Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
06/01/2026, 07:33
General
- Target ie.exe
- Size 3.1MB
- Sample260106-jdl8paev6d
- SHA256 5c8a4a8a13892a089efe1ad9b78a01e5811e7bb5b77e4c62d6da7781abf32198
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
virtuoso.uk.com:4782
-
traumvillen.de.com:4782
-
client.virtuoso.uk.com:4782
-
client.traumvillen.de.com:4782
-
server.virtuoso.uk.com:4782
-
server.traumvillen.de.com:4782
-
c6afbaf2-b818-40a0-b739-28c0a61615e0
-
encryption_key
62BC9D9DFC3C056E2C9CDF76A546148831165DEF
-
install_name
ie.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
Programme
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ie.exe"C:\Users\Admin\AppData\Local\Temp\ie.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Programme\ie.exe"C:\Windows\system32\Programme\ie.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ie.exe.log
ie.exe
memory/4180-0-0x0000000000D30000-0x0000000001054000-memory.dmp
memory/4180-1-0x0000000001880000-0x0000000001890000-memory.dmp
memory/5524-8-0x000000001CC60000-0x000000001CC70000-memory.dmp
memory/5524-9-0x000000001D360000-0x000000001D3B0000-memory.dmp
memory/5524-10-0x000000001D470000-0x000000001D522000-memory.dmp
memory/5524-11-0x000000001CC60000-0x000000001CC70000-memory.dmp