Analysis
- max time kernel
59s - max time network
61s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
01/04/2026, 00:04
Errors
General
- Target cocos200jaja.exe
- Size 1.9MB
- Sample260401-acx45ae14k
- SHA256 930581843c20a3506a02ef2352ea1303d03f7b43c96653f1a195b3f823d983ad
Malware Config
Extracted
-
quasar
-
1.6.6
-
PULSAR-ON-TOP-HACKED
-
mihorror2005.redirectme.net:2026
-
95d79113-47b2-4023-b372-c6e9827bdfb7
-
encryption_key
2BE6327A2B03AED6322898941F4E6C7CA29DE8E5
-
install_name
$77client.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Pulsaar Startup
-
subdirectory
SubDir
Signatures
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cocos200jaja.exe"C:\Users\Admin\AppData\Local\Temp\cocos200jaja.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Pulsaar Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\$77client.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SubDir\$77client.exe"C:\Users\Admin\AppData\Roaming\SubDir\$77client.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Pulsaar Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\$77client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\SubDir\$77client.exeC:\Users\Admin\AppData\Roaming\SubDir\$77client.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
$77client.exe
memory/1832-0-0x000002D998FD0000-0x000002D9991B2000-memory.dmp
memory/1832-1-0x000002D9B3760000-0x000002D9B3770000-memory.dmp
memory/1832-2-0x000002D99AF40000-0x000002D99AF5E000-memory.dmp
memory/1832-9-0x000002D9B37C0000-0x000002D9B37D2000-memory.dmp
memory/1832-7-0x000002D99AEB0000-0x000002D99AEBC000-memory.dmp
memory/2244-18-0x0000025D627F0000-0x0000025D6283A000-memory.dmp
memory/2244-23-0x0000025D62A60000-0x0000025D62AAA000-memory.dmp
memory/2244-42-0x0000025D630A0000-0x0000025D630B6000-memory.dmp
memory/2244-32-0x0000025D62540000-0x0000025D62552000-memory.dmp
memory/2244-16-0x0000025D62840000-0x0000025D62890000-memory.dmp
memory/2244-17-0x0000025D62950000-0x0000025D62A02000-memory.dmp
memory/2244-10-0x0000025D482D0000-0x0000025D482E0000-memory.dmp
memory/2244-19-0x0000025D62890000-0x0000025D628DE000-memory.dmp
memory/2244-20-0x0000025D625A0000-0x0000025D625C6000-memory.dmp
memory/2244-21-0x0000025D628E0000-0x0000025D62914000-memory.dmp
memory/2244-22-0x0000025D62A10000-0x0000025D62A5C000-memory.dmp
memory/2244-13-0x0000025D62560000-0x0000025D6259A000-memory.dmp
memory/2244-24-0x0000025D62920000-0x0000025D6294A000-memory.dmp
memory/2244-27-0x0000025D63070000-0x0000025D63082000-memory.dmp
memory/2244-28-0x0000025D630D0000-0x0000025D6310C000-memory.dmp
memory/2244-29-0x0000025D63060000-0x0000025D6306A000-memory.dmp
memory/2244-30-0x0000025D63090000-0x0000025D63098000-memory.dmp
memory/2244-31-0x0000025D48250000-0x0000025D4825C000-memory.dmp
memory/2244-33-0x0000025D482D0000-0x0000025D482E0000-memory.dmp
memory/3144-15-0x0000020FDFD60000-0x0000020FDFD72000-memory.dmp
memory/3144-14-0x0000020FC7410000-0x0000020FC741C000-memory.dmp