quasar | d23918749f24f722608023363e5f2c2001821844c2c4e78f5b8b4dd03de7c72b

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/10/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sysupdate.exe
Size 4KB
Sample261021-xfa54afs21
SHA256 d23918749f24f722608023363e5f2c2001821844c2c4e78f5b8b4dd03de7c72b
MD5 5cf8ffe03cfdf105951d5e3f74abd1a9
SHA1 cdf4b621c3611ea8067e3ad67d51b90cc413cbc0
SHA512 347e36600e3abb9e48f524217efebe00ba7247b99ddc5f042802108e4c1d1626056e0bc2c4afae5e0a3dfd4d579bc400acfe41c8c55b6bb2961f79f68b81f6c2
SSDEEP 48:6lm1z9EEjbXJryRvklbo7jhdADOulVXQqXSfbNtm:Wez6wNyRj79CnXozNt
TLSH
T110915F16A3D8C266E07B473409F3870227B5B6258922C38E6CD8025EBD227508E63BF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
B6D7F0F9D0177BC652781D54A1E7EE851F5F574E
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
log_directory
2Wu��V��2.C
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral1/memory/2108-41-0x0000022DF74D0000-0x0000022DF7552000-memory.dmp	family_quasar

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	816	powershell.exe
10	2108	powershell.exe
11	2108	powershell.exe
12	2108	powershell.exe
14	2108	powershell.exe
24	816	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2592	cmd.exe
3784	cmd.exe
1428	cmd.exe
2804	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
816	powershell.exe
816	powershell.exe
2108	powershell.exe
2108	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe
816	powershell.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	sysupdate.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	2100	whoami.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	4728	whoami.exe
Token: SeDebugPrivilege	2108	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2804	1476	sysupdate.exe	87
PID 1476 wrote to memory of 2592	1476	sysupdate.exe	89
PID 2804 wrote to memory of 1368	2804	cmd.exe	92
PID 1368 wrote to memory of 1216	1368	conhost.exe	93
PID 1216 wrote to memory of 816	1216	cscript.exe	95
PID 1216 wrote to memory of 3784	1216	cscript.exe	96
PID 3784 wrote to memory of 2100	3784	cmd.exe	97
PID 2592 wrote to memory of 4644	2592	cmd.exe	100
PID 4644 wrote to memory of 4592	4644	conhost.exe	101
PID 4592 wrote to memory of 2108	4592	cscript.exe	102
PID 4592 wrote to memory of 1428	4592	cscript.exe	103
PID 1428 wrote to memory of 4728	1428	cmd.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
"C:\Users\Admin\AppData\Local\Temp\sysupdate.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\sys_update_e8704.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\System32\conhost.exe
    conhost --headless cscript //nologo C:\Users\Admin\AppData\Local\Temp\w9OU.js
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Windows\System32\cscript.exe
      cscript //nologo C:\Users\Admin\AppData\Local\Temp\w9OU.js
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        Badlisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:816
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c whoami /groups
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3784
      - C:\Windows\System32\whoami.exe
        
        whoami /groups
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2100
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\sys_update_6a86a.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\conhost.exe
    conhost --headless cscript //nologo C:\Users\Admin\AppData\Local\Temp\JjiWg.js
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\system32\cscript.exe
      cscript //nologo C:\Users\Admin\AppData\Local\Temp\JjiWg.js
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        Badlisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2108
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c whoami /groups
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1428
      - C:\Windows\system32\whoami.exe
        
        whoami /groups
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
1⤵
PID:1300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
TLSH
T170334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JjiWg.js

Path C:\Users\Admin\AppData\Local\Temp\JjiWg.js
Size 74B
SHA256 8b851a2c77056b40de16127a6227d4fb3d2a408dbbec1e445b42f1a021082e27
MD5 22ad66364ab42ae6661d72e16d3dc528
SHA1 0391205299fddbdb32d97b6550b7d9e2d5e797bd
SHA512 f530a85d462454c4f7d783637efd2352ef84870673df3b4d4787a57d19078b2cf3465a30ccd5ec3d0d29f1ed23bac7934514abdab4787a676128afd1a47567a9
TLSH
T137A011882E0CA088888EE38222A0802E08B28A802283A0A3A0808AC80202A00088002E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_how5hjyj.jym.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_how5hjyj.jym.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sys_update_6a86a.bat

Path C:\Users\Admin\AppData\Local\Temp\sys_update_6a86a.bat
Size 77KB
SHA256 9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a
MD5 01e44e0c09a1baf1d1e575b4d8c0d81c
SHA1 39d341bd1f2c0e204a1ae968d11fba5fee9843d1
SHA512 ecc2536929d3b333de8af975af6a3ebec19c87df995cccfb27388709cfce74fe2bed7dc788376abcbdde944c5d2baddc2c4745faafa6a231de72e0c577b437b0
SSDEEP 1536:6obU79Ck7ZphPKh3tw6Kh2kbEsCLoSKVvQ14mdjKd3x2dg9zwUhCR:6obU7L7shSjDb8oBvQ1MF0dgi1
TLSH
T10D73D0B3B50239293EF0179A58036C497F1FC6C51354E6EF2755A0BBE6BDA47CA0A520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_update_e8704.bat

Path C:\Users\Admin\AppData\Local\Temp\sys_update_e8704.bat
Size 79KB
SHA256 1b9b1fd0583ba73d5209edaa789f02c1cc70b3e0dfda95b6c327fedeab6fb667
MD5 c48e1c2e5434e7638e36045655e6e48f
SHA1 687afe0c79d4e7cd0b754e963a27841948c136e1
SHA512 91581d07280706bb83bced52e3fa1cfe24af23382b3f14b730e0a7f5e4f1d9e1992e770fcec7a5ae4ba3c7b2bb3d85207edadbecac00d85a827997e1c831e466
SSDEEP 1536:XF3WgW70sVifFpyyNvatTxTOE65aFu2xlCLVZlIcsW1nxoMaw:V3W8zyyNvaVQE6ADCxZG3W1/3
TLSH
T13683D073B80535721DF826A7E8810C847F1DD7CA63B1C1DF9A8A54E7A6BE503CE4D690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w9OU.js

Path C:\Users\Admin\AppData\Local\Temp\w9OU.js
Size 115B
SHA256 4883ef250200b804d33a1d1f9ae2ecd1cc0d4441555ee1ba510ba8167958a4e3
MD5 127b286933966bbda277fbd746819a44
SHA1 0aabeae0e4a145dc1039d9b163605920b02b5d68
SHA512 55b470abff3204fd3e59c40da97fe0b618007a0a6f2d56224a99a6e135ca1a75d5f257ae5b2ac381574491de935406a59faa90e37cebb9483ab26bb414424dd3
TLSH
T158B09B608559515725CD56431D44996D50B1D56534D2B1535350708D045ED1594444D5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/816-38-0x0000022EEE1C0000-0x0000022EEE1C4000-memory.dmp

Download

memory/816-43-0x0000022EEEA20000-0x0000022EEEA56000-memory.dmp

Download

memory/816-21-0x0000022EEE640000-0x0000022EEE6B6000-memory.dmp

Download

memory/816-16-0x0000022EEBBD0000-0x0000022EEBBF2000-memory.dmp

Download

memory/816-44-0x0000022EEEA50000-0x0000022EEEA5C000-memory.dmp

Download

memory/816-39-0x0000022EEE7D0000-0x0000022EEE842000-memory.dmp

Download

memory/816-19-0x0000022EEE1D0000-0x0000022EEE214000-memory.dmp

Download

memory/816-42-0x0000022EEEA00000-0x0000022EEEA1C000-memory.dmp

Download

memory/1476-0-0x00000000008D0000-0x00000000008D8000-memory.dmp

Download

memory/1476-1-0x000000001B470000-0x000000001B480000-memory.dmp

Download

memory/2108-41-0x0000022DF74D0000-0x0000022DF7552000-memory.dmp

Download

memory/2108-40-0x0000022DF45F0000-0x0000022DF45F3000-memory.dmp

Download

memory/2108-45-0x0000022DF79E0000-0x0000022DF7A30000-memory.dmp

Download

memory/2108-46-0x0000022DF7AF0000-0x0000022DF7BA2000-memory.dmp

Download

memory/2108-47-0x0000022DF7D80000-0x0000022DF7F42000-memory.dmp

Download

memory/2108-50-0x0000022DF79B0000-0x0000022DF79C2000-memory.dmp

Download

memory/2108-51-0x0000022DF7A70000-0x0000022DF7AAC000-memory.dmp

Download