quasar | aadee5080f4b1f68d333c96fed75bf3d1fc2ccb72648c3f675d28ab1ceaa02f5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 05:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
weathernova.exe
Size 3.1MB
Sample260604-gfh8psbt2n
SHA256 aadee5080f4b1f68d333c96fed75bf3d1fc2ccb72648c3f675d28ab1ceaa02f5
MD5 12b25574a74229739cfc466265a80b38
SHA1 d8af070b0c1cdc5aaa5f18de1adc2cd2bf86b4da
SHA512 d841eaca710aeb7e6479760394fd9b62b093115114e760c39201bd7988f26c60f704a51af1ffe8496256b7f5bd2cc8c7761441d65c38630252dc06f4549701fb
SSDEEP 49152:Svust2zlaWX6bPmlccBGyQxE3fBCP/OBxHQoGdMTHHB72eh2NT:Sv/t2zlaWX6bPmlccB3QxE3fo/N
TLSH
T101E56B0437F85E33E56BD2B3D5B05022A3F1E82AF363EB1B519167BE1C53B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

weathernova discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

WeatherNova

hitclub.ac:443
nhyouthclimatetownhall.com:443
mansionbet.com:443
Fun88kyc.com:443
contact.hitclub.ac:443
contact.nhyouthclimatetownhall.com:443
contact.mansionbet.com:443
contact.Fun88kyc.com:443

Mutex

bda7ff85-9136-4e3c-90ab-1809c0298724

Attributes

encryption_key
42E6C1CCE0206FB677AB01B544B9714D387B33F7
install_name
weathernova.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
WeatherNova
subdirectory
WeatherNova

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/1936-0-0x00000000003D0000-0x00000000006F4000-memory.dmp	family_quasar
behavioral2/files/0x001a00000002b490-4.dat	family_quasar

Executes dropped EXE 6 IoCs

pid	Process
1068	weathernova.exe
4132	weathernova.exe
4520	weathernova.exe
3024	weathernova.exe
2708	weathernova.exe
932	weathernova.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2504	PING.EXE
1244	PING.EXE
4360	PING.EXE
4408	PING.EXE

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
1244	PING.EXE
4360	PING.EXE
4408	PING.EXE
2504	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2868	schtasks.exe
3032	schtasks.exe
232	schtasks.exe
3756	schtasks.exe
4188	schtasks.exe
3312	schtasks.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	weathernova.exe
Token: SeDebugPrivilege	1068	weathernova.exe
Token: SeDebugPrivilege	4132	weathernova.exe
Token: SeDebugPrivilege	4520	weathernova.exe
Token: SeDebugPrivilege	3024	weathernova.exe
Token: SeDebugPrivilege	2708	weathernova.exe
Token: SeDebugPrivilege	932	weathernova.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1068	weathernova.exe
4520	weathernova.exe
3024	weathernova.exe
2708	weathernova.exe
932	weathernova.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4188	1936	weathernova.exe	80
PID 1936 wrote to memory of 1068	1936	weathernova.exe	82
PID 1068 wrote to memory of 3312	1068	weathernova.exe	85
PID 1068 wrote to memory of 3492	1068	weathernova.exe	87
PID 3492 wrote to memory of 3544	3492	cmd.exe	89
PID 3492 wrote to memory of 2504	3492	cmd.exe	90
PID 3492 wrote to memory of 4520	3492	cmd.exe	91
PID 4520 wrote to memory of 2868	4520	weathernova.exe	92
PID 4520 wrote to memory of 3164	4520	weathernova.exe	94
PID 3164 wrote to memory of 1284	3164	cmd.exe	96
PID 3164 wrote to memory of 1244	3164	cmd.exe	97
PID 3164 wrote to memory of 3024	3164	cmd.exe	98
PID 3024 wrote to memory of 3032	3024	weathernova.exe	99
PID 3024 wrote to memory of 3176	3024	weathernova.exe	101
PID 3176 wrote to memory of 3268	3176	cmd.exe	103
PID 3176 wrote to memory of 4360	3176	cmd.exe	104
PID 3176 wrote to memory of 2708	3176	cmd.exe	105
PID 2708 wrote to memory of 232	2708	weathernova.exe	106
PID 2708 wrote to memory of 1956	2708	weathernova.exe	108
PID 1956 wrote to memory of 596	1956	cmd.exe	110
PID 1956 wrote to memory of 4408	1956	cmd.exe	111
PID 1956 wrote to memory of 932	1956	cmd.exe	112
PID 932 wrote to memory of 3756	932	weathernova.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\weathernova.exe
"C:\Users\Admin\AppData\Local\Temp\weathernova.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "WeatherNova" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4188
- C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe
  "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "WeatherNova" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7IU54oqMVFg6.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3544
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2504
  - - C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe
      "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "WeatherNova" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2868
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nkKz8diZSRQv.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3164
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1284
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1244
      - C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe
        
        "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "WeatherNova" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3032
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\khtpvMwaHy21.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3176
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:3268
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4360
        
        C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe
        
        "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "WeatherNova" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3i72tTkXS2tb.bat" "
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:596
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4408
        
        C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe
        
        "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "WeatherNova" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3756

C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe
C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

weathernova.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\weathernova.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

3i72tTkXS2tb.bat

Path C:\Users\Admin\AppData\Local\Temp\3i72tTkXS2tb.bat
Size 217B
SHA256 bbcb7b96f3a3b1287b519d408fc1e2ab41a373c86f708ca8c6cd6487b7457865
MD5 778a1be991c405a1606eaec875420bce
SHA1 3a650a320cfeb53992e3fd30bbd957d64aae1d7c
SHA512 819717f0799163a79cb6020979ab4f37a5194499bc25ee275261ddf2cb12d5492fc66afe59d4e20105dca5c6f61fb8b18898124fd81e69ad17aae09e8b406a0c
TLSH
T10BD023335243C91D4504090B1FB5768CB0A504EB2F4C7D93C7098C9C0387D8CBADB281
MD5 SHA1 SHA512 TLSH

Submit Download

7IU54oqMVFg6.bat

Path C:\Users\Admin\AppData\Local\Temp\7IU54oqMVFg6.bat
Size 217B
SHA256 1b8a0fd94ca5157f16427c8b7f1e04db762d5803c521ef52cdde5566e3e84e7f
MD5 2e4a68218cbeba245f9773761cf19071
SHA1 1d03a798d6d7383de5bdfc7042e78d9af4d904d4
SHA512 568cb51ab82221aae1a6c5f2416201ef2bd8cdca5465a5d55085f48b201bfae44f46eb05edda8f689b3a0a5a3a667f29a669017c297dbe7e7825eb4fdd722c17
TLSH
T1E9D0A7664281CA0D5500084A1A757288B06605E61E487D92CA09889C038799C66962C5
MD5 SHA1 SHA512 TLSH

Submit Download

khtpvMwaHy21.bat

Path C:\Users\Admin\AppData\Local\Temp\khtpvMwaHy21.bat
Size 217B
SHA256 b272aca9ecd43a90d2e5347b8ec4ae95eeed03fe05f8706f64bec99bb41a4604
MD5 49176142c0a8c3869cadf36a24fc07fa
SHA1 a5395dadc2d8f55e42d67e027974b86ff61c85d5
SHA512 87eed35f757b178d6a2f518981929d4edff115d470eb1715fbc641a1ea33798e0f37c745ea6dfc4314ffbe5a289133dd5e8e5178b4a77adc448e16b179d373a1
TLSH
T188D0A7224241C91D5501090A1F75B28CB06904AA2E48AD96C60D4C9C038798D7BD6282
MD5 SHA1 SHA512 TLSH

Submit Download

nkKz8diZSRQv.bat

Path C:\Users\Admin\AppData\Local\Temp\nkKz8diZSRQv.bat
Size 217B
SHA256 2447bf5fd24bcd392ef79ea67ecb5c2ba70e19da978da79c6d9a36941312bc71
MD5 dacfa9d78f072cf34520681be0511402
SHA1 8d675aa36a86c2136d98d3bdc9b4590c7aae35f5
SHA512 90b9489395c18d93423339a5bd4f0b896d4d2bc78c63c50b75d2c71fb33ec5411d539a8eb08f0743773826d6380b66b41eddffdb3aa52fa467076b4d94d7151c
TLSH
T12AD0A7224282CD4D5500080A5B757288B06504E62E487D92CA094C9C13C799C6697282
MD5 SHA1 SHA512 TLSH

Submit Download

weathernova.exe

Path C:\Users\Admin\AppData\Roaming\WeatherNova\weathernova.exe
Size 3.1MB
SHA256 aadee5080f4b1f68d333c96fed75bf3d1fc2ccb72648c3f675d28ab1ceaa02f5
MD5 12b25574a74229739cfc466265a80b38
SHA1 d8af070b0c1cdc5aaa5f18de1adc2cd2bf86b4da
SHA512 d841eaca710aeb7e6479760394fd9b62b093115114e760c39201bd7988f26c60f704a51af1ffe8496256b7f5bd2cc8c7761441d65c38630252dc06f4549701fb
SSDEEP 49152:Svust2zlaWX6bPmlccBGyQxE3fBCP/OBxHQoGdMTHHB72eh2NT:Sv/t2zlaWX6bPmlccB3QxE3fo/N
TLSH
T101E56B0437F85E33E56BD2B3D5B05022A3F1E82AF363EB1B519167BE1C53B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-8-0x00000000013C0000-0x00000000013D0000-memory.dmp

Download

memory/1068-10-0x000000001D4C0000-0x000000001D510000-memory.dmp

Download

memory/1068-11-0x000000001D5D0000-0x000000001D682000-memory.dmp

Download

memory/1068-12-0x00000000013C0000-0x00000000013D0000-memory.dmp

Download

memory/1936-0-0x00000000003D0000-0x00000000006F4000-memory.dmp

Download

memory/1936-1-0x000000001CB30000-0x000000001CB40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads