quasar | f7ebddff5d7ebd52d585ea20d025fb79aee34ef3985cbd29c505edaf29b36c0b

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
avb.eu.exe
Size 3.1MB
Sample260518-eckw1sfx4y
SHA256 f7ebddff5d7ebd52d585ea20d025fb79aee34ef3985cbd29c505edaf29b36c0b
MD5 87466448bd027d73314293d7312bf5a9
SHA1 f3841fdd32f0191d6959fb6ee7eae1b69e12afec
SHA512 839c3915275d698f27e7e5ff76a264c25a463fb86be9673851fa95459156cfb75209e1d761d40d88ad80554ea556dc38cdb2b5562b4d2a05bb5235e3bcd4a178
SSDEEP 49152:Hv/e821/aQWl8P0lSk3aKA3Z+nBSU3rarJLoGdttpTHHB72eh2NT:Hv2821/aQWl8P0lSk3DA3Z+nH3e
TLSH
T123E54A1437F85E23E1ABE373D5B0041367F1F82AB3A3EB0B6191677A5C53B5049826A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

avb.eu.com:443
www.avb.eu.com:443
avb.eu.com:80
www.avb.eu.com:80

Mutex

f86288cf-f9a7-4ee9-b664-decdbd168297

Attributes

encryption_key
ED3227F773701D05083B11A65776F95F93EEEF5E
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/552-0-0x0000000000CC0000-0x0000000000FE4000-memory.dmp	family_quasar
behavioral2/files/0x001a00000002b4cb-7.dat	family_quasar

