Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/02/2026, 09:26
General
- Target E-sign Payment confirmation and Agreement.vbs
- Size 1.5MB
- Sample260218-legqpsez8d
- SHA256 c3a1146bf6e791105fdbd64cc28f99a7ff82f356ff8c5c155755bdc0b549c826
Malware Config
Extracted
-
quasar
-
encryption_key
2B0805F4D2EF415F2B88DDF77A6C83D5F5D0D7AF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Detects DonutLoader 2 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\E-sign Payment confirmation and Agreement.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\app_files_202621892638\application.exe"C:\Users\Admin\AppData\Local\Temp\app_files_202621892638\application.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
application.exe
memory/1604-9-0x000002157C920000-0x000002157CA17000-memory.dmp
memory/1604-10-0x000002157D630000-0x000002157D640000-memory.dmp
memory/1604-11-0x000002157D450000-0x000002157D544000-memory.dmp
memory/1604-12-0x000002157D630000-0x000002157D640000-memory.dmp
memory/1604-13-0x000002157CD40000-0x000002157CD74000-memory.dmp
memory/1604-14-0x000002157D850000-0x000002157D862000-memory.dmp
memory/1604-15-0x000002157D8B0000-0x000002157D8EC000-memory.dmp
memory/1604-16-0x000002157D880000-0x000002157D88A000-memory.dmp
memory/1604-17-0x000002157D8F0000-0x000002157D916000-memory.dmp
memory/1604-18-0x000002157D8A0000-0x000002157D8A8000-memory.dmp
memory/1604-19-0x000002157D920000-0x000002157D982000-memory.dmp
memory/1604-20-0x000002157D990000-0x000002157D9D2000-memory.dmp
memory/1604-21-0x000002157D870000-0x000002157D87A000-memory.dmp
memory/1604-22-0x000002157D890000-0x000002157D89A000-memory.dmp
memory/1604-23-0x000002157D9F0000-0x000002157DA0A000-memory.dmp
memory/1604-24-0x000002157DA60000-0x000002157DA82000-memory.dmp
memory/1604-29-0x000002157D980000-0x000002157D992000-memory.dmp
memory/1604-40-0x000002157DA90000-0x000002157DADA000-memory.dmp
memory/1604-42-0x000002157DB30000-0x000002157DBB0000-memory.dmp
memory/1604-52-0x000002157DCA0000-0x000002157DCB4000-memory.dmp
memory/1604-51-0x000002157DC90000-0x000002157DCA0000-memory.dmp
memory/1604-50-0x000002157DC60000-0x000002157DC92000-memory.dmp
memory/1604-49-0x000002157DC30000-0x000002157DC64000-memory.dmp
memory/1604-48-0x000002157DC20000-0x000002157DC36000-memory.dmp
memory/1604-47-0x000002157DA50000-0x000002157DA5C000-memory.dmp
memory/1604-46-0x000002157D9E0000-0x000002157D9EA000-memory.dmp
memory/1604-45-0x000002157DBE0000-0x000002157DC1A000-memory.dmp
memory/1604-44-0x000002157D9D0000-0x000002157D9E4000-memory.dmp
memory/1604-43-0x000002157DBB0000-0x000002157DBDA000-memory.dmp
memory/1604-41-0x000002157DAE0000-0x000002157DB2C000-memory.dmp
memory/1604-53-0x000002157D630000-0x000002157D640000-memory.dmp
memory/1604-54-0x000002157D630000-0x000002157D640000-memory.dmp
memory/1604-55-0x000002157D630000-0x000002157D640000-memory.dmp