Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/07/2026, 15:43
General
- Target ratonhost.exe
- Size 1.9MB
- Sample260712-s52l5act8k
- SHA256 3f611d6373fe2105903cf00fd496055c94969fc3d4ead359d70ddc03baf247a8
Malware Config
Extracted
-
quasar
-
1.7.3
-
critical
-
tcp.niceports.shop:22265
-
e533e018-ce7e-422a-b379-4c90e7f46f91
-
encryption_key
12518C4545D6D6D57F43040CDD2DC966CD5EA6C4
-
install_name
Solara.exe
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Pulsar Client Startup
-
subdirectory
SubDir
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Drops file in Program Files directory 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonhost.exe"C:\Users\Admin\AppData\Local\Temp\ratonhost.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\SubDir\Solara.exe"C:\Program Files\SubDir\Solara.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Solara.exe
memory/3388-7-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-10-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-3-0x0000022294AD0000-0x0000022294AEE000-memory.dmp
memory/3388-4-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-5-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-6-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-8-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-22-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-2-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-11-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-9-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-12-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-13-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-14-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-15-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/3388-1-0x00000222942D0000-0x00000222944B6000-memory.dmp
memory/3388-0-0x00007FF8A155F000-0x00007FF8A1560000-memory.dmp
memory/4464-24-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-33-0x0000016CB96F0000-0x0000016CB973A000-memory.dmp
memory/4464-19-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-23-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-18-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-25-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-26-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-27-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-29-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-28-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-21-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-17-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-30-0x0000016CB96B0000-0x0000016CB96EA000-memory.dmp
memory/4464-31-0x0000016CB9740000-0x0000016CB9790000-memory.dmp
memory/4464-32-0x0000016CD20F0000-0x0000016CD21A2000-memory.dmp
memory/4464-20-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-34-0x0000016CD1F90000-0x0000016CD1FDE000-memory.dmp
memory/4464-35-0x0000016CB9560000-0x0000016CB9586000-memory.dmp
memory/4464-36-0x0000016CD1FE0000-0x0000016CD2014000-memory.dmp
memory/4464-37-0x0000016CD2020000-0x0000016CD206C000-memory.dmp
memory/4464-38-0x0000016CD2070000-0x0000016CD20BA000-memory.dmp
memory/4464-39-0x0000016CD21B0000-0x0000016CD21DA000-memory.dmp
memory/4464-40-0x0000016CD21E0000-0x0000016CD21F2000-memory.dmp
memory/4464-41-0x0000016CD33C0000-0x0000016CD33FC000-memory.dmp
memory/4464-42-0x0000016CD20D0000-0x0000016CD20DA000-memory.dmp
memory/4464-43-0x0000016CD2210000-0x0000016CD2218000-memory.dmp
memory/4464-44-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-45-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp
memory/4464-46-0x00007FF8A13D0000-0x00007FF8A1D74000-memory.dmp