Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
18/07/2026, 08:07
General
- Target final_stealth.hta
- Size 2.5MB
- Sample260718-jz9acagw21
- SHA256 acc8abc1b890d27ee7bf83d42a6a986dd6668c277388bdc29c0f9bf39f91fb79
Malware Config
Extracted
-
quasar
-
encryption_key
4E5365F610851F7D6CC3DE82D8496DD095DBEA0F
-
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
-
reconnect_delay
3000
Signatures
- Family: Quasar RAT
Quasar is an open source Remote Access Tool.
- Quasar payload 2 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\final_stealth.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\update_host.exe"2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\update_host.exeC:\Users\Admin\AppData\Local\Temp\update_host.exe3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
update_host.exe
memory/5712-3-0x00007FF89F40F000-0x00007FF89F410000-memory.dmp
memory/5712-4-0x000001D719DF0000-0x000001D719EE4000-memory.dmp
memory/5712-5-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-6-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-7-0x000001D71BCB0000-0x000001D71BCE4000-memory.dmp
memory/5712-8-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-9-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-10-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-11-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-12-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-13-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-14-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-15-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-17-0x000001D7344F0000-0x000001D73452C000-memory.dmp
memory/5712-16-0x000001D734490000-0x000001D7344A2000-memory.dmp
memory/5712-18-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-19-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp
memory/5712-20-0x000001D7344D0000-0x000001D7344DA000-memory.dmp
memory/5712-21-0x000001D734550000-0x000001D734576000-memory.dmp
memory/5712-22-0x000001D7344E0000-0x000001D7344E8000-memory.dmp
memory/5712-23-0x000001D734580000-0x000001D7345E2000-memory.dmp
memory/5712-24-0x000001D734720000-0x000001D734762000-memory.dmp
memory/5712-25-0x000001D7344C0000-0x000001D7344CA000-memory.dmp
memory/5712-26-0x000001D734530000-0x000001D73453A000-memory.dmp
memory/5712-27-0x000001D734760000-0x000001D73477A000-memory.dmp
memory/5712-28-0x000001D735550000-0x000001D735572000-memory.dmp
memory/5712-43-0x000001D734780000-0x000001D7347CA000-memory.dmp
memory/5712-44-0x000001D735580000-0x000001D7355CC000-memory.dmp
memory/5712-46-0x000001D7345E0000-0x000001D73460A000-memory.dmp
memory/5712-47-0x000001D7347D0000-0x000001D7347E4000-memory.dmp
memory/5712-45-0x000001D7355D0000-0x000001D735650000-memory.dmp
memory/5712-48-0x000001D735650000-0x000001D73568A000-memory.dmp
memory/5712-55-0x000001D735720000-0x000001D735734000-memory.dmp
memory/5712-54-0x000001D735710000-0x000001D735720000-memory.dmp
memory/5712-53-0x000001D7356E0000-0x000001D735712000-memory.dmp
memory/5712-52-0x000001D7356B0000-0x000001D7356E4000-memory.dmp
memory/5712-51-0x000001D7356A0000-0x000001D7356B6000-memory.dmp
memory/5712-50-0x000001D735690000-0x000001D73569C000-memory.dmp
memory/5712-49-0x000001D7347E0000-0x000001D7347EA000-memory.dmp
memory/5712-56-0x00007FF89F280000-0x00007FF89FC24000-memory.dmp