Executes dropped EXE 16 IoCs

pid	Process
2400	Client.exe
3236	Client.exe
2144	Client.exe
4112	Client.exe
1468	Client.exe
980	Client.exe
2284	Client.exe
4476	Client.exe
1836	Client.exe
4140	Client.exe
3008	Client.exe
780	Client.exe
4832	Client.exe
4956	Client.exe
3632	Client.exe
3408	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1948	PING.EXE
2288	PING.EXE
888	PING.EXE
4944	PING.EXE
1136	PING.EXE
4340	PING.EXE
4768	PING.EXE
2772	PING.EXE
1064	PING.EXE
4016	PING.EXE
4856	PING.EXE
3668	PING.EXE
2976	PING.EXE
2172	PING.EXE
3132	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
1136	PING.EXE
2772	PING.EXE
4016	PING.EXE
4856	PING.EXE
2172	PING.EXE
4944	PING.EXE
1064	PING.EXE
1948	PING.EXE
2976	PING.EXE
4768	PING.EXE
3668	PING.EXE
2288	PING.EXE
888	PING.EXE
4340	PING.EXE
3132	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2252	schtasks.exe
4768	schtasks.exe
408	schtasks.exe
1744	schtasks.exe
1608	schtasks.exe
3912	schtasks.exe
1628	schtasks.exe
3632	schtasks.exe
3336	schtasks.exe
2396	schtasks.exe
1860	schtasks.exe
2396	schtasks.exe
3700	schtasks.exe
488	schtasks.exe
3684	schtasks.exe
1300	schtasks.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	avb.eu.exe
Token: SeDebugPrivilege	2400	Client.exe
Token: SeDebugPrivilege	3236	Client.exe
Token: SeDebugPrivilege	2144	Client.exe
Token: SeDebugPrivilege	4112	Client.exe
Token: SeDebugPrivilege	1468	Client.exe
Token: SeDebugPrivilege	980	Client.exe
Token: SeDebugPrivilege	2284	Client.exe
Token: SeDebugPrivilege	4476	Client.exe
Token: SeDebugPrivilege	1836	Client.exe
Token: SeDebugPrivilege	4140	Client.exe
Token: SeDebugPrivilege	3008	Client.exe
Token: SeDebugPrivilege	780	Client.exe
Token: SeDebugPrivilege	4832	Client.exe
Token: SeDebugPrivilege	4956	Client.exe
Token: SeDebugPrivilege	3632	Client.exe
Token: SeDebugPrivilege	3408	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2400	Client.exe
2144	Client.exe
4112	Client.exe
1468	Client.exe
980	Client.exe
2284	Client.exe
4476	Client.exe
1836	Client.exe
4140	Client.exe
3008	Client.exe
780	Client.exe
4832	Client.exe
4956	Client.exe
3632	Client.exe
3408	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
2400	Client.exe
2144	Client.exe
4112	Client.exe
1468	Client.exe
980	Client.exe
2284	Client.exe
4476	Client.exe
1836	Client.exe
4140	Client.exe
3008	Client.exe
780	Client.exe
4832	Client.exe
4956	Client.exe
3632	Client.exe
3408	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3912	552	avb.eu.exe	80
PID 552 wrote to memory of 2400	552	avb.eu.exe	83
PID 2400 wrote to memory of 1860	2400	Client.exe	85
PID 2400 wrote to memory of 1148	2400	Client.exe	87
PID 1148 wrote to memory of 3652	1148	cmd.exe	89
PID 1148 wrote to memory of 4944	1148	cmd.exe	90
PID 1148 wrote to memory of 2144	1148	cmd.exe	91
PID 2144 wrote to memory of 2252	2144	Client.exe	92
PID 2144 wrote to memory of 2192	2144	Client.exe	94
PID 2192 wrote to memory of 564	2192	cmd.exe	96
PID 2192 wrote to memory of 1136	2192	cmd.exe	97
PID 2192 wrote to memory of 4112	2192	cmd.exe	98
PID 4112 wrote to memory of 1300	4112	Client.exe	99
PID 4112 wrote to memory of 568	4112	Client.exe	101
PID 568 wrote to memory of 4384	568	cmd.exe	103
PID 568 wrote to memory of 2772	568	cmd.exe	104
PID 568 wrote to memory of 1468	568	cmd.exe	105
PID 1468 wrote to memory of 1628	1468	Client.exe	106
PID 1468 wrote to memory of 1872	1468	Client.exe	108
PID 1872 wrote to memory of 1644	1872	cmd.exe	110
PID 1872 wrote to memory of 1064	1872	cmd.exe	111
PID 1872 wrote to memory of 980	1872	cmd.exe	112
PID 980 wrote to memory of 2396	980	Client.exe	113
PID 980 wrote to memory of 4868	980	Client.exe	115
PID 4868 wrote to memory of 4804	4868	cmd.exe	117
PID 4868 wrote to memory of 4016	4868	cmd.exe	118
PID 4868 wrote to memory of 2284	4868	cmd.exe	119
PID 2284 wrote to memory of 3632	2284	Client.exe	120
PID 2284 wrote to memory of 1720	2284	Client.exe	122
PID 1720 wrote to memory of 2108	1720	cmd.exe	124
PID 1720 wrote to memory of 4856	1720	cmd.exe	125
PID 1720 wrote to memory of 4476	1720	cmd.exe	126
PID 4476 wrote to memory of 3700	4476	Client.exe	127
PID 4476 wrote to memory of 1596	4476	Client.exe	129
PID 1596 wrote to memory of 4988	1596	cmd.exe	131
PID 1596 wrote to memory of 3668	1596	cmd.exe	132
PID 1596 wrote to memory of 1836	1596	cmd.exe	133
PID 1836 wrote to memory of 4768	1836	Client.exe	134
PID 1836 wrote to memory of 3876	1836	Client.exe	136
PID 3876 wrote to memory of 1176	3876	cmd.exe	138
PID 3876 wrote to memory of 1948	3876	cmd.exe	139
PID 3876 wrote to memory of 4140	3876	cmd.exe	140
PID 4140 wrote to memory of 408	4140	Client.exe	141
PID 4140 wrote to memory of 2592	4140	Client.exe	143
PID 2592 wrote to memory of 4976	2592	cmd.exe	145
PID 2592 wrote to memory of 2288	2592	cmd.exe	146
PID 2592 wrote to memory of 3008	2592	cmd.exe	147
PID 3008 wrote to memory of 3336	3008	Client.exe	148
PID 3008 wrote to memory of 2764	3008	Client.exe	150
PID 2764 wrote to memory of 4380	2764	cmd.exe	152
PID 2764 wrote to memory of 888	2764	cmd.exe	153
PID 2764 wrote to memory of 780	2764	cmd.exe	154
PID 780 wrote to memory of 1744	780	Client.exe	155
PID 780 wrote to memory of 1448	780	Client.exe	157
PID 1448 wrote to memory of 1668	1448	cmd.exe	159
PID 1448 wrote to memory of 2976	1448	cmd.exe	160
PID 1448 wrote to memory of 4832	1448	cmd.exe	161
PID 4832 wrote to memory of 488	4832	Client.exe	162
PID 4832 wrote to memory of 4580	4832	Client.exe	164
PID 4580 wrote to memory of 1224	4580	cmd.exe	166
PID 4580 wrote to memory of 4340	4580	cmd.exe	167
PID 4580 wrote to memory of 4956	4580	cmd.exe	168
PID 4956 wrote to memory of 2396	4956	Client.exe	169
PID 4956 wrote to memory of 1536	4956	Client.exe	171

