Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
27/02/2026, 17:14
General
- Target 7d3429c94fba92e0427b842ecc36e5c7.vbs
- Size 1.5MB
- Sample260227-vr4wfaaw8f
- SHA256 561dea3827ffaaf208ace7cb3390725bff4f6c1dcb5fc83ce1efc00fe18f8ae8
Malware Config
Extracted
-
quasar
-
encryption_key
2B0805F4D2EF415F2B88DDF77A6C83D5F5D0D7AF
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Detects DonutLoader 1 IoCs
- DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Donutloader family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7d3429c94fba92e0427b842ecc36e5c7.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\app_files_2026227171546\application.exe"C:\Users\Admin\AppData\Local\Temp\app_files_2026227171546\application.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
application.exe
memory/5212-23-0x000001FBE8920000-0x000001FBE8A0A000-memory.dmp
memory/6024-17-0x000002C3D3C90000-0x000002C3D3C9A000-memory.dmp
memory/6024-14-0x000002C3BAE70000-0x000002C3BAEA4000-memory.dmp
memory/6024-12-0x000002C3D3920000-0x000002C3D3930000-memory.dmp
memory/6024-11-0x000002C3D37E0000-0x000002C3D38D4000-memory.dmp
memory/6024-10-0x000002C3D3920000-0x000002C3D3930000-memory.dmp
memory/6024-16-0x000002C3D3CC0000-0x000002C3D3CFC000-memory.dmp
memory/6024-15-0x000002C3D3C60000-0x000002C3D3C72000-memory.dmp
memory/6024-20-0x000002C3D3D30000-0x000002C3D3D92000-memory.dmp
memory/6024-22-0x000002C3D3910000-0x000002C3D391A000-memory.dmp
memory/6024-21-0x000002C3D3D90000-0x000002C3D3DD2000-memory.dmp
memory/6024-19-0x000002C3D3C80000-0x000002C3D3C88000-memory.dmp
memory/6024-25-0x000002C3D3DF0000-0x000002C3D3E0A000-memory.dmp
memory/6024-24-0x000002C3D3CA0000-0x000002C3D3CAA000-memory.dmp
memory/6024-26-0x000002C3D3E60000-0x000002C3D3E82000-memory.dmp
memory/6024-13-0x000002C3D3920000-0x000002C3D3930000-memory.dmp
memory/6024-18-0x000002C3D3D00000-0x000002C3D3D26000-memory.dmp
memory/6024-48-0x000002C3D3DE0000-0x000002C3D3DEA000-memory.dmp
memory/6024-9-0x000002C3BABC0000-0x000002C3BACB7000-memory.dmp
memory/6024-43-0x000002C3D3EE0000-0x000002C3D3F2C000-memory.dmp
memory/6024-53-0x000002C3D4090000-0x000002C3D40A0000-memory.dmp
memory/6024-52-0x000002C3D4060000-0x000002C3D4092000-memory.dmp
memory/6024-51-0x000002C3D4030000-0x000002C3D4064000-memory.dmp
memory/6024-50-0x000002C3D4020000-0x000002C3D4036000-memory.dmp
memory/6024-49-0x000002C3D3E50000-0x000002C3D3E5C000-memory.dmp
memory/6024-47-0x000002C3D3FE0000-0x000002C3D401A000-memory.dmp
memory/6024-46-0x000002C3D3DD0000-0x000002C3D3DE4000-memory.dmp
memory/6024-45-0x000002C3D3FB0000-0x000002C3D3FDA000-memory.dmp
memory/6024-44-0x000002C3D3F30000-0x000002C3D3FB0000-memory.dmp
memory/6024-54-0x000002C3D40A0000-0x000002C3D40B4000-memory.dmp
memory/6024-42-0x000002C3D3E90000-0x000002C3D3EDA000-memory.dmp
memory/6024-31-0x000002C3D3CB0000-0x000002C3D3CC2000-memory.dmp
memory/6024-56-0x000002C3BAFD0000-0x000002C3BAFE2000-memory.dmp
memory/6024-55-0x000002C3D3930000-0x000002C3D3A1A000-memory.dmp
memory/6024-57-0x000002C3D3920000-0x000002C3D3930000-memory.dmp
memory/6024-58-0x000002C3D3920000-0x000002C3D3930000-memory.dmp
memory/6024-59-0x000002C3D3920000-0x000002C3D3930000-memory.dmp