File name:

SWAV2.exe

Full analysis: https://app.any.run/tasks/297baadb-ce91-4b59-b96a-c6667b8de107
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: July 25, 2025, 14:42:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
quasar
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

A437F5BA6C634E0F0385FFE71F6401D3

SHA1:

DE9467CE4E16B23A95DF2680B163BBAB1DE3AEED

SHA256:

380CEE7399BB1F3AEDA142C504DFF07C3775F989F8AF2EA1B49C1A0285A12823

SSDEEP:

12288:oPYuVB3jKrsqpykpHr1js0AlZJzD3IjG:2YCRjMsOjYlHPT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • SWAV2.exe (PID: 1728)
      • SWAV2.exe (PID: 1644)

    • QUASAR has been detected (YARA)

      • SWAV2.exe (PID: 1644)
      • SWAV2.exe (PID: 1160)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • SWAV2.exe (PID: 1728)

    • Starts a Microsoft application from unusual location

      • SWAV2.exe (PID: 1728)
      • SWAV2.exe (PID: 1644)
      • SWAV2.exe (PID: 1160)

    • Starts itself from another location

      • SWAV2.exe (PID: 1728)

    • Executable content was dropped or overwritten

      • SWAV2.exe (PID: 1728)

    • Checks for external IP

      • SWAV2.exe (PID: 1644)
      • svchost.exe (PID: 2200)
      • SWAV2.exe (PID: 1728)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3944)

    • Connects to unusual port

      • SWAV2.exe (PID: 1644)

    • Starts CMD.EXE for commands execution

      • SWAV2.exe (PID: 1728)

    • Reads security settings of Internet Explorer

      • SWAV2.exe (PID: 1728)

    • The executable file from the user directory is run by the CMD process

      • SWAV2.exe (PID: 1160)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 3944)

    • Executing commands from a ".bat" file

      • SWAV2.exe (PID: 1728)

  • INFO

    • Disables trace logs

      • SWAV2.exe (PID: 1728)
      • SWAV2.exe (PID: 1644)

    • Checks supported languages

      • SWAV2.exe (PID: 1728)
      • SWAV2.exe (PID: 1644)
      • chcp.com (PID: 4540)
      • SWAV2.exe (PID: 1160)

    • Creates files or folders in the user directory

      • SWAV2.exe (PID: 1728)
      • SWAV2.exe (PID: 1644)

    • Checks proxy server information

      • SWAV2.exe (PID: 1728)
      • SWAV2.exe (PID: 1644)

    • Reads the computer name

      • SWAV2.exe (PID: 1728)
      • SWAV2.exe (PID: 1644)
      • SWAV2.exe (PID: 1160)

    • Reads the machine GUID from the registry

      • SWAV2.exe (PID: 1728)
      • SWAV2.exe (PID: 1644)
      • SWAV2.exe (PID: 1160)

    • Launching a file from a Registry key

      • SWAV2.exe (PID: 1728)
      • SWAV2.exe (PID: 1644)

    • Process checks computer location settings

      • SWAV2.exe (PID: 1728)

    • Create files in a temporary directory

      • SWAV2.exe (PID: 1728)

    • Changes the display of characters in the console

      • cmd.exe (PID: 3944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(1644) SWAV2.exe
Version2.1.0.0
C2 (2)173.249.217.19:60456
Sub_Dirtemp
Install_NameSWAV2.exe
MutexVNM_MUTEX_j6oT99kUJ2IoHMSqsK
StartupSWAV2
Tagswa
LogDirLogs
Signature
Certificate
(PID) Process(1160) SWAV2.exe
Version2.1.0.0
C2 (2)173.249.217.19:60456
Sub_Dirtemp
Install_NameSWAV2.exe
MutexVNM_MUTEX_j6oT99kUJ2IoHMSqsK
StartupSWAV2
Tagswa
LogDirLogs
Signature
Certificate
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:07:23 16:39:12+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 544256
InitializedDataSize: 3072
UninitializedDataSize: -
EntryPoint: 0x86c2e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 10.0.26100.3912
ProductVersionNumber: 10.0.26100.3912
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Application Frame Host
FileVersion: 10.0.26100.3912
InternalName: ApplicationFrameHost.exe
LegalCopyright: Microsoft Corporation. All rights reserved
LegalTrademarks: -
OriginalFileName: ApplicationFrameHost.exe
ProductName: SWAV2
ProductVersion: 10.0.26100.3912
AssemblyVersion: 10.0.26100.3912
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start swav2.exe #QUASAR swav2.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #QUASAR swav2.exe no specs slui.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1160"C:\Users\admin\AppData\Local\Temp\SWAV2.exe" C:\Users\admin\AppData\Local\Temp\SWAV2.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Application Frame Host
Version:
10.0.26100.3912
Modules
Images
c:\users\admin\appdata\local\temp\swav2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Quasar
(PID) Process(1160) SWAV2.exe
Version2.1.0.0
C2 (2)173.249.217.19:60456
Sub_Dirtemp
Install_NameSWAV2.exe
MutexVNM_MUTEX_j6oT99kUJ2IoHMSqsK
StartupSWAV2
Tagswa
LogDirLogs
Signature
Certificate
1644"C:\Users\admin\AppData\Roaming\temp\SWAV2.exe"C:\Users\admin\AppData\Roaming\temp\SWAV2.exe
SWAV2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Application Frame Host
Version:
10.0.26100.3912
Modules
Images
c:\users\admin\appdata\roaming\temp\swav2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Quasar
(PID) Process(1644) SWAV2.exe
Version2.1.0.0
C2 (2)173.249.217.19:60456
Sub_Dirtemp
Install_NameSWAV2.exe
MutexVNM_MUTEX_j6oT99kUJ2IoHMSqsK
StartupSWAV2
Tagswa
LogDirLogs
Signature
Certificate
1728"C:\Users\admin\AppData\Local\Temp\SWAV2.exe" C:\Users\admin\AppData\Local\Temp\SWAV2.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Application Frame Host
Exit code:
0
Version:
10.0.26100.3912
Modules
Images
c:\users\admin\appdata\local\temp\swav2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3768ping -n 10 localhost C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3944C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\FMy7b5ETLYvs.bat" "C:\Windows\SysWOW64\cmd.exe—SWAV2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4540chcp 65001C:\Windows\SysWOW64\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5744C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 470
Read events
4 454
Write events
16
Delete events
0

Modification events

(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1728) SWAV2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SWAV2_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1644SWAV2.exeC:\Users\admin\AppData\Roaming\Logs\07-25-2025binary
MD5:D698185A28F8E4C020040ED00918E7B4
SHA256:192BC0F37B51417733B3F885249F65468E11E76E939E6F0EF124528C07F7BC20
1728SWAV2.exeC:\Users\admin\AppData\Roaming\temp\SWAV2.exeexecutable
MD5:A437F5BA6C634E0F0385FFE71F6401D3
SHA256:380CEE7399BB1F3AEDA142C504DFF07C3775F989F8AF2EA1B49C1A0285A12823
1728SWAV2.exeC:\Users\admin\AppData\Local\Temp\FMy7b5ETLYvs.battext
MD5:88DC75C52E917FD6C6BF29BCCA39D1D9
SHA256:1129EB135935BB71B19626FB397E463D97A50E6B602EA4F8D9B0C64FE34D799D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
48
DNS requests
19
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1644
SWAV2.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
1728
SWAV2.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
3940
svchost.exe
GET
200
23.51.98.7:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
104.103.72.96:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.33.233.193:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7008
SIHClient.exe
GET
200
23.33.233.193:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7008
SIHClient.exe
GET
200
23.33.233.193:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
828
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1728
SWAV2.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
1644
SWAV2.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
1644
SWAV2.exe
173.249.217.19:60456
—
TZULO
US
malicious
3940
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3940
svchost.exe
23.51.98.7:80
ocsp.digicert.com
Akamai International B.V.
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.78
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
payloads-poison.000webhostapp.com
  • —
shared
login.live.com
  • 20.190.160.130
  • 20.190.160.22
  • 20.190.160.128
  • 20.190.160.14
  • 20.190.160.66
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 23.51.98.7
whitelisted
crl.microsoft.com
  • 104.103.72.96
  • 2.23.154.57
whitelisted
www.microsoft.com
  • 23.33.233.193
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
—
—
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
—
—
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
—
—
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
—
—
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
—
—
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
—
—
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SWAV2.exe