File name:

8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4

Full analysis: https://app.any.run/tasks/7f7ba9da-08d6-4aff-8f5d-60565085d8d2
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 04:01:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
quasar
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, MZ for MS-DOS
MD5:

68BDCFEBBAF69A608A897BA4953B00C4

SHA1:

DEC72D5F75F5EF39AE9DFC0F33AE4BE651711C46

SHA256:

8ACD197DBF6D137ACB5929A693166A2731EF4D6427DF26A14B3C9127708841D4

SSDEEP:

3072:TWKPaurkkakHDetyLMZyJitMe5QPIpTh/XQtZDuxKIgnrjiP:iKPFkbkjsyyrWeyCQtZSxKIgi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • svchost.exe (PID: 1228)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2680)

    • QUASAR detected by memory dumps

      • svchost.exe (PID: 1228)

    • Uses Task Scheduler to run other applications

      • svchost.exe (PID: 1228)

  • SUSPICIOUS

    • Reads the computer name

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)
      • svchost.exe (PID: 4092)
      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3776)
      • svchost.exe (PID: 2004)
      • svchost.exe (PID: 1228)

    • Checks supported languages

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)
      • svchost.exe (PID: 1228)
      • svchost.exe (PID: 2004)
      • svchost.exe (PID: 4092)
      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3776)

    • Reads Environment values

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)
      • svchost.exe (PID: 1228)

    • Starts itself from another location

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)

    • Creates executable files which already exist in Windows

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)

    • Changes tracing settings of the file or console

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)

    • Executed via Task Scheduler

      • svchost.exe (PID: 2004)
      • svchost.exe (PID: 4092)

    • Creates files in the user directory

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3176)
      • svchost.exe (PID: 1228)

  • INFO

    • Checks supported languages

      • explorer.exe (PID: 808)
      • schtasks.exe (PID: 2680)

    • Reads the computer name

      • schtasks.exe (PID: 2680)
      • explorer.exe (PID: 808)

    • Manual execution by user

      • 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe (PID: 3776)
      • explorer.exe (PID: 808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(1228) svchost.exe
Version1.4.0.0
C2 (2)thedroidomania.ddns.net:1337
Sub_DirSubDir
Install_Namesvchost.exe
Mutex2bAat10kmKEjUFevvg
StartupQuasar Client Startup
TagOffice04
LogDirLogs
Signature
Certificate
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2010-Dec-09 18:58:13
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.3.0.0
InternalName: Client.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFilename: Client.exe
ProductName: -
ProductVersion: 1.3.0.0
Assembly Version: 1.3.0.0

DOS Header

e_magic: MZ
e_cblp: 64
e_cp: 1
e_crlc: -
e_cparhdr: 2
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: 46080
e_oeminfo: 52489
e_lfanew: 64

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2010-Dec-09 18:58:13
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
3684
4096
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.25826
.rsrc
16384
2048
2048
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.81773
.reloc
24576
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.39349

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.17881
724
UNKNOWN
UNKNOWN
RT_VERSION
1 (#2)
5.18749
1144
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
7
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe #QUASAR svchost.exe schtasks.exe no specs explorer.exe no specs svchost.exe no specs 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
808"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1228"C:\Users\admin\AppData\Roaming\SubDir\svchost.exe"C:\Users\admin\AppData\Roaming\SubDir\svchost.exe
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\subdir\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Quasar
(PID) Process(1228) svchost.exe
Version1.4.0.0
C2 (2)thedroidomania.ddns.net:1337
Sub_DirSubDir
Install_Namesvchost.exe
Mutex2bAat10kmKEjUFevvg
StartupQuasar Client Startup
TagOffice04
LogDirLogs
Signature
Certificate
2004C:\Users\admin\AppData\Roaming\SubDir\svchost.exe C:\Users\admin\AppData\Roaming\SubDir\svchost.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\subdir\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2680"C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\admin\AppData\Roaming\SubDir\svchost.exe" /sc MINUTE /MO 1C:\Windows\System32\schtasks.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3176"C:\Users\admin\Desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe" C:\Users\admin\Desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3776"C:\Users\admin\Desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe" C:\Users\admin\Desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\desktop\8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
4092C:\Users\admin\AppData\Roaming\SubDir\svchost.exe C:\Users\admin\AppData\Roaming\SubDir\svchost.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\subdir\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 763
Read events
1 730
Write events
33
Delete events
0

Modification events

(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3176) 8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
1228svchost.exeC:\Users\admin\AppData\Roaming\Logs\10-05-2022ini
MD5:—
SHA256:—
31768acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exeC:\Users\admin\AppData\Roaming\SubDir\svchost.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
4
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1228
svchost.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
257 b
malicious
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
257 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
103.31.103.32:1337
thedroidomania.ddns.net
Cyber Internet Services Pvt Ltd.
PK
unknown
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
malicious
1228
svchost.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
malicious
1228
svchost.exe
103.31.103.32:1337
thedroidomania.ddns.net
Cyber Internet Services Pvt Ltd.
PK
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
malicious
thedroidomania.ddns.net
  • 103.31.103.32
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
A Network Trojan was detected
ET TROJAN Common RAT Connectivity Check Observed
3176
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1228
svchost.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
1228
svchost.exe
A Network Trojan was detected
ET TROJAN Common RAT Connectivity Check Observed
1228
svchost.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8acd197dbf6d137acb5929a693166a2731ef4d6427df26a14b3c9127708841d4