quasar | c9a1a10f3b4a86c9779021e6d7744794b7815991f4d9e7bbc6249990d9edf75c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample261113-neyqbsty4l
SHA256 c9a1a10f3b4a86c9779021e6d7744794b7815991f4d9e7bbc6249990d9edf75c
MD5 d382c0ebadd50369fa136acdd4267b33
SHA1 e9fdaed2ff7385855fae79ca91780f0e06212988
SHA512 aee72ee4a96c53b5144d57431c44b3aac8d803b56e7e45efb9bc618314945014ae53e986b303dd6bc0c5e52855983feb493b3b99f703ef56b8ec3dd5ecb4d56f
SSDEEP 49152:fvgz92YpaQI6oPZlhP3ReybewoMB/SBxeLoGdJTHHB72eh2NT:fv692YpaQI6oPZlhP3Yybewou/t
TLSH
T1F0E56B0437F85E33E56BD2B3D5B05026A3F0F82AF363EB1B519167BA1C53B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

cat.coinium.org:443
www.cat.coinium.org:443
cat.coinium.org:80
www.cat.coinium.org:80

Mutex

4f137fa5-913b-44d0-9988-f058d27cff9f

Attributes

encryption_key
ED3227F773701D05083B11A65776F95F93EEEF5E
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/4540-0-0x0000000000DA0000-0x00000000010C4000-memory.dmp	family_quasar
behavioral1/files/0x0007000000024636-5.dat	family_quasar

Checks computer location settings 2 TTPs 11 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 12 IoCs

pid	Process
5616	Client.exe
5536	Client.exe
4064	Client.exe
772	Client.exe
680	Client.exe
2496	Client.exe
1212	Client.exe
4640	Client.exe
5272	Client.exe
4760	Client.exe
4496	Client.exe
3912	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5544	cmd.exe
1208	cmd.exe
3988	cmd.exe
4504	cmd.exe
5892	cmd.exe
6108	cmd.exe
5604	cmd.exe
3620	cmd.exe
872	cmd.exe
4872	cmd.exe
2892	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 22 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Client.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5104	PING.EXE
3196	PING.EXE
4688	PING.EXE
3168	PING.EXE
3896	PING.EXE
5900	PING.EXE
5500	PING.EXE
688	PING.EXE
2348	PING.EXE
5908	PING.EXE
1632	PING.EXE

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
5500	PING.EXE
688	PING.EXE
3168	PING.EXE
3896	PING.EXE
5908	PING.EXE
5104	PING.EXE
3196	PING.EXE
4688	PING.EXE
2348	PING.EXE
1632	PING.EXE
5900	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5336	schtasks.exe
4952	schtasks.exe
4232	schtasks.exe
1952	schtasks.exe
4120	schtasks.exe
4388	schtasks.exe
4572	schtasks.exe
5972	schtasks.exe
5876	schtasks.exe
6016	schtasks.exe
1768	schtasks.exe
5228	schtasks.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	Client-built.exe
Token: SeDebugPrivilege	5616	Client.exe
Token: SeDebugPrivilege	5536	Client.exe
Token: SeDebugPrivilege	4064	Client.exe
Token: SeDebugPrivilege	772	Client.exe
Token: SeDebugPrivilege	680	Client.exe
Token: SeDebugPrivilege	2496	Client.exe
Token: SeDebugPrivilege	1212	Client.exe
Token: SeDebugPrivilege	4640	Client.exe
Token: SeDebugPrivilege	5272	Client.exe
Token: SeDebugPrivilege	4760	Client.exe
Token: SeDebugPrivilege	4496	Client.exe
Token: SeDebugPrivilege	3912	Client.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
5616	Client.exe
4064	Client.exe
772	Client.exe
680	Client.exe
2496	Client.exe
1212	Client.exe
4640	Client.exe
5272	Client.exe
4760	Client.exe
4496	Client.exe
3912	Client.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
5616	Client.exe
4064	Client.exe
772	Client.exe
680	Client.exe
2496	Client.exe
1212	Client.exe
4640	Client.exe
5272	Client.exe
4760	Client.exe
4496	Client.exe
3912	Client.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
5616	Client.exe
4064	Client.exe
772	Client.exe
680	Client.exe
2496	Client.exe
1212	Client.exe
4640	Client.exe
5272	Client.exe
4760	Client.exe
4496	Client.exe
3912	Client.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4120	4540	Client-built.exe	85
PID 4540 wrote to memory of 5616	4540	Client-built.exe	87
PID 5616 wrote to memory of 1768	5616	Client.exe	91
PID 5616 wrote to memory of 5544	5616	Client.exe	97
PID 5544 wrote to memory of 5864	5544	cmd.exe	99
PID 5544 wrote to memory of 5104	5544	cmd.exe	100
PID 5544 wrote to memory of 4064	5544	cmd.exe	106
PID 4064 wrote to memory of 5228	4064	Client.exe	107
PID 4064 wrote to memory of 1208	4064	Client.exe	110
PID 1208 wrote to memory of 5908	1208	cmd.exe	112
PID 1208 wrote to memory of 5500	1208	cmd.exe	113
PID 1208 wrote to memory of 772	1208	cmd.exe	117
PID 772 wrote to memory of 4388	772	Client.exe	118
PID 772 wrote to memory of 3988	772	Client.exe	122
PID 3988 wrote to memory of 2684	3988	cmd.exe	124
PID 3988 wrote to memory of 3196	3988	cmd.exe	125
PID 3988 wrote to memory of 680	3988	cmd.exe	127
PID 680 wrote to memory of 5336	680	Client.exe	128
PID 680 wrote to memory of 872	680	Client.exe	131
PID 872 wrote to memory of 2288	872	cmd.exe	133
PID 872 wrote to memory of 688	872	cmd.exe	134
PID 872 wrote to memory of 2496	872	cmd.exe	136
PID 2496 wrote to memory of 4572	2496	Client.exe	137
PID 2496 wrote to memory of 4504	2496	Client.exe	141
PID 4504 wrote to memory of 3004	4504	cmd.exe	143
PID 4504 wrote to memory of 4688	4504	cmd.exe	144
PID 4504 wrote to memory of 1212	4504	cmd.exe	146
PID 1212 wrote to memory of 5972	1212	Client.exe	147
PID 1212 wrote to memory of 5892	1212	Client.exe	150
PID 5892 wrote to memory of 1676	5892	cmd.exe	152
PID 5892 wrote to memory of 2348	5892	cmd.exe	153
PID 5892 wrote to memory of 4640	5892	cmd.exe	155
PID 4640 wrote to memory of 5876	4640	Client.exe	156
PID 4640 wrote to memory of 6108	4640	Client.exe	159
PID 6108 wrote to memory of 3964	6108	cmd.exe	161
PID 6108 wrote to memory of 3168	6108	cmd.exe	162
PID 6108 wrote to memory of 5272	6108	cmd.exe	164
PID 5272 wrote to memory of 4952	5272	Client.exe	165
PID 5272 wrote to memory of 5604	5272	Client.exe	168
PID 5604 wrote to memory of 4936	5604	cmd.exe	170
PID 5604 wrote to memory of 3896	5604	cmd.exe	171
PID 5604 wrote to memory of 4760	5604	cmd.exe	173
PID 4760 wrote to memory of 4232	4760	Client.exe	174
PID 4760 wrote to memory of 3620	4760	Client.exe	177
PID 3620 wrote to memory of 384	3620	cmd.exe	179
PID 3620 wrote to memory of 5908	3620	cmd.exe	180
PID 3620 wrote to memory of 4496	3620	cmd.exe	182
PID 4496 wrote to memory of 6016	4496	Client.exe	183
PID 4496 wrote to memory of 4872	4496	Client.exe	186
PID 4872 wrote to memory of 2060	4872	cmd.exe	188
PID 4872 wrote to memory of 1632	4872	cmd.exe	189
PID 4872 wrote to memory of 3912	4872	cmd.exe	191
PID 3912 wrote to memory of 1952	3912	Client.exe	192
PID 3912 wrote to memory of 2892	3912	Client.exe	195
PID 2892 wrote to memory of 1856	2892	cmd.exe	197
PID 2892 wrote to memory of 5900	2892	cmd.exe	198

