quasar | 60ecb7c972bb35a8a2769e43f493e277d54076b0ec5b41662950118e1c62f216 | Triage™

Resubmissions

05/08/2026, 04:38

260805-e9sywsybpg10

05/08/2026, 04:09

260805-eq4w2svxe110

Analysis

max time kernel
149s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
catlavan-recode.exe
Size 1.2MB
Sample260805-e9sywsybpg
SHA256 60ecb7c972bb35a8a2769e43f493e277d54076b0ec5b41662950118e1c62f216
MD5 2398d869bcc72e15d17c36bba4802f5b
SHA1 cb5fc467217d56780e04b00de5d60ab62dc5c767
SHA512 c3a81ad1062dd190880bf633f9899040acbf4d5fe03dcf2d9434b72e5032ae41fe2de971edb50ac0e3ecab12ca481a98108eae1afab185120a645f7d44ac16f8
SSDEEP 24576:3F/pgxJzck+uGW/yFoBkkAQsOqBSVILH0:3F/pgTYjqqanTsXUILH
TLSH
T1F445BE5173A48A1AE1BE2BB59472C9394BB7BC125935DB4F08D4BC6B7EB37808D10393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
33A7029011B6BD4B067B8907EB238F25EFF233BF
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/4464-0-0x0000028423AE0000-0x0000028423C16000-memory.dmp	family_quasar
behavioral2/files/0x0007000000028520-3.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
736	SystemHelper.exe
4816	SystemHelper.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SubDir	SystemHelper.exe
File created	C:\Windows\system32\SubDir\SystemHelper.exe	catlavan-recode.exe
File opened for modification	C:\Windows\system32\SubDir\SystemHelper.exe	catlavan-recode.exe
File opened for modification	C:\Windows\system32\SubDir	catlavan-recode.exe
File opened for modification	C:\Windows\system32\SubDir\SystemHelper.exe	SystemHelper.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3456	schtasks.exe
4768	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
736	SystemHelper.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	catlavan-recode.exe
Token: SeDebugPrivilege	736	SystemHelper.exe
Token: SeDebugPrivilege	4816	SystemHelper.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 3456	4464	catlavan-recode.exe	83
PID 4464 wrote to memory of 736	4464	catlavan-recode.exe	85
PID 736 wrote to memory of 4768	736	SystemHelper.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\catlavan-recode.exe
"C:\Users\Admin\AppData\Local\Temp\catlavan-recode.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SystemHelper" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SystemHelper.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3456
- C:\Windows\system32\SubDir\SystemHelper.exe
  "C:\Windows\system32\SubDir\SystemHelper.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "SystemHelper" /sc ONLOGON /tr "C:\Windows\system32\SubDir\SystemHelper.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4768

C:\Windows\system32\SubDir\SystemHelper.exe
C:\Windows\system32\SubDir\SystemHelper.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SystemHelper.exe

Path C:\Windows\System32\SubDir\SystemHelper.exe
Size 1.2MB
SHA256 60ecb7c972bb35a8a2769e43f493e277d54076b0ec5b41662950118e1c62f216
MD5 2398d869bcc72e15d17c36bba4802f5b
SHA1 cb5fc467217d56780e04b00de5d60ab62dc5c767
SHA512 c3a81ad1062dd190880bf633f9899040acbf4d5fe03dcf2d9434b72e5032ae41fe2de971edb50ac0e3ecab12ca481a98108eae1afab185120a645f7d44ac16f8
SSDEEP 24576:3F/pgxJzck+uGW/yFoBkkAQsOqBSVILH0:3F/pgTYjqqanTsXUILH
TLSH
T1F445BE5173A48A1AE1BE2BB59472C9394BB7BC125935DB4F08D4BC6B7EB37808D10393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/736-5-0x000001394C570000-0x000001394C580000-memory.dmp

Download

memory/736-8-0x000001394C4C0000-0x000001394C4F8000-memory.dmp

Download

memory/736-9-0x000001394C570000-0x000001394C580000-memory.dmp

Download

memory/4464-0-0x0000028423AE0000-0x0000028423C16000-memory.dmp

Download

memory/4464-1-0x000002843E1C0000-0x000002843E1D0000-memory.dmp

Download

memory/4464-2-0x0000028423FC0000-0x0000028423FF4000-memory.dmp

Download