Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20251231-en - resource tags
- submitted
16/01/2026, 17:49
General
- Target YCLeDUlhTA.ps1
- Size 3.1MB
- Sample260116-wea82ab18d
- SHA256 0a2c887c8a3b30519f8c1750b8eba2df2ede2710b1fbb71f26c2acff3ececff8
Malware Config
Extracted
-
quasar
-
encryption_key
01D6C292096B4062A62E9D4D9900299B52E749E3
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
300
Signatures
- Detects DonutLoader 2 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 60 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\YCLeDUlhTA.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ljritct\5ljritct.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD28.tmp" "c:\Users\Admin\AppData\Local\Temp\5ljritct\CSC81F71E7910D64F73AAA4993FD8E7E25.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
5ljritct.dll
RESAD28.tmp
__PSScriptPolicyTest_54khniru.thd.ps1
5ljritct.0.cs
5ljritct.cmdline
CSC81F71E7910D64F73AAA4993FD8E7E25.TMP
memory/2828-58-0x0000000008820000-0x000000000886A000-memory.dmp
memory/2828-38-0x00000000064A0000-0x0000000006502000-memory.dmp
memory/2828-72-0x0000000006390000-0x00000000063A0000-memory.dmp
memory/2828-71-0x0000000006390000-0x00000000063A0000-memory.dmp
memory/2828-64-0x0000000005100000-0x000000000510A000-memory.dmp
memory/2828-61-0x000000000B820000-0x000000000B84A000-memory.dmp
memory/2828-62-0x00000000050B0000-0x00000000050C4000-memory.dmp
memory/2828-65-0x00000000053D0000-0x00000000053DC000-memory.dmp
memory/2828-27-0x0000000004B90000-0x0000000004C49000-memory.dmp
memory/2828-28-0x0000000006390000-0x00000000063A0000-memory.dmp
memory/2828-31-0x0000000006390000-0x00000000063A0000-memory.dmp
memory/2828-30-0x0000000006390000-0x00000000063A0000-memory.dmp
memory/2828-29-0x0000000006290000-0x0000000006384000-memory.dmp
memory/2828-32-0x00000000048E0000-0x0000000004914000-memory.dmp
memory/2828-33-0x0000000004C50000-0x0000000004C62000-memory.dmp
memory/2828-34-0x0000000005A10000-0x0000000005A4C000-memory.dmp
memory/2828-35-0x0000000004C70000-0x0000000004C7A000-memory.dmp
memory/2828-36-0x0000000005060000-0x0000000005086000-memory.dmp
memory/2828-37-0x0000000004CB0000-0x0000000004CB8000-memory.dmp
memory/2828-66-0x00000000053E0000-0x00000000053F6000-memory.dmp
memory/2828-39-0x0000000006040000-0x0000000006082000-memory.dmp
memory/2828-40-0x0000000004B20000-0x0000000004B2A000-memory.dmp
memory/2828-41-0x0000000004C80000-0x0000000004C8A000-memory.dmp
memory/2828-42-0x00000000050E0000-0x00000000050FA000-memory.dmp
memory/2828-47-0x0000000004950000-0x0000000004962000-memory.dmp
memory/2828-59-0x000000000B7D0000-0x000000000B81C000-memory.dmp
memory/2828-60-0x000000000C7D0000-0x000000000C850000-memory.dmp
memory/2828-67-0x000000000C950000-0x000000000C984000-memory.dmp
memory/2828-63-0x000000000C910000-0x000000000C94A000-memory.dmp
memory/2828-70-0x0000000005510000-0x0000000005524000-memory.dmp
memory/2828-69-0x0000000005400000-0x0000000005410000-memory.dmp
memory/2828-68-0x000000000CF80000-0x000000000CFB2000-memory.dmp
memory/5584-1-0x0000025799750000-0x0000025799760000-memory.dmp
memory/5584-9-0x0000025799750000-0x0000025799760000-memory.dmp
memory/5584-25-0x0000025799750000-0x0000025799760000-memory.dmp
memory/5584-24-0x0000025799750000-0x0000025799760000-memory.dmp
memory/5584-23-0x0000025799750000-0x0000025799760000-memory.dmp
memory/5584-22-0x0000025799740000-0x0000025799748000-memory.dmp
memory/5584-0-0x0000025799750000-0x0000025799760000-memory.dmp
memory/5584-8-0x00000257FDB50000-0x00000257FDB72000-memory.dmp