Analysis
- geolocation tags
cacanadananorth-americatoronto - user interaction
yes - max time kernel
59s - max time network
60s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/11/2026, 15:13
General
- Target Client-built.exe
- Size 3.1MB
- Sample261105-sl63hagg33
- SHA256 33d1b6f999c1c6a51db44136f421f50493ebfea6596a5adc6e4bf21c534282f3
- MD5 82647ca102f745a4c05b5c48280c1caf
- SHA1 626bcac08564e05da1d74f362394e975ba422df0
- SHA512 73609d0c4e0f0837ab66627c07024f2d4eeffdb14ecacb4b8665633b86c0a681450bbf232d2e34827a6ab264dd9ad93f43a04adfd45f0401f5e978ef5976e3b9
- SSDEEP 49152:bvjlL26AaNeWgPhlmVqvMQ7XSK/RXmzGYoGdFTHHB72eh2NT:bvZL26AaNeWgPhlmVqkQ7XSK/R+
- TLSH T1D9E55B1437F85E62E17BD6B3D5B0501663F0F82AF363EB1B618267BA1C53B4098427A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
172.16.0.2:4444
Mutex
-
02d9a560-aca8-449a-972b-3ae605288516
Attributes
-
encryption_key
91E929AE4015FFF66A5CA6A67CB3D989D3D60AB6
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
microsoft_keyboard
-
reconnect_delay
3000
-
startup_key
Microsoft Startup
-
subdirectory
Microsoft
Signatures
- Quasar payload 2 IoCs
resource yara_rule behavioral1/memory/4324-0-0x00000000000F0000-0x0000000000414000-memory.dmp family_quasar behavioral1/files/0x0018000000024299-5.dat family_quasar - Executes dropped EXE 2 IoCs
pid Process 4860 Client.exe 896 Client.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\system32\Microsoft\Client.exe Client-built.exe File opened for modification C:\Windows\system32\Microsoft Client-built.exe File opened for modification C:\Windows\system32\Microsoft\Client.exe Client.exe File opened for modification C:\Windows\system32\Microsoft Client.exe File created C:\Windows\system32\Microsoft\Client.exe Client-built.exe - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings taskmgr.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1224 schtasks.exe 4644 schtasks.exe - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4324 Client-built.exe Token: SeDebugPrivilege 4860 Client.exe Token: SeDebugPrivilege 896 Client.exe Token: SeDebugPrivilege 2884 taskmgr.exe Token: SeSystemProfilePrivilege 2884 taskmgr.exe Token: SeCreateGlobalPrivilege 2884 taskmgr.exe - Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe - Suspicious use of SendNotifyMessage 59 IoCs
pid Process 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe 2884 taskmgr.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4860 Client.exe 2240 OpenWith.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4324 wrote to memory of 1224 4324 Client-built.exe 85 PID 4324 wrote to memory of 4860 4324 Client-built.exe 87 PID 4860 wrote to memory of 4644 4860 Client.exe 90 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft Startup" /sc ONLOGON /tr "C:\Windows\system32\Microsoft\Client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1224
-
-
C:\Windows\system32\Microsoft\Client.exe"C:\Windows\system32\Microsoft\Client.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Microsoft Startup" /sc ONLOGON /tr "C:\Windows\system32\Microsoft\Client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:4644
-
-
-
C:\Windows\system32\Microsoft\Client.exeC:\Windows\system32\Microsoft\Client.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:896
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2884
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4052
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\Microsoft\Client.exe
- Size 3.1MB
- SHA256 33d1b6f999c1c6a51db44136f421f50493ebfea6596a5adc6e4bf21c534282f3
- MD5 82647ca102f745a4c05b5c48280c1caf
- SHA1 626bcac08564e05da1d74f362394e975ba422df0
- SHA512 73609d0c4e0f0837ab66627c07024f2d4eeffdb14ecacb4b8665633b86c0a681450bbf232d2e34827a6ab264dd9ad93f43a04adfd45f0401f5e978ef5976e3b9
- SSDEEP 49152:bvjlL26AaNeWgPhlmVqvMQ7XSK/RXmzGYoGdFTHHB72eh2NT:bvZL26AaNeWgPhlmVqkQ7XSK/R+
- TLSH T1D9E55B1437F85E62E17BD6B3D5B0501663F0F82AF363EB1B618267BA1C53B4098427A7
- MD5 SHA1 SHA512 SSDEEP TLSH