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\avb.eu.exe
"C:\Users\Admin\AppData\Local\Temp\avb.eu.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3912
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\clgz4tqwIg7a.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3652
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4944
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Fi36TdR40mio.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:564
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1136
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1300
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nikCWd2ToPMS.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4384
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2772
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1628
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NAAS1TrKkeoc.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1644
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1064
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1VNUd1UMRdGq.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:4868
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4016
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3632
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LRKVAmt7p4oT.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2108
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4856
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3700
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SbkdLKr2k4yk.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4988
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3668
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Lcxb3FdcPkNV.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1176
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1948
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:408
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qIYa8gd9l1DC.bat" "
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4976
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2288
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QgMGwXr3BLkF.bat" "
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2764
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:4380
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:888
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:780
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yt8cTlS369n3.bat" "
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1668
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2976
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zOU6zbYUqmuv.bat" "
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:1224
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4340
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2396
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LxIUOC1WLMVK.bat" "
        27⤵
        
        PID:1536
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:1896
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2172
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3632
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ulK6qOaGtrYu.bat" "
        29⤵
        
        PID:2368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:2000
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3132
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3408
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3684
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yr2tFqUnQsQo.bat" "
        31⤵
        
        PID:3456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:4440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4768

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

1VNUd1UMRdGq.bat

Path C:\Users\Admin\AppData\Local\Temp\1VNUd1UMRdGq.bat
Size 207B
SHA256 2d4d056617b149a1db074fe1b13afe577317f439ff8753194fd307c01a2b6a39
MD5 6f9cb903ce3c34a8b9b3fde7653ecafe
SHA1 5565ec9eb1947d9a86db2dbc68bb7479efb7c083
SHA512 1685af1695b7048ac746d7ccbb6311438b22b66f21a60193ad012fddc94b9c4b9bbde2c36edc0930f6df2c37258bc23b5ddd955f74ceca6dc8cf3685083d253b
TLSH
T164D023512380CE5E450058472D65668CB0AB44E62F0C7D714511CC9C1386C4C759B182
MD5 SHA1 SHA512 TLSH

Submit Download

Fi36TdR40mio.bat

Path C:\Users\Admin\AppData\Local\Temp\Fi36TdR40mio.bat
Size 207B
SHA256 2d0f00d9dfa2bc60a743b4839fc46da1ce8c23e38cd4f39fb7cd00d04eedeb38
MD5 9c1e62f2a6dffec9ce7715429577b9a3
SHA1 775f5be960a21967cca7245d2fa4967edba5af88
SHA512 3608ab1a447fbf80dd9130b2bb1399ba71096936091cd5eee3b01ff680149b4f0b48479c1c5e4c21646647fa4b9614b3cef00edc5f5898a3f89d929bd9b90070
TLSH
T154D023112350CDDD850018471D75A6CCF09A04A61F4CBD618605889C03C6D5CB99B181
MD5 SHA1 SHA512 TLSH

