File name:

1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe

Full analysis: https://app.any.run/tasks/804687ae-55b3-4ab5-b85a-aaad35041752
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: July 12, 2024, 04:50:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
quasar
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

DF24DE49146B2451AC1D1F97B42210AE

SHA1:

E708A12577B86FF5B65AA0776859441FC589293A

SHA256:

1AAB08AA24404555CF3B04F40CEFE386AB5E0E937699573277BD502012BF3374

SSDEEP:

98304:nA0c5IhTKe9jXzjtDdhr/tRtJKugg7IDZVw14XFuuIIse317k/UZ74EditE3/JLV:7qrdJOb60hktO6ZsptZ+3F

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe (PID: 3780)

    • QUASAR has been detected (YARA)

      • arcabitmon.exe (PID: 3188)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe (PID: 3780)

    • The process drops C-runtime libraries

      • 1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe (PID: 3780)

    • Detected use of alternative data streams (AltDS)

      • arcabitmon.exe (PID: 3188)

    • Executable content was dropped or overwritten

      • 1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe (PID: 3780)

  • INFO

    • Checks supported languages

      • 1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe (PID: 3780)
      • arcabitmon.exe (PID: 3188)

    • Reads the machine GUID from the registry

      • arcabitmon.exe (PID: 3188)

    • Create files in a temporary directory

      • 1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe (PID: 3780)

    • Reads the computer name

      • arcabitmon.exe (PID: 3188)

    • Reads Environment values

      • arcabitmon.exe (PID: 3188)

    • Reads the software policy settings

      • slui.exe (PID: 6504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(3188) arcabitmon.exe
Version1.4.0
C2 (2)45.77.45.120:443
Sub_DirSubDir
Install_NameClient.exe
Mutex784609ba-92f1-47e7-8adb-816d2679982c
StartupODDJOB Client Startup
Tagsingle-exe-online
LogDirLogs
SignatureNFNK1COKAj6N/Bg0d5yxXDWioQZZcEVlqCo3ObikBWjpNit/Sd8eq58fsN5YulZXVhg/WJOEhKClZuAt7o17ZemP77qdmO5MdqHJ8pcZv1381Hn0uvMmLWAKsJMbWwIg3v40dT63QN74JJVbIe+aFEPa28A5eqB9nN2Cxrx5iICx7y7YuMLUDh+ZiFdDZgmiHt8IiE8y0p4mR4v0v0lxC33DLRVRPj35YW9JpTtq1fzzz6fEfdsd4Tj9IQaEJiK4yb5ozZtZwAs/3ml0KEuiasY1g7sQyKcJQXHx75eNlJbS...
CertificateMIIE5DCCAsygAwIBAgIQALjcHRG30jWUcYEbHZi4gTANBgkqhkiG9w0BAQ0FADATMREwDwYDVQQDDAhQNlQwTkxIMDAgFw0yNDA0MDcwMjI0MjFaGA85OTk5MTIzMTIzNTk1OVowEzERMA8GA1UEAwwIUDZUME5MSDAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCmp4wad8W99b6KJtq2bZPAJIewNsbu507bouQpCREGAmO4KHiOl3qAwix27deUnM3vyewUGnM3zHgdWZy9+uIc5QszkeLT...
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:04:09 09:49:21+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.39
CodeSize: 142336
InitializedDataSize: 83968
UninitializedDataSize: -
EntryPoint: 0x71c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe #QUASAR arcabitmon.exe sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3188"C:\Users\admin\AppData\Local\Temp\cache\arcabitmon.exe"C:\Users\admin\AppData\Local\Temp\cache\arcabitmon.exe
1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe
User:
admin
Company:
Arcabit
Integrity Level:
MEDIUM
Description:
Arcabit Monitor
Version:
2017.0.0.1044
Modules
Images
c:\users\admin\appdata\local\temp\cache\arcabitmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Quasar
(PID) Process(3188) arcabitmon.exe
Version1.4.0
C2 (2)45.77.45.120:443
Sub_DirSubDir
Install_NameClient.exe
Mutex784609ba-92f1-47e7-8adb-816d2679982c
StartupODDJOB Client Startup
Tagsingle-exe-online
LogDirLogs
SignatureNFNK1COKAj6N/Bg0d5yxXDWioQZZcEVlqCo3ObikBWjpNit/Sd8eq58fsN5YulZXVhg/WJOEhKClZuAt7o17ZemP77qdmO5MdqHJ8pcZv1381Hn0uvMmLWAKsJMbWwIg3v40dT63QN74JJVbIe+aFEPa28A5eqB9nN2Cxrx5iICx7y7YuMLUDh+ZiFdDZgmiHt8IiE8y0p4mR4v0v0lxC33DLRVRPj35YW9JpTtq1fzzz6fEfdsd4Tj9IQaEJiK4yb5ozZtZwAs/3ml0KEuiasY1g7sQyKcJQXHx75eNlJbS...
CertificateMIIE5DCCAsygAwIBAgIQALjcHRG30jWUcYEbHZi4gTANBgkqhkiG9w0BAQ0FADATMREwDwYDVQQDDAhQNlQwTkxIMDAgFw0yNDA0MDcwMjI0MjFaGA85OTk5MTIzMTIzNTk1OVowEzERMA8GA1UEAwwIUDZUME5MSDAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCmp4wad8W99b6KJtq2bZPAJIewNsbu507bouQpCREGAmO4KHiOl3qAwix27deUnM3vyewUGnM3zHgdWZy9+uIc5QszkeLT...
3780"C:\Users\admin\AppData\Local\Temp\1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe" C:\Users\admin\AppData\Local\Temp\1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
6468C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6504"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6972C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
92 593
Read events
92 592
Write events
1
Delete events
0

