quasar | 59d46a3af61bae823a061cb17369826afdf7fa1b1c29fe96c85b236921c95eb6

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update4.exe
Size 1.4MB
Sample260702-b3lpfsay4w
SHA256 59d46a3af61bae823a061cb17369826afdf7fa1b1c29fe96c85b236921c95eb6
MD5 2ca9e9f9fd9d94b8341099d43d4dee0e
SHA1 c359e76b844a558af6684f2c30af7cf4aa081d43
SHA512 246d42c0e30cb3c7e179ff6cdff758d16dd40b354fbe5ee5f870c5cf072405086a35dd9b1497912b4c525decd27f8f402dfdf652465f07d7dac0061720623031
SSDEEP 24576:1AlCWjwCsPvsSZs6tr15dgCPqtPS9U45JDzKpbfYLcf55gMFE0ZJWcfm:1uljKsasedggoPWU45JPobvf55NmcEc
TLSH
T178651298335ADC03C8D66BB84871D3F01678CE89E521D313AFEA7EEBB4BA2151D46345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

�Y��

Attributes

encryption_key
794A3874F53015A8504282867F082BCD3E7E97F6
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/1080-38-0x0000000000400000-0x00000000004A4000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1460	powershell.exe
5020	powershell.exe
4876	powershell.exe
5756	powershell.exe
4696	powershell.exe
4264	powershell.exe
4340	powershell.exe
3008	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
2	3476	update4.exe
4	3956	zeDjakAYaNq.exe

Executes dropped EXE 9 IoCs

pid	Process
6044	netstates.exe
3956	zeDjakAYaNq.exe
5848	Client.exe
2360	Client.exe
4920	netstates.exe
2420	PwEEXBIhH.exe
6136	netstates.exe
2124	zeDjakAYaNq.exe
3408	zeDjakAYaNq.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeDjakAYaNq = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\lvi0xqskelw.ps1\""	update4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3704578903-1610922810-1098216751-1000\Software\Microsoft\Windows\CurrentVersion\Run\PwEEXBIhH = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\ijpdofzfg3y.ps1\""	netstates.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3476 set thread context of 1080	3476	update4.exe	91
PID 6044 set thread context of 4920	6044	netstates.exe	104
PID 3956 set thread context of 3408	3956	zeDjakAYaNq.exe	112

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zeDjakAYaNq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zeDjakAYaNq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3592	schtasks.exe
2084	schtasks.exe
5848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3476	update4.exe
1460	powershell.exe
1460	powershell.exe
3476	update4.exe
3476	update4.exe
4340	powershell.exe
4340	powershell.exe
6044	netstates.exe
5020	powershell.exe
5020	powershell.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
3956	zeDjakAYaNq.exe
4876	powershell.exe
4876	powershell.exe
3956	zeDjakAYaNq.exe
3956	zeDjakAYaNq.exe
3956	zeDjakAYaNq.exe
3956	zeDjakAYaNq.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3476	update4.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	1080	update4.exe
Token: SeDebugPrivilege	4340	powershell.exe
Token: SeIncreaseQuotaPrivilege	1460	powershell.exe
Token: SeSecurityPrivilege	1460	powershell.exe
Token: SeTakeOwnershipPrivilege	1460	powershell.exe
Token: SeLoadDriverPrivilege	1460	powershell.exe
Token: SeSystemProfilePrivilege	1460	powershell.exe
Token: SeSystemtimePrivilege	1460	powershell.exe
Token: SeProfSingleProcessPrivilege	1460	powershell.exe
Token: SeIncBasePriorityPrivilege	1460	powershell.exe
Token: SeCreatePagefilePrivilege	1460	powershell.exe
Token: SeBackupPrivilege	1460	powershell.exe
Token: SeRestorePrivilege	1460	powershell.exe
Token: SeShutdownPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeSystemEnvironmentPrivilege	1460	powershell.exe
Token: SeRemoteShutdownPrivilege	1460	powershell.exe
Token: SeUndockPrivilege	1460	powershell.exe
Token: SeManageVolumePrivilege	1460	powershell.exe
Token: 33	1460	powershell.exe
Token: 34	1460	powershell.exe
Token: 35	1460	powershell.exe
Token: 36	1460	powershell.exe
Token: SeDebugPrivilege	6044	netstates.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeIncreaseQuotaPrivilege	5020	powershell.exe
Token: SeSecurityPrivilege	5020	powershell.exe
Token: SeTakeOwnershipPrivilege	5020	powershell.exe
Token: SeLoadDriverPrivilege	5020	powershell.exe
Token: SeSystemProfilePrivilege	5020	powershell.exe
Token: SeSystemtimePrivilege	5020	powershell.exe
Token: SeProfSingleProcessPrivilege	5020	powershell.exe
Token: SeIncBasePriorityPrivilege	5020	powershell.exe
Token: SeCreatePagefilePrivilege	5020	powershell.exe
Token: SeBackupPrivilege	5020	powershell.exe
Token: SeRestorePrivilege	5020	powershell.exe
Token: SeShutdownPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeSystemEnvironmentPrivilege	5020	powershell.exe
Token: SeRemoteShutdownPrivilege	5020	powershell.exe
Token: SeUndockPrivilege	5020	powershell.exe
Token: SeManageVolumePrivilege	5020	powershell.exe
Token: 33	5020	powershell.exe
Token: 34	5020	powershell.exe
Token: 35	5020	powershell.exe
Token: 36	5020	powershell.exe
Token: SeDebugPrivilege	3956	zeDjakAYaNq.exe
Token: SeDebugPrivilege	4876	powershell.exe
Token: SeDebugPrivilege	3408	zeDjakAYaNq.exe
Token: SeIncreaseQuotaPrivilege	4876	powershell.exe
Token: SeSecurityPrivilege	4876	powershell.exe
Token: SeTakeOwnershipPrivilege	4876	powershell.exe
Token: SeLoadDriverPrivilege	4876	powershell.exe
Token: SeSystemProfilePrivilege	4876	powershell.exe
Token: SeSystemtimePrivilege	4876	powershell.exe
Token: SeProfSingleProcessPrivilege	4876	powershell.exe
Token: SeIncBasePriorityPrivilege	4876	powershell.exe
Token: SeCreatePagefilePrivilege	4876	powershell.exe
Token: SeBackupPrivilege	4876	powershell.exe
Token: SeRestorePrivilege	4876	powershell.exe
Token: SeShutdownPrivilege	4876	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 1460	3476	update4.exe	88
PID 3476 wrote to memory of 6044	3476	update4.exe	90
PID 3476 wrote to memory of 1080	3476	update4.exe	91
PID 3476 wrote to memory of 1080	3476	update4.exe	91
PID 3476 wrote to memory of 1080	3476	update4.exe	91
PID 3476 wrote to memory of 1080	3476	update4.exe	91
PID 3476 wrote to memory of 1080	3476	update4.exe	91
PID 4340 wrote to memory of 3956	4340	powershell.exe	94
PID 1080 wrote to memory of 3592	1080	update4.exe	95
PID 1080 wrote to memory of 5848	1080	update4.exe	136
PID 6044 wrote to memory of 5020	6044	netstates.exe	102
PID 6044 wrote to memory of 4920	6044	netstates.exe	104
PID 6044 wrote to memory of 4920	6044	netstates.exe	104
PID 6044 wrote to memory of 4920	6044	netstates.exe	104
PID 6044 wrote to memory of 4920	6044	netstates.exe	104
PID 6044 wrote to memory of 4920	6044	netstates.exe	104
PID 6044 wrote to memory of 4920	6044	netstates.exe	104
PID 6044 wrote to memory of 4920	6044	netstates.exe	104
PID 6044 wrote to memory of 4920	6044	netstates.exe	104
PID 3008 wrote to memory of 2420	3008	powershell.exe	107
PID 3956 wrote to memory of 4876	3956	zeDjakAYaNq.exe	108
PID 3956 wrote to memory of 6136	3956	zeDjakAYaNq.exe	110
PID 3956 wrote to memory of 2124	3956	zeDjakAYaNq.exe	111
PID 3956 wrote to memory of 3408	3956	zeDjakAYaNq.exe	112
PID 3956 wrote to memory of 3408	3956	zeDjakAYaNq.exe	112
PID 3956 wrote to memory of 3408	3956	zeDjakAYaNq.exe	112
PID 3956 wrote to memory of 3408	3956	zeDjakAYaNq.exe	112
PID 3956 wrote to memory of 3408	3956	zeDjakAYaNq.exe	112

C:\Users\Admin\AppData\Local\Temp\update4.exe
"C:\Users\Admin\AppData\Local\Temp\update4.exe"
1⤵
- Downloads MZ/PE file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\update4.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Users\Admin\AppData\Local\Temp\netstates.exe
  "C:\Users\Admin\AppData\Local\Temp\netstates.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\netstates.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\netstates.exe
    C:\Users\Admin\AppData\Local\Temp\netstates.exe
    3⤵
    - Executes dropped EXE
    PID:4920
- C:\Users\Admin\AppData\Local\Temp\update4.exe
  "C:\Users\Admin\AppData\Local\Temp\update4.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "conhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3592
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5848

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\lvi0xqskelw.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Users\Admin\AppData\Roaming\zeDjakAYaNq.exe
  "C:\Users\Admin\AppData\Roaming\zeDjakAYaNq.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zeDjakAYaNq.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\netstates.exe
    "C:\Users\Admin\AppData\Local\Temp\netstates.exe"
    3⤵
    - Executes dropped EXE
    PID:6136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\netstates.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\netstates.exe
      C:\Users\Admin\AppData\Local\Temp\netstates.exe
      4⤵
      PID:5680
- - C:\Users\Admin\AppData\Roaming\zeDjakAYaNq.exe
    "C:\Users\Admin\AppData\Roaming\zeDjakAYaNq.exe"
    3⤵
    - Executes dropped EXE
    PID:2124
- - C:\Users\Admin\AppData\Roaming\zeDjakAYaNq.exe
    "C:\Users\Admin\AppData\Roaming\zeDjakAYaNq.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "conhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2084
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      PID:3892
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4264
    - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        5⤵
        
        PID:3920
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "conhost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5848

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\ijpdofzfg3y.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Roaming\PwEEXBIhH.exe
  "C:\Users\Admin\AppData\Roaming\PwEEXBIhH.exe"
  2⤵
  - Executes dropped EXE
  PID:2420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PwEEXBIhH.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5756
- - C:\Users\Admin\AppData\Roaming\PwEEXBIhH.exe
    C:\Users\Admin\AppData\Roaming\PwEEXBIhH.exe
    3⤵
    PID:5620

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:5956
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:2736

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2928

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact