Analysis
- max time kernel
58s - max time network
62s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 10:45
General
- Target messenger_update.exe
- Size 3.1MB
- Sample260702-mtpwasew6r
- SHA256 7ff29576e74c400121678e825339bccdca8c58d41a4d96c6e84a97fad806b219
Malware Config
Extracted
-
quasar
-
1.4.1
-
pingping
-
xoilacxta.tv
-
malware.xoilacxta.tv
-
dff4d9d4-ee98-4856-b36f-7b3aeffd8d10
-
encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
-
install_name
molliza.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
5000
-
startup_key
malware
-
subdirectory
malware
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\eX8UhLHiRcon.bat" "2⤵
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SEWOw8h64bhm.bat" "4⤵
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jy12DNKG07H7.bat" "6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5VXvLNNgdATz.bat" "8⤵
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"9⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5h5iGaWN0Naa.bat" "10⤵
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"11⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bxXoJgEm2EPx.bat" "12⤵
-
C:\Windows\system32\chcp.comchcp 6500113⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"13⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0fTgPgeutZdl.bat" "14⤵
-
C:\Windows\system32\chcp.comchcp 6500115⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"15⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cmpdRAkBg6xt.bat" "16⤵
-
C:\Windows\system32\chcp.comchcp 6500117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"17⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yr4p7TeZr0S7.bat" "18⤵
-
C:\Windows\system32\chcp.comchcp 6500119⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"19⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wXFAg4LAF3Ve.bat" "20⤵
-
C:\Windows\system32\chcp.comchcp 6500121⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"21⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\enfuQwIKNA5p.bat" "22⤵
-
C:\Windows\system32\chcp.comchcp 6500123⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"23⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\s8p3eyv6dzx8.bat" "24⤵
-
C:\Windows\system32\chcp.comchcp 6500125⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"25⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3P7OzufcS4fc.bat" "26⤵
-
C:\Windows\system32\chcp.comchcp 6500127⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"27⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wiCEok0ZYUlF.bat" "28⤵
-
C:\Windows\system32\chcp.comchcp 6500129⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"29⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QotDat0hjmpz.bat" "30⤵
-
C:\Windows\system32\chcp.comchcp 6500131⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"31⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PbQWGeLoIa04.bat" "32⤵
-
C:\Windows\system32\chcp.comchcp 6500133⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"33⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hKAhDB0tbsVs.bat" "34⤵
-
C:\Windows\system32\chcp.comchcp 6500135⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"35⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kpjDAkZyDjar.bat" "36⤵
-
C:\Windows\system32\chcp.comchcp 6500137⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"37⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
0fTgPgeutZdl.bat
3P7OzufcS4fc.bat
5VXvLNNgdATz.bat
5h5iGaWN0Naa.bat
PbQWGeLoIa04.bat
QotDat0hjmpz.bat
SEWOw8h64bhm.bat
bxXoJgEm2EPx.bat
cmpdRAkBg6xt.bat
eX8UhLHiRcon.bat
enfuQwIKNA5p.bat
hKAhDB0tbsVs.bat
jy12DNKG07H7.bat
kpjDAkZyDjar.bat
s8p3eyv6dzx8.bat
wXFAg4LAF3Ve.bat
yr4p7TeZr0S7.bat
memory/1016-13-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-3-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-1-0x00000000000A0000-0x00000000003CC000-memory.dmp
memory/1016-2-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-4-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-5-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-6-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-7-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-8-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-9-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-10-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-11-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-12-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-0-0x00007FFF3C96F000-0x00007FFF3C970000-memory.dmp
memory/1016-14-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1016-22-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/1152-169-0x000001DD001F0000-0x000001DD002F0000-memory.dmp
memory/1152-214-0x000001DD141B0000-0x000001DD141D0000-memory.dmp
memory/1152-179-0x000001DD039D0000-0x000001DD039F0000-memory.dmp
memory/1152-180-0x000001DD13DF0000-0x000001DD13EF0000-memory.dmp
memory/1152-200-0x000001DD03D90000-0x000001DD03DB0000-memory.dmp
memory/1152-170-0x000001DD001F0000-0x000001DD002F0000-memory.dmp
memory/5708-35-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-28-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-32-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-31-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-30-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-29-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-26-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-33-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-34-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-23-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-36-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-25-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-43-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-24-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp
memory/5708-27-0x00007FFF3C7E0000-0x00007FFF3D184000-memory.dmp