Modification events

(PID) Process:(6972) slui.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\sppcomapi.dll,-3200
Value:
Software Licensing
Executable files
6
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3188arcabitmon.exeC:\Users\admin\ntuser.ini:arc6400binary
MD5:09B7B0465AD85573C8A9DDC989AE1704
SHA256:A1A6E869E87BB8D101BDA206BCAC4B21747969DFC418D247D8C8BD63673AE007
37801aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exeC:\Users\admin\AppData\Local\Temp\cache\mfc120u.dllexecutable
MD5:4502ED8B3188A92E6C36B474BF21A462
SHA256:9E07A95502C96F4520768D0DF4D2935D231E58BE950DFF2D70C3FD14FCB8711A
37801aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exeC:\Users\admin\AppData\Local\Temp\cache\corebinary
MD5:1899C3931844EC1228E42320F8006CD2
SHA256:7AB0120502C4DDB6B8D83473F27E018A9C1DD03B02D8B6B3CB2FF2A5A5AAB7B3
37801aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exeC:\Users\admin\AppData\Local\Temp\cache\scan.dllexecutable
MD5:B27F62DEECDC696D42D0051A40E1C39A
SHA256:953F1CD570B6143A23CF695406C03E3A64BA493C148C105B7EA996FA34AF760A
37801aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exeC:\Users\admin\AppData\Local\Temp\cache\msvcr120.dllexecutable
MD5:8081229B857A7B06D25B860DBA797202
SHA256:C3AC59CAF560C34C10904EEB90BE9F3FCDF94E4E5CE0FFCB157E03ECC81E127F
37801aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exeC:\Users\admin\AppData\Local\Temp\cache\msvcp120.dllexecutable
MD5:2A0CA3FAE20959A9F6AC0443B111D672
SHA256:ADEC97FEFB5CBAEF773766233806CC9F467733E18781BBDA7CE4E308D863CD5D
37801aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exeC:\Users\admin\AppData\Local\Temp\cache\nfapi.dllexecutable
MD5:6625D99527E81044416CC3D061C022D8
SHA256:7545F0A00E3D1DA34EF53AB18FB75A498E74755AE51FF6EE8064A7EA4B64C068
37801aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exeC:\Users\admin\AppData\Local\Temp\cache\arcabitmon.exeexecutable
MD5:BA1068E414CAC75FBE2C64202625F754
SHA256:B4869EC0C92B3AE87D1D147F6F8AF38D414333387A141006752449F2A680CDE1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
118
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2204
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2204
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5004
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5600
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6284
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6284
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3680
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2204
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2824
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2220
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4656
SearchApp.exe
2.16.110.171:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2204
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2204
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.16.110.171
  • 2.16.110.170
  • 2.16.110.193
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.133
  • 40.126.32.134
  • 40.126.32.138
  • 40.126.32.136
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.74
whitelisted
go.microsoft.com
  • 23.213.170.81
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374.exe