quasar | fed9b42a45423980e39b04dfb9f8c287c70e0bd333acc143a95a5afda68b00a4

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 14:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample260519-rpkg8sey2x
SHA256 fed9b42a45423980e39b04dfb9f8c287c70e0bd333acc143a95a5afda68b00a4
MD5 eeacdce7aa28e40bd8aac81ffee30108
SHA1 a135747b45fbf47f29b6cb9a8babf3b06207ab60
SHA512 b8d2020f65ed3352ca7107f1cd8eb54aa4ab97650fba414a9d5207f4bbdf829e6ee837356128957d5263f42fc411cfdd3b066f3da54012b29de87dbca2866509
SSDEEP 49152:Tv/e821/aQWl8P0lSk3aKA3Z+n+xrEDkck/JxToGdATHHB72eh2NT:Tv2821/aQWl8P0lSk3DA3Z+n+xBl
TLSH
T1ADE55B143BF85E23E1BBE673D5B0041667F0EC2AB3A3EB1B1191677E1C53B5058426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

avb.eu.com:443
www.avb.eu.com:443
avb.eu.com:80
www.avb.eu.com:80

Mutex

b7e2d3ca-1d68-4d1a-8a20-1174bcecff13

Attributes

encryption_key
ED3227F773701D05083B11A65776F95F93EEEF5E
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2360-0-0x0000000000D20000-0x0000000001044000-memory.dmp	family_quasar
behavioral2/files/0x001a00000002b68d-5.dat	family_quasar

Executes dropped EXE 16 IoCs

pid	Process
5232	Client.exe
5260	Client.exe
432	Client.exe
3716	Client.exe
4928	Client.exe
2164	Client.exe
968	Client.exe
1732	Client.exe
5476	Client.exe
236	Client.exe
5628	Client.exe
4164	Client.exe
4332	Client.exe
6072	Client.exe
4000	Client.exe
2088	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 15 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5932	PING.EXE
6104	PING.EXE
3272	PING.EXE
5664	PING.EXE
1408	PING.EXE
3104	PING.EXE
5692	PING.EXE
2496	PING.EXE
2588	PING.EXE
5268	PING.EXE
3776	PING.EXE
1172	PING.EXE
3024	PING.EXE
2024	PING.EXE
272	PING.EXE

