Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
28/05/2026, 11:10
General
- Target UMPDC(3).dll
- Size 181KB
- Sample260528-m97faadw2k
- SHA256 20e41f9151518c16eaaec357c16761d4dfebabb425ac727105a10020b34e169e
Malware Config
Extracted
-
quasar
-
encryption_key
F00D8BB24970E7D1F5959C85D7084E366FF0C645
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Family: XoriumStealer
XoriumStealer is an information stealer written in C#.
- Detects DonutLoader 1 IoCs
- Detects XoriumStealer payload 1 IoCs
- Quasar payload 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UMPDC(3).dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5108-1-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-17-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-0-0x0000000000840000-0x0000000000844000-memory.dmp
memory/5108-18-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-16-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-15-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-14-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-13-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-12-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-11-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-10-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-9-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-8-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-7-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-6-0x0000000000850000-0x0000000000896000-memory.dmp
memory/5108-25-0x00000000030C0000-0x000000000321A000-memory.dmp
memory/5108-27-0x000000001B9F0000-0x000000001BA00000-memory.dmp
memory/5108-28-0x000000001BB60000-0x000000001BCB8000-memory.dmp
memory/5108-29-0x000000001B9F0000-0x000000001BA00000-memory.dmp
memory/5108-30-0x000000001B9B0000-0x000000001B9E6000-memory.dmp
memory/5108-31-0x000000001CC30000-0x000000001CC68000-memory.dmp
memory/5108-34-0x000000001B9F0000-0x000000001BA00000-memory.dmp
memory/5108-35-0x000000001B9F0000-0x000000001BA00000-memory.dmp