Analysis
- max time kernel
149s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 17:30
General
- Target final.exe
- Size 15.0MB
- Sample260701-v3arqsbt4p
- SHA256 681946f1b2d2041ca3f85d2acb1f02488665055835d4f48453829c617376eeaa
Malware Config
Extracted
-
quasar
-
1.6.6
-
Office04
-
maria-interruption.with.playit.plus:1788
-
af2c6f00-df3c-48d8-a841-fe604bd57ba9
-
encryption_key
7799F230382DEC15CFC54F1D560B5A8B875621D2
-
install_name
System Update 3.3.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
-
startup_key
System Update 3.3
-
subdirectory
System Update 3.3
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 18 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\final.exe"C:\Users\Admin\AppData\Local\Temp\final.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\final.exe"C:\Users\Admin\AppData\Local\Temp\final.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmp16a0x_fn.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp16a0x_fn.exeC:\Users\Admin\AppData\Local\Temp\tmp16a0x_fn.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "System Update 3.3" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\System Update 3.3\System Update 3.3.exe" /rl HIGHEST /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\System Update 3.3\System Update 3.3.exe"C:\Users\Admin\AppData\Roaming\System Update 3.3\System Update 3.3.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "System Update 3.3" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\System Update 3.3\System Update 3.3.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\llxLXsDnLnRu.exe"C:\Users\Admin\AppData\Local\Temp\llxLXsDnLnRu.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /delete /tn "System Update 3.3" /f6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\aFMRi8Z8SHcu.bat" "6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Windows\system32\timeout.exetimeout /T 5 /NOBREAK7⤵
- Delays execution with timeout.exe
-
-
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000498 0x00000000000004F01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_aes.pyd
_raw_aesni.pyd
_raw_cbc.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python311.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
aFMRi8Z8SHcu.bat
llxLXsDnLnRu.exe
tmp16a0x_fn.exe
memory/6240-133-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-142-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-135-0x0000025E57AF0000-0x0000025E57B0E000-memory.dmp
memory/6240-136-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-137-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-138-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-139-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-140-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-141-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-132-0x0000025E573B0000-0x0000025E57680000-memory.dmp
memory/6240-143-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-144-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-145-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-146-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-148-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-134-0x00007FFD29FE0000-0x00007FFD2A984000-memory.dmp
memory/6240-131-0x00007FFD2A16F000-0x00007FFD2A170000-memory.dmp
memory/7088-149-0x0000018E8A2E0000-0x0000018E8A31A000-memory.dmp
memory/7088-152-0x0000018EA42C0000-0x0000018EA430A000-memory.dmp
memory/7088-153-0x0000018EA43B0000-0x0000018EA43FE000-memory.dmp
memory/7088-154-0x0000018EA4360000-0x0000018EA4386000-memory.dmp
memory/7088-155-0x0000018EA4400000-0x0000018EA4434000-memory.dmp
memory/7088-156-0x0000018EA4450000-0x0000018EA449C000-memory.dmp
memory/7088-157-0x0000018EA51C0000-0x0000018EA520A000-memory.dmp
memory/7088-158-0x0000018EA5210000-0x0000018EA523A000-memory.dmp
memory/7088-159-0x0000018EA5260000-0x0000018EA5272000-memory.dmp
memory/7088-160-0x0000018EA54D0000-0x0000018EA550C000-memory.dmp
memory/7088-161-0x0000018EA5490000-0x0000018EA549A000-memory.dmp
memory/7088-162-0x0000018EA54B0000-0x0000018EA54B8000-memory.dmp
memory/7088-151-0x0000018EA5280000-0x0000018EA5332000-memory.dmp
memory/7088-150-0x0000018EA4310000-0x0000018EA4360000-memory.dmp