| File name: | installservice.EXE |
| Full analysis: | https://app.any.run/tasks/00c99747-5cd1-4442-8a0f-db69a579983f |
| Verdict: | Malicious activity |
| Threats: | Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely. |
| Analysis date: | May 10, 2025, 04:29:59 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows, 6 sections |
| MD5: | 20D4A2D13113919E86AEFFA530437B89 |
| SHA1: | 8528B3AC4160EC1A11B02B575124FFF36A71FC2A |
| SHA256: | BB82D33D5DCDE02F6E391DDD0C5171167878B14B9C447BD2B28E6688C8D90CA3 |
| SSDEEP: | 49152:pnzLnemIE1M84UKznrfiCR4JX4ZwfUTlfTKa6bK1RFB59ZdnioC+gC8digLTQDOM:pXn2qM86fzqfUT1Ka9RFb9jhC+V8digT |
MALICIOUS
Changes the autorun value in the registry
- Install.exe (PID: 7436)
Uses Task Scheduler to run other applications
- Client.exe (PID: 7616)
QUASAR has been detected (YARA)
- Client.exe (PID: 7616)
SUSPICIOUS
Starts a Microsoft application from unusual location
- installservice.EXE.exe (PID: 7404)
Executable content was dropped or overwritten
- installservice.EXE.exe (PID: 7404)
- Install.exe (PID: 7436)
Process drops legitimate windows executable
- installservice.EXE.exe (PID: 7404)
Reads the date of Windows installation
- Client.exe (PID: 7616)
Starts itself from another location
- Install.exe (PID: 7436)
Reads security settings of Internet Explorer
- Client.exe (PID: 7616)
Creates file in the systems drive root
- Client.exe (PID: 7616)
Connects to unusual port
- Client.exe (PID: 7616)
Checks for external IP
- Install.exe (PID: 7436)
Potential Corporate Privacy Violation
- svchost.exe (PID: 2196)
There is functionality for taking screenshot (YARA)
- Client.exe (PID: 7616)
The process executes via Task Scheduler
- Client.exe (PID: 7148)
INFO
Reads the computer name
- installservice.EXE.exe (PID: 7404)
- Install.exe (PID: 7436)
- Client.exe (PID: 7148)
The sample compiled with english language support
- installservice.EXE.exe (PID: 7404)
Checks supported languages
- installservice.EXE.exe (PID: 7404)
- Install.exe (PID: 7436)
- Client.exe (PID: 7616)
- Client.exe (PID: 7148)
Create files in a temporary directory
- installservice.EXE.exe (PID: 7404)
Reads the machine GUID from the registry
- Install.exe (PID: 7436)
- Client.exe (PID: 7148)
Disables trace logs
- Install.exe (PID: 7436)
Reads Environment values
- Install.exe (PID: 7436)
Creates files or folders in the user directory
- Install.exe (PID: 7436)
Checks proxy server information
- Install.exe (PID: 7436)
Process checks computer location settings
- Client.exe (PID: 7616)
.NET Reactor protector has been detected
- Client.exe (PID: 7616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2085:08:19 04:21:51+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.3 |
| CodeSize: | 32768 |
| InitializedDataSize: | 1101824 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1150 |
| OSVersion: | 10 |
| ImageVersion: | 10 |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 11.0.22621.1 |
| ProductVersionNumber: | 11.0.22621.1 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Win32 Cabinet Self-Extractor |
| FileVersion: | 11.00.22621.1 (WinBuild.160101.0800) |
| InternalName: | Wextract |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFileName: | WEXTRACT.EXE .MUI |
| ProductName: | Internet Explorer |
| ProductVersion: | 11.00.22621.1 |
Total processes
134
Monitored processes
8
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7148 | "C:\Users\admin\AppData\Roaming\SubDir\Client.exe" | C:\Users\admin\AppData\Roaming\SubDir\Client.exe | — | svchost.exe | |||||||||||
User: admin Company: Al-Jahbat Technology Integrity Level: MEDIUM Description: Do not tamper with this executable file Exit code: 0 Version: 0.0.4.2 Modules
| |||||||||||||||
| 7404 | "C:\Users\admin\AppData\Local\Temp\installservice.EXE.exe" | C:\Users\admin\AppData\Local\Temp\installservice.EXE.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Win32 Cabinet Self-Extractor Version: 11.00.22621.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7436 | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Install.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Install.exe | installservice.EXE.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 7616 | "C:\Users\admin\AppData\Roaming\SubDir\Client.exe" | C:\Users\admin\AppData\Roaming\SubDir\Client.exe | Install.exe | ||||||||||||
User: admin Company: Al-Jahbat Technology Integrity Level: MEDIUM Description: Do not tamper with this executable file Version: 0.0.4.2 Modules
| |||||||||||||||
| 7676 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) | |||||||||||||||
| 7836 | "C:\Windows\System32\schtasks.exe" /create /tn "WINDOWSSYSTEMHOST" /tr "C:\Users\admin\AppData\Roaming\SubDir\Client.exe" /sc MINUTE /MO 1 | C:\Windows\System32\schtasks.exe | — | Client.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7856 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
2 190
Read events
2 175
Write events
15
Delete events
0
Modification events
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASMANCS |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (7436) Install.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Install_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
Executable files
2
Suspicious files
3
Text files
7
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7404 | installservice.EXE.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\51P_8_~1.JPG | binary | |
MD5:669AEFF9A9E053BFD260C21BE67FF693 | SHA256:B23E9EFA76A187B19C617D39AF68EA1ED0FDF2E153CCE1841DE05E6FEC8C5EFC | |||
| 7404 | installservice.EXE.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Install.exe | executable | |
MD5:00154949ECFFB6F84E75C617AC7C3E0D | SHA256:5369A180C08EE8E67F03A58621D4543E939D824B755C438D43DECF9F357E5A54 | |||
| 7404 | installservice.EXE.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\texture3.png | image | |
MD5:1067349C91D73B50A4F99DBAE0945CAE | SHA256:D3946A3241FDFC7DA928D92F09236862C4BFD8BCBEAF1B4E21AD2F994F07BB38 | |||
| 7404 | installservice.EXE.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\texture2.png | image | |
MD5:FE7806B9F16EFB8975C1EAF32C0F7323 | SHA256:5916F5220940E73A53D0D7D22960486AA1C707BC617B20815768FC4F643BD0D0 | |||
| 7404 | installservice.EXE.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\texture.png | image | |
MD5:7D777BC3635994F35C4541FD981CFD95 | SHA256:5C339ED4CC9EADE9753E235F18F157D12B8A4C1649C8DCFF76DD338D8ED13C50 | |||
| 7404 | installservice.EXE.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\texture4.png | image | |
MD5:787A2536C3268FDEC0A0A3024081CFC9 | SHA256:DA97C460CD4471D99D3F23E53FC8B1C724250258DEB9B2E9CCC1DFB17F087320 | |||
| 7404 | installservice.EXE.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\CENSOR~1.PNG | binary | |
MD5:6E6C8FF4F671DEC412A43378218B4584 | SHA256:E8517C175D328C0C0CCBD2459D27D0D10D54751AB0B8F4D50F5D11002C29EC03 | |||
| 7404 | installservice.EXE.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\CHANGE~1.TXT | text | |
MD5:7AC10980270BCCE6D466EB92C94129F6 | SHA256:6D4F4A3DA2A365CB42834294088189C38F5DF98A9E864A8E7C7A8509C74EA6AA | |||
| 7616 | Client.exe | C:\Users\admin\AppData\Roaming\Logs\05-10-2025 | binary | |
MD5:4E54B077578DB93A8A9B10D467CA093F | SHA256:1F5E6CF45A296F49507A5F835046553DCE875C8ABA2643A80B24E15EE8274A60 | |||
| 7404 | installservice.EXE.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Readme.txt | text | |
MD5:697BB4FDC19F7FD7AF6BBC78A268D74F | SHA256:11613D766B043E389F640FF3D4D83EC38BEA894C75B10E4D53656DC41ABFF35A | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
37
DNS requests
16
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.11:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7436 | Install.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json/ | unknown | — | — | whitelisted |
— | — | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json/ | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7316 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7316 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.216.77.11:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
7436 | Install.exe | 208.95.112.1:80 | ip-api.com | TUT-AS | US | whitelisted |
— | — | 208.95.112.1:80 | ip-api.com | TUT-AS | US | whitelisted |
6544 | svchost.exe | 40.126.32.72:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7616 | Client.exe | 193.161.193.99:23372 | SBBK-23372.portmap.io | OOO Bitree Networks | RU | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
ip-api.com |
| whitelisted |
SBBK-23372.portmap.io |
| malicious |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
7436 | Install.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup ip-api.com |
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
7436 | Install.exe | A Network Trojan was detected | ET MALWARE Common RAT Connectivity Check Observed |
— | — | Device Retrieving External IP Address Detected | ET INFO External IP Lookup ip-api.com |
— | — | A Network Trojan was detected | ET MALWARE Common RAT Connectivity Check Observed |
2196 | svchost.exe | Misc activity | ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io) |
2196 | svchost.exe | Potential Corporate Privacy Violation | ET INFO DNS Query to a Reverse Proxy Service Observed |