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4120
- C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
  "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\We8g0tfLs5Jq.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5864
  - - C:\Windows\system32\PING.EXE
      ping -n 10 localhost
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5104
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4064
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e8zPz4SHebSH.bat" "
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:1208
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:5908
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5500
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4388
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2zPJpLCYTdD3.bat" "
        7⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2684
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3196
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5336
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dV0edUjbXt1e.bat" "
        9⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2288
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:688
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4572
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tkRP14FByuvb.bat" "
        11⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:3004
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4688
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5972
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\f90MENIrX0SD.bat" "
        13⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1676
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4640
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5876
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EkGcQsIdx7ex.bat" "
        15⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:6108
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:3964
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3168
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5272
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fqKuCsdiaRP2.bat" "
        17⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:4936
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3896
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4232
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fwwmx0HloxRK.bat" "
        19⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3620
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:384
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5908
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6016
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\WW4f49Hiv5Ud.bat" "
        21⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:2060
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1632
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Checks computer location settings
        Executes dropped EXE
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3912
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1952
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yAprVRhqrDkU.bat" "
        23⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:1856
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5900

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
Size 1KB
SHA256 ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
MD5 baf55b95da4a601229647f25dad12878
SHA1 abc16954ebfd213733c4493fc1910164d825cac8
SHA512 24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545
TLSH
T1B521CD712376B1D889163F422C5D2A8007BF0335BA50DE1CB9A9725ED9260171F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

2zPJpLCYTdD3.bat

Path C:\Users\Admin\AppData\Local\Temp\2zPJpLCYTdD3.bat
Size 207B
SHA256 2c36fa934973bfc991749bf3426150e3600ec259fc338008123934c3db5bf262
MD5 0413ed9d1fc8d1ecd242e223dc2f95aa
SHA1 42e39ef4160fc5f01a6bebeeb6e6d64278723783
SHA512 b2880eb270dd11b60c28a2a93c3f482611eee61740cc409591d72f2d9f919c4e29199ab21463477b21ffe64044b9611eea5b7c36d3a5d713c2f58f2acb86da15
TLSH
T115D023112740CD9D450058471DA96288F0AA04A61F49BD714501CC9C438684C755B141
MD5 SHA1 SHA512 TLSH

Submit Download

EkGcQsIdx7ex.bat

Path C:\Users\Admin\AppData\Local\Temp\EkGcQsIdx7ex.bat
Size 207B
SHA256 bdcad55a065c2223eaa701b19f3055f9152feeda3f0f7661566a153a3b7041f6
MD5 d252b784872d0e88ea622c71de6f02a7
SHA1 9602a594ba10699555a33f8ccdb8a44cac13947f
SHA512 aa6fa09cdbd00709f408390a2137e33779adc2b6a1cc50a0044253aaf7f1f04fad44e53cef2fe65662421fd57bda944071171411b9a3164a483ba3e955a40b1e
TLSH
T149D023416340CD6D450418475D756688B0DB04A62F087D714611CC9C438684CB55B142
MD5 SHA1 SHA512 TLSH

Submit Download

WW4f49Hiv5Ud.bat

Path C:\Users\Admin\AppData\Local\Temp\WW4f49Hiv5Ud.bat
Size 207B
SHA256 0cf2c656dfb0548c39d1c19076f8d44e2b498b8d73748ece4366427106f94eb9
MD5 6f637af675e6fb05eb2ad07176af6083
SHA1 55dcf03f79fb4e721fae49fd7739ecb2aeb4da51
SHA512 e5d0d52e27791b62b4fa28b9ebba134e79a5f5eea7c7c859316f2bf5d5c176b314254dc76428647b4616856f68777b3af127f2483410238a2061d044bb898ab1
TLSH
T121D022013781CE9E46101C471EA5A288F0BE04AA2F09BDA286118C9C4386D9CB59B2C2
MD5 SHA1 SHA512 TLSH

