analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4

Full analysis: https://app.any.run/tasks/7f7ba9da-08d6-4aff-8f5d-60565085d8d2
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 04:01:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
quasar
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, MZ for MS-DOS
MD5:

68BDCFEBBAF69A608A897BA4953B00C4

SHA1:

DEC72D5F75F5EF39AE9DFC0F33AE4BE651711C46

SHA256:

8ACD197DBF6D137ACB5929A693166A2731EF4D6427DF26A14B3C9127708841D4

SSDEEP:

3072:TWKPaurkkakHDetyLMZyJitMe5QPIpTh/XQtZDuxKIgnrjiP:iKPFkbkjsyyrWeyCQtZSxKIgi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • svchost.exe (PID: 1228)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 1228)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2680)

    • QUASAR detected by memory dumps

      • svchost.exe (PID: 1228)

  • SUSPICIOUS

    • Reads the computer name

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)
      • svchost.exe (PID: 1228)
      • svchost.exe (PID: 4092)
      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3776)
      • svchost.exe (PID: 2004)

    • Starts itself from another location

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)

    • Reads Environment values

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)
      • svchost.exe (PID: 1228)

    • Changes tracing settings of the file or console

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)

    • Checks supported languages

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)
      • svchost.exe (PID: 1228)
      • svchost.exe (PID: 4092)
      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3776)
      • svchost.exe (PID: 2004)

    • Creates files in the user directory

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)
      • svchost.exe (PID: 1228)

    • Creates executable files which already exist in Windows

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)

    • Executed via Task Scheduler

      • svchost.exe (PID: 4092)
      • svchost.exe (PID: 2004)

  • INFO

    • Reads the computer name

      • schtasks.exe (PID: 2680)
      • explorer.exe (PID: 808)

    • Checks supported languages

      • schtasks.exe (PID: 2680)
      • explorer.exe (PID: 808)

    • Manual execution by user

      • explorer.exe (PID: 808)
      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(1228) svchost.exe
Certificate
Signature
LogDirLogs
TagOffice04
StartupQuasar Client Startup
Mutex2bAat10kmKEjUFevvg
Install_Namesvchost.exe
Sub_DirSubDir
C2 (2)thedroidomania.ddns.net:1337
Version1.4.0.0
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2010-Dec-09 18:58:13
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.3.0.0
InternalName: Client.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFilename: Client.exe
ProductName: -
ProductVersion: 1.3.0.0
Assembly Version: 1.3.0.0

DOS Header

e_magic: MZ
e_cblp: 64
e_cp: 1
e_crlc: -
e_cparhdr: 2
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: 46080
e_oeminfo: 52489
e_lfanew: 64

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2010-Dec-09 18:58:13
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
3684
4096
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.25826
.rsrc
16384
2048
2048
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.81773
.reloc
24576
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.39349

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.17881
724
UNKNOWN
UNKNOWN
RT_VERSION
1 (#2)
5.18749
1144
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
7
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe #QUASAR svchost.exe schtasks.exe no specs explorer.exe no specs svchost.exe no specs 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3176"C:\Users\admin\Desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe" C:\Users\admin\Desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1228"C:\Users\admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\admin\AppData\Roaming\SubDir\svchost.exe
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\subdir\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Quasar
(PID) Process(1228) svchost.exe
Certificate
Signature
LogDirLogs
TagOffice04
StartupQuasar Client Startup
Mutex2bAat10kmKEjUFevvg
Install_Namesvchost.exe
Sub_DirSubDir
C2 (2)thedroidomania.ddns.net:1337
Version1.4.0.0
2680"C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\admin\AppData\Roaming\SubDir\svchost.exe" /sc MINUTE /MO 1C:\Windows\System32\schtasks.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
808"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
4092C:\Users\admin\AppData\Roaming\SubDir\svchost.exe C:\Users\admin\AppData\Roaming\SubDir\svchost.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\subdir\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3776"C:\Users\admin\Desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe" C:\Users\admin\Desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2004C:\Users\admin\AppData\Roaming\SubDir\svchost.exe C:\Users\admin\AppData\Roaming\SubDir\svchost.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\subdir\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 763
Read events
1 730
Write events
33
Delete events
0

Modification events

(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
31768acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeC:\Users\admin\AppData\Roaming\SubDir\svchost.exeexecutable
MD5:68BDCFEBBAF69A608A897BA4953B00C4
SHA256:8ACD197DBF6D137ACB5929A693166A2731EF4D6427DF26A14B3C9127708841D4
1228svchost.exeC:\Users\admin\AppData\Roaming\Logs\10-05-2022ini
MD5:1BA786FA5FAEB088819E32849C184119
SHA256:27DF2DB4821424A62F1908848A0D084A21677282E455BB8888F180DB5761E652
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1228
svchost.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
257 b
shared
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
257 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1228
svchost.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
malicious
1228
svchost.exe
103.31.103.32:1337
thedroidomania.ddns.net
Cyber Internet Services Pvt Ltd.
PK
unknown
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
malicious
—
—
103.31.103.32:1337
thedroidomania.ddns.net
Cyber Internet Services Pvt Ltd.
PK
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
thedroidomania.ddns.net
  • 103.31.103.32
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
A Network Trojan was detected
ET TROJAN Common RAT Connectivity Check Observed
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1228
svchost.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
1228
svchost.exe
A Network Trojan was detected
ET TROJAN Common RAT Connectivity Check Observed
1228
svchost.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4