quasar | d23918749f24f722608023363e5f2c2001821844c2c4e78f5b8b4dd03de7c72b

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sysupdate.exe
Size 4KB
Sample261021-xfa54afs21
SHA256 d23918749f24f722608023363e5f2c2001821844c2c4e78f5b8b4dd03de7c72b
MD5 5cf8ffe03cfdf105951d5e3f74abd1a9
SHA1 cdf4b621c3611ea8067e3ad67d51b90cc413cbc0
SHA512 347e36600e3abb9e48f524217efebe00ba7247b99ddc5f042802108e4c1d1626056e0bc2c4afae5e0a3dfd4d579bc400acfe41c8c55b6bb2961f79f68b81f6c2
SSDEEP 48:6lm1z9EEjbXJryRvklbo7jhdADOulVXQqXSfbNtm:Wez6wNyRj79CnXozNt
TLSH
T110915F16A3D8C266E07B473409F3870227B5B6258922C38E6CD8025EBD227508E63BF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
B6D7F0F9D0177BC652781D54A1E7EE851F5F574E
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
log_directory
2Wu��V��2.C
reconnect_delay
3000

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4088-32-0x0000017D29D60000-0x0000017D29DE2000-memory.dmp	family_quasar

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	4088	powershell.exe
10	1256	powershell.exe
11	4088	powershell.exe
12	4088	powershell.exe
13	4088	powershell.exe
14	1256	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1952	cmd.exe
1900	cmd.exe
2688	cmd.exe
5136	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4088	powershell.exe
4088	powershell.exe
4088	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe
1256	powershell.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	sysupdate.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3980	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	1256	powershell.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe
Token: SeDebugPrivilege	3240	whoami.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 1952	4076	sysupdate.exe	89
PID 4076 wrote to memory of 1900	4076	sysupdate.exe	91
PID 1900 wrote to memory of 4680	1900	cmd.exe	93
PID 4680 wrote to memory of 6116	4680	conhost.exe	94
PID 6116 wrote to memory of 4088	6116	cscript.exe	95
PID 6116 wrote to memory of 2688	6116	cscript.exe	96
PID 2688 wrote to memory of 3980	2688	cmd.exe	97
PID 1952 wrote to memory of 2952	1952	cmd.exe	98
PID 2952 wrote to memory of 5012	2952	conhost.exe	99
PID 5012 wrote to memory of 1256	5012	cscript.exe	100
PID 5012 wrote to memory of 5136	5012	cscript.exe	101
PID 5136 wrote to memory of 3240	5136	cmd.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sysupdate.exe
"C:\Users\Admin\AppData\Local\Temp\sysupdate.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\sys_update_9713f.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\System32\conhost.exe
    conhost --headless cscript //nologo C:\Users\Admin\AppData\Local\Temp\w9OU.js
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\System32\cscript.exe
      cscript //nologo C:\Users\Admin\AppData\Local\Temp\w9OU.js
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5012
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        Badlisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1256
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c whoami /groups
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5136
      - C:\Windows\System32\whoami.exe
        
        whoami /groups
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\sys_update_d658b.bat""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\conhost.exe
    conhost --headless cscript //nologo C:\Users\Admin\AppData\Local\Temp\JjiWg.js
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\system32\cscript.exe
      cscript //nologo C:\Users\Admin\AppData\Local\Temp\JjiWg.js
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe
        5⤵
        Badlisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4088
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c whoami /groups
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2688
      - C:\Windows\system32\whoami.exe
        
        whoami /groups
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe
1⤵
PID:5960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 f5c0788f5d245aee0845d0c63135d5686dd7592383416c42f522e03739ea122a
MD5 a4c4fb8f0dd06eb2e75875dd6a87fe28
SHA1 3648e25b6ef1548bc1f4fcaa15a08c352a7cba5a
SHA512 9b5d18378f81ae6bd60bd5ead49ff373135ec5ba15e27f0e18602242e78742e76ca01f0b2d37977a510a20778b1d09da84f63de281b096b4fa3e1661b8bca8b9
SSDEEP 1536:zKLg0mYo2hOovpfKQVCYXflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2VG:zKLg0mYo2hOovpfKQVCYXflJd9YWqiUx
TLSH
T1C8636292E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JjiWg.js

