Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/04/2026, 15:24
General
- Target lols.exe
- Size 2.6MB
- Sample260407-ss8vnsay2x
- SHA256 0e0b2eaf79afcf2fdce4ed0f13c6c6269e4e388fb607506c694bcc90f781d6ec
Malware Config
Extracted
-
quasar
-
1.6.6
-
Office04
-
ash1.voidport.io:30411
-
127.0.0.1:25565
-
17f489ef-9b61-4286-9088-f32e7e55a291
-
encryption_key
DCC40FEE2FAA2A722CF639524A942A8CDFCDCF84
-
install_name
Client.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
svchost.exe
-
subdirectory
SubDir
Signatures
- Customer Loader
Customer Loader is a downloader written in C#.
- Customerloader family
- Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar family
- Quasar payload 1 IoCs
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\lols.exe"C:\Users\Admin\AppData\Local\Temp\lols.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FileCool.exe"C:\Users\Admin\AppData\Local\Temp\FileCool.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles2⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
FileCool.exe
Token.txt
memory/3860-11-0x000001F66D870000-0x000001F66D8BA000-memory.dmp
memory/3860-2-0x000001F6549E0000-0x000001F6549FE000-memory.dmp
memory/3860-4-0x000001F66D650000-0x000001F66D6A0000-memory.dmp
memory/3860-5-0x000001F66D760000-0x000001F66D812000-memory.dmp
memory/3860-6-0x000001F66D600000-0x000001F66D64A000-memory.dmp
memory/3860-8-0x000001F66D3C0000-0x000001F66D3E6000-memory.dmp
memory/3860-7-0x000001F66D6A0000-0x000001F66D6EE000-memory.dmp
memory/3860-9-0x000001F66D6F0000-0x000001F66D724000-memory.dmp
memory/3860-10-0x000001F66D820000-0x000001F66D86C000-memory.dmp
memory/3860-12-0x000001F66D730000-0x000001F66D75A000-memory.dmp
memory/3860-0-0x000001F6529B0000-0x000001F652C4C000-memory.dmp
memory/3860-15-0x000001F66DE90000-0x000001F66DEA2000-memory.dmp
memory/3860-3-0x000001F66D380000-0x000001F66D3BA000-memory.dmp
memory/3860-42-0x000001F66E180000-0x000001F66E1F6000-memory.dmp
memory/3860-16-0x000001F66DEF0000-0x000001F66DF2C000-memory.dmp
memory/3860-19-0x000001F653070000-0x000001F65307C000-memory.dmp
memory/3860-21-0x000001F66D3F0000-0x000001F66D400000-memory.dmp
memory/3860-20-0x000001F66D350000-0x000001F66D362000-memory.dmp
memory/3860-24-0x000001F66DF50000-0x000001F66DF62000-memory.dmp
memory/3860-18-0x000001F66DEC0000-0x000001F66DEC8000-memory.dmp
memory/3860-41-0x000001F66E2D0000-0x000001F66E492000-memory.dmp
memory/3860-17-0x000001F66DE80000-0x000001F66DE8A000-memory.dmp
memory/3860-1-0x000001F66D3F0000-0x000001F66D400000-memory.dmp
memory/4576-36-0x000001CBD6730000-0x000001CBD6738000-memory.dmp
memory/4576-37-0x000001CBF0CE0000-0x000001CBF0CF0000-memory.dmp