URL:

https://cjoint.net/?3krtn0jmod17qrzvqd83

Full analysis: https://app.any.run/tasks/5f31d445-683c-47ca-a4b7-89841af9bcb2
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: March 05, 2024, 19:11:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
quasar
evasion
remote
Indicators:
MD5:

0C935999BE4868EE53E05FB0436EE322

SHA1:

2DAC4D89ECD2ADF8307D9342A7EB4CFCEF85AC44

SHA256:

A36320647E3C9497A11C6085DBF346B1A4F7ADC4239770426885CCDEDF85CA83

SSDEEP:

3:N8SXySOXRLV/NC:2Sm4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops/Copies Quasar RAT executable

      • iexplore.exe (PID: 2160)
      • iexplore.exe (PID: 3664)
      • firefox.exe (PID: 2648)

    • Drops the executable file immediately after the start

      • firefox.exe (PID: 2648)

    • Changes the autorun value in the registry

      • firefox.exe (PID: 2648)
      • csrsss.exe (PID: 2208)

    • QUASAR has been detected (SURICATA)

      • csrsss.exe (PID: 2208)

    • QUASAR has been detected (YARA)

      • csrsss.exe (PID: 2208)

  • SUSPICIOUS

    • Reads the Internet Settings

      • firefox.exe (PID: 2648)
      • csrsss.exe (PID: 2208)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 2648)

    • Starts itself from another location

      • firefox.exe (PID: 2648)

    • Checks for external IP

      • csrsss.exe (PID: 2208)
      • firefox.exe (PID: 2648)

    • Connects to unusual port

      • csrsss.exe (PID: 2208)

    • Cleans NTFS data stream (Zone Identifier)

      • firefox.exe (PID: 2648)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 1384)
      • firefox.exe (PID: 2648)
      • csrsss.exe (PID: 2208)

    • Reads the computer name

      • wmpnscfg.exe (PID: 1384)
      • firefox.exe (PID: 2648)
      • csrsss.exe (PID: 2208)

    • Application launched itself

      • iexplore.exe (PID: 2160)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3664)
      • iexplore.exe (PID: 2160)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2160)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3664)
      • iexplore.exe (PID: 2160)

    • Reads the machine GUID from the registry

      • firefox.exe (PID: 2648)
      • csrsss.exe (PID: 2208)

    • Reads Environment values

      • firefox.exe (PID: 2648)
      • csrsss.exe (PID: 2208)

    • Creates files or folders in the user directory

      • firefox.exe (PID: 2648)
      • csrsss.exe (PID: 2208)

    • The process uses the downloaded file

      • firefox.exe (PID: 2648)
      • iexplore.exe (PID: 2160)

    • Manual execution by a user

      • cmd.exe (PID: 2900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(2208) csrsss.exe
Version1.3.0.0
C2 (2)mvps-remote.duckdns.org:7
Sub_Dirupdatess
Install_Namecsrsss.exe
MutexQSR_MUTEX_75FzcMZvy1nRcxtL1M
Startupcsrsss
TagNEW 2025
LogDirLogs
Signature
Certificate
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe firefox.exe #QUASAR csrsss.exe cmd.exe no specs ping.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1308ping mvps-remote.duckdns.orgC:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1384"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2160"C:\Program Files\Internet Explorer\iexplore.exe" "https://cjoint.net/?3krtn0jmod17qrzvqd83"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2208"C:\Users\admin\AppData\Roaming\updatess\csrsss.exe"C:\Users\admin\AppData\Roaming\updatess\csrsss.exe
firefox.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\updatess\csrsss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Quasar
(PID) Process(2208) csrsss.exe
Version1.3.0.0
C2 (2)mvps-remote.duckdns.org:7
Sub_Dirupdatess
Install_Namecsrsss.exe
MutexQSR_MUTEX_75FzcMZvy1nRcxtL1M
Startupcsrsss
TagNEW 2025
LogDirLogs
Signature
Certificate
2648"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\firefox.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\firefox.exe
iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2900"C:\Windows\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3664"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2160 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
25 804
Read events
25 674
Write events
102
Delete events
28

Modification events

(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31092528
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
146279666
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31092529
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
4
Suspicious files
19
Text files
13
Unknown types
6

Dropped files

PID
Process
Filename
Type
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:C99EA45B55DB0DD4852EB69EED0D77C6
SHA256:797DA85C1ECD23A17C3246741426C6F1D6EA2A661B8C41CADC969C3A5AF12193
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0911256CEC942F326366AB96DD55218Cder
MD5:799FE59EEE7161F022BA72C056EE70B0
SHA256:88E2E53D3CF75439E81F7866FD62917A0A4C735C4BA6F622DF41383BD3E6C09C
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:CF19F4F3E1E5BFAD2D00175954B1801E
SHA256:AEE5ABB1B5271C577E52C69129AB81CE991F936BDD07149DA0F68A9E5942B521
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:9BBEEB75E115AEB63501231B5AB34B79
SHA256:69C2C9D583E485DB372DDDB789DF7281F683E2E291C9AD3F5860868808427A9D
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:735C7674E62AAE7E72A6EB609F330987
SHA256:2E6759B73933DC5E1759434377066819E363FD082550D0B6F764EBED62DD4E73
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:9D67B0032D946460063F397E9B9440AE
SHA256:13E2F7CE6C483A27C7FA94208935B41EBB3D6E941CE97BE5250194AAEEF226E2
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0911256CEC942F326366AB96DD55218Cbinary
MD5:0E7F09ECEAB34B8DEB6E68EE148DA576
SHA256:1F6020FBF1538871617CECC271FB21AC989A8A40553AE7F8A34358B71DB90D49
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_96EEC010953ED454BBCDFA69FC071E7Cder
MD5:619EA4A597A613172C310891E7F5F8D8
SHA256:CDFA57AE66811963A8C151E204705A9FCE2F06AAE4FCB52AB74E087F2F70BBE4
3664iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\firefox[1].exeexecutable
MD5:0194C2EF1B7640783BF6963F6B0B49D2
SHA256:F7E927082CF23020C29C68326281B37FFD0D42F4772B60CCA0AC4AD3901D913E
3664iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_96EEC010953ED454BBCDFA69FC071E7Cbinary
MD5:FF52A53A30643D37C47916314D1DE457
SHA256:84F8ACD296C3C64894CD263F51B951D31D95E213DE0355FC60B3B222AFA034E0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
31
DNS requests
18
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3664
iexplore.exe
GET
304
23.48.23.7:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?927e0d673a39dd41
unknown
—
—
—
3664
iexplore.exe
GET
304
23.48.23.34:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d362edf7b65e9a48
unknown
—
—
—
3664
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
—
3664
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCswwDztTW5%2BiafvAydgYq%2F
unknown
binary
472 b
—
3664
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
—
3664
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEH1NQqkrQx1%2BZFPnwZqNWHc%3D
unknown
binary
1.41 Kb
—
3664
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/alphasslcasha256g4/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSPdwLcDiHQXlVfp8h37hrpMerTggQUT8usqMLvq92Db2u%2Fzpg9XFgldhUCDE957Ej9f2yuuh%2F1lQ%3D%3D
unknown
binary
1.40 Kb
—
2648
firefox.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
292 b
—
1080
svchost.exe
GET
200
23.48.23.21:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?fc91d912a85a08d5
unknown
compressed
67.5 Kb
—
2208
csrsss.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
292 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3664
iexplore.exe
5.39.224.140:443
cjoint.net
DSTORAGE s.a.s.
FR
unknown
3664
iexplore.exe
23.48.23.7:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3664
iexplore.exe
23.48.23.34:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3664
iexplore.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
unknown
3664
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
3664
iexplore.exe
5.39.224.2:443
a-2.1fichier.com
DSTORAGE s.a.s.
FR
unknown
3664
iexplore.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
cjoint.net
  • 5.39.224.140
unknown
ctldl.windowsupdate.com
  • 23.48.23.7
  • 23.48.23.34
  • 23.48.23.8
  • 23.48.23.21
  • 23.48.23.67
  • 23.48.23.18
  • 23.48.23.51
unknown
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
unknown
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
unknown
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
unknown
a-2.1fichier.com
  • 5.39.224.2
unknown
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
unknown
ip-api.com
  • 208.95.112.1
unknown
mvps-remote.duckdns.org
  • 89.117.79.31
unknown
iecvlist.microsoft.com
  • 152.199.19.161
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
—
—
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
—
—
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
—
—
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
—
—
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
—
—
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] QuasarRAT Successful Connection (TCP)
—
—
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cjoint.net/?3krtn0jmod17qrzvqd83