit Download

OH4GbX2QIYDz.bat

Path C:\Users\Admin\AppData\Local\Temp\OH4GbX2QIYDz.bat
Size 207B
SHA256 5808cb56388561af76ffef8933d61999634ae995a3053150ebf18c52fe872508
MD5 07e0afbf799e3cc82dfe2c8f6e150be0
SHA1 c684828623414f504a7ca35f4011c21b2ff2d521
SHA512 568febc411ae7fee2f7d8bfaf35cde635aea36979880100bef9c6ec9b0bc9d8cbb377e78e4ca7616d91a8ed8333aded60619c544dd67c93a2ccf83588beaf916
TLSH
T1ECD023412344CDBE450018471F697688F0DF04E61F08BD6145114CDC438688C759B141
MD5 SHA1 SHA512 TLSH

Submit Download

QA4XULDw6V9y.bat

Path C:\Users\Admin\AppData\Local\Temp\QA4XULDw6V9y.bat
Size 207B
SHA256 afc735235badf27ada1b11074e1489345c490d77d2f127805a60db85af2b11a6
MD5 58dac8a583745b00164a22175a92e5c8
SHA1 a07842eb0c02b62238fc4b8373f23da4c2b0bf49
SHA512 ddee1a2183fc37701d2145e643628c225fb7ff28ea8b93cf9a212f57fd45bc986619748350fabb4c8e7ee36fb2e00ec1426fa34b1615575e111794876a8a929a
TLSH
T1A8D0230123C1CD5D450018475D6562C8F09E04A71F4D7D6246154CDD038684C755F181
MD5 SHA1 SHA512 TLSH

Submit Download

fc2LtgQJOMtt.bat

Path C:\Users\Admin\AppData\Local\Temp\fc2LtgQJOMtt.bat
Size 207B
SHA256 7ae2ac24e8af3ae424a406d52c79ed4a88ca1a4b8e502724521e462fb2d720fe
MD5 e810105f343743110486d4752691c684
SHA1 0a86babe23b9d0ea32fe7dd1f73a54dba0ac5f16
SHA512 abb3634ad119df59ecf39988092ba43202cba88dc2e606bffd17db8448e486afb9b78724f5d75d9ec628a3bc9e5aeb9bc331451156cf17bc997d91820d5c7f15
TLSH
T1AFD022013380CE9E454018475EA5B28CF0AE04AA2F08BDA386028CDC0386A9CB5AB282
MD5 SHA1 SHA512 TLSH

Submit Download

jlHNKetQSgts.bat

Path C:\Users\Admin\AppData\Local\Temp\jlHNKetQSgts.bat
Size 207B
SHA256 1a4a242ea35755e5c82e33abdc6052097e3cf14503935267640dcdef9ea203e1
MD5 7b6e5e0537d0e0e5f2b2c90b45ea28cc
SHA1 4ab43a5d7d0423efd21c7e11aaf8890d8919df0e
SHA512 f46f010df2d7f489c3237fa0887ca66b734573979cf069ccd69cf252af638ee3223dc0c4b45b2ef5aa92fd4ccc64d65c5101bbed52e2ed18824bb5d536cd983f
TLSH
T102D023413341CE5D550118476D65A2C8B0AA04EB1F0C7E6345018CDD438688C755B141
MD5 SHA1 SHA512 TLSH

Submit Download

nnYrWVdwSY71.bat

Path C:\Users\Admin\AppData\Local\Temp\nnYrWVdwSY71.bat
Size 207B
SHA256 d81cc3942226b3817fa96cc366d27edc351078165a1c0fb2fced0876da5b3ef2
MD5 ebc85947d2d1779a6a8a33f9b88b0075
SHA1 ebbaab4b4059ed9205d7c023fa282e4812067eac
SHA512 7df28e936d7b6275e8bdf333b91055fab09d021dc0ef93b86d905a5f31982033e0d700c32f3197cf79d4fc06a9b3b1448543528a0a89423e6c188edb0cf4ba9e
TLSH
T1EAD023116781CD5D450018475E767288B09E04A71F49BD71850148DC538688CB59B181
MD5 SHA1 SHA512 TLSH

Submit Download

nxKja2MXFFRU.bat

Path C:\Users\Admin\AppData\Local\Temp\nxKja2MXFFRU.bat
Size 207B
SHA256 b074ca5eeac68127e9d7482d97599ba7a8173919987ee838ad91b3059c9ff2c7
MD5 81946ce7759723ebc4f92be8557e9471
SHA1 b54a33044dfc96922609c9141c13ba9dc26f08e9
SHA512 c0a886a334d8ea2ac0b9ea95c27f56a945f497443af01ab46d5f06f6b136e6f54b8cf3e84dbcfdb61ad834fce85271e10e24a8416586a35d4afe87fc19d5096a
TLSH
T10ED023022781CE5D450158875E65E2C8B0EA04B71F487D614505489C138694C755F181
MD5 SHA1 SHA512 TLSH

