Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
19/06/2026, 13:08
General
- Target Client-built.exe
- Size 1.6MB
- Sample260619-qdpgdaf16k
- SHA256 750f68f848ee7ad3dea54f70d5e1a243d47ebdc8f0cf3bb23e766000769fa3ec
Malware Config
Extracted
-
quasar
-
1.6.2
-
Office04
-
193.8.215.36:14447
-
c309e0cd-1863-44ff-9d03-abfdcd3f88a5
-
encryption_key
AE82780435B1CCEF85C04A1CA71F0D6403E04CAB
-
install_name
Client.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Pulsar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qCdk2AysPQFn.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\timeout.exetimeout /T 5 /NOBREAK3⤵
- Delays execution with timeout.exe
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
qCdk2AysPQFn.bat
memory/3736-14-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-24-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-3-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-4-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-15-0x000001CAED660000-0x000001CAED69A000-memory.dmp
memory/3736-6-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-7-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-8-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-9-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-10-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-11-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-12-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-2-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-13-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-5-0x000001CAD4BF0000-0x000001CAD4C0C000-memory.dmp
memory/3736-16-0x000001CAED710000-0x000001CAED760000-memory.dmp
memory/3736-17-0x000001CAEE4E0000-0x000001CAEE592000-memory.dmp
memory/3736-18-0x000001CAED6A0000-0x000001CAED6EE000-memory.dmp
memory/3736-20-0x000001CAED7B0000-0x000001CAED7FA000-memory.dmp
memory/3736-21-0x000001CAD4E60000-0x000001CAD4E8A000-memory.dmp
memory/3736-19-0x000001CAED760000-0x000001CAED7AC000-memory.dmp
memory/3736-22-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-23-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-0-0x00007FFCE979F000-0x00007FFCE97A0000-memory.dmp
memory/3736-25-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-26-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp
memory/3736-1-0x000001CAD2E20000-0x000001CAD2FB6000-memory.dmp
memory/3736-33-0x00007FFCE9610000-0x00007FFCE9FB4000-memory.dmp