Submit Download

LRKVAmt7p4oT.bat

Path C:\Users\Admin\AppData\Local\Temp\LRKVAmt7p4oT.bat
Size 207B
SHA256 1bfaa18181294b1202cd0c7ddfd30dec458381f83f1577950f27248fb1a4fb09
MD5 1fdfc12ade7cb7d62cfefb3e7195d7c1
SHA1 013b4bcfc6e80464b7215376252af39e5e109d7a
SHA512 f677038f72bfa321df9967f2c0293e89b9595f455f92be3902d9798eda85c897fd604a8b0573384d4442824f92ed8df42d19114c6439d43907485d4b44eb2155
TLSH
T144D023412380CF5D45101C471E65A2CCB0DA04E62F48BD6145014C9C43C688C75BB141
MD5 SHA1 SHA512 TLSH

Submit Download

Lcxb3FdcPkNV.bat

Path C:\Users\Admin\AppData\Local\Temp\Lcxb3FdcPkNV.bat
Size 207B
SHA256 ca8735c8702922f91e9063a784b84a6187fbf8a246f466179097fc0c49317881
MD5 c1847703c6f4ffd891a2982db5400826
SHA1 1cc90575a824bdb1fcdb55da365925668a3816d0
SHA512 c3bbe3a1e1599861d21fe51af5ec297547dc7fff30b5d4a7be0f5cccd76cf963902b05986b908b3524d9dad3784e3cbaba8e6139aaa371fd7c138126b7bed51c
TLSH
T171D023112381CD5D550018471D656789F0EA04EA1F087D6147114C9C038BC9C755B1C1
MD5 SHA1 SHA512 TLSH

Submit Download

LxIUOC1WLMVK.bat

Path C:\Users\Admin\AppData\Local\Temp\LxIUOC1WLMVK.bat
Size 207B
SHA256 cc2ec6ad5ec25f7b6c37352a545de6ad2bd2b339232b0216912d07be50b24906
MD5 cbbe95bf957d2dd89cff553616e5b96a
SHA1 e189b4d7db3f97bde7cddb4bffc54a90fc16da82
SHA512 c9c70f15e2973ca282a9f3cfd6ef582ce8fb34d03b39b88f575f3f96a88637457e5ea14dcfec6310281637fa980e454d9fdda17ed836e6c19e9e61c3bedac4d5
TLSH
T177D023012790CD5D45001C471E65A78CF1BB04E61F087D71490348DC03C6C4CB59B141
MD5 SHA1 SHA512 TLSH

Submit Download

NAAS1TrKkeoc.bat

Path C:\Users\Admin\AppData\Local\Temp\NAAS1TrKkeoc.bat
Size 207B
SHA256 8d8bb4e4c77f6e4dee6e6a3cc76da6ccabd472708ca0c67fa19fb87dfa392732
MD5 ffe3510a6288e9aee3b07f2ec6ad35f3
SHA1 41d24289dddba362d08cadb50b9d6586474bae79
SHA512 97696aebe6e084de8fb68049d7dae405f56b45785a6cf4bc14c0af7ff055580d51ec6337091244308bd48103d37a9440cad826fc44d4c5da5d2b8b589f067dac
TLSH
T1F6D023012780CDDD550418471E656288F0DE14A61F087D7146058CDC438684C755B141
MD5 SHA1 SHA512 TLSH

Submit Download

QgMGwXr3BLkF.bat

Path C:\Users\Admin\AppData\Local\Temp\QgMGwXr3BLkF.bat
Size 207B
SHA256 0d5a411190fa307455eae39eb29590b0116dd27a5f02156179a59c01f057dab2
MD5 69c458fea4c4ddd0fd38d9c8e6b34584
SHA1 76ad063ff582b2564d45faff2d423117f02cdfbf
SHA512 2269f726479d64356ffda6635872a3607afb6a20308e26e6562aaa26c358817750c2dfda8462daa78d7637af6b52dd232450637a8b1055433857b73f4a01ca20
TLSH
T19FD023512345CD9D45001C471E69668CB09E08AB2F0DBD61851148DC03C7C8CB59F142
MD5 SHA1 SHA512 TLSH

Submit Download

SbkdLKr2k4yk.bat

Path C:\Users\Admin\AppData\Local\Temp\SbkdLKr2k4yk.bat
Size 207B
SHA256 cd1e61c7b906adc759ac63878a3228ee99f6fb923f0dffedb7fd11567fd8e762
MD5 6298465a93495d09b2ea24f0da1df155
SHA1 af103a2976af63bcdbec010d608cd4268e8fc1b6
SHA512 1f77ba5b2f906bf80f7bd77e9b09ef82281636f24e85a0018207151130a544951adc3ecb6fabdad4af46e386c06a51e0dec9fa67100c26b6218e369a4ea2b3b9
TLSH
T137D023012340CD5D55011C875D6D63CCB0AA04AB2F08BDA2460148DC038785C759B542
MD5 SHA1 SHA512 TLSH

Submit Download

clgz4tqwIg7a.bat

Path C:\Users\Admin\AppData\Local\Temp\clgz4tqwIg7a.bat
Size 207B
SHA256 fc16c5adc8022d3f3b2eecb39c57f226fcd52188286daebbd45281f729501a7a
MD5 dcbffe66c4fea7bdc0f51f6f3887fa70
SHA1 b50b5043c5bfc3f7641c92b55b390a2abc09543e
SHA512 dcdd87da47942f590d0be1c989e7f7de4fbfcd76092032630c4219a09a5aafb72e28159deef1a958a202751a88f22e51e06d907b40076d2af8d8a99ed05e2102
TLSH
T158D023017341CD5E450058475D6D7388B0AE44B61F4C7D6145154C9C5386C4C759F541
MD5 SHA1 SHA512 TLSH

Submit Download

nikCWd2ToPMS.bat

Path C:\Users\Admin\AppData\Local\Temp\nikCWd2ToPMS.bat
Size 207B
SHA256 524c648c8f38764af51f7630e6dd6a17d3a03ac9d342e7f6d4a452770b009536
MD5 4f8e93fbe788432a749787a1ada3fb4f
SHA1 2cf2481b39dc5790e81fa124bf71518ad6b31e82
SHA512 2402d4816570e6d036f39625f3bd7c8d5b0381d312506f6aa64cf1b52e01e337dd0e62ab72d313234f87bc8cc951bfd8ca3cc93df35b6e08639ce25832e489b1
TLSH
T1D4D0220133C1CE9E45012C8B1EA6A68CB0AA04EA2F08BEB286018C9C03C6C8CB59F182
MD5 SHA1 SHA512 TLSH

Submit Download

qIYa8gd9l1DC.bat

Path C:\Users\Admin\AppData\Local\Temp\qIYa8gd9l1DC.bat
Size 207B
SHA256 87f46f7428d8c70a99875239ce7e2f34d5810868032017111f2c3ab4275465aa
MD5 91130a2410f419a6d3311e5eef5c87f3
SHA1 26e2a0ed7309b8e322919010e3ac7a789265cdac
SHA512 b0fdcff3550cbcae66dcc5837b7ee9bca92d3c03e392ecd7a25e0c2ef03239219242f4d2ee57c688b6d68159c828efdf46462455f394e545e7435ee2fb8d92af
TLSH
T13ED023012740CD5D450018471D6573CCB0DA04AB1F4CFDB1450188DC0386C4CB55B141
MD5 SHA1 SHA512 TLSH

Submit Download

ulK6qOaGtrYu.bat

Path C:\Users\Admin\AppData\Local\Temp\ulK6qOaGtrYu.bat
Size 207B
SHA256 f3473196f581c87a74b8d1624aeb82ccb782556e20a0237b995b9556cbce49c2
MD5 58b8414e3dd7288f3c35092c1673311e
SHA1 5ff99c1d73f792d5fdbf0bbc534cbf123de28814
SHA512 a4072afbff3c3d9f5e090f03366a3c4d184c69610eba98ad7c495ae97e44ace622b178982f6566e9cdeb4150d6f9f676f1e2101ea7b5d06b03e3f250d51f2111
TLSH
T19FD022412780CEAE850018471EA9B28CF0EA04EB2F09FEA28A058CDC0386C9CB59B182
MD5 SHA1 SHA512 TLSH

Submit Download

yr2tFqUnQsQo.bat

Path C:\Users\Admin\AppData\Local\Temp\yr2tFqUnQsQo.bat
Size 207B
SHA256 a05a955eafa36fa577cb66407849f5d90697c83f4c2c1bfa0492080114f6dbdd
MD5 a9db9f7d0ab482f813a153aeba35ac43
SHA1 7f01a1f3396c1d0120429337c6ba9c28b64ac60d
SHA512 f09ac864b714c17d8ee0e813cb4ee503876a59c7b8c8ac40493f0be3f8e5b2a471b85f979ea570f0c2998d60f7898bc47a609ab909e8b83778c911d6fc88356f
TLSH
T155D022012380CF9E4500B8471EA5B38CB0AE08BA2F08BDA28601889C13CBC8CB5AF582
MD5 SHA1 SHA512 TLSH

Submit Download

yt8cTlS369n3.bat

Path C:\Users\Admin\AppData\Local\Temp\yt8cTlS369n3.bat
Size 207B
SHA256 3f4ce4f17dcbca1780f586f11addf1c98f4189a63dbc38712d60ee532ae06102
MD5 53eaa33dfaf642640fa4defed6e6946e
SHA1 da9a65fd4a752e086c5d312b235c05ba78eb66da
SHA512 89cc707a45bc5ac11f7c97fb441d6fd99fe65beeaae5248c0f05f47072f783d0ffc277988b4646319b0b07f08861bba6561fab9b604ed56b6173c9f1a5900bde
TLSH
T15FD023012750CD9D4500D8471D7962C8B0BA04F71F4C7DE14601489C038685CB55F182
MD5 SHA1 SHA512 TLSH

Submit Download

zOU6zbYUqmuv.bat

Path C:\Users\Admin\AppData\Local\Temp\zOU6zbYUqmuv.bat
Size 207B
SHA256 6773a9893a858d727c9c00f49ee1946402297f090b701253969a05b88289b8ba
MD5 5bd1b6fdf56aaaf51f59f9a356acc20d
SHA1 f009c64c8bf59114277644faf52bad44562a1f5f
SHA512 ef54551c1281c3e4127e14490c4609488b6be12e1b9e4382beb667ed3910eef3b558c965124f6016b5c704f5f9794db8fd879cc0f2352fdc68180a9818260b34
TLSH
T162D022012381CEAF4500188B5EE5A68CB0EA04AA2F08BDB286018C9C17C6CCCB59B582
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 f7ebddff5d7ebd52d585ea20d025fb79aee34ef3985cbd29c505edaf29b36c0b
MD5 87466448bd027d73314293d7312bf5a9
SHA1 f3841fdd32f0191d6959fb6ee7eae1b69e12afec
SHA512 839c3915275d698f27e7e5ff76a264c25a463fb86be9673851fa95459156cfb75209e1d761d40d88ad80554ea556dc38cdb2b5562b4d2a05bb5235e3bcd4a178
SSDEEP 49152:Hv/e821/aQWl8P0lSk3aKA3Z+nBSU3rarJLoGdttpTHHB72eh2NT:Hv2821/aQWl8P0lSk3DA3Z+nH3e
TLSH
T123E54A1437F85E23E1ABE373D5B0041367F1F82AB3A3EB0B6191677A5C53B5049826A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-0-0x0000000000CC0000-0x0000000000FE4000-memory.dmp

Download

memory/552-1-0x000000001D540000-0x000000001D550000-memory.dmp

Download

memory/2400-12-0x000000001D6B0000-0x000000001D762000-memory.dmp

Download

memory/2400-11-0x000000001D5A0000-0x000000001D5F0000-memory.dmp

Download

memory/2400-9-0x000000001C9B0000-0x000000001C9C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads