quasar | e7fa9494811b479f00405027a8bad59dccaa410ac439bdd046ed2c440d0e101f

Analysis

max time kernel
149s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
skibidi-main/CondoGenerator.exe
Size 3.1MB
Sample260912-nf8a6avhpb
SHA256 e7fa9494811b479f00405027a8bad59dccaa410ac439bdd046ed2c440d0e101f
MD5 5da0a355dcd44b29fdd27a5eba904d8d
SHA1 1099e489937a644376653ab4b5921da9527f50a9
SHA512 289ac0076045bcb1e8b35d572ed27eca424f718b9ef26d821a5cc7ee372203125a6c516b296044efc23ad4d4bd771e1d875cf74107b9205c5312a6c49d37b0a6
SSDEEP 49152:3viI22SsaNYfdPBldt698dBcjHFfRJ6fbR3LoGd5THHB72eh2NT:3vv22SsaNYfdPBldt6+dBcjHFfRJ6x
TLSH
T1E9E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.79:4782

Mutex

956eafb2-7482-407b-bff4-d2b57a1c3d75

Attributes

encryption_key
EFEBD005E03B8B8669985D9A167E2BEF9FFCA477
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral3/memory/3848-0-0x00000000007B0000-0x0000000000AD4000-memory.dmp	family_quasar
behavioral3/files/0x000800000002440f-5.dat	family_quasar

Checks computer location settings 2 TTPs 14 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 15 IoCs

pid	Process
752	Client.exe
3752	Client.exe
760	Client.exe
3028	Client.exe
3328	Client.exe
4484	Client.exe
2396	Client.exe
3444	Client.exe
4760	Client.exe
4272	Client.exe
1632	Client.exe
4560	Client.exe
912	Client.exe
4420	Client.exe
3808	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 14 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2516	cmd.exe
4752	cmd.exe
4776	cmd.exe
2348	cmd.exe
2592	cmd.exe
220	cmd.exe
1972	cmd.exe
1524	cmd.exe
5048	cmd.exe
4860	cmd.exe
408	cmd.exe
2504	cmd.exe
4536	cmd.exe
1368	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
640	PING.EXE
4908	PING.EXE
1752	PING.EXE
2776	PING.EXE
396	PING.EXE
4084	PING.EXE
4912	PING.EXE
4388	PING.EXE
2788	PING.EXE
2892	PING.EXE
2208	PING.EXE
592	PING.EXE
4368	PING.EXE
1776	PING.EXE

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
2208	PING.EXE
2776	PING.EXE
592	PING.EXE
4368	PING.EXE
1776	PING.EXE
640	PING.EXE
4908	PING.EXE
1752	PING.EXE
2892	PING.EXE
396	PING.EXE
4084	PING.EXE
4912	PING.EXE
4388	PING.EXE
2788	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2784	schtasks.exe
1112	schtasks.exe
4904	schtasks.exe
1788	schtasks.exe
4400	schtasks.exe
2508	schtasks.exe
932	schtasks.exe
2356	schtasks.exe
4356	schtasks.exe
416	schtasks.exe
2796	schtasks.exe
4236	schtasks.exe
1744	schtasks.exe
996	schtasks.exe
4360	schtasks.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	CondoGenerator.exe
Token: SeDebugPrivilege	752	Client.exe
Token: SeDebugPrivilege	3752	Client.exe
Token: SeDebugPrivilege	760	Client.exe
Token: SeDebugPrivilege	3028	Client.exe
Token: SeDebugPrivilege	3328	Client.exe
Token: SeDebugPrivilege	4484	Client.exe
Token: SeDebugPrivilege	2396	Client.exe
Token: SeDebugPrivilege	3444	Client.exe
Token: SeDebugPrivilege	4760	Client.exe
Token: SeDebugPrivilege	4272	Client.exe
Token: SeDebugPrivilege	1632	Client.exe
Token: SeDebugPrivilege	4560	Client.exe
Token: SeDebugPrivilege	912	Client.exe
Token: SeDebugPrivilege	4420	Client.exe
Token: SeDebugPrivilege	3808	Client.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
752	Client.exe
760	Client.exe
3028	Client.exe
3328	Client.exe
4484	Client.exe
2396	Client.exe
3444	Client.exe
4760	Client.exe
4272	Client.exe
1632	Client.exe
4560	Client.exe
912	Client.exe
4420	Client.exe
3808	Client.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
752	Client.exe
760	Client.exe
3028	Client.exe
3328	Client.exe
4484	Client.exe
2396	Client.exe
3444	Client.exe
4760	Client.exe
4272	Client.exe
1632	Client.exe
4560	Client.exe
912	Client.exe
4420	Client.exe
3808	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 4400	3848	CondoGenerator.exe	82
PID 3848 wrote to memory of 752	3848	CondoGenerator.exe	84
PID 752 wrote to memory of 2796	752	Client.exe	87
PID 752 wrote to memory of 2592	752	Client.exe	89
PID 2592 wrote to memory of 4552	2592	cmd.exe	91
PID 2592 wrote to memory of 1752	2592	cmd.exe	92
PID 2592 wrote to memory of 760	2592	cmd.exe	93
PID 760 wrote to memory of 2784	760	Client.exe	94
PID 760 wrote to memory of 4536	760	Client.exe	96
PID 4536 wrote to memory of 2024	4536	cmd.exe	98
PID 4536 wrote to memory of 2788	4536	cmd.exe	99
PID 4536 wrote to memory of 3028	4536	cmd.exe	100
PID 3028 wrote to memory of 1112	3028	Client.exe	101
PID 3028 wrote to memory of 220	3028	Client.exe	103
PID 220 wrote to memory of 1424	220	cmd.exe	105
PID 220 wrote to memory of 2892	220	cmd.exe	106
PID 220 wrote to memory of 3328	220	cmd.exe	109
PID 3328 wrote to memory of 2508	3328	Client.exe	110
PID 3328 wrote to memory of 1368	3328	Client.exe	112
PID 1368 wrote to memory of 4896	1368	cmd.exe	114
PID 1368 wrote to memory of 2208	1368	cmd.exe	115
PID 1368 wrote to memory of 4484	1368	cmd.exe	116
PID 4484 wrote to memory of 2356	4484	Client.exe	117
PID 4484 wrote to memory of 2516	4484	Client.exe	119
PID 2516 wrote to memory of 4516	2516	cmd.exe	121
PID 2516 wrote to memory of 2776	2516	cmd.exe	122
PID 2516 wrote to memory of 2396	2516	cmd.exe	123
PID 2396 wrote to memory of 932	2396	Client.exe	124
PID 2396 wrote to memory of 4752	2396	Client.exe	126
PID 4752 wrote to memory of 4296	4752	cmd.exe	128
PID 4752 wrote to memory of 592	4752	cmd.exe	129
PID 4752 wrote to memory of 3444	4752	cmd.exe	130
PID 3444 wrote to memory of 4356	3444	Client.exe	131
PID 3444 wrote to memory of 1972	3444	Client.exe	133
PID 1972 wrote to memory of 976	1972	cmd.exe	135
PID 1972 wrote to memory of 4368	1972	cmd.exe	136
PID 1972 wrote to memory of 4760	1972	cmd.exe	137
PID 4760 wrote to memory of 4236	4760	Client.exe	138
PID 4760 wrote to memory of 1524	4760	Client.exe	140
PID 1524 wrote to memory of 1988	1524	cmd.exe	142
PID 1524 wrote to memory of 396	1524	cmd.exe	143
PID 1524 wrote to memory of 4272	1524	cmd.exe	144
PID 4272 wrote to memory of 1744	4272	Client.exe	145
PID 4272 wrote to memory of 5048	4272	Client.exe	147
PID 5048 wrote to memory of 2188	5048	cmd.exe	149
PID 5048 wrote to memory of 1776	5048	cmd.exe	150
PID 5048 wrote to memory of 1632	5048	cmd.exe	151
PID 1632 wrote to memory of 4904	1632	Client.exe	152
PID 1632 wrote to memory of 4776	1632	Client.exe	154
PID 4776 wrote to memory of 3804	4776	cmd.exe	156
PID 4776 wrote to memory of 640	4776	cmd.exe	157
PID 4776 wrote to memory of 4560	4776	cmd.exe	158
PID 4560 wrote to memory of 996	4560	Client.exe	159
PID 4560 wrote to memory of 4860	4560	Client.exe	161
PID 4860 wrote to memory of 5020	4860	cmd.exe	163
PID 4860 wrote to memory of 4908	4860	cmd.exe	164
PID 4860 wrote to memory of 912	4860	cmd.exe	165
PID 912 wrote to memory of 416	912	Client.exe	166
PID 912 wrote to memory of 408	912	Client.exe	168
PID 408 wrote to memory of 2388	408	cmd.exe	170
PID 408 wrote to memory of 4084	408	cmd.exe	171
PID 408 wrote to memory of 4420	408	cmd.exe	172
PID 4420 wrote to memory of 1788	4420	Client.exe	173
PID 4420 wrote to memory of 2504	4420	Client.exe	175

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\skibidi-main\CondoGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\skibidi-main\CondoGenerator.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4400
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9mexobW1vpdH.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:4552
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1752
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:760
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2784
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DYPuRqHkCytj.bat" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4536
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2024
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2788
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1112
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zD1PKTem03tk.bat" "
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1424
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2892
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YWdcYSP9kUcK.bat" "
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:4896
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2208
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6D54zDdgEgqS.bat" "
        11⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4516
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2776
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:932
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ejQgBt63hEgQ.bat" "
        13⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:4296
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:592
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4356
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Olb60K5VEgEk.bat" "
        15⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:976
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4368
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\83MHB472zDnh.bat" "
        17⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:1988
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:396
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4272
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1744
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Udjz8AknSXZr.bat" "
        19⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2188
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1776
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4904
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\K4FF6VbczOff.bat" "
        21⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:3804
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:640
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4560
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f7YY1jP9e117.bat" "
        23⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:5020
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4908
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:416
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0y7dozsFiao7.bat" "
        25⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:2388
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4084
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zQTwoXdldSgE.bat" "
        27⤵
        Executes a command shell one-liner
        
        PID:2504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:4692
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4912
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3808
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4360
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DwX9IhZawssS.bat" "
        29⤵
        Executes a command shell one-liner
        
        PID:2348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4488
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4388

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

0y7dozsFiao7.bat

Path C:\Users\Admin\AppData\Local\Temp\0y7dozsFiao7.bat
Size 207B
SHA256 60684cae6d289c9d7dfedc63a6c8768e5374e50365c7a7df03766348ad26ccec
MD5 7957a58c509bccb4fc2fa33b2709be94
SHA1 2a15c52879dd09d7bd49d074bd6e43f8cb8d7aa4
SHA512 d881596d62b17a1a11083a2819720f08f5610790e47927774658f4b0de51769cde2b3804077c7948333ac33cc26d050df867d8048bc89b459baa9febbea9c701
TLSH
T1F9D022022380CE9E450018471EA5A388F0AE08AB2F08BDA28602889D439699CB9AB1C2
MD5 SHA1 SHA512 TLSH

Submit Download

6D54zDdgEgqS.bat

Path C:\Users\Admin\AppData\Local\Temp\6D54zDdgEgqS.bat
Size 207B
SHA256 d8869a6459db1abf6f45d21d620e10cacac673106b680e8cd55a2c9afec7c383
MD5 9bf3a4e42e5e0a53c03ae95fe5e914b0
SHA1 1ddc2ac8b3a1f2811f0c7bdc2743f3d8a3892e3b
SHA512 4a607eb76063e58f811b8de5f7488decc1540aa461ed7232fb785ebe46638b7b3387fade2db835ea8f444326be11bd09e674d6a1900f7881968d4959cd966fee
TLSH
T11BD023013340CD9D450158471F65F388B09F04AB2F09BD718511889C038684D755B142
MD5 SHA1 SHA512 TLSH

Submit Download

83MHB472zDnh.bat

Path C:\Users\Admin\AppData\Local\Temp\83MHB472zDnh.bat
Size 207B
SHA256 b2f0dc0b7cb4278a444a51f180b8e5f925d2f07163d491e47a5969e7de2897ff
MD5 f819fde17d154d1d476683b2d89ee708
SHA1 06960ec385e9c778667b069fee89a583033cbb72
SHA512 771bbd00f089516e5d7d2e6f25fef941aad3fc77e5b00bfccec2365c48f2ad8b1f23b38cc0a4b3f38a00c9691bca5f2a625d8ea5d90f110ae4e6abdd84e4343a
TLSH
T186D0230123C0CD5F850118471DA56288B0BA08F66F0D7D71461188DC0386D8CB55F542
MD5 SHA1 SHA512 TLSH

Submit Download

9mexobW1vpdH.bat

Path C:\Users\Admin\AppData\Local\Temp\9mexobW1vpdH.bat
Size 207B
SHA256 116e8446398f170a75f06e5aedad20a621f5071695525788a530060d761b5e6c
MD5 e6f3b8c0a282548878db287cc1a77ad9
SHA1 4366b5edc0e851fedeeda72694bcc37b92706430
SHA512 a48c073f398b110b2cd01495d6cf626d85570bfd707b35df68fb83907b16130b4f759991a72a446118f2a21b5a6e110cc9c10a8fa3600cff3bca0f16a12589ea
TLSH
T137D022012780CEAF45005C471EA6A68CB0EE04AA2F09BDB286218C9C039698CB5AB682
MD5 SHA1 SHA512 TLSH

Submit Download

DYPuRqHkCytj.bat

Path C:\Users\Admin\AppData\Local\Temp\DYPuRqHkCytj.bat
Size 207B
SHA256 425bd7ecb8efa16e1130f38360f4b9cbcacd583472c01f280715506a13d1592d
MD5 0ed1f6f406672beed24ba64420e3e972
SHA1 9bc3c87720186c40d51fb176c6e801b74193057f
SHA512 fa47d514ea99cebbd369f014f0308648ca86bbf7858143a5a991538c8196d5a5634f6d44cad7556c03a865584e096b0882458af275b98463d4a3e7c7cb491ecb
TLSH
T162D023033740CD5E450118475EA5728CB0EA08BA1F48BD624501489C8387C4C759F541
MD5 SHA1 SHA512 TLSH

Submit Download

DwX9IhZawssS.bat

Path C:\Users\Admin\AppData\Local\Temp\DwX9IhZawssS.bat
Size 207B
SHA256 31cce4eed784d9d62a90cca695080bdc43c7416300f911625a971adff826d625
MD5 a752071d0588114b4b99c093a512c64b
SHA1 1388e6e83a85fb882cfa7405b7e97205aee0c86e
SHA512 cc766201b006bfbf200691b3133712502746ad882d45d826699b2b11e7bf929b03e749cd9cb8b5d360bfcc4a71ddc19172f28dd30562761856298d779cb63259
TLSH
T144D023016740CD5D450018475D76A68CB09A04AB1F08FD72450188DC4786C4C759B1C1
MD5 SHA1 SHA512 TLSH

Submit Download

K4FF6VbczOff.bat

Path C:\Users\Admin\AppData\Local\Temp\K4FF6VbczOff.bat
Size 207B
SHA256 e40dd37a4c0f7d662c357fd2f80cbeeea5bf1054df681d2a0f9ab8879ec619a5
MD5 1dff05a345e94747ca45954f1c034faf
SHA1 e607610be28e03f5692fabd7c9856558bf4665a1
SHA512 9f971fdc4f1421f1d9e49190727dcd34a8d75225cc2008804643c8d071858530093c45ada69edf5c97ff2c6504a3305507cc066e0f07b1542025e089f91088ae
TLSH
T17AD023013740CD5E550019471D65F28CF09F44A61F0C7D61C5014C9C038789C755B282
MD5 SHA1 SHA512 TLSH

Submit Download

Olb60K5VEgEk.bat

Path C:\Users\Admin\AppData\Local\Temp\Olb60K5VEgEk.bat
Size 207B
SHA256 68c5d3202624a72c867c24de48165cdf26676a440623682310566770bf8db883
MD5 17c012c54dc7adb9c9414936b4f20196
SHA1 aa9da02102621f77ecfd77dbc3e9143c3f027dcf
SHA512 86c1ac8690dc46387cc8e17c71752d19a3464d100615aa8253794f908dcfcf5f2a9c38a9ca7886e8ade828c840563ac72ae799b784371d71bd68486893329219
TLSH
T1B6D023017341CDDD450158471EE576C8B0AB04AE1F087D614506489D138788CF55B142
MD5 SHA1 SHA512 TLSH

Submit Download

Udjz8AknSXZr.bat

Path C:\Users\Admin\AppData\Local\Temp\Udjz8AknSXZr.bat
Size 207B
SHA256 51bce201b227b74f00a561559f6cc08ed0cf5c60a77d24e935434f8ef4b92d5e
MD5 2a7918ee550e4fa4e4e0d60a6bb90094
SHA1 2ec884b24c909ff09d22338e2c81768f8378c1ca
SHA512 5d762d0ed6ac3e8d65490c795c25806386964832ae51ecc3a4fe52a9b98c3e7e9cb295752663005c79a9e43ea7614234f68d8dad2b1f65a84ce42a3d199bf1e3
TLSH
T10CD023012380CD9ED5001C971D65E388F09E04AA1F087D624605489C1387C4C755B583
MD5 SHA1 SHA512 TLSH

Submit Download

YWdcYSP9kUcK.bat

Path C:\Users\Admin\AppData\Local\Temp\YWdcYSP9kUcK.bat
Size 207B
SHA256 95cd5a5833010068a12228a0feb9c8d4b5819c2dc4e3461b5628b3c28e330933
MD5 46e93234e5f0cbeb474da759b6c655a8
SHA1 c287471a57aa7fec4e997029ec2e9100b4f3a763
SHA512 322d9a758146cc7aa0e18d02ee4d16ee9e3dc07997abac2fdbe8c6e043cf1282b141b2dc3342cf3a584c47a0bb423b307ff6960fbdd61070a40c3ab4b6fa080a
TLSH
T163D023013340CD5D55001C472D656688B0AE04EA2F087D628515889C03C795C755B141
MD5 SHA1 SHA512 TLSH

Submit Download

ejQgBt63hEgQ.bat

Path C:\Users\Admin\AppData\Local\Temp\ejQgBt63hEgQ.bat
Size 207B
SHA256 b7dd3ba2ab76d0313aae70305ed9225530ae060ef820ec3669499a6e1154667d
MD5 b116c89a9c733fdf632b370821e53832
SHA1 8df1509bf55857936d2a9abf7e8acb27ff837cc7
SHA512 1b22c5aa57a4e57b63606f22b045d473cd9f0616239dce0253180e6bb1ad461d35f44b6ebed5859319b5ec6a9e1560bd8ed13ab68a0eeb097a41306c4b21321c
TLSH
T1CFD023012340CD5D550018471DB57288B09A04EA1F4CFD714606889C578788C759B142
MD5 SHA1 SHA512 TLSH

Submit Download

f7YY1jP9e117.bat

Path C:\Users\Admin\AppData\Local\Temp\f7YY1jP9e117.bat
Size 207B
SHA256 57fda4526d739808dc272d0fd49297681fe9af993c8e7795c7a3e85327d6b739
MD5 deff9fba0315987b61279af185bbbe41
SHA1 71e7865ccb0025c617bd2ef38339aa22a00ca0ab
SHA512 8cbe91cfdd303df966b3ed0565d91251c7f0cedd909a7e03dc291d78995a67693d2219dfb83105ee50e3f37cb4eafc06531c756e97b8b4964ed17e5c488e9936
TLSH
T1FBD023023380CD5E450118471D756288B0DA04A72F497D61850188DC438694C755F181
MD5 SHA1 SHA512 TLSH

Submit Download

zD1PKTem03tk.bat

Path C:\Users\Admin\AppData\Local\Temp\zD1PKTem03tk.bat
Size 207B
SHA256 b0825576d8c7a8d6586d415ce4b8572874f48433cfeff7bd03174187b110b6a2
MD5 dc7f66aecfc7fd02ebdfcb58837a79eb
SHA1 2ae06c9630c5212bb51d27108784b1123c643638
SHA512 e0673c46f32ca5154c802911501531023fcf81421b66d839964fab22305b8078e4f89e1c0b3ea9fdb6154feb0feee2db8c1f0bc7d2a15ffc132a918e308f0e17
TLSH
T195D023012340CE9D450158471EB7B288B09F04B72F087D614511889C03C7D4C759F141
MD5 SHA1 SHA512 TLSH

Submit Download

zQTwoXdldSgE.bat

Path C:\Users\Admin\AppData\Local\Temp\zQTwoXdldSgE.bat
Size 207B
SHA256 4e61f842252a867764db1a35f8222efc6412b94ab2f8344aaf54c4ed1187b6c4
MD5 04523caa426d2e98abef6c1d30a67f5c
SHA1 87415f11d7eca4967769e4066d649dc72f3bd372
SHA512 5c8c37958f5d0f88839b9b246b15ae387d20bb6e035fb31c1eabde9a5ee0e0191ff9a7bd5aba88cc68d3e5e6aadecdba767e02f1db610be0bc0e4d28e1ebd693
TLSH
T169D0230133C0CD5D5500188B5D756288F0AE04AA1F48BDB189014CDC438788C795B981
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 e7fa9494811b479f00405027a8bad59dccaa410ac439bdd046ed2c440d0e101f
MD5 5da0a355dcd44b29fdd27a5eba904d8d
SHA1 1099e489937a644376653ab4b5921da9527f50a9
SHA512 289ac0076045bcb1e8b35d572ed27eca424f718b9ef26d821a5cc7ee372203125a6c516b296044efc23ad4d4bd771e1d875cf74107b9205c5312a6c49d37b0a6
SSDEEP 49152:3viI22SsaNYfdPBldt698dBcjHFfRJ6fbR3LoGd5THHB72eh2NT:3vv22SsaNYfdPBldt6+dBcjHFfRJ6x
TLSH
T1E9E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/752-12-0x000000001D960000-0x000000001DA12000-memory.dmp

Download

memory/752-11-0x000000001D850000-0x000000001D8A0000-memory.dmp

Download

memory/752-8-0x0000000000C70000-0x0000000000C80000-memory.dmp

Download

memory/3848-0-0x00000000007B0000-0x0000000000AD4000-memory.dmp

Download

memory/3848-1-0x000000001B7C0000-0x000000001B7D0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads