Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
29/06/2026, 12:17
General
- Target Tharswag.exe
- Size 1.5MB
- Sample260629-pgbh9aex7p
- SHA256 2eac96249e00012e874d427c378cafae63f8ad2aac861121818ccfb4ccb19e90
Malware Config
Extracted
-
quasar
-
X}�3[�,�g
-
encryption_key
73CCF4A81000CB6AD78558C83788308349EF86B9
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
- Modifies registry class 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tharswag.exe"C:\Users\Admin\AppData\Local\Temp\Tharswag.exe"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\MsEdgeUpdate.exeC:\Users\Admin\AppData\Roaming\Microsoft\WindowsApps\MsEdgeUpdate.exe1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
MsEdgeUpdate.exe
memory/1528-20-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-2-0x000001CFDDEB0000-0x000001CFDDEB1000-memory.dmp
memory/1528-4-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-6-0x000001CFDFB40000-0x000001CFDFB48000-memory.dmp
memory/1528-8-0x000001CFDFC20000-0x000001CFDFCA2000-memory.dmp
memory/1528-7-0x000001CFDFB50000-0x000001CFDFB58000-memory.dmp
memory/1528-9-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-10-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-11-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-12-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-13-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-14-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-15-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-16-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-17-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-18-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-0-0x000001CFDF7F0000-0x000001CFDF86D000-memory.dmp
memory/1528-19-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-41-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-40-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/1528-39-0x000001CFF8500000-0x000001CFF853C000-memory.dmp
memory/1528-27-0x000001CFF8470000-0x000001CFF84C0000-memory.dmp
memory/1528-38-0x000001CFF8450000-0x000001CFF8462000-memory.dmp
memory/1528-36-0x000001CFF91E0000-0x000001CFF9292000-memory.dmp
memory/1528-3-0x00007FF936C1F000-0x00007FF936C20000-memory.dmp
memory/4128-31-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-32-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-33-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-30-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-35-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-29-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-37-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-28-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-25-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-24-0x00007FF936A90000-0x00007FF937434000-memory.dmp
memory/4128-34-0x00007FF936A90000-0x00007FF937434000-memory.dmp