Analysis
- user interaction
yes - max time kernel
71s - max time network
73s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 16:03
General
- Target Client-built.exe
- Size 3.1MB
- Sample260701-tht47sbw2x
- SHA256 e38c27d5e1c1bb1641b1c4f0f687b2b8bdc7fe67799729e0554b9161eafe18e9
Malware Config
Extracted
-
quasar
-
1.4.1
-
AaronTheLoser
-
192.168.178.83:4782
-
5.146.182.44:4782
-
d5cfbbd4-d3fc-45d0-add7-7850286835d4
-
encryption_key
CA00AF61F2134B9ABD9308EC6487097496CD51B3
-
install_name
Requirements.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\SubDir\Requirements.exe"C:\Users\Admin\AppData\Roaming\SubDir\Requirements.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Requirements.exe
memory/2376-23-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-17-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-32-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-31-0x000000001CD80000-0x000000001CE32000-memory.dmp
memory/2376-30-0x000000001CC70000-0x000000001CCC0000-memory.dmp
memory/2376-29-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-28-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-27-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-18-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-26-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-25-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-22-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-21-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-20-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-19-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/2376-16-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-11-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-0-0x00007FFF8F65F000-0x00007FFF8F660000-memory.dmp
memory/5916-2-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-14-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-13-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-12-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-1-0x0000000000900000-0x0000000000C24000-memory.dmp
memory/5916-24-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-10-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-9-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-8-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-6-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-7-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-5-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-4-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp
memory/5916-3-0x00007FFF8F4D0000-0x00007FFF8FE74000-memory.dmp