Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20251218-en - resource tags
- submitted
23/12/2025, 13:00
General
- Target file.exe
- Size 7.6MB
- Sample251223-p8vffazlez
- SHA256 a7c4b700d55ace0c0b6e2005a507aa4cec3e76e23e33a5a22cd3e004cc18f652
Malware Config
Extracted
-
quasar
-
encryption_key
5C52523B5B341169F1F8B7FCC6D37DB9B747E8CF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Detects DonutLoader 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Drops startup file 2 IoCs
- Loads dropped DLL 12 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_aes.pyd
_raw_aesni.pyd
_raw_cbc.pyd
_cpuid_c.pyd
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_wmi.pyd
cards.dll
libffi-8.dll
python313.dll
vcruntime140_1.dll
memory/1364-76-0x000002F750920000-0x000002F750962000-memory.dmp
memory/1364-72-0x000002F74EE10000-0x000002F74EE1A000-memory.dmp
memory/1364-68-0x000002F736170000-0x000002F7361A4000-memory.dmp
memory/1364-66-0x000002F7366F0000-0x000002F7367E4000-memory.dmp
memory/1364-67-0x000002F74EE90000-0x000002F74EEA0000-memory.dmp
memory/1364-69-0x000002F74EE30000-0x000002F74EE42000-memory.dmp
memory/1364-70-0x000002F750690000-0x000002F7506CC000-memory.dmp
memory/1364-73-0x000002F750880000-0x000002F7508A6000-memory.dmp
memory/1364-75-0x000002F7508B0000-0x000002F750912000-memory.dmp
memory/1364-77-0x000002F74EE20000-0x000002F74EE2A000-memory.dmp
memory/1364-62-0x000002F735D40000-0x000002F735E37000-memory.dmp
memory/1364-79-0x000002F7509C0000-0x000002F7509DA000-memory.dmp
memory/1364-78-0x000002F74EE50000-0x000002F74EE5A000-memory.dmp
memory/1364-80-0x000002F750A20000-0x000002F750A42000-memory.dmp
memory/1364-74-0x000002F750720000-0x000002F750728000-memory.dmp
memory/1364-65-0x000002F74EE90000-0x000002F74EEA0000-memory.dmp
memory/1364-71-0x000002F7506D0000-0x000002F750708000-memory.dmp
memory/1364-103-0x000002F7509B0000-0x000002F7509C6000-memory.dmp
memory/1364-107-0x000002F750C10000-0x000002F750C24000-memory.dmp
memory/1364-106-0x000002F750A10000-0x000002F750A20000-memory.dmp
memory/1364-105-0x000002F750BE0000-0x000002F750C12000-memory.dmp
memory/1364-104-0x000002F750BB0000-0x000002F750BE4000-memory.dmp
memory/1364-102-0x000002F7509A0000-0x000002F7509AC000-memory.dmp
memory/1364-101-0x000002F750710000-0x000002F75071A000-memory.dmp
memory/1364-100-0x000002F750B70000-0x000002F750BAA000-memory.dmp
memory/1364-99-0x000002F74EE60000-0x000002F74EE74000-memory.dmp
memory/1364-98-0x000002F7509E0000-0x000002F750A0A000-memory.dmp
memory/1364-97-0x000002F750AF0000-0x000002F750B70000-memory.dmp
memory/1364-96-0x000002F750AA0000-0x000002F750AEC000-memory.dmp
memory/1364-95-0x000002F750A50000-0x000002F750A9A000-memory.dmp
memory/1364-109-0x000002F74EE90000-0x000002F74EEA0000-memory.dmp
memory/1364-108-0x000002F74EE90000-0x000002F74EEA0000-memory.dmp