File name:

payload.exe

Full analysis: https://app.any.run/tasks/f479d646-a56a-493b-a1a7-8911b47a3a27
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: April 12, 2025, 10:55:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
evasion
uac
golang
quasar
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 15 sections
MD5:

CAE4409D8B36C442A10419796086C47F

SHA1:

2C44970C94E5899AFB95B7A77CB9003D9B5E31FA

SHA256:

8AD7D50075F254B758085711870AF8F7172346526662FD1174E48355F776A119

SSDEEP:

98304:krXenLxbam/S4tVl1s4JE7N3maaOhqa5DtiuXOVMvpNCJ6ZSCEKTDOLlMpbKuFBG:fG7yt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • payload.exe (PID: 7864)
      • Client.exe (PID: 8156)

    • Bypass User Account Control (Modify registry)

      • payload.exe (PID: 7864)

    • Bypass User Account Control (ComputerDefaults)

      • ComputerDefaults.exe (PID: 6044)

    • QUASAR has been detected (YARA)

      • Client.exe (PID: 8156)

  • SUSPICIOUS

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Client.exe (PID: 8156)
      • payload.exe (PID: 7864)

    • Executable content was dropped or overwritten

      • payload.exe (PID: 7864)

    • Reads security settings of Internet Explorer

      • payload.exe (PID: 7864)
      • Client.exe (PID: 8156)

    • Changes default file association

      • payload.exe (PID: 7864)

    • Starts itself from another location

      • payload.exe (PID: 7864)

    • Starts CMD.EXE for commands execution

      • payload.exe (PID: 7864)

    • Connects to unusual port

      • Client.exe (PID: 8156)

    • There is functionality for taking screenshot (YARA)

      • Client.exe (PID: 8156)

  • INFO

    • Reads the machine GUID from the registry

      • payload.exe (PID: 7864)
      • Client.exe (PID: 8156)

    • Checks supported languages

      • payload.exe (PID: 7864)
      • Client.exe (PID: 8156)

    • Reads the computer name

      • payload.exe (PID: 7864)
      • Client.exe (PID: 8156)

    • Reads the software policy settings

      • payload.exe (PID: 7864)
      • Client.exe (PID: 8156)
      • slui.exe (PID: 4400)

    • Disables trace logs

      • payload.exe (PID: 7864)
      • Client.exe (PID: 8156)

    • Reads Environment values

      • payload.exe (PID: 7864)
      • Client.exe (PID: 8156)

    • Checks proxy server information

      • payload.exe (PID: 7864)
      • Client.exe (PID: 8156)
      • slui.exe (PID: 4400)

    • Creates files or folders in the user directory

      • payload.exe (PID: 7864)

    • Reads security settings of Internet Explorer

      • ComputerDefaults.exe (PID: 6044)

    • Detects GO elliptic curve encryption (YARA)

      • Client.exe (PID: 8156)

    • Application based on Golang

      • Client.exe (PID: 8156)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 2580480
InitializedDataSize: 304128
UninitializedDataSize: -
EntryPoint: 0x772a0
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
11
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start payload.exe conhost.exe no specs svchost.exe #QUASAR client.exe cmd.exe no specs conhost.exe no specs conhost.exe no specs computerdefaults.exe no specs computerdefaults.exe no specs computerdefaults.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4180computerdefaults.exe C:\Windows\System32\ComputerDefaults.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Set Program Access and Computer Defaults Control Panel
Exit code:
3221226540
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\computerdefaults.exe
c:\windows\system32\ntdll.dll
4400C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6044"C:\WINDOWS\system32\ComputerDefaults.exe" C:\Windows\System32\ComputerDefaults.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Set Program Access and Computer Defaults Control Panel
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\computerdefaults.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7440"C:\WINDOWS\system32\ComputerDefaults.exe" C:\Windows\System32\ComputerDefaults.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Set Program Access and Computer Defaults Control Panel
Exit code:
3221226540
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\computerdefaults.exe
c:\windows\system32\ntdll.dll
7864"C:\Users\admin\Desktop\payload.exe" C:\Users\admin\Desktop\payload.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\payload.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
7872\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—payload.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8156"C:\Users\admin\AppData\Roaming\temp\Client.exe"C:\Users\admin\AppData\Roaming\temp\Client.exe
payload.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\roaming\temp\client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
8164"cmd.exe" /c start computerdefaults.exeC:\Windows\System32\cmd.exe—payload.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
13 450
Read events
13 415
Write events
35
Delete events
0

Modification events

(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7864) payload.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\payload_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7864payload.exeC:\Users\admin\AppData\Roaming\temp\Client.exeexecutable
MD5:CAE4409D8B36C442A10419796086C47F
SHA256:8AD7D50075F254B758085711870AF8F7172346526662FD1174E48355F776A119
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
8
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6404
RUXIMICS.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8156
Client.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
7864
payload.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
—
—
GET
200
140.82.121.3:443
https://raw.githubusercontent.com/XeroxzB/weqeq/main/1update.bin
unknown
binary
443 Kb
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
GET
200
140.82.121.3:443
https://raw.githubusercontent.com/XeroxzB/weqeq/main/1update.bin
unknown
binary
443 Kb
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6404
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7864
payload.exe
185.199.109.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
6404
RUXIMICS.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7864
payload.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
8156
Client.exe
185.199.109.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
8156
Client.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 172.217.18.110
whitelisted
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.25
  • 23.216.77.42
  • 23.216.77.20
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
go-dramatically.gl.at.ply.gg
  • 147.185.221.27
malicious
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7864
payload.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7864
payload.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
—
—
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
payload.exe