Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20251218-en - resource tags
- submitted
23/12/2025, 13:00
General
- Target file.exe
- Size 7.6MB
- Sample251223-p8vffazlez
- SHA256 a7c4b700d55ace0c0b6e2005a507aa4cec3e76e23e33a5a22cd3e004cc18f652
Malware Config
Extracted
-
quasar
-
encryption_key
5C52523B5B341169F1F8B7FCC6D37DB9B747E8CF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Detects DonutLoader 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Drops startup file 2 IoCs
- Loads dropped DLL 12 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_aes.pyd
_raw_aesni.pyd
_raw_cbc.pyd
_cpuid_c.pyd
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_wmi.pyd
cards.dll
libffi-8.dll
python313.dll
vcruntime140_1.dll
memory/1600-78-0x000001F878740000-0x000001F87874A000-memory.dmp
memory/1600-72-0x000001F878790000-0x000001F8787C8000-memory.dmp
memory/1600-66-0x000001F875B10000-0x000001F875C04000-memory.dmp
memory/1600-67-0x000001F877900000-0x000001F877910000-memory.dmp
memory/1600-69-0x000001F874D90000-0x000001F874DC4000-memory.dmp
memory/1600-68-0x000001F877900000-0x000001F877910000-memory.dmp
memory/1600-70-0x000001F8786F0000-0x000001F878702000-memory.dmp
memory/1600-71-0x000001F878750000-0x000001F87878C000-memory.dmp
memory/1600-74-0x000001F878710000-0x000001F878736000-memory.dmp
memory/1600-77-0x000001F878860000-0x000001F8788A2000-memory.dmp
memory/1600-64-0x000001F874A80000-0x000001F874B77000-memory.dmp
memory/1600-80-0x000001F878920000-0x000001F87893A000-memory.dmp
memory/1600-79-0x000001F878830000-0x000001F87883A000-memory.dmp
memory/1600-76-0x000001F8787D0000-0x000001F878832000-memory.dmp
memory/1600-81-0x000001F878990000-0x000001F8789B2000-memory.dmp
memory/1600-75-0x000001F8778F0000-0x000001F8778F8000-memory.dmp
memory/1600-73-0x000001F8778E0000-0x000001F8778EA000-memory.dmp
memory/1600-65-0x000001F877900000-0x000001F877910000-memory.dmp
memory/1600-108-0x000001F878B80000-0x000001F878B94000-memory.dmp
memory/1600-107-0x000001F878B70000-0x000001F878B80000-memory.dmp
memory/1600-106-0x000001F878B40000-0x000001F878B72000-memory.dmp
memory/1600-105-0x000001F878B10000-0x000001F878B44000-memory.dmp
memory/1600-104-0x000001F878B00000-0x000001F878B16000-memory.dmp
memory/1600-109-0x000001F877900000-0x000001F877910000-memory.dmp
memory/1600-103-0x000001F8788C0000-0x000001F8788CC000-memory.dmp
memory/1600-102-0x000001F878850000-0x000001F87885A000-memory.dmp
memory/1600-101-0x000001F878AC0000-0x000001F878AFA000-memory.dmp
memory/1600-100-0x000001F878840000-0x000001F878854000-memory.dmp
memory/1600-99-0x000001F878A90000-0x000001F878ABA000-memory.dmp
memory/1600-98-0x000001F878A10000-0x000001F878A90000-memory.dmp
memory/1600-97-0x000001F8789C0000-0x000001F878A0C000-memory.dmp
memory/1600-96-0x000001F878940000-0x000001F87898A000-memory.dmp
memory/1600-110-0x000001F877900000-0x000001F877910000-memory.dmp
memory/1600-111-0x000001F877900000-0x000001F877910000-memory.dmp