Path C:\Users\Admin\AppData\Local\Temp\JjiWg.js
Size 74B
SHA256 8b851a2c77056b40de16127a6227d4fb3d2a408dbbec1e445b42f1a021082e27
MD5 22ad66364ab42ae6661d72e16d3dc528
SHA1 0391205299fddbdb32d97b6550b7d9e2d5e797bd
SHA512 f530a85d462454c4f7d783637efd2352ef84870673df3b4d4787a57d19078b2cf3465a30ccd5ec3d0d29f1ed23bac7934514abdab4787a676128afd1a47567a9
TLSH
T137A011882E0CA088888EE38222A0802E08B28A802283A0A3A0808AC80202A00088002E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_twi1r0p4.tow.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_twi1r0p4.tow.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

sys_update_9713f.bat

Path C:\Users\Admin\AppData\Local\Temp\sys_update_9713f.bat
Size 79KB
SHA256 1b9b1fd0583ba73d5209edaa789f02c1cc70b3e0dfda95b6c327fedeab6fb667
MD5 c48e1c2e5434e7638e36045655e6e48f
SHA1 687afe0c79d4e7cd0b754e963a27841948c136e1
SHA512 91581d07280706bb83bced52e3fa1cfe24af23382b3f14b730e0a7f5e4f1d9e1992e770fcec7a5ae4ba3c7b2bb3d85207edadbecac00d85a827997e1c831e466
SSDEEP 1536:XF3WgW70sVifFpyyNvatTxTOE65aFu2xlCLVZlIcsW1nxoMaw:V3W8zyyNvaVQE6ADCxZG3W1/3
TLSH
T13683D073B80535721DF826A7E8810C847F1DD7CA63B1C1DF9A8A54E7A6BE503CE4D690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sys_update_d658b.bat

Path C:\Users\Admin\AppData\Local\Temp\sys_update_d658b.bat
Size 77KB
SHA256 9baffa9920c3590d676eea87a3316ddd8d7ebb96a80dc41276244f5fe2e5487a
MD5 01e44e0c09a1baf1d1e575b4d8c0d81c
SHA1 39d341bd1f2c0e204a1ae968d11fba5fee9843d1
SHA512 ecc2536929d3b333de8af975af6a3ebec19c87df995cccfb27388709cfce74fe2bed7dc788376abcbdde944c5d2baddc2c4745faafa6a231de72e0c577b437b0
SSDEEP 1536:6obU79Ck7ZphPKh3tw6Kh2kbEsCLoSKVvQ14mdjKd3x2dg9zwUhCR:6obU7L7shSjDb8oBvQ1MF0dgi1
TLSH
T10D73D0B3B50239293EF0179A58036C497F1FC6C51354E6EF2755A0BBE6BDA47CA0A520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w9OU.js

Path C:\Users\Admin\AppData\Local\Temp\w9OU.js
Size 115B
SHA256 4883ef250200b804d33a1d1f9ae2ecd1cc0d4441555ee1ba510ba8167958a4e3
MD5 127b286933966bbda277fbd746819a44
SHA1 0aabeae0e4a145dc1039d9b163605920b02b5d68
SHA512 55b470abff3204fd3e59c40da97fe0b618007a0a6f2d56224a99a6e135ca1a75d5f257ae5b2ac381574491de935406a59faa90e37cebb9483ab26bb414424dd3
TLSH
T158B09B608559515725CD56431D44996D50B1D56534D2B1535350708D045ED1594444D5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1256-35-0x000001EBC2B00000-0x000001EBC2B36000-memory.dmp

Download

memory/1256-31-0x000001EBC1D00000-0x000001EBC1D04000-memory.dmp

Download

memory/1256-36-0x000001EBC1D30000-0x000001EBC1D3C000-memory.dmp

Download

memory/1256-34-0x000001EBC2260000-0x000001EBC227C000-memory.dmp

Download

memory/1256-33-0x000001EBC21F0000-0x000001EBC2262000-memory.dmp

Download

memory/4076-2-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4076-3-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4076-1-0x00007FFB0212F000-0x00007FFB02130000-memory.dmp

Download

memory/4076-7-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4076-0-0x0000000000F90000-0x0000000000F98000-memory.dmp

Download

memory/4088-32-0x0000017D29D60000-0x0000017D29DE2000-memory.dmp

Download

memory/4088-14-0x0000017D297B0000-0x0000017D297F8000-memory.dmp

Download

memory/4088-25-0x0000017D299D0000-0x0000017D29A46000-memory.dmp

Download

memory/4088-11-0x0000017D29330000-0x0000017D29352000-memory.dmp

Download

memory/4088-37-0x0000017D2B0C0000-0x0000017D2B110000-memory.dmp

Download

memory/4088-38-0x0000017D2B1D0000-0x0000017D2B282000-memory.dmp

Download

memory/4088-39-0x0000017D2B460000-0x0000017D2B622000-memory.dmp

Download

memory/4088-42-0x0000017D2B070000-0x0000017D2B082000-memory.dmp

Download

memory/4088-43-0x0000017D2B150000-0x0000017D2B18C000-memory.dmp

Download

memory/4088-30-0x0000017D29790000-0x0000017D29793000-memory.dmp

Download