Analysis
- max time kernel
149s - max time network
148s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/05/2026, 18:03
General
- Target BindedOutput.exe
- Size 2.5MB
- Sample260528-wngr6shz7s
- SHA256 01747e0419832a9767cf4ca8001639095431d487aacc94864d9860954e3e6f6b
Malware Config
Extracted
-
quasar
-
encryption_key
AFA3CAD4ED1D6F9700536DD60F51307FFEA2892B
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 19 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BindedOutput.exe"C:\Users\Admin\AppData\Local\Temp\BindedOutput.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp_5de795e5_app.exe"C:\Users\Admin\AppData\Local\Temp\tmp_5de795e5_app.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "win64" /sc ONLOGON /tr "C:\Windows\system32\winsys\windows client.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\winsys\windows client.exe"C:\Windows\system32\winsys\windows client.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "win64" /sc ONLOGON /tr "C:\Windows\system32\winsys\windows client.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
tmp_5de795e5_app.exe
memory/952-29-0x000001FD6F400000-0x000001FD6F40A000-memory.dmp
memory/952-30-0x000001FD718E0000-0x000001FD718FA000-memory.dmp
memory/952-52-0x000001FD714F0000-0x000001FD714FA000-memory.dmp
memory/952-51-0x000001FD71A90000-0x000001FD71ACA000-memory.dmp
memory/952-49-0x000001FD71900000-0x000001FD7192A000-memory.dmp
memory/952-18-0x000001FD6DAD0000-0x000001FD6DB04000-memory.dmp
memory/952-20-0x000001FD6F3B0000-0x000001FD6F3C2000-memory.dmp
memory/952-21-0x000001FD712F0000-0x000001FD7132C000-memory.dmp
memory/952-22-0x000001FD71450000-0x000001FD71488000-memory.dmp
memory/952-23-0x000001FD6F3A0000-0x000001FD6F3AA000-memory.dmp
memory/952-25-0x000001FD6F410000-0x000001FD6F418000-memory.dmp
memory/952-24-0x000001FD6F3D0000-0x000001FD6F3F6000-memory.dmp
memory/952-26-0x000001FD71490000-0x000001FD714F2000-memory.dmp
memory/952-27-0x000001FD71680000-0x000001FD716C2000-memory.dmp
memory/952-50-0x000001FD71330000-0x000001FD71344000-memory.dmp
memory/952-28-0x000001FD6F390000-0x000001FD6F39A000-memory.dmp
memory/952-46-0x000001FD71970000-0x000001FD719BA000-memory.dmp
memory/952-31-0x000001FD71940000-0x000001FD71962000-memory.dmp
memory/952-53-0x000001FD718C0000-0x000001FD718CC000-memory.dmp
memory/952-47-0x000001FD719C0000-0x000001FD71A0C000-memory.dmp
memory/952-48-0x000001FD71A10000-0x000001FD71A90000-memory.dmp
memory/952-58-0x000001FD71B30000-0x000001FD71B44000-memory.dmp
memory/952-57-0x000001FD71930000-0x000001FD71940000-memory.dmp
memory/952-56-0x000001FD71B00000-0x000001FD71B32000-memory.dmp
memory/952-55-0x000001FD71AD0000-0x000001FD71B04000-memory.dmp
memory/952-54-0x000001FD718D0000-0x000001FD718E6000-memory.dmp
memory/3136-10-0x000001DC38C20000-0x000001DC38C54000-memory.dmp
memory/3136-9-0x000001DC3A6F0000-0x000001DC3A700000-memory.dmp
memory/3136-8-0x000001DC38690000-0x000001DC38786000-memory.dmp
memory/4800-0-0x0000000000330000-0x00000000005BA000-memory.dmp
memory/4800-3-0x000000001C900000-0x000000001C910000-memory.dmp