Submit Download

qmr9Gk5LS80Q.bat

Path C:\Users\Admin\AppData\Local\Temp\qmr9Gk5LS80Q.bat
Size 207B
SHA256 a145292131ec239d55dbae246824a02fac7b097d0a3452ad1b4ab1df6837327f
MD5 316466e154d3797d94fa3a0bd693a10b
SHA1 404c35839a5d896d0a33dda51fc58f4b9dee5284
SHA512 76e6555349fe87e6828fc0182a7691b4728e6f40e4d312af04daaa946072e634827bb7a0896482cc40285daf82767084dd0e2975681acd0d7c358be4f85b8026
TLSH
T163D023012341CD5D450018475E6562C8F09A04FA2F09FD714506489D5386C4C75DF141
MD5 SHA1 SHA512 TLSH

Submit Download

uymzesw1LpZH.bat

Path C:\Users\Admin\AppData\Local\Temp\uymzesw1LpZH.bat
Size 207B
SHA256 29c6ec94aada0fc64a84e51a9cdd24c1babf9660ebbaa56ec5287ccf8e50ad45
MD5 dcc0797bd58b5835362605e9fd7a635c
SHA1 3053c2e6e93ae13463e72af2fdddf16c340fd75c
SHA512 63d44d1089f49c31456c283299345c824cd5268a3944735fc5e37dc37e85ca2cf1e755870d7be773db727ecd982a197c2efe42c94c768aeb8007521b0dec7be4
TLSH
T183D022412390CEAF49001C471EA6B288F0EF04BA2F48BEA2861988DC0387C8CB5DB182
MD5 SHA1 SHA512 TLSH

Submit Download

vKkQr2fxOUTw.bat

Path C:\Users\Admin\AppData\Local\Temp\vKkQr2fxOUTw.bat
Size 207B
SHA256 17a588d661ecb80e80b0ec0fc06e982543704325108e34580d7af863f33662c1
MD5 1e4b19b715bb8613356eb42e0e10164d
SHA1 64c4fd12963aa931cbfcadfd4c9bf0264cd15bf5
SHA512 b6f22999fab922547d6746572f6d60771880e046fbec9744d31ae12f39bea26edf9270a69a9158bccb6ecf2ff51e9760215d483f3b35e2e41b55a039556faec8
TLSH
T198D023012340CD5E45011C471DA562CCF0BA04BA2F0D7D614501489C0387C5C795F182
MD5 SHA1 SHA512 TLSH

Submit Download

xPwylqULazRD.bat

Path C:\Users\Admin\AppData\Local\Temp\xPwylqULazRD.bat
Size 207B
SHA256 4f0dd44a2b419d2dcb5788718ee348676b84dbb8231f01847f4585183d31d35a
MD5 1b82f3aa4ae0d5df2e81dae3f446f1c7
SHA1 7e998329c222e04fa9baf22969da051da401f03b
SHA512 bf4d1494aa78ab1357cbf97943d93a3f8d9a659ca3eab19002b3db86bf541ba6aeed8b901ac9e377748e90f6d61b5a8e71886e3e903c2c13acbfb43f6407a885
TLSH
T123D022013381CE9E45005C871EA9A288F0EE04AA2F4CBDA286018C9C538B98CB5AB582
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 f7ebddff5d7ebd52d585ea20d025fb79aee34ef3985cbd29c505edaf29b36c0b
MD5 87466448bd027d73314293d7312bf5a9
SHA1 f3841fdd32f0191d6959fb6ee7eae1b69e12afec
SHA512 839c3915275d698f27e7e5ff76a264c25a463fb86be9673851fa95459156cfb75209e1d761d40d88ad80554ea556dc38cdb2b5562b4d2a05bb5235e3bcd4a178
SSDEEP 49152:Hv/e821/aQWl8P0lSk3aKA3Z+nBSU3rarJLoGdttpTHHB72eh2NT:Hv2821/aQWl8P0lSk3DA3Z+nH3e
TLSH
T123E54A1437F85E23E1ABE373D5B0041367F1F82AB3A3EB0B6191677A5C53B5049826A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2060-12-0x000000001CB90000-0x000000001CC42000-memory.dmp

Download

memory/2060-11-0x000000001CA80000-0x000000001CAD0000-memory.dmp

Download

memory/2060-8-0x000000001B970000-0x000000001B980000-memory.dmp

Download

memory/4496-0-0x0000000000950000-0x0000000000C74000-memory.dmp

Download

memory/4496-1-0x000000001B9F0000-0x000000001BA00000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads