quasar | 9e59b307e546d5a5b4847189f33275c56ec8705b9f290bc42f0d67baf71680bc

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample260602-t16wqaav8t
SHA256 9e59b307e546d5a5b4847189f33275c56ec8705b9f290bc42f0d67baf71680bc
MD5 8360540d93c457b93a76df80a7ee0327
SHA1 84ae21ab84fe579a3e1c60bf4c928731595c1bbf
SHA512 c8f3ab13ba7f556396973c556c1577013611b45b512be6da0bf557ad7b8bb89e665d7915fddb1806d80c67edb5ffdeda1a3b575c5c1ab46fb5fa1e6449ac1ec1
SSDEEP 49152:GvIt62XlaSFNWPjljiFa2RoUYIEKXmtmzNXoGdCb+THHB72eh2NT:GvE62XlaSFNWPjljiFXRoUYIDXmY
TLSH
T1C1E55A0577F85E62E16BD3B2D5F0542363F0F82AF3A3EB0B5191677A1C93B4098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

runtime broker discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Runtime Broker

biliex.ddns.net:4782

Mutex

f5825daa-bc69-4e27-a531-0fb0efe0fd44

Attributes

encryption_key
5B27051D67AA2CCE9314596003B68709A13FC003
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Runtime Broker
subdirectory
discord

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4940-0-0x0000000000A60000-0x0000000000D84000-memory.dmp	family_quasar
behavioral2/files/0x001900000002b539-4.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
4436	Client.exe
924	Client.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4912	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4912	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2352	schtasks.exe
2780	schtasks.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	Client-built.exe
Token: SeDebugPrivilege	4436	Client.exe
Token: SeDebugPrivilege	924	Client.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4436	Client.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2352	4940	Client-built.exe	83
PID 4940 wrote to memory of 4436	4940	Client-built.exe	85
PID 4436 wrote to memory of 2780	4436	Client.exe	86
PID 4436 wrote to memory of 1812	4436	Client.exe	91
PID 4436 wrote to memory of 2500	4436	Client.exe	93
PID 2500 wrote to memory of 4384	2500	cmd.exe	95
PID 2500 wrote to memory of 4912	2500	cmd.exe	96

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\discord\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2352
- C:\Users\Admin\AppData\Roaming\discord\Client.exe
  "C:\Users\Admin\AppData\Roaming\discord\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\discord\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2780
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /delete /tn "Runtime Broker" /f
    3⤵
    PID:1812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KHoApSmEc9NA.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4384
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4912

C:\Users\Admin\AppData\Roaming\discord\Client.exe
C:\Users\Admin\AppData\Roaming\discord\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

KHoApSmEc9NA.bat

Path C:\Users\Admin\AppData\Local\Temp\KHoApSmEc9NA.bat
Size 212B
SHA256 bbe3079eb1712050d619cfc9ea7ef31d6b296cf43545464c512376f271bf1659
MD5 584139d84ac3a68a7afcf3958dffc6da
SHA1 7a8c8c154dbc5a327db5278e57d5f55f3c614958
SHA512 7f76290459663489b7ce8bf9a2b5a5851c1d8d361076f400e69faf11842a2f155eaef94055c20eb94b07e92a9c55423d9e16f4952a61090b162f53108ebc757b
TLSH
T1C2D023521341CD9C5501844759E5B2CC609E08F71F4DBDE1450148DD428587C65275C3
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\discord\Client.exe
Size 3.1MB
SHA256 9e59b307e546d5a5b4847189f33275c56ec8705b9f290bc42f0d67baf71680bc
MD5 8360540d93c457b93a76df80a7ee0327
SHA1 84ae21ab84fe579a3e1c60bf4c928731595c1bbf
SHA512 c8f3ab13ba7f556396973c556c1577013611b45b512be6da0bf557ad7b8bb89e665d7915fddb1806d80c67edb5ffdeda1a3b575c5c1ab46fb5fa1e6449ac1ec1
SSDEEP 49152:GvIt62XlaSFNWPjljiFa2RoUYIEKXmtmzNXoGdCb+THHB72eh2NT:GvE62XlaSFNWPjljiFXRoUYIDXmY
TLSH
T1C1E55A0577F85E62E16BD3B2D5F0542363F0F82AF3A3EB0B5191677A1C93B4098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4436-7-0x000000001C0D0000-0x000000001C0E0000-memory.dmp

Download

memory/4436-8-0x0000000002660000-0x00000000026B0000-memory.dmp

Download

memory/4436-9-0x000000001C7D0000-0x000000001C882000-memory.dmp

Download

memory/4436-12-0x000000001C0D0000-0x000000001C0E0000-memory.dmp

Download

memory/4940-0-0x0000000000A60000-0x0000000000D84000-memory.dmp

Download

memory/4940-1-0x0000000001730000-0x0000000001740000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads