Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
23/06/2026, 17:12
General
- Target sextop1.exe
- Size 3.1MB
- Sample260623-vqym2aev3q
- SHA256 8bbba128ef916e6799ed59fb59a59d9d0f457a7b031b0ea0cfbb904cad88cd7a
Malware Config
Extracted
-
quasar
-
1.4.1
-
sex
-
sextop1.gd:4782
-
sextop1.net:4782
-
sextop1.ing:4782
-
sextop1.dad:4782
-
sextop1.work:4782
-
sextop1.moe:4782
-
sextop1.skin:4782
-
sextop1.fit:4782
-
sextop1.st:4782
-
sextop1.hot:4782
-
sextop1.vg:4782
-
cdn.sextop1.net:4782
-
cdn.sextop1.ing:4782
-
cdn.sextop1.dad:4782
-
cdn.sextop1.work:4782
-
cdn.sextop1.moe:4782
-
cdn.sextop1.skin:4782
-
cdn.sextop1.fit:4782
-
cdn.sextop1.st:4782
-
cdn.sextop1.hot:4782
-
18a71e73-09fa-4619-8af2-755067ad7912
-
encryption_key
239ECC85C91C3110CB08E82C11B57BB8B6AD4392
-
install_name
sextop1.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
App Data
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Runs ping.exe 1 TTPs 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sextop1.exe"C:\Users\Admin\AppData\Local\Temp\sextop1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\App Data\sextop1.exe"C:\Users\Admin\AppData\Roaming\App Data\sextop1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xBK4cvVberXA.bat" "3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\App Data\sextop1.exe"C:\Users\Admin\AppData\Roaming\App Data\sextop1.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ysoj0Yf7GDBV.bat" "5⤵
-
C:\Windows\system32\chcp.comchcp 650016⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\App Data\sextop1.exe"C:\Users\Admin\AppData\Roaming\App Data\sextop1.exe"6⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GPACuOU5h0W5.bat" "7⤵
-
C:\Windows\system32\chcp.comchcp 650018⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost8⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\App Data\sextop1.exe"C:\Users\Admin\AppData\Roaming\App Data\sextop1.exe"8⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XiRyqbE2iYDC.bat" "9⤵
-
C:\Windows\system32\chcp.comchcp 6500110⤵
-
-
C:\Windows\system32\PING.EXEping -n 10 localhost10⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GPACuOU5h0W5.bat
XiRyqbE2iYDC.bat
xBK4cvVberXA.bat
ysoj0Yf7GDBV.bat
sextop1.exe
memory/1016-5-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-12-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-7-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-8-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-9-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-10-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-11-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-6-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-13-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-14-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-26-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-4-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-3-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-0-0x00007FF95BC4F000-0x00007FF95BC50000-memory.dmp
memory/1016-2-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/1016-1-0x0000000000320000-0x0000000000644000-memory.dmp
memory/2152-18-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-22-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-23-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-24-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-25-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-21-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-27-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-28-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-29-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-30-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-32-0x000000001CB20000-0x000000001CBD2000-memory.dmp
memory/2152-31-0x000000001BC00000-0x000000001BC50000-memory.dmp
memory/2152-33-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-20-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-40-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-19-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-17-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp
memory/2152-16-0x00007FF95BAC0000-0x00007FF95C464000-memory.dmp