Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20251231-en - resource tags
- submitted
16/01/2026, 17:49
General
- Target YCLeDUlhTA.ps1
- Size 3.1MB
- Sample260116-wea82ab18d
- SHA256 0a2c887c8a3b30519f8c1750b8eba2df2ede2710b1fbb71f26c2acff3ececff8
Malware Config
Extracted
-
quasar
-
encryption_key
01D6C292096B4062A62E9D4D9900299B52E749E3
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
300
Signatures
- Detects DonutLoader 2 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\YCLeDUlhTA.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yb5frpe2\yb5frpe2.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81A3.tmp" "c:\Users\Admin\AppData\Local\Temp\yb5frpe2\CSCD557C006B66B4522A95CBC4373C8D35.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RES81A3.tmp
__PSScriptPolicyTest_f1skjlbe.mua.ps1
yb5frpe2.dll
CSCD557C006B66B4522A95CBC4373C8D35.TMP
yb5frpe2.0.cs
yb5frpe2.cmdline
memory/3208-66-0x000000000B850000-0x000000000B882000-memory.dmp
memory/3208-38-0x00000000082B0000-0x00000000082BA000-memory.dmp
memory/3208-71-0x0000000008840000-0x0000000008850000-memory.dmp
memory/3208-70-0x0000000008840000-0x0000000008850000-memory.dmp
memory/3208-57-0x000000000B740000-0x000000000B78C000-memory.dmp
memory/3208-58-0x000000000B790000-0x000000000B810000-memory.dmp
memory/3208-59-0x0000000008DE0000-0x0000000008E0A000-memory.dmp
memory/3208-26-0x00000000081C0000-0x0000000008279000-memory.dmp
memory/3208-27-0x0000000009240000-0x0000000009334000-memory.dmp
memory/3208-28-0x0000000008840000-0x0000000008850000-memory.dmp
memory/3208-29-0x0000000008840000-0x0000000008850000-memory.dmp
memory/3208-30-0x0000000007950000-0x0000000007984000-memory.dmp
memory/3208-31-0x00000000084D0000-0x00000000084E2000-memory.dmp
memory/3208-32-0x00000000087F0000-0x000000000882C000-memory.dmp
memory/3208-33-0x0000000008310000-0x000000000831A000-memory.dmp
memory/3208-34-0x0000000008370000-0x0000000008396000-memory.dmp
memory/3208-35-0x00000000085F0000-0x00000000085F8000-memory.dmp
memory/3208-36-0x0000000008870000-0x00000000088D2000-memory.dmp
memory/3208-37-0x0000000009180000-0x00000000091C2000-memory.dmp
memory/3208-61-0x000000000B810000-0x000000000B84A000-memory.dmp
memory/3208-39-0x0000000008500000-0x000000000850A000-memory.dmp
memory/3208-40-0x00000000091C0000-0x00000000091DA000-memory.dmp
memory/3208-45-0x0000000008830000-0x0000000008842000-memory.dmp
memory/3208-56-0x000000000AAB0000-0x000000000AAFA000-memory.dmp
memory/3208-60-0x0000000008DC0000-0x0000000008DD4000-memory.dmp
memory/3208-68-0x000000000A6C0000-0x000000000A6D4000-memory.dmp
memory/3208-67-0x000000000A6B0000-0x000000000A6C0000-memory.dmp
memory/3208-62-0x00000000091E0000-0x00000000091EA000-memory.dmp
memory/3208-65-0x000000000A890000-0x000000000A8C4000-memory.dmp
memory/3208-64-0x000000000A630000-0x000000000A646000-memory.dmp
memory/3208-63-0x0000000009430000-0x000000000943C000-memory.dmp
memory/3412-1-0x00000229B0610000-0x00000229B0620000-memory.dmp
memory/3412-7-0x00000229CB470000-0x00000229CB492000-memory.dmp
memory/3412-25-0x00000229B0610000-0x00000229B0620000-memory.dmp
memory/3412-24-0x00000229B0610000-0x00000229B0620000-memory.dmp
memory/3412-23-0x00000229B0610000-0x00000229B0620000-memory.dmp
memory/3412-69-0x00000229B0610000-0x00000229B0620000-memory.dmp
memory/3412-22-0x00000229B06D0000-0x00000229B06D8000-memory.dmp
memory/3412-0-0x00000229B0610000-0x00000229B0620000-memory.dmp