Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 22:43
General
- Target e43f17c314b55fd5cb523284ee2f132942c9a4dc28e917acd67c16901135586e_nethost.dll
- Size 103KB
- Sample260420-2nekpsex9m
- SHA256 e43f17c314b55fd5cb523284ee2f132942c9a4dc28e917acd67c16901135586e
Malware Config
Extracted
-
quasar
-
1.4.1
-
Office04
-
127.0.0.1:4782
-
5f34ccca-3055-4fc6-8717-ab2a8e0bc218
-
encryption_key
9BD5BFB930BF97834590CB0E737FF24D6F422857
-
install_name
Client.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e43f17c314b55fd5cb523284ee2f132942c9a4dc28e917acd67c16901135586e_nethost.dll,#11⤵
- Badlisted process makes network request
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3100-8-0x000002334A0A0000-0x000002334A0B0000-memory.dmp
memory/3100-9-0x000002334A3E0000-0x000002334A704000-memory.dmp
memory/3100-11-0x000002334A0A0000-0x000002334A0B0000-memory.dmp
memory/3100-10-0x000002334A0A0000-0x000002334A0B0000-memory.dmp
memory/3100-12-0x0000023331AF0000-0x0000023331B40000-memory.dmp
memory/3100-13-0x0000023349FD0000-0x000002334A082000-memory.dmp
memory/3100-14-0x000002334A0A0000-0x000002334A0B0000-memory.dmp
memory/3100-15-0x000002334A0A0000-0x000002334A0B0000-memory.dmp
memory/3100-16-0x000002334A0A0000-0x000002334A0B0000-memory.dmp
memory/3100-17-0x000002334A0A0000-0x000002334A0B0000-memory.dmp