Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
12/05/2026, 07:40
General
- Target UIOP.exe
- Size 3.2MB
- Sample260512-jhq3fagy6x
- SHA256 eee6d177a92e0e870f5aa99b4366cb4559b3f0c2c6c78ffd4fc4721dfc3d4c91
Malware Config
Extracted
-
quasar
-
1.4.1
-
Client
-
brandy.it.com:4782
-
brandy.it.com:443
-
brandy.it.com:80
-
bildad.us.org:80
-
bildad.us.org:443
-
bildad.us.org:8080
-
be45b43b-bd2d-46ea-ae86-634e20c1530d
-
encryption_key
D383E5F8335529BD437BAED92C7C0A18C19F5B84
-
install_name
system32.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Extracted
-
xworm
-
XWorm V6.5 by c3lestial.fun
-
bildad.us.org:8080
-
brandy.it.com:8080
-
VtOFSNrTKezCmmlI
-
Install_directory
%AppData%
-
install_file
XWormClient.exe
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Quasar payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- Executes dropped EXE 7 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\UIOP.exe"C:\Users\Admin\AppData\Local\Temp\UIOP.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\FGHJ.exe"C:\Users\Admin\AppData\Roaming\FGHJ.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system32.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\SubDir\system32.exe"C:\Windows\system32\SubDir\system32.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Windows\system32\SubDir\system32.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Roaming\ASD.exe"C:\Users\Admin\AppData\Roaming\ASD.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ASD.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ASD.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XWormClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XWormClient.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWormClient" /tr "C:\Users\Admin\AppData\Roaming\XWormClient.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\SubDir\system32.exeC:\Windows\system32\SubDir\system32.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\XWormClient.exeC:\Users\Admin\AppData\Roaming\XWormClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\XWormClient.exeC:\Users\Admin\AppData\Roaming\XWormClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\XWormClient.exeC:\Users\Admin\AppData\Roaming\XWormClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
XWormClient.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mmvpdut5.h2b.ps1
ASD.exe
FGHJ.exe
memory/1096-71-0x0000024024410000-0x000002402441C000-memory.dmp
memory/1096-47-0x000002403CB50000-0x000002403CB72000-memory.dmp
memory/1096-65-0x000002403D1D0000-0x000002403D1EA000-memory.dmp
memory/1096-72-0x000002403CB00000-0x000002403CB12000-memory.dmp
memory/1096-68-0x000002403D1F0000-0x000002403D1FA000-memory.dmp
memory/1096-67-0x000002403CEE0000-0x000002403CEE6000-memory.dmp
memory/1096-66-0x000002403CED0000-0x000002403CED8000-memory.dmp
memory/1096-73-0x000002403D050000-0x000002403D0A6000-memory.dmp
memory/1096-64-0x000002403CEC0000-0x000002403CECA000-memory.dmp
memory/1096-60-0x000002403CDE0000-0x000002403CDFC000-memory.dmp
memory/1096-61-0x000002403CE00000-0x000002403CEB3000-memory.dmp
memory/1096-62-0x000002403CDD0000-0x000002403CDDA000-memory.dmp
memory/1096-63-0x000002403D0B0000-0x000002403D0CC000-memory.dmp
memory/1668-160-0x0000000000D70000-0x0000000000D7C000-memory.dmp
memory/1792-91-0x0000024BA4E30000-0x0000024BA4E86000-memory.dmp
memory/1792-89-0x0000024B8C070000-0x0000024B8C07C000-memory.dmp
memory/1792-90-0x0000024BA4710000-0x0000024BA4722000-memory.dmp
memory/3084-41-0x0000000001040000-0x000000000104C000-memory.dmp
memory/3084-26-0x0000000000820000-0x0000000000830000-memory.dmp
memory/3344-39-0x0000000001710000-0x000000000171C000-memory.dmp
memory/3344-40-0x00000000017A0000-0x00000000017B2000-memory.dmp
memory/3768-24-0x0000000000B70000-0x0000000000E94000-memory.dmp
memory/3768-34-0x0000000003130000-0x0000000003142000-memory.dmp
memory/3768-33-0x00000000017C0000-0x00000000017CC000-memory.dmp
memory/3936-25-0x00000000027C0000-0x00000000027CC000-memory.dmp
memory/3936-0-0x00000000003D0000-0x0000000000700000-memory.dmp
memory/4192-36-0x000000001C300000-0x000000001C350000-memory.dmp
memory/4192-42-0x0000000001430000-0x000000000143C000-memory.dmp
memory/4192-37-0x000000001C410000-0x000000001C4C2000-memory.dmp
memory/4192-43-0x000000001B770000-0x000000001B782000-memory.dmp
memory/4228-134-0x0000000001170000-0x000000000117C000-memory.dmp
memory/4848-124-0x0000024886440000-0x0000024886452000-memory.dmp
memory/4848-125-0x000002489EBD0000-0x000002489EC26000-memory.dmp
memory/4848-123-0x0000024886300000-0x000002488630C000-memory.dmp
memory/4980-139-0x0000000001260000-0x000000000126C000-memory.dmp
memory/5088-108-0x0000015539F60000-0x0000015539FB6000-memory.dmp
memory/5088-107-0x0000015521310000-0x0000015521322000-memory.dmp
memory/5088-106-0x0000015521260000-0x000001552126C000-memory.dmp