Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/07/2026, 17:13
General
- Target swag.exe
- Size 1.5MB
- Sample260709-vrld4aet7r
- SHA256 37d820586008e23767774a05f15c698bd09c42cd3b11da36ec672cc278023fd5
Malware Config
Extracted
-
quasar
-
X}�3[�,�g
-
encryption_key
73CCF4A81000CB6AD78558C83788308349EF86B9
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
- Modifies registry class 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\swag.exe"C:\Users\Admin\AppData\Local\Temp\swag.exe"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsDefender\WidgetService.exeC:\Users\Admin\AppData\Roaming\Microsoft\WindowsDefender\WidgetService.exe1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WidgetService.exe
memory/4272-16-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-29-0x0000016871000000-0x00000168710B2000-memory.dmp
memory/4272-4-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-6-0x000001686F450000-0x000001686F458000-memory.dmp
memory/4272-17-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-7-0x000001686F460000-0x000001686F468000-memory.dmp
memory/4272-9-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-10-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-11-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-12-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-13-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-14-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-3-0x00007FF989F3F000-0x00007FF989F40000-memory.dmp
memory/4272-15-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-8-0x000001686F6A0000-0x000001686F722000-memory.dmp
memory/4272-18-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-19-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-20-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-2-0x000001686F1D0000-0x000001686F1D1000-memory.dmp
memory/4272-33-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/4272-31-0x000001686FF40000-0x000001686FF7C000-memory.dmp
memory/4272-26-0x000001686FEB0000-0x000001686FF00000-memory.dmp
memory/4272-30-0x000001686FE80000-0x000001686FE92000-memory.dmp
memory/4272-0-0x000001686F220000-0x000001686F29D000-memory.dmp
memory/5360-28-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/5360-25-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/5360-32-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp
memory/5360-24-0x00007FF989DB0000-0x00007FF98A754000-memory.dmp