Submit Download

We8g0tfLs5Jq.bat

Path C:\Users\Admin\AppData\Local\Temp\We8g0tfLs5Jq.bat
Size 207B
SHA256 0ca8cda5009944c5302412107e03fc6ada9df4291cb6f15504e02a2a35901405
MD5 5802e938e735e6ca2bce91ada204ba10
SHA1 ea325de616710346a56732072f2ed919bb27d8d7
SHA512 1a801bbfe98c45fc2b47dc5730ef498c9b08f262d6471b096c8726e6f51ad908f9ebea9b3c7526e72d047281874a58cbeba10493779d6df436ef0ef00858a9bf
TLSH
T118D023113740CD5D45001C471D69678CB0AA44A61F487DA24605889C038784C759B181
MD5 SHA1 SHA512 TLSH

Submit Download

dV0edUjbXt1e.bat

Path C:\Users\Admin\AppData\Local\Temp\dV0edUjbXt1e.bat
Size 207B
SHA256 da59b464978a37d40ec5024f0b3fb4e569f8031829c7e93819318f761ce6c324
MD5 a0c3c626f5c714c343aeade39d07937e
SHA1 e58bf4fb3783cdcf1546950ac5bcf88219167039
SHA512 2a7eaffba8d2417d7926e193380a3439b18d8a89f7f5ef4ece9b0e27a9f1958242aa129b6107a2827e2a7f7f9c8ce417077400a0a51d3e79b17a797020fdfb57
TLSH
T175D023012740CE9D4500184B5DA5A68CB0AA04BA3F097D61C515489C038799C75DF142
MD5 SHA1 SHA512 TLSH

Submit Download

e8zPz4SHebSH.bat

Path C:\Users\Admin\AppData\Local\Temp\e8zPz4SHebSH.bat
Size 207B
SHA256 369e87b9a6b9536e1cb1d79ea01aaad726466bd0850a2264e9996165b0f0f594
MD5 7dc9e204a5453f94175bbb52b300cb33
SHA1 e5175027d64dd26b73decffa9199999548baf82e
SHA512 c411aacddc7ea62a74e922b0591a0752e1fb217ce4644e1fa3158d97dcd9673d44bac043be1c645b37130b3e395a8b38b2751715b42e1670059138422ff4e545
TLSH
T1F6D022012381CE9E550418476EA5B7C8B0AE08BA2F0CBDB2C601889C438689CB59B582
MD5 SHA1 SHA512 TLSH

Submit Download

f90MENIrX0SD.bat

Path C:\Users\Admin\AppData\Local\Temp\f90MENIrX0SD.bat
Size 207B
SHA256 4773b5f30fc7bb0c5948f8fbc7ca86d1d973aca6ec6498b3e0a4f59a3732a714
MD5 6dd5790c2fb0411bf6f93feccb1cee49
SHA1 ea30836f42c70f574cbc1b848697e86dbe75b5a0
SHA512 493989bbde5ebe2af00851225f6939485b1296c69ae7a61349572332d4c7005b4f2b9ea99a2b4876959f6c98f9407196de8ec0a88d2cb3dcd1d5096d22442ec4
TLSH
T1A9D022412382CE9E850018475EA5A389F0AE08AB2F08BDA386058CDC438698CB5AF282
MD5 SHA1 SHA512 TLSH

Submit Download

fqKuCsdiaRP2.bat

Path C:\Users\Admin\AppData\Local\Temp\fqKuCsdiaRP2.bat
Size 207B
SHA256 22117f3339aae663a7153c7a5141ceb5e2fcdc546d40a63c6484c1e8324ff497
MD5 f42ae1a2713f727fbce5903c2204fa1c
SHA1 76a26f2277145213f4f85eb208f89d46e2217c67
SHA512 d6ac2f05875ae0dc3e243a8d422c751166527445e4fb784d48e4867cba1f2c80b89e8c4e2428cbdc30fef54fdf3d23b264be4f28731649439cd6b85a0206b971
TLSH
T10AD023412340CE5D45055C471EB5A288B09A04E61F0CBD614711489C138784C799F181
MD5 SHA1 SHA512 TLSH

