Resubmissions
19/04/2026, 20:58
260419-zscwkahx7r1019/04/2026, 20:57
260419-zrj89afs4s1019/04/2026, 20:52
260419-zn2n5ae15110Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/04/2026, 20:52
General
- Target you.exe
- Size 3.1MB
- Sample260419-zn2n5ae151
- SHA256 c500c6a880a36905bad8300c07e6b7769bf4379cabaa9734855692d92dfaff0b
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
rkgb2m8dlt.localto.net:3201
-
e3dac159-b253-4c16-91b4-cc212f14dbf4
-
encryption_key
B4C70BBD7DC5280B9E29D79B8B404B2CB606B047
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\you.exe"C:\Users\Admin\AppData\Local\Temp\you.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Client.exe
memory/536-0-0x0000000000FE0000-0x0000000001304000-memory.dmp
memory/536-1-0x000000001C070000-0x000000001C080000-memory.dmp
memory/536-7-0x0000000001AB0000-0x0000000001ABC000-memory.dmp
memory/4492-8-0x000000001B5A0000-0x000000001B5B0000-memory.dmp
memory/4492-9-0x000000001C000000-0x000000001C050000-memory.dmp
memory/4492-10-0x000000001C110000-0x000000001C1C2000-memory.dmp
memory/4492-11-0x0000000000FA0000-0x0000000000FAC000-memory.dmp
memory/4492-12-0x000000001B5A0000-0x000000001B5B0000-memory.dmp
memory/4492-13-0x000000001C050000-0x000000001C062000-memory.dmp
memory/4492-14-0x000000001C0B0000-0x000000001C0EC000-memory.dmp