Runs ping.exe 1 TTPs 15 IoCs

Remote System Discovery

T1018

pid	Process
1172	PING.EXE
3272	PING.EXE
5692	PING.EXE
3104	PING.EXE
3024	PING.EXE
272	PING.EXE
5932	PING.EXE
5268	PING.EXE
5664	PING.EXE
2024	PING.EXE
3776	PING.EXE
2588	PING.EXE
6104	PING.EXE
1408	PING.EXE
2496	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3584	schtasks.exe
5860	schtasks.exe
3144	schtasks.exe
1012	schtasks.exe
1048	schtasks.exe
5092	schtasks.exe
3956	schtasks.exe
1488	schtasks.exe
3476	schtasks.exe
3780	schtasks.exe
1784	schtasks.exe
1052	schtasks.exe
2504	schtasks.exe
5964	schtasks.exe
5036	schtasks.exe
4944	schtasks.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	Client-built.exe
Token: SeDebugPrivilege	5232	Client.exe
Token: SeDebugPrivilege	5260	Client.exe
Token: SeDebugPrivilege	432	Client.exe
Token: SeDebugPrivilege	3716	Client.exe
Token: SeDebugPrivilege	4928	Client.exe
Token: SeDebugPrivilege	2164	Client.exe
Token: SeDebugPrivilege	968	Client.exe
Token: SeDebugPrivilege	1732	Client.exe
Token: SeDebugPrivilege	5476	Client.exe
Token: SeDebugPrivilege	236	Client.exe
Token: SeDebugPrivilege	5628	Client.exe
Token: SeDebugPrivilege	4164	Client.exe
Token: SeDebugPrivilege	4332	Client.exe
Token: SeDebugPrivilege	6072	Client.exe
Token: SeDebugPrivilege	4000	Client.exe
Token: SeDebugPrivilege	2088	Client.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
5232	Client.exe
432	Client.exe
3716	Client.exe
4928	Client.exe
2164	Client.exe
968	Client.exe
1732	Client.exe
5476	Client.exe
236	Client.exe
5628	Client.exe
4164	Client.exe
4332	Client.exe
6072	Client.exe
4000	Client.exe
2088	Client.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
5232	Client.exe
432	Client.exe
3716	Client.exe
4928	Client.exe
2164	Client.exe
968	Client.exe
1732	Client.exe
5476	Client.exe
236	Client.exe
5628	Client.exe
4164	Client.exe
4332	Client.exe
6072	Client.exe
4000	Client.exe
2088	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 5092	2360	Client-built.exe	79
PID 2360 wrote to memory of 5232	2360	Client-built.exe	81
PID 5232 wrote to memory of 3780	5232	Client.exe	84
PID 5232 wrote to memory of 5204	5232	Client.exe	86
PID 5204 wrote to memory of 3124	5204	cmd.exe	88
PID 5204 wrote to memory of 1172	5204	cmd.exe	89
PID 5204 wrote to memory of 432	5204	cmd.exe	90
PID 432 wrote to memory of 1784	432	Client.exe	91
PID 432 wrote to memory of 2352	432	Client.exe	93
PID 2352 wrote to memory of 2084	2352	cmd.exe	95
PID 2352 wrote to memory of 6104	2352	cmd.exe	96
PID 2352 wrote to memory of 3716	2352	cmd.exe	97
PID 3716 wrote to memory of 3956	3716	Client.exe	98
PID 3716 wrote to memory of 4648	3716	Client.exe	100
PID 4648 wrote to memory of 3748	4648	cmd.exe	102
PID 4648 wrote to memory of 3272	4648	cmd.exe	103
PID 4648 wrote to memory of 4928	4648	cmd.exe	104
PID 4928 wrote to memory of 5964	4928	Client.exe	105
PID 4928 wrote to memory of 1564	4928	Client.exe	107
PID 1564 wrote to memory of 1748	1564	cmd.exe	109
PID 1564 wrote to memory of 5664	1564	cmd.exe	110
PID 1564 wrote to memory of 2164	1564	cmd.exe	111
PID 2164 wrote to memory of 1052	2164	Client.exe	112
PID 2164 wrote to memory of 2340	2164	Client.exe	114
PID 2340 wrote to memory of 4832	2340	cmd.exe	116
PID 2340 wrote to memory of 3024	2340	cmd.exe	117
PID 2340 wrote to memory of 968	2340	cmd.exe	118
PID 968 wrote to memory of 3584	968	Client.exe	119
PID 968 wrote to memory of 3168	968	Client.exe	121
PID 3168 wrote to memory of 2924	3168	cmd.exe	123
PID 3168 wrote to memory of 2024	3168	cmd.exe	124
PID 3168 wrote to memory of 1732	3168	cmd.exe	125
PID 1732 wrote to memory of 5860	1732	Client.exe	126
PID 1732 wrote to memory of 5796	1732	Client.exe	128
PID 5796 wrote to memory of 5376	5796	cmd.exe	130
PID 5796 wrote to memory of 5692	5796	cmd.exe	131
PID 5796 wrote to memory of 5476	5796	cmd.exe	132
PID 5476 wrote to memory of 5036	5476	Client.exe	133
PID 5476 wrote to memory of 4792	5476	Client.exe	135
PID 4792 wrote to memory of 4528	4792	cmd.exe	137
PID 4792 wrote to memory of 272	4792	cmd.exe	138
PID 4792 wrote to memory of 236	4792	cmd.exe	139
PID 236 wrote to memory of 4944	236	Client.exe	140
PID 236 wrote to memory of 3288	236	Client.exe	142
PID 3288 wrote to memory of 4180	3288	cmd.exe	144
PID 3288 wrote to memory of 1408	3288	cmd.exe	145
PID 3288 wrote to memory of 5628	3288	cmd.exe	146
PID 5628 wrote to memory of 2504	5628	Client.exe	147
PID 5628 wrote to memory of 2112	5628	Client.exe	149
PID 2112 wrote to memory of 5788	2112	cmd.exe	151
PID 2112 wrote to memory of 3776	2112	cmd.exe	152
PID 2112 wrote to memory of 4164	2112	cmd.exe	153
PID 4164 wrote to memory of 3144	4164	Client.exe	154
PID 4164 wrote to memory of 5116	4164	Client.exe	156
PID 5116 wrote to memory of 3624	5116	cmd.exe	158
PID 5116 wrote to memory of 2496	5116	cmd.exe	159
PID 5116 wrote to memory of 4332	5116	cmd.exe	160
PID 4332 wrote to memory of 1488	4332	Client.exe	161
PID 4332 wrote to memory of 2880	4332	Client.exe	163
PID 2880 wrote to memory of 3468	2880	cmd.exe	165
PID 2880 wrote to memory of 2588	2880	cmd.exe	166
PID 2880 wrote to memory of 6072	2880	cmd.exe	167
PID 6072 wrote to memory of 1012	6072	Client.exe	168
PID 6072 wrote to memory of 2388	6072	Client.exe	170

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5092
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jPUSjL1ew4eD.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5204
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3124
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1172
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dQeCZudxOjdK.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2352
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2084
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:6104
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3716
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\S2CGmC0KUNfS.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3748
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3272
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5964
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f2bt4G26iosk.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1748
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5664
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1052
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SpzRPXBKZTdx.bat" "
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4832
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3024
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:968
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3584
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6F5ydvi0d8SL.bat" "
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2924
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2024
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5860
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M3f1zVCKENIs.bat" "
        15⤵
        Suspicious use of WriteProcessMemory
        
        PID:5796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:5376
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5692
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5476
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5036
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\t7J3sNraYoky.bat" "
        17⤵
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4528
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:272
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:236
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4944
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EezVrOB9Ck1G.bat" "
        19⤵
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:4180
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1408
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5628
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2504
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\u8lEQOq8HWmj.bat" "
        21⤵
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:5788
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3776
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3144
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eq8PLAucC51F.bat" "
        23⤵
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3624
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2496
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1488
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CAVGLkQ0b1pe.bat" "
        25⤵
        Suspicious use of WriteProcessMemory
        
        PID:2880
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:3468
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2588
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:6072
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1012
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\G58XfAxayd5s.bat" "
        27⤵
        
        PID:2388
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:404
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5932
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4000
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3476
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wYkSSIDcnxiE.bat" "
        29⤵
        
        PID:4948
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:5480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3104
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2088
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1048
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TMmhwNF9U2Uy.bat" "
        31⤵
        
        PID:2524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:2480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5268

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

6F5ydvi0d8SL.bat

Path C:\Users\Admin\AppData\Local\Temp\6F5ydvi0d8SL.bat
Size 207B
SHA256 f5e9837df2c3cb9456eaf041a5af5e50ec6a1aaac7740fd0736763f21820cd0e
MD5 9fa0e8571d86322e508e6813e97e1a8b
SHA1 93e0fc33de353fd6905e3a96d3ce4864eb052d69
SHA512 58176c1c8097ea09a66883f15fed21efedfb2b8e9804011805aa9d4c6c177dfa2401f0ce1cae208b2b7ef5f866486a44cf5d00ca56a10d8f8e39b64f94260077
TLSH
T10BD022013381CE9E490068479EA5A28CF0AB04FB2F09BDA286018C9C43C688CB69F282
MD5 SHA1 SHA512 TLSH

Submit Download

CAVGLkQ0b1pe.bat

Path C:\Users\Admin\AppData\Local\Temp\CAVGLkQ0b1pe.bat
Size 207B
SHA256 f6b6cfe833f9e4bb560aff1c8ef56f22d784c6f8f11993cebc927cc5d3dd3d60
MD5 c15342019474ce26f07b79bcced21723
SHA1 57e21bb22ae514bdbd168e9da1693164379b6837
SHA512 cdd1bf261a5a6ad046dd62fb91599359c6c784bd4e2f93cb794052c14b3562a3e34b6b4186590f5df4f3174bac207324206d35c7c0e8740d12720a1f5695602c
TLSH
T128D023012340CD5D450018471D756388F0DF08A71F08FDA245054C9C038684C755B241
MD5 SHA1 SHA512 TLSH

Submit Download

EezVrOB9Ck1G.bat

Path C:\Users\Admin\AppData\Local\Temp\EezVrOB9Ck1G.bat
Size 207B
SHA256 b2fca84fdf55312f68390854147fd27b951df4d4cca2d50e56cc4819a9a1d80b
MD5 4caf0c352244f4cad060c3f32f1ada6a
SHA1 2588b595adb2cf510adc14ad173b6bf19c61d995
SHA512 fa358b2ce10e4eb28579b1f12f371996e9be25a63088479cfaa0a3d94517561db9c0d75814cbe197b35d4c08bea51ed747a3229f025783b023612960338572e4
TLSH
T14BD023523381CF5D450018471D656688B0DA04A61F087E714511889C4396C4C75DB142
MD5 SHA1 SHA512 TLSH

Submit Download

G58XfAxayd5s.bat

Path C:\Users\Admin\AppData\Local\Temp\G58XfAxayd5s.bat
Size 207B
SHA256 b779db564b3c6f3b973c5543038926d14b292bf016725337c9844650ef2c476d
MD5 1526de8f852d54e6a0b31dc2a430b720
SHA1 0a8c41f10c0b8f3fc55fd367686737be33b990aa
SHA512 5a739c44923ad15ea9276cbd15da559ea1a0dbf94d33328f2202202b0367617ceb4bbbea4380fef404f69b2b25dd8de3a1e51605b69bf65fd22b8b6eff66a28b
TLSH
T1A4D023013740CD5D850118471D6577C8B09E04AA2F0DBDA145024CDC438689C759F1C1
MD5 SHA1 SHA512 TLSH

Submit Download

M3f1zVCKENIs.bat

Path C:\Users\Admin\AppData\Local\Temp\M3f1zVCKENIs.bat
Size 207B
SHA256 379a9dadf2b19daaccd49d8ce672ada2da91c3326a9974b6bd2657dd994707f8
MD5 c7e01daa09532c01142ab234fcb280b4
SHA1 95aa1749623cedd1002fd79956bc3900e1878bf2
SHA512 babbebc5fc882a91fd0616a003a9d2a1a669323ae99753dc1ad127984476dbbf8f07289aac2d525c4131237c68f3cd03174d5f426dd71905e7a0217ab031f29d
TLSH
T1DBD023412744CD5D450018471D65A3C8B0EE04E63F0DBE6187114C9C43C788CF59B541
MD5 SHA1 SHA512 TLSH

Submit Download

S2CGmC0KUNfS.bat

Path C:\Users\Admin\AppData\Local\Temp\S2CGmC0KUNfS.bat
Size 207B
SHA256 a8c28a61fe98ebee6d39d7ffc1c331af096d44e491d69ee38694f70296e097dd
MD5 6f0030822343d16311716704ee8792df
SHA1 ffaa26b511cecc28ee2afd5b8c68ef95dada03a2
SHA512 f50f3b7bab92ec82ada39a8c99f219ccbdc1cffe4c8f880fe4714af69512c1a655e94dcb590b8b62f257152fe9846a07a96f3b8531f6884a3da581193a5bda11
TLSH
T192D023012384CE5F450018471DA56288F09A04AA1F48BD624A11889C0386D8C755F541
MD5 SHA1 SHA512 TLSH

Submit Download

SpzRPXBKZTdx.bat

Path C:\Users\Admin\AppData\Local\Temp\SpzRPXBKZTdx.bat
Size 207B
SHA256 d350d55cf6a3c9e333aa4832ef415188fb70107cd3f8e71aacdf9e8faccc8301
MD5 569d47a3850b71aab1dd9d860f8b71c2
SHA1 48b8eaf76793d49dacc2f7b7d7951d39adde17e5
SHA512 6993540eedfcd741072a7f02a9701d57697c74ebc21d015a8dd7acac927fb39397f163b69c18cd78676987164bae413398ddba7fc4566b6ca901d5ae5b6100fe
TLSH
T189D022527390CE9E850018471EB9A288F0EB04BA2F09BDA286118CEC03C688CB69B182
MD5 SHA1 SHA512 TLSH

Submit Download

TMmhwNF9U2Uy.bat

Path C:\Users\Admin\AppData\Local\Temp\TMmhwNF9U2Uy.bat
Size 207B
SHA256 9f7aece596d44f55ff110fce050ab3ec17be87a477bbe641de98dbb14cc2eec7
MD5 caff737d3203bdd33828da41cffae323
SHA1 234168634aa79fd96e611ec115d298c87b9466b8
SHA512 bfa76c947909bfe4e1915dee3aee0ebbccfac0a47b186c85435b7ec034d5ce4b93e8d41cf90e9f793bf81b930943329b3a03bbd2f81a47e6b9f7f31b217567fd
TLSH
T16DD023412740CD5E450118871D657388B0DE04A62F0C7D614915489C03C698C795F182
MD5 SHA1 SHA512 TLSH

Submit Download

dQeCZudxOjdK.bat

Path C:\Users\Admin\AppData\Local\Temp\dQeCZudxOjdK.bat
Size 207B
SHA256 cf791e6acf6e2d94f4856c65afb74357d9cec5aeb26985771bb957921a117998
MD5 a02cb293de50ee150bc80a5aeef15191
SHA1 2478f4f4eceb0fcea4a1f205f520e2d56df0e7bb
SHA512 37fd271eeee574a89f5ef60bcec643a7b4c227ab43dd23ca02e38e0e83ef3ab478f2cba5fb62cea3f603cd827b86d45bfb6e894543914ea84f89c5c839d9a631
TLSH
T193D023013340CD9D460018475D757788B0DE04BA1F0C7E714601489C03D6D8CF55B541
MD5 SHA1 SHA512 TLSH

Submit Download

eq8PLAucC51F.bat

Path C:\Users\Admin\AppData\Local\Temp\eq8PLAucC51F.bat
Size 207B
SHA256 b8fafc401ba5fcc6c5a6e0857b253cabc7d56a5eab1b27e07e46cb9070d19bf6
MD5 d37da3ed71bf7f435efc01bc616ad40b
SHA1 d75baa7b5efcee7f6377ca5fb55fbbfa7279a63c
SHA512 0e631e2ad2944dd7d3960ec48a12aa88a170432f974c36f58c9be4b28392bc97c00ddd2e944f7b196f5c6b5fabc9d13114aa851ffec3147b73dbafbe9e220e12
TLSH
T121D023512381CD9E55001C575D69A788B09B04AA1F0D7D738511889C23C68DCB56F141
MD5 SHA1 SHA512 TLSH

Submit Download

f2bt4G26iosk.bat

Path C:\Users\Admin\AppData\Local\Temp\f2bt4G26iosk.bat
Size 207B
SHA256 5904f9fbd38b7038a5a0596f699250901fb28be97165d7aa90ef862793999ca0
MD5 bb6484b399283445e3477d99b76d3cb0
SHA1 3ebc7530102a244bee32e376bfa2207e88e36c2a
SHA512 5a3cb4f280c2614da381fbfd212f26571339692d479853d229fca33ed7a768049141a08c4b297d33b2047c53d701a1c3841060fcf25c85408f5e1f6e1045ade3
TLSH
T1ACD023013340CD5D550019471DA56388F0AA04A61F0CBD61850148DC43C688CB5DB141
MD5 SHA1 SHA512 TLSH

Submit Download

jPUSjL1ew4eD.bat

Path C:\Users\Admin\AppData\Local\Temp\jPUSjL1ew4eD.bat
Size 207B
SHA256 573e896d0021a3882d3625e51107ddae48d6f131b5c04fc9460224f6ae74e2fa
MD5 63bdba87f650ac8eaea599f4d018a8c6
SHA1 e28fbd9adb91e960626e1b17e8e76b9a4bbaf169
SHA512 12dfe7d888bbd38069f1b1130b5f3bb2e1af2ab6cc7c790dc748907c8e2635ef3a43f67becd2756cce1b93819139219020055670bb593f662885acbfc7251dc9
TLSH
T14CD023413341CE5D45005C471DF5628CB1AE04A61F0D7D6145018CDC0387C4C75BF181
MD5 SHA1 SHA512 TLSH

Submit Download

t7J3sNraYoky.bat

Path C:\Users\Admin\AppData\Local\Temp\t7J3sNraYoky.bat
Size 207B
SHA256 0754f23c62f2d445095a307632c0ca1e93537477ee20a66f667dd7062dfdaee3
MD5 de02bf93cc62a78699373ebdf32d129d
SHA1 463017e31d50140a88077ab26f9b8fa8b796c24d
SHA512 145496652af5ed1238bae378d6aa5cdc4e8b7e593608ca97eba79e447169909102390f8f144a0105446f54165cd82ef49c42894be2ce666eb72f1ce1d1295ae8
TLSH
T13BD0231123C1CDDD451018475D6563C8B09A04BE2F4C7D6245054C9C039BC5C755B141
MD5 SHA1 SHA512 TLSH

Submit Download

u8lEQOq8HWmj.bat

Path C:\Users\Admin\AppData\Local\Temp\u8lEQOq8HWmj.bat
Size 207B
SHA256 8796154cc576dc394d70afd1b7c527aeec16130f763b271d63444d14d784d001
MD5 840e6385a1c95c64c65ad15f0f7ca415
SHA1 7ce5a4fbd1b778c1e64d3cea2e5a6f309afa6d6b
SHA512 9c7de2831720f19b74a511da9f03eaa03586f21575152ebff0c941699da20ef17128ee7298b2ad98254d2f7c532e13f50423725abe8afbb9ce0106f1806c10d4
TLSH
T1C9D023412380CE5F550018471E656388F0DA04A71F487D62450548DC4386D4C755B181
MD5 SHA1 SHA512 TLSH

Submit Download

wYkSSIDcnxiE.bat

Path C:\Users\Admin\AppData\Local\Temp\wYkSSIDcnxiE.bat
Size 207B
SHA256 77d2140deb57d50f4da2c5010685392decadf586877ccf7924caadf7373976d8
MD5 315c8a1831e8cc0945885c7c1141f4c3
SHA1 5396523a317f5920b43bc1a0756946d341d486b0
SHA512 25429514ca9f629738d456410d165876bb7a44dc6c6d4e1d91fa68caa304736080f21a9c6fa3e380c98076a33ed967b5a3ec98c7330bf1b703c2e63e5515e09f
TLSH
T11CD023012340CD5D45001C875E756388B09A08A61F497DB2450148AC4386C5CB55F181
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 fed9b42a45423980e39b04dfb9f8c287c70e0bd333acc143a95a5afda68b00a4
MD5 eeacdce7aa28e40bd8aac81ffee30108
SHA1 a135747b45fbf47f29b6cb9a8babf3b06207ab60
SHA512 b8d2020f65ed3352ca7107f1cd8eb54aa4ab97650fba414a9d5207f4bbdf829e6ee837356128957d5263f42fc411cfdd3b066f3da54012b29de87dbca2866509
SSDEEP 49152:Tv/e821/aQWl8P0lSk3aKA3Z+n+xrEDkck/JxToGdATHHB72eh2NT:Tv2821/aQWl8P0lSk3DA3Z+n+xBl
TLSH
T1ADE55B143BF85E23E1BBE673D5B0041667F0EC2AB3A3EB1B1191677E1C53B5058426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2360-0-0x0000000000D20000-0x0000000001044000-memory.dmp

Download

memory/2360-1-0x0000000003290000-0x00000000032A0000-memory.dmp

Download

memory/5232-12-0x000000001DA90000-0x000000001DB42000-memory.dmp

Download

memory/5232-11-0x000000001D980000-0x000000001D9D0000-memory.dmp

Download

memory/5232-8-0x000000001CF80000-0x000000001CF90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads