Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 03:11
General
- Target Client-built.exe
- Size 2.6MB
- Sample260630-dplteadv2z
- SHA256 34ff577a7276c8ea8ad7172593a734c75dabd506feaf6a568377088d54ba6eb2
Malware Config
Extracted
-
quasar
-
1.6.6
-
Office04
-
beenpaidwoo1-62183.portmap.host:62183
-
b37c4cbf-68f4-4e7c-92ba-ac265729eb51
-
encryption_key
7799F230382DEC15CFC54F1D560B5A8B875621D2
-
install_name
.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5996-0-0x00007FFD0C19F000-0x00007FFD0C1A0000-memory.dmp
memory/5996-1-0x0000019BEA620000-0x0000019BEA8BE000-memory.dmp
memory/5996-2-0x0000019BEAD80000-0x0000019BEAD9E000-memory.dmp
memory/5996-3-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-4-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-5-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-6-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-7-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-8-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-9-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-10-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-11-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-12-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-13-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-14-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-15-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-16-0x0000019BEC610000-0x0000019BEC64A000-memory.dmp
memory/5996-17-0x0000019BED040000-0x0000019BED090000-memory.dmp
memory/5996-18-0x0000019BED1B0000-0x0000019BED262000-memory.dmp
memory/5996-19-0x0000019BEC650000-0x0000019BEC69A000-memory.dmp
memory/5996-21-0x0000019BEC6C0000-0x0000019BEC6E6000-memory.dmp
memory/5996-20-0x0000019BED090000-0x0000019BED0DE000-memory.dmp
memory/5996-22-0x0000019BED0E0000-0x0000019BED114000-memory.dmp
memory/5996-23-0x0000019BED120000-0x0000019BED16C000-memory.dmp
memory/5996-25-0x0000019BEC700000-0x0000019BEC72A000-memory.dmp
memory/5996-24-0x0000019BED270000-0x0000019BED2BA000-memory.dmp
memory/5996-26-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp
memory/5996-27-0x00007FFD0C010000-0x00007FFD0C9B4000-memory.dmp