Analysis
- max time kernel
150s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20251231-en - resource tags
- submitted
06/01/2026, 07:33
General
- Target ie.exe
- Size 3.1MB
- Sample260106-jdl8paev6d
- SHA256 5c8a4a8a13892a089efe1ad9b78a01e5811e7bb5b77e4c62d6da7781abf32198
Score
10/10
Malware Config
Extracted
Family
-
quasar
Version
-
1.4.1
Botnet
-
Office04
C2
-
virtuoso.uk.com:4782
-
traumvillen.de.com:4782
-
client.virtuoso.uk.com:4782
-
client.traumvillen.de.com:4782
-
server.virtuoso.uk.com:4782
-
server.traumvillen.de.com:4782
Mutex
-
c6afbaf2-b818-40a0-b739-28c0a61615e0
Attributes
-
encryption_key
62BC9D9DFC3C056E2C9CDF76A546148831165DEF
-
install_name
ie.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
Programme
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ie.exe"C:\Users\Admin\AppData\Local\Temp\ie.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Programme\ie.exe"C:\Windows\system32\Programme\ie.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ie.exe.log
ie.exe
memory/4544-8-0x000000001B340000-0x000000001B350000-memory.dmp
memory/4544-9-0x00000000027C0000-0x0000000002810000-memory.dmp
memory/4544-10-0x000000001BED0000-0x000000001BF82000-memory.dmp
memory/5984-0-0x0000000000610000-0x0000000000934000-memory.dmp
memory/5984-1-0x000000001B680000-0x000000001B690000-memory.dmp