Analysis
- max time kernel
148s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
23/06/2026, 12:17
General
- Target stellar-cart-ecommerce-v2026.3.0-full-package-x64.exe
- Size 3.1MB
- Sample260623-pf13hscy5t
- SHA256 c6ac496dc8908cf8378e79e5f68bc43c35a93bd43000b8f388744fc8e12cb0c4
Malware Config
Extracted
-
quasar
-
1.4.1
-
StellarCart Ecommerce
-
syalegal.cl:443
-
my-lifestyle.co:443
-
circuitomarchex.net:443
-
hidas.io:443
-
peripage.io:443
-
negaheno.me:443
-
cf265ac1-b270-4c06-8969-13ea84ba0f7d
-
encryption_key
FAA6DCCCB5AA917EA4E50E1D9897AB35BE84AF27
-
install_name
stellar-cart-ecommerce-v2026.3.0-full-package-x64.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
StellarCart Ecommerce
-
subdirectory
StellarCart Ecommerce
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\stellar-cart-ecommerce-v2026.3.0-full-package-x64.exe"C:\Users\Admin\AppData\Local\Temp\stellar-cart-ecommerce-v2026.3.0-full-package-x64.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "StellarCart Ecommerce" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\StellarCart Ecommerce\stellar-cart-ecommerce-v2026.3.0-full-package-x64.exe" /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\StellarCart Ecommerce\stellar-cart-ecommerce-v2026.3.0-full-package-x64.exe"C:\Users\Admin\AppData\Roaming\StellarCart Ecommerce\stellar-cart-ecommerce-v2026.3.0-full-package-x64.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "StellarCart Ecommerce" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\StellarCart Ecommerce\stellar-cart-ecommerce-v2026.3.0-full-package-x64.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
stellar-cart-ecommerce-v2026.3.0-full-package-x64.exe
memory/5408-17-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-2-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-3-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-4-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-5-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-6-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-7-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-8-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-9-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-10-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-11-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-12-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-13-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-14-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5408-1-0x0000000000770000-0x0000000000A94000-memory.dmp
memory/5408-0-0x00007FFBB634F000-0x00007FFBB6350000-memory.dmp
memory/5704-16-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-19-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-18-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-20-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-21-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-22-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-23-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-24-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-25-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-26-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-27-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-28-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-29-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-30-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp
memory/5704-31-0x000000001C8B0000-0x000000001C900000-memory.dmp
memory/5704-32-0x000000001C9C0000-0x000000001CA72000-memory.dmp
memory/5704-33-0x00007FFBB61C0000-0x00007FFBB6B64000-memory.dmp