Submit Download

fwwmx0HloxRK.bat

Path C:\Users\Admin\AppData\Local\Temp\fwwmx0HloxRK.bat
Size 207B
SHA256 cf11fbe91c4e2f2ea1510da9de3d9356263a85a93659ec9b29ae61225c726a9c
MD5 b217928d9bf2e65289b16bec1e536d39
SHA1 d3adfdcce430a4468b2676cf8206ddc5348d834d
SHA512 7f82c38454ab91dc0f854045245e20152b414838d99223b70a11173f0822c1bfd0081eeb59994080fcace57310eaf23461566d62e865c1d01213c69441aaf73b
TLSH
T10CD023016341CD5D450058471DA56288B09B04A61F097D62C605489C43C785CB55B141
MD5 SHA1 SHA512 TLSH

Submit Download

tkRP14FByuvb.bat

Path C:\Users\Admin\AppData\Local\Temp\tkRP14FByuvb.bat
Size 207B
SHA256 9eb9ef6d5e87eee6c784d17b16dc87b8291571f90710c774779b70f854dacdbd
MD5 ed6f73c2c8c1649fb38de36e8c97306c
SHA1 3025db00dbf247b91d312ac69e20e49157f65259
SHA512 da866670d72ddd8cfa96a752b7d8e170a12abd4032ef2fbaa4a731ba35e8bb7041208c45e703d46ff0cdcaf1fa57183adedd967f41bb416cb12efd62bc6caea3
TLSH
T171D023012381CD5D4504184B5D65A2CCB09A04F61F097D71C6018CDD03C694C755B181
MD5 SHA1 SHA512 TLSH

Submit Download

yAprVRhqrDkU.bat

Path C:\Users\Admin\AppData\Local\Temp\yAprVRhqrDkU.bat
Size 207B
SHA256 4f609f92620877d55985e30026f7b168a8cad2407e7068d53b49c2c7128bed70
MD5 e3c109db7e83697c2434e05a32719423
SHA1 92a7ac59c468a1fb63da904ef6faa020654ae084
SHA512 c3ee53dd2d011e482255a6ce102942cb8a7109b82e78cc0ce0bfd84142f341537583eb23cfd20ec226f7bb21b58c85f60b9c88760b532b73510bf6fd051c510a
TLSH
T1ABD023212380CD5D45055C471D7572C9F0DA08A61F087D618501889C438785C755F542
MD5 SHA1 SHA512 TLSH

Submit Download

Client.exe

Path C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
Size 3.1MB
SHA256 c9a1a10f3b4a86c9779021e6d7744794b7815991f4d9e7bbc6249990d9edf75c
MD5 d382c0ebadd50369fa136acdd4267b33
SHA1 e9fdaed2ff7385855fae79ca91780f0e06212988
SHA512 aee72ee4a96c53b5144d57431c44b3aac8d803b56e7e45efb9bc618314945014ae53e986b303dd6bc0c5e52855983feb493b3b99f703ef56b8ec3dd5ecb4d56f
SSDEEP 49152:fvgz92YpaQI6oPZlhP3ReybewoMB/SBxeLoGdJTHHB72eh2NT:fv692YpaQI6oPZlhP3Yybewou/t
TLSH
T1F0E56B0437F85E33E56BD2B3D5B05026A3F0F82AF363EB1B519167BA1C53B5488426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4540-0-0x0000000000DA0000-0x00000000010C4000-memory.dmp

Download

memory/4540-1-0x000000001BDD0000-0x000000001BDE0000-memory.dmp

Download

memory/5616-11-0x000000001DC40000-0x000000001DCF2000-memory.dmp

Download

memory/5616-10-0x000000001DB30000-0x000000001DB80000-memory.dmp

Download

memory/5616-8-0x0000000002A60000-0x0000000002A70000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads