Resubmissions
19/04/2026, 20:58
260419-zscwkahx7r1019/04/2026, 20:57
260419-zrj89afs4s1019/04/2026, 20:52
260419-zn2n5ae15110Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 20:52
General
- Target you.exe
- Size 3.1MB
- Sample260419-zn2n5ae151
- SHA256 c500c6a880a36905bad8300c07e6b7769bf4379cabaa9734855692d92dfaff0b
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
rkgb2m8dlt.localto.net:3201
-
e3dac159-b253-4c16-91b4-cc212f14dbf4
-
encryption_key
B4C70BBD7DC5280B9E29D79B8B404B2CB606B047
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\you.exe"C:\Users\Admin\AppData\Local\Temp\you.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Client.exe
memory/3504-0-0x0000000000120000-0x0000000000444000-memory.dmp
memory/3504-1-0x000000001B2D0000-0x000000001B2E0000-memory.dmp
memory/3504-8-0x0000000002590000-0x00000000025A2000-memory.dmp
memory/3504-7-0x0000000000B60000-0x0000000000B6C000-memory.dmp
memory/3992-10-0x000000001C560000-0x000000001C5B0000-memory.dmp
memory/3992-9-0x000000001BBE0000-0x000000001BBF0000-memory.dmp
memory/3992-11-0x000000001C670000-0x000000001C722000-memory.dmp
memory/3992-14-0x000000001C5D0000-0x000000001C5E2000-memory.dmp
memory/3992-15-0x000000001C630000-0x000000001C66C000-memory.dmp
memory/3992-16-0x0000000001700000-0x000000000170C000-memory.dmp
memory/3992-19-0x000000001BBE0000-0x000000001BBF0000-memory.dmp
memory/3992-18-0x000000001C540000-0x000000001C54A000-memory.dmp
memory/3992-17-0x0000000003130000-0x0000000003142000-memory.dmp