Analysis
- max time kernel
149s - max time network
133s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/02/2026, 16:19
General
- Target 53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe
- Size 5.4MB
- Sample260205-tspbpsdw2g
- SHA256 53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728
Malware Config
Extracted
-
quasar
-
1.4.1
-
SPAIN2
-
twart.myfirewall.org:9792
-
rency.ydns.eu:5287
-
wqo9.firewall-gateway.de:8841
-
code1.ydns.eu:5287
-
wqo9.firewall-gateway.de:9792
-
Q4e9mb0d-11cb-44R6b-T1b-05f80M1dcIfx051
-
encryption_key
3145298725BA5E0DD56E87FFE3F8898EA81E6EDA
-
install_name
Notepadbook.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
6000
-
startup_key
Adobe PDF
-
subdirectory
WindowsMD
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- .NET Reactor proctector 64 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 6 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe"C:\Users\Admin\AppData\Local\Temp\53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe"C:\Users\Admin\AppData\Local\Temp\53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Adobe PDF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Adobe PDF" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe" /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exeC:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"C:\Users\Admin\AppData\Roaming\WindowsMD\Notepadbook.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
53aefcb31cf737d2af9779bea562b358bb08c876bb68fbe5614c1084decb6728.exe.log
Notepadbook.exe
memory/888-504-0x0000000000400000-0x0000000000724000-memory.dmp
memory/888-505-0x0000000005700000-0x0000000005710000-memory.dmp
memory/1592-60-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-51-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-2-0x00000000053E0000-0x0000000005472000-memory.dmp
memory/1592-3-0x0000000005520000-0x00000000055BC000-memory.dmp
memory/1592-4-0x0000000005770000-0x0000000005780000-memory.dmp
memory/1592-5-0x00000000055C0000-0x0000000005610000-memory.dmp
memory/1592-15-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-45-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-131-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-129-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-127-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-125-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-121-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-119-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-117-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-115-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-113-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-111-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-107-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-105-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-103-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-101-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-99-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-97-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-95-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-93-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-89-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-87-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-85-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-83-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-81-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-79-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-77-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-49-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-73-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-69-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-67-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-65-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-63-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-61-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-0-0x00000000003E0000-0x0000000000942000-memory.dmp
memory/1592-55-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-1-0x00000000058B0000-0x0000000005E56000-memory.dmp
memory/1592-53-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-75-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-48-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-44-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-39-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-37-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-35-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-33-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-123-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-109-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-91-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-25-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-23-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-72-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-21-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-19-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-57-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-17-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-41-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-13-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-11-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-31-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-29-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-9-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-27-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-7-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-6-0x00000000055C0000-0x0000000005629000-memory.dmp
memory/1592-494-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/1592-495-0x0000000005760000-0x000000000576A000-memory.dmp
memory/1592-496-0x0000000006070000-0x0000000006086000-memory.dmp
memory/1592-497-0x0000000005770000-0x0000000005780000-memory.dmp
memory/1592-498-0x0000000007340000-0x0000000007356000-memory.dmp
memory/1592-499-0x0000000004DF0000-0x0000000004DF6000-memory.dmp
memory/1592-500-0x0000000005770000-0x0000000005780000-memory.dmp
memory/1592-501-0x0000000005770000-0x0000000005780000-memory.dmp
memory/1716-1495-0x0000000007330000-0x0000000007948000-memory.dmp
memory/1716-1496-0x0000000006E90000-0x0000000006EE0000-memory.dmp
memory/1716-1497-0x0000000007100000-0x00000000071B2000-memory.dmp
memory/1716-1498-0x0000000007300000-0x0000000007312000-memory.dmp
memory/1716-1499-0x00000000084E0000-0x000000000851C000-memory.dmp
memory/1716-1500-0x0000000008590000-0x00000000085F6000-memory.dmp
memory/2112-1489-0x0000000005EB0000-0x0000000005EC6000-memory.dmp