Analysis
- max time kernel
59s - max time network
61s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/07/2026, 04:24
General
- Target messenger_update.exe
- Size 3.1MB
- Sample260715-e1rpgabw4p
- SHA256 5153a92734b7b421ffd2df199f491fc479af45f005305642325a3a4f93cde127
Malware Config
Extracted
-
quasar
-
1.4.1
-
pingping
-
zmax.io
-
malware.zmax.io
-
dff4d9d4-ee98-4856-b36f-7b3aeffd8d10
-
encryption_key
88744B6C5529B458F3F34862830C659732FE5A1C
-
install_name
molliza.exe
-
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
-
log_directory
Logs
-
reconnect_delay
5000
-
startup_key
malware
-
subdirectory
malware
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wehOnSn4oGtv.bat" "2⤵
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\HCIA38cluh6g.bat" "4⤵
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zfgcfbfD6Fp9.bat" "6⤵
-
C:\Windows\system32\chcp.comchcp 650017⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PmblXdFiofUD.bat" "8⤵
-
C:\Windows\system32\chcp.comchcp 650019⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"9⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TSNrJgdyfZLQ.bat" "10⤵
-
C:\Windows\system32\chcp.comchcp 6500111⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"11⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\66khIVhCzYFH.bat" "12⤵
-
C:\Windows\system32\chcp.comchcp 6500113⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"13⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lI67QsPsO6P3.bat" "14⤵
-
C:\Windows\system32\chcp.comchcp 6500115⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"15⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TRghDpGb6ChQ.bat" "16⤵
-
C:\Windows\system32\chcp.comchcp 6500117⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"17⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QwMeJxbMe9kO.bat" "18⤵
-
C:\Windows\system32\chcp.comchcp 6500119⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"19⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EEL4mJqdJDgC.bat" "20⤵
-
C:\Windows\system32\chcp.comchcp 6500121⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"21⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\nkgB2PhoQoDl.bat" "22⤵
-
C:\Windows\system32\chcp.comchcp 6500123⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"23⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Jz4B59DceGW4.bat" "24⤵
-
C:\Windows\system32\chcp.comchcp 6500125⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"25⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\725IVO1c1Gld.bat" "26⤵
-
C:\Windows\system32\chcp.comchcp 6500127⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"27⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5kA5v3hTdpnA.bat" "28⤵
-
C:\Windows\system32\chcp.comchcp 6500129⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"29⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\w0XhR4ZGYUqD.bat" "30⤵
-
C:\Windows\system32\chcp.comchcp 6500131⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"31⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hfyx8ULFwgPG.bat" "32⤵
-
C:\Windows\system32\chcp.comchcp 6500133⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"33⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xPqpdyFDKFoV.bat" "34⤵
-
C:\Windows\system32\chcp.comchcp 6500135⤵
-
-
C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"C:\Users\Admin\AppData\Local\Temp\messenger_update.exe"35⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
5kA5v3hTdpnA.bat
66khIVhCzYFH.bat
725IVO1c1Gld.bat
EEL4mJqdJDgC.bat
HCIA38cluh6g.bat
Jz4B59DceGW4.bat
PmblXdFiofUD.bat
QwMeJxbMe9kO.bat
TRghDpGb6ChQ.bat
TSNrJgdyfZLQ.bat
hfyx8ULFwgPG.bat
lI67QsPsO6P3.bat
nkgB2PhoQoDl.bat
w0XhR4ZGYUqD.bat
wehOnSn4oGtv.bat
xPqpdyFDKFoV.bat
zfgcfbfD6Fp9.bat
memory/1532-12-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-5-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-1-0x0000000000C70000-0x0000000000F9C000-memory.dmp
memory/1532-2-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-3-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-4-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-6-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-21-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-7-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-8-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-9-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-10-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-11-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-0-0x00007FFA7AA9F000-0x00007FFA7AAA0000-memory.dmp
memory/1532-13-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/1532-14-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-31-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-43-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-23-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-36-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-35-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-34-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-33-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-32-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-24-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-30-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-28-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-29-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-26-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-27-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp
memory/3384-25-0x00007FFA7A910000-0x00007FFA7B2B4000-memory.dmp