quasar | 6b02104091480bffc4d13c29032cfbb88893f3658669e3477e39c9cf51309546

Analysis

user interaction
yes
max time kernel
60s
max time network
66s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
output.bat
Size 4.5MB
Sample260804-srvlnatbqb
SHA256 6b02104091480bffc4d13c29032cfbb88893f3658669e3477e39c9cf51309546
MD5 4cb7755ebbead7e167cc219614939b74
SHA1 cf96cc214a901355f9fb323d308c2033d6b15114
SHA512 ba709501c05fea71d1d45e5421076f54c5e985b68413c1ffacc2f100470f36626b2269a93f40f7cd6975bd85b313f45a188de31ffd0c413d85f9530431369066
SSDEEP 49152:w5KeISVBv3AkRtuGm/DU8tGc/QGkqOBphZ+k1LJ7+yumX/ZcUWQFLd9RSUJ5wAT6:9
TLSH
T177263330EE72BD6D04AC8229A0D3AD1F1637DFC092A4E19E67CA79C7459CA50780FE75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 defense_evasion execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

xxxxxxxxxxxxx1.localto.net:6155

Mutex

b4e6b30f-9ca8-4cbf-95c6-796eaf2b5f7a

Attributes

encryption_key
9AB3C8E4FBD91315175F3A5B7282BF3024F7F5D9
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4764-43-0x000002264AF40000-0x000002264B264000-memory.dmp	family_quasar

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2496	powershell.exe
2696	powershell.exe
2352	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4988	cmd.exe
2324	cmd.exe
3520	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2696	powershell.exe
2696	powershell.exe
2352	powershell.exe
2352	powershell.exe
2496	powershell.exe
2496	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeIncreaseQuotaPrivilege	2496	powershell.exe
Token: SeSecurityPrivilege	2496	powershell.exe
Token: SeTakeOwnershipPrivilege	2496	powershell.exe
Token: SeLoadDriverPrivilege	2496	powershell.exe
Token: SeSystemProfilePrivilege	2496	powershell.exe
Token: SeSystemtimePrivilege	2496	powershell.exe
Token: SeProfSingleProcessPrivilege	2496	powershell.exe
Token: SeIncBasePriorityPrivilege	2496	powershell.exe
Token: SeCreatePagefilePrivilege	2496	powershell.exe
Token: SeBackupPrivilege	2496	powershell.exe
Token: SeRestorePrivilege	2496	powershell.exe
Token: SeShutdownPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeSystemEnvironmentPrivilege	2496	powershell.exe
Token: SeRemoteShutdownPrivilege	2496	powershell.exe
Token: SeUndockPrivilege	2496	powershell.exe
Token: SeManageVolumePrivilege	2496	powershell.exe
Token: 33	2496	powershell.exe
Token: 34	2496	powershell.exe
Token: 35	2496	powershell.exe
Token: 36	2496	powershell.exe
Token: SeIncreaseQuotaPrivilege	2496	powershell.exe
Token: SeSecurityPrivilege	2496	powershell.exe
Token: SeTakeOwnershipPrivilege	2496	powershell.exe
Token: SeLoadDriverPrivilege	2496	powershell.exe
Token: SeSystemProfilePrivilege	2496	powershell.exe
Token: SeSystemtimePrivilege	2496	powershell.exe
Token: SeProfSingleProcessPrivilege	2496	powershell.exe
Token: SeIncBasePriorityPrivilege	2496	powershell.exe
Token: SeCreatePagefilePrivilege	2496	powershell.exe
Token: SeBackupPrivilege	2496	powershell.exe
Token: SeRestorePrivilege	2496	powershell.exe
Token: SeShutdownPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeSystemEnvironmentPrivilege	2496	powershell.exe
Token: SeRemoteShutdownPrivilege	2496	powershell.exe
Token: SeUndockPrivilege	2496	powershell.exe
Token: SeManageVolumePrivilege	2496	powershell.exe
Token: 33	2496	powershell.exe
Token: 34	2496	powershell.exe
Token: 35	2496	powershell.exe
Token: 36	2496	powershell.exe
Token: SeIncreaseQuotaPrivilege	2496	powershell.exe
Token: SeSecurityPrivilege	2496	powershell.exe
Token: SeTakeOwnershipPrivilege	2496	powershell.exe
Token: SeLoadDriverPrivilege	2496	powershell.exe
Token: SeSystemProfilePrivilege	2496	powershell.exe
Token: SeSystemtimePrivilege	2496	powershell.exe
Token: SeProfSingleProcessPrivilege	2496	powershell.exe
Token: SeIncBasePriorityPrivilege	2496	powershell.exe
Token: SeCreatePagefilePrivilege	2496	powershell.exe
Token: SeBackupPrivilege	2496	powershell.exe
Token: SeRestorePrivilege	2496	powershell.exe
Token: SeShutdownPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeSystemEnvironmentPrivilege	2496	powershell.exe
Token: SeRemoteShutdownPrivilege	2496	powershell.exe
Token: SeUndockPrivilege	2496	powershell.exe
Token: SeManageVolumePrivilege	2496	powershell.exe
Token: 33	2496	powershell.exe
Token: 34	2496	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2696	4988	cmd.exe	90
PID 2696 wrote to memory of 2324	2696	powershell.exe	91
PID 2324 wrote to memory of 2352	2324	cmd.exe	93
PID 2324 wrote to memory of 1064	2324	cmd.exe	94
PID 2324 wrote to memory of 2496	2324	cmd.exe	95
PID 2496 wrote to memory of 3520	2496	powershell.exe	98
PID 3520 wrote to memory of 1292	3520	cmd.exe	99
PID 1292 wrote to memory of 2608	1292	net.exe	100
PID 2496 wrote to memory of 4764	2496	powershell.exe	102
PID 2496 wrote to memory of 4764	2496	powershell.exe	102
PID 2496 wrote to memory of 4764	2496	powershell.exe	102

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1064	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\output.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:YSIXRYPSUO))"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /d /c ""C:\Users\Admin\AppData\Local\Temp\output.bat" HVJSPYPRY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:LIXKYPPZMD))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2352
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\iconcache_idx\iconcache_idx.dat"
      4⤵
      Views/modifies file attributes
      PID:1064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "&([scriptblock]::Create([string]$env:HCKLMCPUQPO))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "net session >nul 2>&1"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3520
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:2608
    - - C:\Windows\system32\prevhost.exe
        
        "C:\Windows\system32\prevhost.exe"
        5⤵
        
        PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 174de485d7265108d719a0fcaac35b1acaef5307bdbc43bec5ebb31299e56f1f
MD5 c625a3418635dfd61a51ffed1bd13979
SHA1 de78a0bc943ecde295c2cce9d0604048e6954d85
SHA512 60d17271772391b8d1e18de298ecbb0cd2933c9780bb9dfff2eefd8d393b4cc02332cf98c68c6e2742fa2324f6242a818a310131f5fb8cd566eacbb853c0d390
TLSH
T1E1215333F3CC8624C89A413A50CEAC1036B687DB419FCFABBB84D154A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6a0f6c545beaac7d95f6d759165f12ab79330c5a4214be90d4c3bd70a7466e0e
MD5 71c335411158d29b1ecf4aff8f563b0c
SHA1 5415d69ca139a19eb3375e2dfad2e6474582e9c0
SHA512 a339fb321041dc8598843f625ec72700310b8945709719268c4c0dc3a81246ae5b2f0a0df6dfba157a797e955996b6cfc44afcc3f540c9aa526b36fcfbbd2822
TLSH
T144215733F3CC86A4DC9A413650CEAC1136B787DB409EDEABAB84D559B42F689CF61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_loac0ucp.n55.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_loac0ucp.n55.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2352-22-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2352-26-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2352-23-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2352-18-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2352-21-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2352-20-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2352-19-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2352-13-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2352-14-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2352-15-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2496-38-0x0000000180000000-0x0000000180070000-memory.dmp

Download

memory/2496-31-0x000002287DEA0000-0x000002287DEA8000-memory.dmp

Download

memory/2496-39-0x0000000180000000-0x0000000180070000-memory.dmp

Download

memory/2496-41-0x0000000180000000-0x0000000180070000-memory.dmp

Download

memory/2496-32-0x0000000180000000-0x0000000180070000-memory.dmp

Download

memory/2496-40-0x0000000180000000-0x0000000180070000-memory.dmp

Download

memory/2696-6-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2696-10-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2696-4-0x0000013FCBD50000-0x0000013FCBD72000-memory.dmp

Download

memory/2696-3-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2696-12-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2696-7-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2696-8-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2696-9-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/2696-0-0x00007FFC827BF000-0x00007FFC827C0000-memory.dmp

Download

memory/2696-5-0x00007FFC82630000-0x00007FFC82FD4000-memory.dmp

Download

memory/4764-42-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/4764-43-0x000002264AF40000-0x000002264B264000-memory.dmp

Download

memory/4764-44-0x0000000180000000-0x0000000180020000-memory.dmp

Download

memory/4764-46-0x000002264AA60000-0x000002264AAB0000-memory.dmp

Download

memory/4764-47-0x000002264AE10000-0x000002264AEC2000-memory.dmp

Download

memory/4764-49-0x000002264AEF0000-0x000002264AF02000-memory.dmp

Download

memory/4764-50-0x000002264C0A0000-0x000002264C0DC000-memory.dmp

Download